Legal notice & privacy

Controller

Data Driven Solutions e.U., Alexander Dür, Küniglberggasse 10, 1130 Vienna, Austria, office@alexduer.com

Website

The website is hosted by Cloudflare, Inc. (USA). When you visit it, Cloudflare processes technically necessary data such as your IP address on my behalf to deliver the pages and protect them against attacks, and keeps it only as long as needed for that. The legal basis is my legitimate interest in this (Art. 6(1)(f) GDPR). Without your consent, the website sets no cookies and loads nothing from other providers. I don’t use analytics tools such as Google Analytics.

Contact

If you write to me through the form or by email, I process your name, email address and message to answer your inquiry (for project inquiries Art. 6(1)(b) GDPR, otherwise my legitimate interest in answering, Art. 6(1)(f)). Cloudflare passes inquiries from the form on to my mailbox at mailbox.org (Heinlein Hosting GmbH, Berlin, Germany). Emails to office@alexduer.com arrive there too, and I reply from there. I also forward incoming messages to my Google (Gmail) mailbox.

I delete inquiries three years after our last contact. If an engagement follows, I keep tax-relevant records for seven years (§ 132 BAO, Art. 6(1)(c) GDPR). You don’t have to give me any data, but without it I can’t answer your inquiry.

If you withdraw your consent to the Google Ads measurement (see below) and the page reloads as a result, the website temporarily keeps, in your browser’s session storage (sessionStorage), anything you have typed into the form but not yet sent, so that it isn’t lost. The entry is read and deleted the next time a page with the form loads. It is not sent to Google.

Booking a call

“Book a call” leads to Google’s booking service, where Google’s privacy policy applies. If you book a call, I receive your details through Google in order to hold the meeting (Art. 6(1)(b) GDPR). For the details I receive, the same retention periods apply as for inquiries: three years after our last contact, or seven years for tax-relevant records if an engagement follows.

Google Ads measurement

I advertise on Google Ads. I measure whether these ads lead to project inquiries only on my MVP development page (in German), and only if you click “Accept”, either in the notice there (in German: “Akzeptieren”) or under “Privacy settings” at the bottom of every page. Only then does the website load the Google Ads tag on that page, from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; no other page loads it, even with your consent. Until you consent, the tag is not loaded and no measurement data is sent to Google. Google processes the data as an independent controller and explains how at business.safety.google/privacy.

With your consent, when you visit the MVP development page, the tag sets cookies whose names begin with “_gcl” on this website and creates an entry in your browser’s storage. This lets Google tell whether an inquiry follows a click on an ad. The cookies remain in your browser for up to 90 days after your last visit to the MVP development page. Google receives your IP address, a random identifier from the cookie, the address of the page you are visiting and, where applicable, of the page you came from, the click ID if you arrived via an ad, information about your browser and device, the time and, once an inquiry has been sent successfully, the fact that it was sent. No form contents (name, email address, message) are sent to Google for Google Ads measurement.

Google may link this data with cookies on its own domains and, if you are signed in to Google, with your Google account. According to Google, it also uses the IP address to measure how ads perform, and it removes part of the IP address from its log data after 9 months and the cookie information after 18 months (Google’s explanation). I don’t use the measurement for personalized advertising, and I don’t use remarketing or Google Analytics.

The legal basis is your consent (Art. 6(1)(a) GDPR; for the cookies, § 165(3) of the Austrian Telecommunications Act (TKG 2021)). I store your choice, whether consent or refusal, in your browser’s storage (localStorage) so that it applies across the website and you aren’t asked on every visit. After six months it expires: until you choose again, the website does not load the tag, and my MVP development page asks again.

As proof, I keep a record of each choice made in the notice in a database at Cloudflare in the EU: whether consent was given or refused, which version and language of the notice was shown, and the date and time to the minute. A record contains no IP address and no identifier, and I do not link it with any other data. For consents, the legal basis is my obligation to be able to demonstrate them (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR); for refusals, it is my legitimate interest in fully documenting the consent request (Art. 6(1)(f) GDPR). I delete the records after three years.

You can withdraw your consent at any time under “Privacy settings” at the bottom of every page. The website then stops loading the tag, sends no further measurement data and deletes the tag’s cookies on this website. Withdrawal does not affect the lawfulness of processing carried out before it. I can’t delete Google’s cookies on Google’s own domains; you can do so in your browser settings.

Transfers to the USA

Cloudflare and Google are certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission. This also applies to the data from the Google Ads measurement, which Google may process in the USA.

Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR). To exercise them, email me at office@alexduer.com. There is no automated decision-making.

Objection

Where I process data based on legitimate interests, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Complaints

You can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.