Privacy notice

The controller for the processing of personal data on this website is Wogenfels Consulting GmbH, Pribelsdorf 87, 9125 Eberndorf, Austria.

Telephone: +43 660 2719741. Email: office@wogenfels.com.

Companies register number: 550483i. Companies register court: Landesgericht Klagenfurt. VAT identification number: ATU76609528.

Managing director: Ing. Dominik Stefan Pototschnig, MSc. Supervisory authority: Bezirkshauptmannschaft Völkermarkt. Chamber membership: Wirtschaftskammer Kärnten.

Please address any data protection questions to office@wogenfels.com or to the postal address given above.

This website consists of static files served by a web server (Nginx) on a rented server. When you open a page, your browser connects to that server and transmits the details needed for the connection, in particular your IP address. This is technically necessary for the page to reach you.

The server is operated at Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, and stands in their data centre in Nuremberg. Hetzner processes the data solely on our behalf. Hosting at Hetzner therefore involves no processing outside the European Union. Besides the operator of the server, the provider of the server administration named in the section “Recipients and processors” has administrative access; that provider is likewise established in the European Union.

For the delivery of pages the web server keeps no access log: logging of ordinary page views is switched off. Only an error log is written, and only when a request actually fails. Such an entry may contain the IP address of the request concerned and serves solely to analyse the fault.

Requests to our interface — that means submitting the contact form, not simply reading a page — produce a log entry with the request method, the path requested, the status code of the response and the processing time. The IP address, query parameters and request content are not logged, which means in particular no form entries. The technical availability check of the server produces no such entry.

For those interface requests we derive a key from the connection in order to limit the number of requests per sender (rate limiting). The derivation uses only a fixed, configured number of trusted proxy hops, so that no arbitrary browser-supplied value counts as the sender address. The counter runs in a window of one minute; a tighter limit applies to the contact form on top of that.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the stable and secure operation of the website and the protection of the form and the interface against overload and automated abuse.

The first time you visit, you see a consent banner. It uses the vanilla-cookieconsent software, which is served from our own server. There you can decide, per category, which services may be loaded. A category is only offered as long as a service is set up for it at all; at present that is the statistics category alone.

Your choice is stored in a cookie named “cc_cookie” in your browser so that the website can respect it on later visits. The cookie expires after 182 days. No user account is created, and the choice is not transmitted to an external consent service.

You can change your choice or withdraw consent at any time. Once you have made a first choice the banner is no longer shown; you then open the dialogue through the “Cookie settings” button in the footer of every page. A withdrawal takes effect going forward. Third-party code that was already loaded on the basis of an earlier consent is not retroactively removed from your browser by the withdrawal.

If the services used or the recipients change materially, we raise the revision of the consent configuration and ask again. An older stored consent then no longer applies.

The legal basis for storing and evaluating the choice itself is Article 6(1)(c) and (f) GDPR: without that record we could neither respect nor demonstrate your decision. For the storing of and access to information on your terminal equipment, Section 165(3) of the Austrian Telecommunications Act (Telekommunikationsgesetz 2021, TKG 2021) applies in addition; the cookie holding your choice is strictly necessary for the operation of the website, and every other storage operation takes place only with your consent.

On the contact page we use Cloudflare Turnstile to detect automated submissions. The provider is Cloudflare, Inc.

Turnstile is loaded as soon as the contact page is opened, not only on submission. In doing so, technical characteristics of your device and browser as well as your IP address are transmitted to Cloudflare. According to the provider, Turnstile sets no advertising cookies, and we do not use it for audience measurement.

On submission we verify the token issued by Turnstile on our server, including the expected action and the permitted host. If the check fails or the token is missing, the request is not processed. A spent token is renewed for a new attempt.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to protect the form against automated submissions; without that protection an open contact form could not be operated.

The bot protection is only rendered if a key is configured for it. If none is configured, the check does not appear and no request reaches Cloudflare. Turnstile is not loaded on any other page of this website.

We use Google Analytics 4 for the statistics category. The provider is Google Ireland Limited, where applicable involving Google LLC.

We use Google Consent Mode in its basic form. As long as there is no consent for the statistics category, neither the loader nor a configuration nor an event is sent. In that case no request reaches Google at all.

If your consent is in place, Google processes usage data: which pages you open, when and for how long, technical characteristics of your device and browser, and your IP address. The purpose is to measure reach and to improve the content of this website.

The legal basis is Article 6(1)(a) GDPR. You can withdraw your consent at any time through the “Cookie settings” button in the footer of every page; from that point on, no further events are sent.

The service is switched on for this website, which is why the statistics category is offered in the consent banner. Google Analytics 4 is currently the only service in that category. If a further analytics service is switched on, we review and extend this list.

Alongside the browser scripts, server-side interfaces to Google Analytics 4, Meta and LinkedIn are prepared. They would send event data directly from our server to the provider, for example the information that an enquiry has been submitted.

At present none of these interfaces is connected to any processing on this website: no data is transmitted to Google, Meta or LinkedIn by this route. We describe them here because they are prepared in the source code and can be put into operation individually.

If one is put into operation, the following applies. The transmission is not exempt from consent. Before every call the server checks whether consent for the matching category is in place — statistics for Google Analytics 4, marketing for Meta and LinkedIn. If it is not, nothing is transmitted. Whether a stored choice still matches the current revision of the consent configuration is checked by the browser before it reports a consent as given at all; a choice made under an earlier revision does not count. A cookie or a stored state alone does not release a later transmission.

What would be transmitted is event data together with identifiers for matching. To Meta, the email address, telephone number and parts of the name would go solely as a SHA-256 hash, whereas the IP address, the browser identifier and the Meta cookie values fbc and fbp would go in plain text. To LinkedIn, the email address would go as a SHA-256 hash, but first name, last name and a company name in plain text, because the provider's interface requires it that way. To Google Analytics 4, event data would go without any contact identifiers. Before putting an interface into operation we review this list again and extend it if anything changes.

If an interface is in operation and you withdraw your consent, no further transmission takes place from that point on. Events already transmitted are not undone by the withdrawal. To have such data deleted, please contact us or the provider concerned directly.

No artificial intelligence system that processes your data is used when you visit this website. There is no chatbot, no speech or writing assistant and no AI-supported evaluation of your entries. What you write in the contact form is not handed by this website to any AI system; it goes to our mailbox as an email through the delivery provider named in the “Contact form” section. Individual images on this website were created with generative AI; no personal data is processed in doing so.

Nor does any automated decision-making, including profiling within the meaning of Article 22 GDPR, take place here. The check for automated submissions in the contact form serves solely to prevent abuse; it makes no decision about you and has no legal effect concerning you.

The position is different for our consulting and implementation work, which is not delivered through this website. There it can happen that software and AI systems are used and that personal data from a client's business is processed in the course of that work.

Which systems those are in an individual case, which data may reach them, where they process it and who has access is settled with the client before implementation and recorded in the respective engagement. The client decides on the purposes and means of that processing. This notice does not cover it; it describes this website only.

The server this website sits on stands in Germany; the hosting itself therefore involves no transfer to a third country. The provider of the server administration is established in the Netherlands; we have no further information on where its administrative access is carried out.

With Cloudflare, Google, Meta, LinkedIn, HubSpot and Resend, by contrast, processing in the United States is possible. Whether and to what extent this happens in an individual case is determined by the provider concerned. Three of these providers are involved without your consent: Cloudflare when the contact page is opened, and Resend and Google when the contact form is submitted — Resend delivers the message, and Google then processes it as the provider of our mailbox. All other processing by these providers, including Google Analytics 4, is added only after your consent or after an explicit click by you; the marketing services are not switched on at present.

Possible bases for such a transfer are the European Commission's standard contractual clauses under Article 46(2)(c) GDPR and the adequacy decision on the EU-US Data Privacy Framework.

We do not give any assurance that a particular provider is certified under the EU-US Data Privacy Framework. Before we take on any further provider, we clarify what a transfer would be based on. On request to office@wogenfels.com we will tell you what a transfer to a particular provider is based on and provide you with a copy of the standard contractual clauses where those form the basis; their wording is also published in the Official Journal of the European Union.

In third countries the level of protection may differ from the European one. In particular, access by authorities there is not excluded in the same way and legal remedies are not secured in the same way. If you consent to analytics or marketing, you consent in the knowledge of that.

You have the right to obtain information about which data we process about you (Article 15 GDPR), to have inaccurate data corrected (Article 16 GDPR) and to have data erased (Article 17 GDPR).

You can also request that processing be restricted (Article 18 GDPR) and receive the data you provided to us in a common format, or have it transferred to another controller (Article 20 GDPR).

To exercise these rights, write to office@wogenfels.com or to the postal address given above. We reply within one month; for complex requests that period may be extended under Article 12(3) GDPR, and we will tell you if it is.

So that we do not disclose information to the wrong person, we may ask for further details that allow us to match your request to our records.

Regardless of the above, you can lodge a complaint with a supervisory authority at any time. The authority responsible for us is the Austrian data protection authority.

Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria. Telephone: +43 1 52 152-0. Email: dsb@dsb.gv.at. Website: www.dsb.gv.at.