Privacy Policy

1. Data Controller

The controller responsible for data processing on this website is:

KLW & Partner FlexCo
Urstein Süd 15
5412 Puch bei Hallein
Austria

Email: Paul.Kotrba@klw-partner.com

2. Collection and Processing of Personal Data

We process personal data exclusively in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

Personal data is only collected if you voluntarily provide it to us, for example by:

• contacting us via email
• using the contact form on this website — it does not transmit data to our servers; it opens your own email program with a prefilled message, which then reaches us as an ordinary email
• engaging in direct business communication

The following data may be processed:

• Name
• Email address
• Phone number (if provided)
• Content of your inquiry

3. Purpose and Legal Basis of Processing

Your data is processed for the following purposes:

• Responding to inquiries
• Initiating or preparing business relationships
• Contract performance
• Internal administrative purposes

Processing is based on:

• Art. 6(1)(a) GDPR (consent)
• Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures)
• Art. 6(1)(f) GDPR (legitimate interest)

4. Server Log Files

When you visit our website, technical information is automatically collected by the hosting provider. This may include:

• IP address
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL

These data are used solely to ensure system security and the proper functioning of the website. No personal profiling takes place. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation).

Hosting provider: This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, acting as our processor under a data processing agreement pursuant to Art. 28 GDPR.

Because Vercel is based in the United States, personal data contained in server log files may be transferred to a third country. The transfer is based on Vercel's certification under the EU–US Data Privacy Framework pursuant to Art. 45 GDPR where applicable, and otherwise safeguarded by the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

5. Fonts

The typefaces used on this website are hosted on our own server. No connection to Google servers or any other external font provider is established, and no data about your visit is transmitted to third parties for font delivery.

6. Vercel Web Analytics

We use Vercel Web Analytics, a privacy-focused analytics service from Vercel Inc. It automatically records page views so that we can understand how this website is used and improve its content and performance.

The data points may include the time of access, page path, referrer, filtered query parameters, approximate location, browser, operating system, device type, and analytics script version. According to Vercel, these data points are aggregated and are not associated with an individual visitor or IP address. We do not send custom events or form contents to Vercel.

Vercel Web Analytics does not use third-party cookies. Visitors are distinguished using a hash generated from the incoming request, and the visitor session is discarded after 24 hours. Aggregated analytics remain available for the reporting window of our Vercel plan.

To the extent that the processing involves personal data, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the aggregated measurement and improvement of our website. The information on hosting and international data transfers in section 4 also applies.

Further information is available in Vercel's Web Analytics privacy documentation.

7. Cookies and Similar Technologies

This website does not currently set cookies or use advertising or social media tracking tools. Vercel Web Analytics operates without third-party cookies as described in section 6.

8. Data Sharing

Personal data may be disclosed to processors and other recipients only where this is necessary and legally permitted, including when:

• it is necessary for contractual or pre-contractual purposes
• service providers process data on our behalf
• we have a legitimate interest permitted by law
• we are legally obligated to disclose it
• you have given consent

Current processor categories include hosting and analytics providers, as described in sections 4 and 6, and email or IT service providers used to handle inquiries. Your data will not be shared for advertising purposes.

9. Data Retention

Personal data is stored only for as long as necessary to fulfill the respective purpose or as required by statutory retention obligations:

• Inquiries that do not lead to a business relationship: deleted after 6 months
• Data relating to a contract or its preparation: 7 years, per the retention obligation in § 132 of the Austrian Federal Fiscal Code (BAO)
• Server and runtime logs: retained according to the Vercel plan and configuration, for no longer than 30 days in Vercel's standard observability offerings
• Vercel Web Analytics: the visitor session is discarded after 24 hours; aggregated statistics remain available for the reporting window of our Vercel plan

10. Your Rights

Under the GDPR, you have the right to:

• Access your stored personal data
• Rectification of inaccurate data
• Erasure ("right to be forgotten")
• Restriction of processing
• Data portability
• Object to processing based on legitimate interest (Art. 21 GDPR)
• Withdraw consent at any time

To exercise your rights, please contact: Paul.Kotrba@klw-partner.com

11. Right to Lodge a Complaint

If you believe that the processing of your personal data violates data protection laws, you have the right to lodge a complaint with the competent supervisory authority:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
www.dsb.gv.at

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse.

13. Automated Decision-Making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

14. Data Protection Officer

We are not required to appoint a data protection officer under Art. 37 GDPR. For all data protection matters, please contact the address given in section 1.