Privacy policy

[01]Controller

Elias Maria Lindner, trading as vorell
Mentlgasse 1, Raum13, 6020 Innsbruck, Austria
Email: office@vorell.eu

This policy describes which personal data we process when you visit this website, write to us, book a call or work with us. It is based on the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (Datenschutzgesetz, DSG) and the Austrian Telecommunications Act 2021 (Telekommunikationsgesetz 2021, TKG 2021).

You are not obliged to provide us with personal data. Without your contact details, however, we cannot answer an enquiry or enter into a contract with you.

[02]Visiting this website

Hosting and server logs

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Each time you access it, your browser transmits technically necessary data that Vercel processes in server logs: IP address, date and time of access, the page requested and information about your browser and operating system. We do not combine this data with other data.

The legal basis is our legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR). Vercel processes the data as our processor (Art. 28 GDPR) under Vercel’s Data Processing Addendum (DPA), which forms part of Vercel’s Terms of Service. The transfer to the USA is based on the European Commission’s standard contractual clauses.

Encryption

The connection to this website is encrypted with TLS, recognisable by “https://” in the address bar of your browser.

Fonts and design

Fonts, images and scripts for the design of this website are hosted on our own server. No connection to font or script services of other providers is established for this.

Storage in your browser

We store your decision in the notice “May we measure?” (“Accept all”, “Decline” or your selection under “Settings”) in the local storage of your browser (localStorage, entry “vorell-consent”). This entry is strictly necessary so that we can respect your choice (§ 165(3) TKG 2021). It remains stored until you delete it in your browser or change your choice. Beyond this, this website stores nothing on your device without your consent.

[03]Visitor measurement with Google Analytics

With your consent, we measure how this website is used: which pages are viewed, for how long, how visitors arrive and on which device. For this we use Google Analytics 4 and Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Tag Manager loads the measurement on the page; we do not use it to load any other services.

Only with your consent

On your first visit, the notice “May we measure?” asks whether you agree. If you choose “Decline” or make no choice, this website loads neither Google Tag Manager nor Google Analytics and no data goes to Google. Under “Settings” you choose individually: “Necessary” is always on and only stores your selection, and you switch on “Statistics” yourself. Only when you choose “Accept all”, or switch on “Statistics” and press “Save selection”, does your browser load both scripts from Google servers; your IP address is transmitted in the process. Google Analytics then sets the cookies _ga and _ga_PSG46Z1G5J on your device (expiry up to two years) and analyses your visits. Your consent covers this measurement only and does not extend to advertising purposes. The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021).

How Google Analytics is configured on our site

Google signals and the collection of user-related data are switched off. Google states that Google Analytics does not log or store IP addresses of users from the EU; only the approximate location (country, region, city) is derived from the IP address, on servers in the EU. Google Analytics deletes user-level data after 14 months and event data after two months.

Google processes the measurement data as our processor under the Google Ads Data Processing Terms, which we have accepted. Data sharing for Google products and services is switched off. Two sharing settings are switched on: for industry comparisons, Google may combine our data with data from other websites; Google states that neither we nor you can be identified from this. In addition, Google technical support may access our account to resolve problems. If data reaches Google LLC in the USA, the transfer is based on the standard contractual clauses in the Google Ads Data Processing Terms.

Withdrawal

Your consent is voluntary. You can withdraw it at any time: in the footer of any page or here, click “Cookie settings”, switch off “Statistics” and press “Save selection”. Measurement stops immediately, without you having to reload the page, and the Google Analytics cookies are deleted.

[04]Embedded projects

On the “Website & Funnel” page we show websites we have built, live in a frame: nordbox.at. A frame only loads when you scroll close to it. Your browser then connects to the website in question and transmits your IP address and technical information about your browser to that website’s server at Vercel. The legal basis is our legitimate interest in showing our work on real projects (Art. 6(1)(f) GDPR).

[05]Booking a call via Calendly

The buttons for booking a call, such as “Let’s talk”, lead to our booking page at Calendly, Inc., 115 E Main St, Ste A1B, Buford, GA 30518, USA. Only when you open the link does Calendly process your connection data and the information you enter there: name, email address, chosen time slot and anything you add voluntarily. We use this information to prepare and hold the conversation.

The legal basis is the taking of steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in simple appointment scheduling (Art. 6(1)(f) GDPR). Calendly processes the booking data as our processor under Calendly’s Data Processing Addendum. The transfer to the USA is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) and, alternatively, on standard contractual clauses. Calendly is responsible for cookies on the booking page itself; for these, see the Calendly Privacy Notice.

[06]Contact by email

When you write to us, we process your information in order to answer your enquiry. The legal basis is our legitimate interest in answering it (Art. 6(1)(f) GDPR) or, where a contract with you is concerned, Art. 6(1)(b) GDPR.

Our email service is Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes the data as our processor under the Microsoft Products and Services Data Protection Addendum (DPA). Microsoft is certified under the EU-US Data Privacy Framework; if data reaches the USA, the transfer is based on this certification.

[07]Clients and assignments

For quotes, contracts, invoicing and our work together, we process contact, contract, billing and communication data of our clients and their contact persons (Art. 6(1)(b) GDPR). We keep invoices and accounting records for seven years, as required by § 132 of the Bundesabgabenordnung (Austrian Federal Fiscal Code, BAO) (Art. 6(1)(c) GDPR).

If we process personal data on behalf of a client, for example enquiries from their campaigns, we conclude a data processing agreement with them under Art. 28 GDPR and act only on their instructions. In that case the client is the controller.

[08]Public reviews in market analyses

For market analyses on behalf of our clients, we analyse reviews of companies that are publicly posted on Google Maps, for example reviews of our client’s competitors. In doing so we process the name or display name of the authors, the review text, the star rating and the date of the review. We use the reviews to understand what customers in an industry value or criticise about providers.

The legal basis is our legitimate interest, and that of our clients, in assessing a market on the basis of public customer reviews (Art. 6(1)(f) GDPR). We retrieve the reviews automatically with Apify (Apify Technologies s.r.o., Vodičkova 704/36, 110 00 Prague 1, Czech Republic). Apify processes the data as our processor under the Apify Data Processing Addendum, which forms part of the Apify General Terms of Service. Apify may transfer the data to sub-processors in the USA and other countries and, under these terms, safeguards such transfers with the European Commission’s standard contractual clauses where legally required.

We store the reviews only for as long as we need them for the assignment in question. You can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). To do so, write to office@vorell.eu.

[09]AI services and tools for our work

For research, measurements, analyses and copy we use the following services. Personal data from client documents and correspondence may be processed in the course of this, for example names of contact persons. We use business accounts for this. We review the results and take responsibility for them ourselves; we do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR. The legal basis is our legitimate interest in careful and efficient work (Art. 6(1)(f) GDPR) and, for assignments, also the performance of a contract (Art. 6(1)(b) GDPR).

Claude

Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland. We use Claude through a business account under Anthropic’s Commercial Terms of Service. Anthropic processes the data as our processor under Anthropic’s Data Processing Addendum, which forms part of the Commercial Terms of Service. Under these terms, Anthropic does not train models on our content. Transfers to the USA are based on standard contractual clauses.

OpenAI

OpenAI Ireland Ltd. OpenAI processes the data as our processor under the OpenAI Data Processing Addendum. Under the OpenAI Services Agreement, OpenAI does not use our content to develop or improve its services. Transfers outside the European Economic Area are based on standard contractual clauses or an adequacy decision.

Gemini

Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. For users in the European Economic Area, under the Gemini API Additional Terms of Service, Google does not use prompts and responses to improve its products and processes them as a processor under the Data Processing Addendum for Products Where Google is a Data Processor.

DataForSEO and Semrush

DataForSEO OÜ, Estonia, and Semrush Inc., USA, with Semrush CZ s.r.o., Prague, for Europe. Both supply search and competitor data. We enter search terms, domains and company names there, no data about contact persons.

Higgsfield

Higgsfield Inc., 535 Mission St, 14th Floor, San Francisco, CA 94105, USA, generates images and videos for us. Under its own terms, Higgsfield also uses inputs to train its models. For that reason we do not enter any personal data there.

[10]Recipients

Your data is received only by the services named in this policy, and only to the extent necessary for the purpose in question. Authorities and courts also receive it where we are legally obliged to provide it.

[11]Transfers to countries outside the EU

Some of the providers named are based in the USA or use sub-processors there. For companies in the USA certified under the EU-US Data Privacy Framework, an adequacy decision of the European Commission applies (Implementing Decision (EU) 2023/1795). Where this basis does not apply, the transfer is based on standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can obtain a copy on request.

[12]Retention periods

• Invoices and accounting records: seven years from the end of the calendar year, as required by § 132 BAO.
• Enquiries and correspondence without an assignment: until they have been dealt with, then for a maximum of three years.
• Public reviews from Google Maps: for as long as we need them for the assignment in question.
• Measurement data in Google Analytics: 14 months at user level, two months for event data.
• Google Analytics cookies, only with your consent: up to two years, unless you delete them earlier.
• Your decision on measurement: in your browser, until you delete or change it.
• Server logs in our Vercel account: 30 days.

After that, we delete or anonymise the data.

[13]Your rights

You have the right of access (Art. 15 GDPR), the right to rectification (Art. 16), the right to erasure (Art. 17), the right to restriction of processing (Art. 18), the right to data portability (Art. 20) and the right to object (Art. 21). You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). To do so, write to office@vorell.eu.

Complaint

You can lodge a complaint with a supervisory authority (Art. 77 GDPR). In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40‑42, 1030 Vienna, www.dsb.gv.at.

[14]Data security

We protect data against loss, alteration and unauthorised access with technical and organisational measures, including encrypted transmission, password-protected access and restricted access rights.

[15]Changes

If our services or the legal situation change, we update this policy. The version published on this page applies.

This English translation is provided for convenience only. In the event of any discrepancy, the German version prevails.

Last updated: November 2026