Privacy Policy

1. Data Controller

Web-Werk Ischgl GmbH
Stöckwaldweg 19
6561 Ischgl, Austria
Email: hello@web-werk.at

Managing Directors: Simon Ljuljdjuraj, Patrick Zangerl

2. Overview of Processing

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

• Inventory data (e.g., names, addresses)
• Contact data (e.g., email, phone numbers)
• Content data (e.g., entries in contact forms)
• Usage data (e.g., visited websites, access times)
• Meta/communication data (e.g., device information, IP addresses)
• Contract and payment data (e.g., services, prices, invoices)

Categories of data subjects

• Website users
• Communication partners (contact form, email, phone, WhatsApp)
• Customers, prospects and business partners
• Visitors to our Instagram profile

3. Legal Bases

Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data:

• Consent (Art. 6 Para. 1 lit. a GDPR) – The data subject has given their consent to the processing of their personal data for one or more specific purposes (e.g., cookies for web analytics).
• Contract fulfillment and pre-contractual inquiries (Art. 6 Para. 1 lit. b GDPR) – Processing is necessary for the performance of a contract or for the implementation of pre-contractual measures (e.g., contact inquiries).
• Legal obligation (Art. 6 Para. 1 lit. c GDPR) – Processing is necessary to comply with a legal obligation (e.g., retention obligations under tax and company law).
• Legitimate interests (Art. 6 Para. 1 lit. f GDPR) – Processing is necessary to safeguard the legitimate interests of the controller, unless the interests or fundamental rights of the data subject prevail (e.g., website security).

4. Hosting

Our website is hosted by the following provider:

World4You Internet Services GmbH
Wolfgang-Pauli-Straße 2/BT3
4020 Linz, Austria
www.world4you.com

We have concluded a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR with World4You. World4You processes personal data exclusively on our behalf and according to our instructions.

When visiting our website, the server automatically collects so-called server log files. These contain:

• IP address of the requesting device
• Date and time of access
• Name and URL of the retrieved page
• Amount of data transferred
• Notification of whether the retrieval was successful
• Browser type and version
• Operating system
• Referrer URL (previously visited page)

Legal basis: Art. 6 Para. 1 lit. f GDPR (legitimate interest in the security and operation of the website).
Storage period: Server log files are automatically deleted after 14 days.

5. Contact Forms

When you contact us via one of our contact forms, the following data is processed:

• Name (required)
• Email address (required)
• Message/inquiry (required)
• Phone number (optional)
• Company (optional)

The data is processed via PHP on our server and forwarded to us by email. No storage in a database takes place. The data is used exclusively to process your inquiry.

To prevent abuse (at most one request per minute), we briefly store a hash value of your IP address on our server. Entries older than one hour are automatically deleted the next time the contact form is used.

Legal basis: Art. 6 Para. 1 lit. b GDPR (pre-contractual measures or contract fulfillment) and Art. 6 Para. 1 lit. f GDPR (legitimate interest in answering inquiries).
Storage period: Your inquiry will be deleted no later than 6 months after final processing, unless a contractual relationship is established. If a business relationship arises, we retain the data in accordance with statutory retention obligations (§ 132 BAO: 7 years).

6. Customers, Prospects and Business Partners

If you send us an inquiry, are our customer or supply us, we process your data to handle the inquiry, prepare offers and perform and invoice our services.

• Name and company
• Address, email address, phone number
• VAT ID
• Information on services, prices and contracts
• Payment information
• Correspondence with you

Legal basis: Art. 6 Para. 1 lit. b GDPR (contract and pre-contractual measures), Art. 6 Para. 1 lit. c GDPR (retention obligations under Austrian tax and company law, in particular § 132 BAO and § 212 UGB) and Art. 6 Para. 1 lit. f GDPR (maintaining the business relationship, enforcing claims).
Recipients: our IT service providers as processors (World4You Internet Services GmbH, Linz – hosting and email; Hetzner Online GmbH – encrypted backup in a data centre in the EU), our tax advisor, the tax office, banks and, where necessary, legal representatives and courts.
Storage period: We keep invoices, accounting records and business letters for seven years (§ 132 BAO, § 212 UGB). Inquiries that do not lead to an order are deleted after six months, we keep offers as business letters for seven years (§ 212 UGB).

7. Communication by Email, Phone and WhatsApp

If you contact us by email, phone or WhatsApp, we process your details and the content of your message in order to handle your request. Emails are transmitted and stored via the servers of our hosting provider World4You (Austria).

WhatsApp

If you write to us via WhatsApp, WhatsApp Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) processes your phone number, your messages and connection data. Data may be transferred to WhatsApp LLC in the USA; WhatsApp LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). Messages are end-to-end encrypted. If you do not want this, you can always reach us by email or phone.

Legal basis: Art. 6 Para. 1 lit. b GDPR or Art. 6 Para. 1 lit. f GDPR (legitimate interest in efficient communication).
Storage period: We keep business letters for seven years (§ 212 UGB). We delete WhatsApp chats after the end of the customer relationship, unless a retention obligation applies. Other messages are deleted as soon as they are no longer needed.

8. Use of AI Services

We use the AI service Claude provided by Anthropic Ireland, Limited (Ireland) as a processor – in our business software to draft offers and documents, suggest texts and capture receipts, and when creating texts, concepts and source code. We only transmit the details required for this (e.g. company or personal name, service and price data), no contact or bank details from our customer database and no special categories of personal data. Chat histories in our business software are deleted automatically 90 days after the last message.

All results are drafts that we review; no automated decisions within the meaning of Art. 22 GDPR take place. Anthropic does not use the data to train AI models and generally deletes it within 30 days; longer only if content is classified as a violation of its usage policies.

Legal basis: Art. 6 Para. 1 lit. b GDPR (offers and contracts) and our legitimate interest in handling enquiries, offers and documents efficiently in a small business (Art. 6 Para. 1 lit. f GDPR), as well as, for capturing receipts, our retention obligations (Art. 6 Para. 1 lit. c GDPR).
Recipients and third countries: Anthropic Ireland, Limited uses sub-processors for cloud infrastructure (Google Cloud, Amazon Web Services, Microsoft Azure), including in the USA. Transfers are based on the EU Standard Contractual Clauses (Art. 46 Para. 2 lit. c GDPR) and a documented assessment of the level of protection. You can obtain a copy of the safeguards on request at hello@web-werk.at.

Objection: Where we base the AI service on our legitimate interest, you may object to this processing at any time (Art. 21 GDPR) – informally at hello@web-werk.at. We will then handle your request without AI support.

Public municipal council minutes

We store the council meeting minutes published by the municipality of Ischgl under § 46 Para. 5 of the Tyrolean Municipal Code 2001 (ischgl.gv.at) in order to follow municipal decisions and construction projects at our location. The minutes are not analysed with AI services and are deleted three years after the meeting date. The legal basis is Art. 6 Para. 1 lit. f GDPR (interest in information about the development of our location). The persons named in the minutes are affected; as they are not known to us, we inform them by this means (Art. 14 Para. 5 lit. b GDPR). You may object to this processing at any time.

9. Instagram

We operate a company profile on Instagram. On this website, Instagram is only linked – data is only transferred when you click a link to Instagram.

We are jointly responsible with Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) for the statistics on our profile (Art. 26 GDPR). Meta also processes data in the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. You can also exercise your rights directly against Meta. More information: privacycenter.instagram.com/policy

Legal basis: Art. 6 Para. 1 lit. f GDPR (legitimate interest in our public relations).

10. Web Analytics with Matomo

We use Matomo (formerly Piwik) on our website, an open-source software for statistical analysis of user access. Matomo is self-hosted by us – the data is stored exclusively on our server at our hosting provider World4You (see section 4) and is not passed on to third parties.

Processed Data

• IP address (fully masked before storage)
• Date and time of access
• Pages visited and time spent
• Referrer (referring page)
• Browser type and version
• Operating system
• Screen resolution
• Approximate region (based on the masked IP address)
• Interactions such as clicks on phone or email links and the successful submission of the contact form (without form content)
• Campaign parameters in links (e.g., from our online ads) to measure the success of advertising

Cookies

Matomo sets cookies on your device to recognize returning visits and analyze usage behavior. These cookies are only set after your explicit consent (opt-in via our cookie banner).

The following cookies are used by Matomo:

Legal basis: Art. 6 Para. 1 lit. a GDPR (consent) in conjunction with § 165 Para. 3 TKG 2021. You can revoke your consent at any time via our cookie banner or by email.
Revocation: You can revoke your consent at any time by accessing the cookie settings via the link in the footer of our website.
Storage period: Raw data is automatically deleted after 180 days. After that, only aggregated, anonymous statistics without any personal reference remain.

11. Cookies

Our website uses cookies. Cookies are small text files that are stored on your device and saved by your browser.

Technically necessary cookies

The following cookies are technically required for the operation of the website and do not require consent pursuant to § 165 Para. 3 TKG 2021:

Analytics cookies

Analytics cookies (Matomo) are only set after your explicit consent. See section 9.

12. Data Transfer to Third Countries

We generally process your data within the European Union. Data is only transferred to third countries (outside the EEA) in the following cases:

• WhatsApp and Instagram (USA): on the basis of the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), see sections 7 and 9.
• AI service Claude (Anthropic Ireland Ltd. with sub-processors in the USA): on the basis of the EU Standard Contractual Clauses (Art. 46 Para. 2 lit. c GDPR), see section 8.

You can obtain a copy of the safeguards on request at hello@web-werk.at.

13. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR): You have the right to request confirmation as to whether personal data is being processed and to obtain information about this data.
• Right to rectification (Art. 16 GDPR): You have the right to request the rectification of inaccurate data and the completion of incomplete data.
• Right to erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data, provided the legal requirements are met.
• Right to restriction (Art. 18 GDPR): You have the right to request the restriction of the processing of your data.
• Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your data for reasons arising from your particular situation, if the processing is based on Art. 6 Para. 1 lit. f GDPR.
• Right of withdrawal (Art. 7 Para. 3 GDPR): You have the right to revoke your consent at any time. The lawfulness of the processing until the revocation remains unaffected.

To exercise your rights, please contact: hello@web-werk.at

14. Right to Complain to the Supervisory Authority

If you believe that the processing of your personal data violates the GDPR, you have the right to file a complaint with the competent supervisory authority:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Phone: +43 1 521 52-2569
Email: dsb@dsb.gv.at
Web: www.dsb.gv.at

15. Data Security

Our website uses SSL/TLS encryption for security reasons. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

16. Updates and Changes

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The new privacy policy will apply to your next visit.

Last updated: October 19, 2026