Privacy Policy

With this Privacy Policy we inform you about the nature, scope and purpose of the processing of personal data (hereinafter referred to as „data“) in connection with the provision of our website aiagent.engineer and its associated functions and content. The processing is carried out in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Data controller

The controller within the meaning of Art. 4(7) GDPR is:

  • Thomas Heindl (sole trader)
  • Donau-City-Straße 3, 1220 Vienna, Austria
  • Email: contact@aiagent.engineer
  • VAT ID: ATU65424347

A data protection officer has not been appointed, as this is not required by law. For all questions concerning data protection and the exercise of your rights, please contact the email address given above.

2. Legal bases for data processing

We process the personal data of our users only in compliance with the applicable data protection provisions. The legal bases for processing derive in particular from Art. 6 GDPR:

  • Consent pursuant to Art. 6(1)(a) GDPR;
  • Performance of a contract and pre-contractual measures pursuant to Art. 6(1)(b) GDPR;
  • Compliance with legal obligations pursuant to Art. 6(1)(c) GDPR;
  • Safeguarding of legitimate interests pursuant to Art. 6(1)(f) GDPR.

We state the specific legal basis applicable in each case for the individual processing activities set out below.

3. Your rights as a data subject

Under the GDPR you have the following rights, which you may assert against us at any time:

  • Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether data concerning you are being processed, as well as to receive access to such data and further information.
  • Right to rectification (Art. 16 GDPR): You have the right to request the completion of data concerning you or the rectification of inaccurate data.
  • Right to erasure (Art. 17 GDPR): You have the right to request that data concerning you be erased without undue delay („right to be forgotten“), provided that no statutory retention obligations preclude this.
  • Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your data.
  • Right to data portability (Art. 20 GDPR): You have the right to receive the data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to transmit these data to another controller.
  • Right to object (Art. 21 GDPR): You have the right, on grounds relating to your particular situation, to object at any time to the processing of data concerning you which is carried out on the basis of Art. 6(1)(f) GDPR. Where data are processed for the purpose of direct marketing, you have the right to object to such processing at any time without giving reasons.
  • Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent, you have the right to withdraw it at any time with effect for the future. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

Right to lodge a complaint with the supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right pursuant to Art. 77 GDPR to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is:

  • Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
  • Barichgasse 40–42, 1030 Vienna, Austria
  • Web: www.dsb.gv.at

4. Provision of the website and hosting

For the provision of this website we use the infrastructure of an external hosting provider. The provider is:

  • Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany

The server is located in Germany (European Union). The provider processes on our behalf the data transmitted via the website (in particular server log files, see below) exclusively for the purpose of the technical provision and security of the website. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of our online offering).

Server log files

Each time our website is accessed, the hosting provider automatically records information in what are known as server log files, which your browser transmits automatically. These are in particular:

  • anonymised or shortened IP address of the accessing device;
  • date and time of access;
  • name and URL of the file retrieved;
  • amount of data transferred and notification of successful retrieval (HTTP status code);
  • the website from which access is made (referrer URL);
  • the browser used, operating system and its version.

The processing of these data is carried out for the purpose of delivering the website, ensuring system stability and security, as well as for error analysis and the prevention of attacks. These data are not merged with other data sources, nor are they evaluated for the purpose of identifying individual persons.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technical operational security).

Retention period: The log files are generally stored for a short period (usually up to 14 days) and are then deleted, unless they are required for a longer period to clarify or pursue specific security incidents.

5. Cookies and consent management

Our website uses cookies and comparable technologies (e.g. LocalStorage). Cookies are small text files that are stored on your device. We distinguish between:

  • Technically necessary cookies, which are required for the operation of the website (e.g. for storing your cookie settings). The legal basis is Art. 6(1)(f) GDPR or Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).
  • Non-necessary cookies (e.g. for statistics/analysis or marketing), which are only set with your express consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.

Consent management with Complianz

To obtain and manage your consent we use the consent management tool Complianz. When you first access the website, Complianz displays a cookie banner and stores the choice you have made (consent to or rejection of individual categories). This storage is necessary in order to take your preference into account on subsequent visits and to comply with the statutory obligations to demonstrate the consent given. In this context, details such as your consent choice, a timestamp and technical information (e.g. anonymised IP address, device/browser used) are processed and generally stored locally on the server or in your browser.

You can adjust or withdraw your consent at any time with effect for the future via the settings option on the website (cookie settings).

Legal basis: Art. 6(1)(c) GDPR (compliance with the legal obligation to demonstrate consent) and Art. 6(1)(f) GDPR (legitimate interest in a legally compliant consent management).

Retention period: The consent data are stored for the duration of the statutory demonstration period (usually up to 12 months, after which a renewed request is made).

6. Contacting us

Contact by email

If you contact us by email (e.g. at contact@aiagent.engineer), we process the data you provide (in particular your email address, your name and the content of your message) in order to handle your enquiry.

Contact form (WPForms)

On our website we offer you the possibility to get in touch with us via a contact form. For this we use the WordPress plugin WPForms. The data you enter in the form (e.g. name, email address and your message, as well as any further information you provide) are processed for the purpose of handling your enquiry and are transmitted to us. Processing by the plugin takes place on our own WordPress installation with the hosting provider named above.

Legal basis: If your enquiry is made in connection with a (possible) contract, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract). In all other cases the legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Retention period: We store the data arising in the course of your contacting us for as long as is necessary to handle your enquiry. The data are then deleted, provided that no statutory retention obligations (e.g. under commercial or tax law) preclude deletion.

7. Appointment booking via Calendly

For arranging appointments (in particular so-called discovery calls) we use the service Calendly provided by Calendly LLC, 271 17th Street NW, Atlanta, Georgia 30363, USA. When you book an appointment via the Calendly function embedded on our website, you enter the data required for this (usually name, email address, desired appointment, as well as any further information you provide). These data are processed by Calendly for appointment management.

Third-country transfer: When using Calendly, personal data may be transferred to the USA (a third country). To ensure an adequate level of data protection, we base the transfer on the Standard Contractual Clauses (SCC) adopted by the European Commission pursuant to Art. 46(2)(c) GDPR. Further information can be found in Calendly’s privacy policy.

Legal basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures or of a contract), insofar as the appointment booking serves the initiation or performance of a contractual relationship; otherwise Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR (legitimate interest in efficient appointment organisation).

Retention period: The appointment data are deleted as soon as they are no longer required for the purpose of appointment organisation and no statutory retention obligations preclude this.

8. Web analytics: Google Analytics 4 via Google Site Kit

This website uses — exclusively with your consent — the web analytics service Google Analytics 4, integrated via the WordPress plugin Google Site Kit. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google“). The operator of the underlying services is additionally Google LLC, USA.

Google Analytics uses cookies and similar technologies which enable an analysis of your use of the website. The information generated about your use of this website (including a shortened IP address) is processed in order to compile reports on website activity and to evaluate for us the reach and use of our offering.

Consent and Consent Mode: Analytics cookies are only set, and data is only transmitted to Google, once you have expressly given your consent via our cookie banner (Complianz). We use Google Consent Mode; the default setting is „denied“. Without your consent, no analysis takes place. You may withdraw your consent at any time with effect for the future.

Third-country transfer: In the course of using Google Analytics, personal data may be transferred to Google LLC in the USA (a third country). The transfer is based on the Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR. Insofar as the recipient has certified itself under the EU-U.S. Data Privacy Framework, the transfer may additionally be based on an adequacy decision of the European Commission pursuant to Art. 45 GDPR.

Legal basis: Art. 6(1)(a) GDPR (consent) and — for the setting of the cookies — Section 165(3) TKG 2021.

Retention period: The data collected in the course of Google Analytics are stored in accordance with the retention periods we have set and are then automatically deleted or anonymised.

9. Google Fonts (local provision)

This website uses so-called Google Fonts for the uniform display of typefaces. Where applicable, the fonts used are integrated locally (self-hosted) on our server and delivered from there. In this case, no connection to Google servers is established when the website is accessed, and no personal data (in particular no IP address) is transmitted to Google.

Should integration via Google servers nevertheless occur in individual cases, your browser would in this case establish a connection to Google (Google Ireland Limited or Google LLC, USA), whereby Google could obtain knowledge of your IP address. We endeavour to avoid this through local provision.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an appealing and uniform presentation of our online offering).

10. Newsletter (Mailchimp) — where offered

Insofar as a newsletter subscription is offered on our website, we send newsletters via the service Mailchimp provided by Intuit Inc. / The Rocket Science Group LLC, 405 N. Angier Ave. NE, Atlanta, Georgia 30308, USA. To subscribe, it is necessary to provide your email address; further details are optional.

Subscription takes place by means of a so-called double opt-in procedure: after subscribing, you will receive an email in which you must confirm your subscription. In this way we ensure that the subscription actually originates from you. Subscription, confirmation and unsubscription are logged.

Third-country transfer: When using Mailchimp, personal data may be transferred to the USA (a third country). The transfer is based on the Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR.

Legal basis: Art. 6(1)(a) GDPR (consent). You can unsubscribe from the newsletter and withdraw your consent at any time, for example via the unsubscribe link contained in every newsletter.

Retention period: The data stored for the purpose of sending the newsletter are stored until you unsubscribe from the newsletter and are deleted after unsubscription, provided that no obligations to demonstrate the consent given require further retention.

11. Transfer of data to third countries

As set out in the preceding sections, individual processing activities (in particular Calendly, Google Analytics and, where applicable, Mailchimp) may involve a transfer of personal data to third countries, in particular to the USA. Such a transfer only takes place if an adequate level of data protection is ensured. The basis for this is:

  • an adequacy decision of the European Commission pursuant to Art. 45 GDPR (e.g. within the framework of the EU-U.S. Data Privacy Framework, provided that the respective recipient is certified), or
  • the Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR, where applicable supplemented by additional protective measures, or
  • your express consent pursuant to Art. 49(1)(a) GDPR.

12. Retention period and erasure

Unless a more specific retention period is stated in this Privacy Policy, we process and store personal data only for as long as is necessary to achieve the respective processing purpose or as required by statutory retention obligations (in particular commercial and tax retention periods). Once the purpose ceases to apply or the statutory periods expire, the data are routinely deleted or blocked.

13. Data security

We take appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data against accidental or unlawful destruction, loss, alteration and unauthorised access. The transmission of data via our website is encrypted using a secure TLS/SSL connection.

14. Currency and amendment of this Privacy Policy

This Privacy Policy is currently valid. As a result of the further development of our website or due to changed statutory or regulatory requirements, it may become necessary to amend this Privacy Policy. The current version published on this website applies in each case.