Privacy policy

Updated for the Cloudflare preview on 22 October 2026. Final release review is pending.

1. Controller and contact

The controller for personal data processed through this website is Ulrich Lehensteiner, Penzinger Straße 76, 1140 Vienna, Austria. Contact: [email protected]; telephone +43 664 4875760.

2. Website delivery and security

The website is hosted using Cloudflare Pages. When you visit it, connection data such as your IP address, time of access, requested address, browser/device information and, where transmitted, referring page are sent to the hosting provider. This enables delivery, availability and protection against abuse. The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in operating a secure website.

The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Its published Self-Serve terms incorporate the Cloudflare Data Processing Addendum. Cloudflare uses an international network; processing in the United States may occur. The DPA describes applicable international-transfer safeguards, including the EU-US Data Privacy Framework and Standard Contractual Clauses. The safeguards and subprocessor list are accessible through the DPA linked below.

Retention depends on delivery and security purposes and legal obligations. For data within its scope, the DPA specifies retention until the earlier of contract expiry/termination or the point when processing is no longer necessary to perform contractual obligations. This is not a uniform retention period measured in days for all hosting and security data.

Further information: https://www.cloudflare.com/privacypolicy/ and https://www.cloudflare.com/cloudflare-customer-dpa/.

3. Local content and language preference

Fonts, photographs, album covers and video thumbnails are served by the website hosting service. Displaying them does not require a connection to Google Fonts, Pexels or YouTube. Stock photographs are retrieved during website preparation and then served locally.

The language is determined by the /de/ or /en/ address you visit. Switching languages opens the corresponding language version. No language preference is stored in cookies or browser storage for this purpose.

This website uses no advertising trackers or embedded social media plugins. Cloudflare Web Analytics is disabled for this Pages project.

4. YouTube videos

Videos are embedded through youtube-nocookie.com only after activation. Loading the player transmits connection data, including your IP address, browser information and the page being viewed, to YouTube. This mode does not mean that no personal data is processed. The provider for the EEA is Google Ireland Limited; processing by other Google companies, including outside the EEA, may occur.

Embedding relies on your consent under Article 6(1)(a) GDPR and, where required, section 165(3) TKG 2021. Closing the player stops further transmission through that player; it does not undo previous transmissions. You may instead open the linked YouTube page directly. Further information: https://policies.google.com/privacy.

For EEA users, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A consent prompt appears before loading the player; your choice is not saved for future videos. Google explains retention in its privacy policy. Its international-transfer information describes adequacy decisions, including the EU-US Data Privacy Framework, and Standard Contractual Clauses: international-transfer safeguards.

5. Email enquiries

If you contact us, we process your email address, name, message and other information you provide to handle your enquiry. The website form prepares a draft in your own email application rather than transmitting the form to a website server. Your message reaches our mailbox only when you send it from that application.

Processing is based on Article 6(1)(b) GDPR for contractual or pre-contractual enquiries and otherwise Article 6(1)(f) GDPR, reflecting our legitimate interest in responding to you. Data retained to comply with legal obligations is processed under Article 6(1)(c) GDPR. Enquiries are deleted when no longer needed, unless legal retention duties or a legitimate need to establish, exercise or defend legal claims require further storage.

The mailbox uses Microsoft Outlook.com. Microsoft processes message and connection data required to provide email delivery and storage. Further information on Microsoft’s processing: https://www.microsoft.com/en-us/privacy/privacystatement.

This is a personal Outlook.com account. For processing as a controller in the EEA, Microsoft identifies Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, and Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. Microsoft's privacy statement describes processing outside the EEA and applicable safeguards, including the EU-US Data Privacy Framework and Standard Contractual Clauses. This policy does not promise EU-only storage or a Microsoft 365 business agreement. After emails are deleted, the service's subsequent deletion periods and legal obligations may delay final erasure.

6. Links to shops and other platforms

The website contains ordinary links to Lemon Squeezy, music platforms and social networks. Those external sites are contacted when you open their links. The respective providers' information applies to processing and purchases there. This website has no embedded checkout and does not itself process payment data.

7. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests. You may withdraw consent for future processing; this does not affect the lawfulness of earlier processing. Contact [email protected] to exercise these rights.

You may lodge a complaint with a supervisory authority, including the Austrian Data Protection Authority, https://www.dsb.gv.at/. This website does not carry out automated decision-making, including profiling. Merely visiting it does not contractually require you to provide personal data; a contact address is needed if you wish to receive a reply to an enquiry.

8. Access to the protected preview

Protected preview addresses additionally use Cloudflare Access. When you sign in, Cloudflare processes the email address you provide, authentication and connection data, and sets a technically necessary authentication cookie. This protects the website before public release. The legal basis is Article 6(1)(f) GDPR, reflecting the interest in restricting access. The application session is configured for 24 hours; higher-level rules may limit its duration. This does not specify retention of security logs. Cloudflare's provider and transfer information in section 2 also applies here. This protection concerns the preview and does not impose a general login requirement on the future public website.