Overview of the key provisions. The complete, binding text is published at silicon.garden/dataprivacy.
Controller
Michael Laussegger, MSc. No data protection officer has been appointed. We process personal data under the GDPR and the Austrian Telecommunications Act (TKG 2021).
Data we process
Inventory data, contact details, content data, usage data, and meta and communication data such as IP addresses.
Purposes and legal bases
Providing our online offer, optimisation, answering inquiries, security, and reach measurement and marketing. Legal bases are consent, contract performance, legal obligations, legitimate interests and vital interests under GDPR Art. 6(1).
Security, processors and third countries
We apply technical and organisational measures under GDPR Art. 32. Processors work under data processing agreements (Art. 28). Transfers outside the EU/EEA rely on Standard Contractual Clauses and supplementary measures.
Your rights
Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to complain to a supervisory authority.
Cookies
We use session and persistent cookies. You can manage consent via the cookie banner or your browser settings.
Retention
Data is deleted when no longer needed, unless legal retention duties apply (for example accounting records under Austrian law).
Accounts and orders
Order data is processed to fulfil contracts. Optional user accounts can be deleted, subject to retention obligations. IP addresses and action times are logged for security.
AI features
Google Gemini and Lovable AI process user-submitted content to deliver requested outputs, based on consent, legitimate interest or contract performance.
Payments
Providers include PayPal, Klarna, Skrill, Giropay, Visa, Mastercard, American Express and Stripe. Stripe may transfer data to the USA under SCCs.
Analytics and advertising
Google Analytics and Google Ads (including remarketing and conversion tracking) rely on explicit consent. Analytics data is deleted or anonymised after 14 months and IP addresses are anonymised.
Newsletter
Double opt-in, logged registrations, unsubscribe at any time. Unsubscribed addresses may be kept for up to three years to document consent.
Contact inquiries
Inquiries are processed on contract or pre-contract grounds and may be stored in a CRM, with necessity reviewed every two years.
Social media and reCAPTCHA
Social media interactions follow each platform’s policies. Google reCAPTCHA is used under legitimate interest to prevent spam and misuse, with possible US transfers under SCCs.