Privacy Policy

1. Introduction

I run my design practice and this website (https://leomuehlfeld.at) from Vienna, Austria (EU), and I take your privacy seriously. This policy explains what personal data is processed when you use this site, on what legal basis, who receives it, and what rights you have under the EU General Data Protection Regulation (GDPR).

2. Data Controller

I am the data controller responsible for processing personal data on this website. The address below reaches me directly. There is no data protection officer, as none is required for a practice of this size.

3. Data Collection and Use

3.1. Usage Data (Server Log Files)

My website is hosted by Vercel Inc. When you visit it, Vercel automatically collects and stores certain information in “server log files”. This includes:

1. Time of Visit
2. Route
3. URL
4. Referrer
5. Browser type and version
6. Network Speed
7. Device OS and version
8. Device type
9. Country (ISO 3166-1 alpha-2)
10. Web Vital
11. Web Vital Attribution
12. SDK Information
13. Server-Received Event Time

These log files let me and Vercel, acting as my processor, keep the site running, stable and secure, and understand faults when they occur. The legal basis is my legitimate interest in an operable website (Article 6(1)(f) GDPR). The data is not used to identify you and is not combined with anything else.

Where the data goes and how it is safeguarded is set out in section 9.

3.2. Contacting Me

If you write to me, by email or through any of the profiles linked in the footer, I process what you send: your name, your email address and whatever the message itself contains. I use it to answer you and for nothing else. The legal basis is Article 6(1)(b) GDPR where your message concerns a possible project, and otherwise Article 6(1)(f) GDPR, my legitimate interest in replying to people who get in touch. My email is hosted with iCloud+ (Apple). Transport is encrypted wherever your provider supports it. You are not obliged to give me any data, but without a return address I cannot reply.

3.3. Booking a Call

The »Book a call« buttons let you book a call through Cal.com, Inc. (app.cal.com). The booking window is only loaded when you click one of them; before that, visiting this site involves Cal.com in nothing. From that click on, Cal.com receives your IP address, browser data and the page you are on, and may set its own cookies inside the window. If you book, what you enter – name, email address, time zone, the chosen slot and any message – is processed by Cal.com and reaches me as an invitation in my Apple Calendar (iCloud).

Legal basis: Article 6(1)(b) GDPR – you open the window and book at your own request, as a step before a possible contract. The cookies inside the window are necessary for the service you explicitly request by clicking (§ 165(3) TKG 2021). Cal.com acts as my processor for the booking data.

You never have to use it. An email to the address above starts the same conversation, and nothing on this site requires an account.

4. Web Analytics

I use Vercel Web Analytics, provided by Vercel Inc. It is cookieless: nothing is stored on your device and no profile is built across sites or over time. According to Vercel, a short-lived hash is derived from the incoming request (including the IP address and user agent) so that repeat views within a day are not counted twice; the hash is discarded and the IP address itself is not retained. What I see on my end is aggregate: page paths, referrers, country, device and browser class.

Legal basis: Article 6(1)(f) GDPR. I have a legitimate interest in knowing whether what I publish is read, and I have chosen the measurement method that collects the least to answer that.

5. Speed Insights

I also use Vercel Speed Insights, which measures how quickly pages actually load and respond for real visitors (the Core Web Vitals). It samples timing data from the browser together with the page, the device class and the connection type. It sets no cookies and collects no content of what you view.

Legal basis: Article 6(1)(f) GDPR. I have a legitimate interest in a site that loads quickly for the people using it, which cannot be judged from my own machine alone.

6. Embedded Video

Several project pages show videos hosted by Vimeo.com, Inc., and one shows a YouTube video (Google Ireland Limited). Each first appears as a placeholder: until you click »Load video«, nothing is requested from either service.

Only on that click is the player fetched from the provider, and your IP address, browser data and the address of the page you are reading reach it. The Vimeo players run in Do Not Track mode (»dnt=1«): Vimeo then sets no tracking cookies and uses the view neither for advertising nor for profiling. The YouTube video runs on youtube-nocookie.com; once it plays, Google may still store data in your browser. Your choice is not remembered – the placeholder asks again on the next page.

Legal basis: your consent, given by the click (Article 6(1)(a) GDPR; § 165(3) TKG 2021). I am jointly responsible with the provider for the transmission to it (Article 26 GDPR); what Vimeo or Google do with the data afterwards is their own responsibility under their own privacy policies.

7. Fonts

The typefaces are served from my own domain. No font is requested from Google Fonts or any other external service, so visiting the site transmits no data to a font provider.

8. Cookies and Local Storage

This website sets one cookie of its own. It is called »NEXT_LOCALE«, it holds nothing but a language code (»de« or »en«), and it records which language you chose or, on a first visit, which one your browser asked for. It is a session cookie, deleted when you close your browser. It carries no identifier and no personal data. As a strictly necessary cookie it requires no consent (§ 165(3) TKG 2021).

I use no advertising, tracking or profiling cookies, and the analytics above are cookieless. Third-party cookies can only arise once you load a video yourself (section 6) or open the booking window (section 3.3).

If I ever introduce a non-essential cookie of my own, I will update this policy and ask for your consent before setting it (Article 6(1)(a) GDPR).

9. Recipients and International Transfers

Beyond the providers named above, no personal data is passed on, sold or used for advertising. The recipients are:

• Vercel Inc. (USA) — hosting, web analytics and speed insights, acting as my processor.
• Apple Distribution International Ltd. (Ireland), with Apple Inc. (USA) — email (iCloud+) and calendar, acting as my processor.
• Cal.com, Inc. (USA) — appointment scheduling, acting as my processor for what you enter when booking.
• Vimeo.com, Inc. (USA) — video playback after your click; jointly responsible with me for the transmission, independent afterwards.
• Google Ireland Limited (Ireland), with Google LLC (USA) — video playback after your click; jointly responsible with me for the transmission, independent afterwards.

These providers process data on infrastructure that may sit outside the EU and the EEA, in particular in the United States. Those transfers rest on the EU–US Data Privacy Framework where the provider is certified under it, and on the European Commission’s Standard Contractual Clauses in the providers’ data processing terms. European authorities have found that US law does not offer protection identical to the GDPR, particularly as regards access by public authorities, so a residual risk remains.

10. Data Retention

I keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires. Server logs are held by the host for a short period and then rotated out. Analytics and speed data are aggregated and retained by Vercel for the window my plan provides. Correspondence stays in my mailbox while the exchange is live; where it turns into a project, the records are kept for the seven years Austrian tax law requires (§ 132 BAO). Appointments that do not lead to a project are deleted within a year.

11. Data Security

The site is served exclusively over an encrypted connection (HTTPS/TLS). Access to the systems holding correspondence and booking data is protected by strong authentication, the software is kept current, and the number of services with access to anything at all is deliberately small. No transmission over the internet is ever entirely without risk.

12. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

1. Right of access (Article 15 GDPR): Request information about the personal data I hold about you.
2. Right to rectification (Article 16 GDPR): Request the correction of inaccurate personal data.
3. Right to erasure (Article 17 GDPR): Ask me to delete your personal data, subject to certain conditions.
4. Right to restriction of processing (Article 18 GDPR): Request that I limit the processing of your personal data under certain circumstances.
5. Right to data portability (Article 20 GDPR): Receive your personal data in a structured, commonly used, machine-readable format.
6. Right to object (Article 21 GDPR): Object to the processing of your personal data if it is based on legitimate interests.
7. Right to withdraw consent (Article 7(3) GDPR): If processing is based on your consent, you may withdraw it at any time with future effect.

Right to object: where I process data on the basis of my legitimate interests (Article 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Article 21 GDPR). I will then stop, unless I can demonstrate compelling legitimate grounds.

There is no automated decision-making and no profiling within the meaning of Article 22 GDPR on this website.

To exercise any of these rights, write to me using the contact details in section 2. It costs you nothing, and I reply within one month. You are also entitled to complain to a supervisory authority; in Austria, the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at.

13. Changes to this Privacy Policy

I update this policy whenever what the site does changes, a new service, a service dropped or a legal requirement. The current version is the one on this page, and the date at the top of it is the date it took effect.