Privacy Policy

2.1 Server Log Files

Our hosting provider automatically records technical data each time the Website is accessed:

• IP address
• Date and time of the request
• URL of the page accessed and referring URL
• Browser type and version, operating system
• Amount of data transferred and HTTP status code

Purpose: Delivering the Website, ensuring a stable and secure connection, detecting and preventing misuse, and technical troubleshooting.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in the secure and reliable operation of the Website.

Retention: Our hosting provider stores log data for 5 days, after which it is deleted.

2.2 Hosting

The Website is built and hosted using the services of Lovable Labs Incorporated, 1111b South Governors Avenue, Dover, DE 19904, USA, together with its affiliate Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden (“Lovable”).

Lovable acts as our processor under Art. 28 GDPR on the basis of a data processing agreement. Personal data may be transferred to and processed in the United States; such transfers are safeguarded by the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Lovable’s own privacy information is available at https://lovable.dev/privacy.

Lovable delivers the Website and runs our server-side functions on the global edge network of Cloudflare, Inc., which acts as a sub-processor. Requests are processed in the Cloudflare data centre closest to the visitor, which may be outside the EEA; the safeguards described in section 4 apply.

2.3 Contact Form

If you use our contact form, we process the data you enter:

• Name
• Email address
• Project
• Message content
• Timestamp of submission
• IP address (processed transiently for abuse prevention, see below)

Purpose: Receiving, processing, and responding to your enquiry.

Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a contract or pre-contractual measures; otherwise Art. 6(1)(f) GDPR — our legitimate interest in responding to enquiries addressed to us.

We briefly process the IP address of the submitting device in order to detect and limit automated or abusive submissions. This data is held only in memory for the duration of the request and is not stored. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in protecting the form against misuse.

Processing route: Form submissions are received by a server-side function operated on the infrastructure of our hosting provider Lovable (see section 2.2) and are then sent to office@artsandtonic.com by email. For sending, we use the transactional email service of Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA (“Resend”). Resend acts as our processor under Art. 28 GDPR on the basis of a data processing agreement. Resend is certified under the EU-US Data Privacy Framework, so transfers to the United States are based on the European Commission’s adequacy decision pursuant to Art. 45 GDPR. Resend’s privacy information is available at https://resend.com/legal/privacy-policy. Your message is not stored in a separate database. Resend retains delivery logs, including the content of the message, for up to 30 days; after that, the enquiry exists only in our mailbox.

Retention: We store your enquiry until it has been fully dealt with and for a further 6 months in case of follow-up questions. Statutory retention obligations under Austrian commercial and tax law (generally 7 years) remain unaffected.

Providing this data is voluntary, but without the mandatory fields we cannot process your enquiry.

2.4 Contact by Email and Telephone

If you contact us at the email address or phone number published on this Website, we process your contact details and the content of your message in order to respond. The legal bases and retention periods correspond to those set out in section 2.3.

Our email is operated using Google Workspace, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google acts as our processor under Art. 28 GDPR on the basis of a data processing agreement; data may be transferred to servers outside the EEA subject to the safeguards described in section 4.

Please note that unencrypted email transmission may have security vulnerabilities and cannot be guaranteed to be confidential.

2.5 Cookies

We use only cookies and comparable storage technologies that are strictly necessary for the Website to function and to be delivered securely. We do not use advertising cookies, cross-site tracking, or profiling technologies, and we do not store information on your device that requires consent.

Legal basis: Art. 6(1)(f) GDPR; no consent is required under § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), as these technologies are strictly necessary to provide the service you requested.

You can delete cookies at any time and configure your browser to block them; this may limit the functionality of the Website.

2.6 Visitor Statistics

To understand how our Website is used, we use the built-in analytics function of our hosting provider Lovable. It records aggregate traffic statistics such as page views, number of visitors, visit duration, bounce rate, referring websites, device type, and the visitor’s country (derived from the browser time zone).

This function measures overall traffic rather than individual persons. No profiles are created, the data is not combined with other data sources, and visitors are not identified.

Purpose: Statistical evaluation of Website use and improvement of our content and services.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding and improving the reach and usability of our Website. We have weighed this interest against your interests and consider it to prevail, given the aggregate nature of the data.

Processor: Lovable (see section 2.2), on the basis of a data processing agreement and, for transfers to the United States, the EU Standard Contractual Clauses.

Retention: Statistics are available to us for a rolling period of up to 90 days.

Right to object: You may object to this processing at any time on grounds relating to your particular situation by writing to office@artsandtonic.com.

3. Recipients of Personal Data

We only disclose personal data where this is necessary and legally permitted. Recipients may include:

• our hosting provider Lovable, including the server-side function that forwards contact form submissions, acting as a processor under Art. 28 GDPR
• Google Ireland Limited as the provider of our Google Workspace email service, acting as a processor under Art. 28 GDPR
• Resend, Inc. as the provider of the email delivery service used by our contact form, acting as a processor under Art. 28 GDPR
• professional advisers (e.g. tax advisers, lawyers) where required
• public authorities and courts, where we are legally obliged to disclose data

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

4. International Data Transfers

Where personal data is transferred to countries outside the European Economic Area — in particular to the United States in connection with our hosting provider and our email delivery service — we ensure an adequate level of protection through:

• an adequacy decision of the European Commission pursuant to Art. 45 GDPR, or
• EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, supplemented by additional technical and organisational measures where necessary.

You may request further information on these safeguards at office@artsandtonic.com.

5. Data Security

Data transmitted between your browser and our servers is encrypted using TLS/SSL, recognisable by the “https://” prefix in your browser’s address bar. We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or alteration. Please note that no method of transmission over the internet is completely secure.

6. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.

7. Your Rights

Subject to the conditions set out in the GDPR, you have the right to:

• Access (Art. 15) — obtain confirmation as to whether we process your data, and a copy of that data
• Rectification (Art. 16) — have inaccurate or incomplete data corrected
• Erasure (Art. 17) — have your data deleted
• Restriction of processing (Art. 18)
• Data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format
• Object (Art. 21) — object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR
• Withdraw consent (Art. 7(3)) — at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal

To exercise these rights, contact us at office@artsandtonic.com. We will respond within one month; where necessary this period may be extended by two further months, in which case we will inform you.

Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your residence, place of work, or the place of the alleged infringement. The authority competent for us is: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria · Email: dsb@dsb.gv.at · Website: https://www.dsb.gv.at

8. Visitors Outside the European Economic Area

The Website is accessible worldwide, and we apply the standards described above to all visitors. If the law of your place of residence grants you further rights — for example the rights to know, delete, correct, opt out of the sale or sharing of personal information, and non-discrimination under the California Consumer Privacy Act (CCPA/CPRA) — you may exercise them by contacting us at office@artsandtonic.com. We do not sell or share personal information as those terms are defined under the CCPA.

9. Children

The Website is not directed at children under the age of 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our Website, our processing activities, or legal requirements. The current version is always available at artsandtonic.com/privacy.