Privacy Policy

1. In brief

You can read our pages without telling us anything about yourself. We use no advertising cookies, no social media tracking pixels and no profiling for targeting purposes, and we neither sell nor rent data.

Processing occurs in three situations only: the technical delivery of the page by our hosting provider, an anonymous and cookie-free audience measurement on our presentation pages, and, if you choose to act, the submission of a form, an email, an order or a booking request.

2. Controller

The controller within the meaning of Article 4(7) GDPR is:

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data. We have not appointed a data protection officer, as we are not required by law to do so. Any question concerning data protection may be addressed directly to the above.

3. Who does what: the systems we use

Our online presence does not run on a single platform. The table below sets out, transparently, which provider operates which part and in what capacity. Each row is explained in the corresponding section.

Providers involved in the processing

System	Role	Provider
Wix	Hosting of the main site donumaustria.com, the online shop and appointment booking (section 4)	Wix.com Ltd., Tel Aviv, Israel
Cloudflare Pages	Hosting of the sector presentation pages and of this page (section 5)	Cloudflare, Inc., San Francisco, USA
Cloudflare Web Analytics	Cookie-free audience measurement on the presentation pages (section 6)	Cloudflare, Inc.
GoHighLevel / LeadConnector	Enquiry forms and customer relationship management (section 7)	HighLevel LLC, Dallas, USA
Google Fonts	Loading of typefaces (section 8)	Google Ireland Limited, Dublin, Ireland

Each of these providers acts as a processor within the meaning of Article 28 GDPR, under a data processing agreement concluded with them. None of them is permitted to use your data for its own purposes.

4. Main site, shop and appointment booking: Wix

The site donumaustria.com, the online shop and the appointment booking function are hosted and technically operated by Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel.

When you visit that site, Wix collects the data required to display it and to keep it stable and secure: IP address, page requested, date and time of the request, volume of data transferred, browser type and version, operating system and, where applicable, the referring page.

If you place an order in the shop or book an appointment, the data you enter at that point, namely name, delivery and billing address, email address, order contents or chosen slot, are processed by Wix on our behalf. Depending on the payment method you choose, payment data are processed directly by the payment provider displayed during checkout; we do not receive your complete bank details. The legal basis is Article 6(1)(b) GDPR for performance of the contract and Article 6(1)(c) GDPR for the statutory retention obligations arising from it.

The hosting itself relies on Article 6(1)(f) GDPR: we have a legitimate interest in the reliable presentation of our site. Where consent has been requested, in particular for storing cookies or accessing information on your device, processing is based exclusively on Article 6(1)(a) GDPR in conjunction with section 165(3) of the Austrian Telecommunications Act 2021. Consent may be withdrawn at any time with effect for the future.

A data processing agreement is in place with Wix. Wix also processes data in the United States and other third countries; see section 14. Further information: wix.com/about/privacy

5. Presentation pages: Cloudflare Pages

Our sector presentation pages, reachable via subdomains of donumaustria.com, are hosted on Cloudflare Pages, a service provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, and by its European subsidiary Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany.

When you open one of these pages, your browser necessarily establishes a connection to Cloudflare's servers. Cloudflare then processes technical connection data: IP address, page requested, date and time of the request, volume of data transferred, browser type and version, operating system and, where applicable, the referring page. These data are required to deliver the page and to maintain security and stability. They serve neither to identify you nor to build a profile.

Cloudflare operates a global server network and routes requests to the nearest point of presence, which shortens loading times and protects the infrastructure against attacks. The legal basis is Article 6(1)(f) GDPR: we have a legitimate interest in presenting our pages reliably, quickly and securely.

A data processing agreement is in place with Cloudflare. Further information: cloudflare.com/privacypolicy

6. Cookie-free audience measurement: Cloudflare Web Analytics

On our presentation pages we use Cloudflare Web Analytics to learn how many people read them and which sections attract attention. This tool differs from conventional analytics solutions on one decisive point: it sets no cookies, accesses no information stored on your device, uses no fingerprinting and permits no recognition across sites or over time.

Measurements are aggregated and cannot be traced back to an individual. No persistent identifier is created. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in a statistical understanding of how our pages are used, obtained by the least intrusive means available. No consent is required, since no information is stored on or read from your device, and section 165(3) of the Austrian Telecommunications Act 2021 therefore does not apply.

7. Enquiry forms and customer management: GoHighLevel

The forms on our presentation pages are embedded using the LeadConnector service, operated by HighLevel LLC, 1801 N. Lamar Street, Suite 600, Dallas, Texas 75202, USA, better known as GoHighLevel. The same platform serves as our customer relationship management system: your enquiry is recorded there and followed through until it is closed.

Data processed

The data you enter: name, company, role where given, email address, telephone number if you choose to provide one, country, and the content of your message. Added to this are the date and time of submission and, where present in the link that brought you to us, campaign parameters showing which channel the enquiry came through.

Because the form is displayed in an embedded frame, your browser establishes a connection to the provider's servers as soon as the page loads. Your IP address is transmitted at that point, and cookies technically necessary for the operation of the form may be set.

Purpose and legal basis

We process these data solely in order to respond to your enquiry and, should an exchange develop, to prepare a possible business relationship. The legal basis is Article 6(1)(b) GDPR where your enquiry is directed at concluding a contract or taking pre-contractual steps, and Article 6(1)(f) GDPR otherwise, our legitimate interest lying in the diligent handling of enquiries addressed to us.

Processing agreement and retention

A data processing agreement under Article 28 GDPR is in place with the provider. Your data are retained for as long as the exchange continues and thereafter until the applicable statutory retention periods expire, in particular those under Austrian tax and commercial law. You may request erasure of your data at any time, subject to those obligations.

Further information: gohighlevel.com/privacy-policy

8. Typefaces: Google Fonts

Our pages use the typefaces Cormorant Garamond and Jost, loaded through the Google Fonts service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

During loading, your browser connects to Google's servers, which thereby learn your IP address and the usual technical connection data. Google states that no cookies are set in this process. The legal basis is Article 6(1)(f) GDPR: we have a legitimate interest in a consistent typographic presentation faithful to our visual identity. If loading fails, your browser uses a substitute typeface and the page remains fully legible.

Further information: policies.google.com/privacy and developers.google.com/fonts/faq/privacy

9. Cookies

Our pages use strictly necessary cookies only. They enable basic functions such as session management, the shopping basket in the online shop, protection of forms against abuse, and storage of your language preference. Without these cookies the functions concerned could not be provided.

Strictly necessary cookies do not require consent under section 165(3) of the Austrian Telecommunications Act 2021. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in providing our services correctly and securely.

You can configure your browser to notify you when cookies are set, to permit them case by case, or to exclude them altogether. Disabling cookies may limit the functionality of this site.

10. Server log files

The providers of the pages automatically collect and store information in what are known as server log files, which your browser transmits automatically. These are browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and IP address.

This data is not merged with other data sources. Collection is based on Article 6(1)(f) GDPR: we have a legitimate interest in the technically correct presentation and optimisation of our sites, for which server log files must be collected. Storage takes place with the hosting providers named in section 3, according to their respective retention periods.

11. Contact by email or telephone

If you contact us by email or telephone, your enquiry and the personal data accompanying it are stored and processed for the purpose of dealing with it. The legal bases are those set out in section 7. We do not pass this data on without your consent.

Please note that the transmission of data over the internet, in particular by unencrypted email, may have security gaps. Complete protection against access by third parties is not achievable.

12. General notes on the legal bases

Where you have consented to processing, we process your personal data on the basis of Article 6(1)(a) GDPR, or Article 9(2)(a) GDPR where special categories of data under Article 9(1) GDPR are processed. Where you have expressly consented to the transfer of personal data to third countries, processing additionally relies on Article 49(1)(a) GDPR. Where you have consented to the storage of cookies or to access to information on your device, section 165(3) of the Austrian Telecommunications Act 2021 applies in addition. Consent may be withdrawn at any time.

Where your data are required for the performance of a contract or for pre-contractual steps, we process them on the basis of Article 6(1)(b) GDPR. Where they are required to comply with a legal obligation, processing relies on Article 6(1)(c) GDPR. Processing may further be based on our legitimate interest under Article 6(1)(f) GDPR. The legal basis applicable in each case is stated in the relevant section of this policy.

13. Recipients of your data

Beyond the processors listed in section 3, we pass on personal data only where this is necessary for the performance of a contract, for example to the delivery company instructed to bring your order to you, where we are legally obliged to do so, for example towards tax authorities, where we have a legitimate interest in the disclosure under Article 6(1)(f) GDPR, or where another legal basis permits it.

Where we engage processors, disclosure takes place solely on the basis of a valid data processing agreement. In the case of joint controllership, a joint controllership agreement is concluded. We neither sell nor rent your data.

14. Transfers to third countries

The providers named in section 3 may process data in the United States, in Israel or in other third countries. Such transfers rely on the European Commission's standard contractual clauses under Article 46(2)(c) GDPR, supplemented where applicable by the provider's certification under the EU-U.S. Data Privacy Framework, recognised by the European Commission's adequacy decision of 10 July 2023. For Israel, the European Commission established an adequate level of protection by decision of 31 January 2011.

We note transparently that, despite these safeguards, the level of data protection in the third countries concerned may not correspond in every respect to that of the European Economic Area, and that access by local authorities cannot be entirely excluded.

15. Retention periods

Unless a specific period is stated in this policy, your personal data remain with us until the purpose for processing them ceases to apply. If you assert a valid request for erasure or withdraw your consent, your data will be deleted, unless we have other legally permissible grounds for retaining them, in particular tax and commercial retention periods. In the latter case, deletion takes place once those grounds no longer apply.

16. Your rights

Within the limits of the applicable law, you have the following rights at any time:

• Right of access (Art. 15 GDPR): to obtain free of charge information about the data we hold about you, its origin, its recipients and the purpose of the processing.
• Right to rectification (Art. 16 GDPR): to have inaccurate data corrected and incomplete data completed without undue delay.
• Right to erasure (Art. 17 GDPR): to have your data deleted where the statutory conditions are met.
• Right to restriction of processing (Art. 18 GDPR): you may request restriction where you contest the accuracy of your data and we need time to verify it, where the processing was unlawful and you prefer restriction to erasure, where we no longer need your data but you require it to establish, exercise or defend legal claims, or where you have objected under Article 21(1) GDPR and the balancing exercise is still pending. Restricted data may, apart from being stored, be processed only with your consent, for the establishment of legal claims, for the protection of another person's rights, or for reasons of important public interest.
• Right to data portability (Art. 20 GDPR): to receive, in a structured, commonly used and machine-readable format, the data processed automatically on the basis of your consent or a contract, or to have it transmitted directly to another controller where technically feasible.
• Right to object (Art. 21 GDPR): see section 17.
• Right to withdraw consent (Art. 7(3) GDPR): at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint (Art. 77 GDPR): see section 18.

An informal message to info@donumaustria.com is enough to exercise these rights. We reply within the one-month period provided for by the GDPR.

17. Right to object (Art. 21 GDPR)

18. Complaint to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

The authority competent for us is:

19. SSL and TLS encryption

These pages use SSL or TLS encryption to protect the transmission of confidential content between your browser and the server. You can recognise an encrypted connection by the address bar changing from "http://" to "https://" and by the padlock symbol displayed by your browser. While encryption is active, the data you transmit to us cannot be read by third parties.

20. Changes to this policy

We adapt this policy when our processing operations change or when new legal requirements make it necessary. The version published on this page is the one that applies.

Version of 20 August 2026, prepared from the binding German version of 20 August 2026.