Privacy policy

Last updated: October 2026

Table of contents

1. Controller
2. Overview and principles
3. Legal bases
4. Storage period
5. Your rights
6. Hosting and server log files
7. TLS encryption
8. Contact, forms and email
9. Customer and order data
10. Cookies and consent management (Complianz)
11. Google Analytics (only with consent)
12. Google Ads (only with consent)
13. Meta Pixel (only with consent)
14. Appointment booking with Calendly (only with consent)
15. Social media profiles
16. Fonts
17. Security and spam protection
18. Search engine tools and SEO
19. NFC business cards
20. Data transfers to third countries
21. Changes to this privacy policy

1. Controller

The controller responsible for processing personal data on this website is:

Martin Wetzel Design
Martin Wetzel
Ybbsstraße 46, Tür 34-35
1020 Vienna, Austria
Phone: +43 660 22 11 319
Email: office@martinwetzeldesign.com

A data protection officer is not required by law and has not been appointed. If you have any questions about data protection, please contact the address above directly.

2. Overview and principles

In this privacy policy, we inform you in accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Telecommunications Act 2021 (TKG 2021) about which personal data we process when you visit this website and in the course of our business activities, for what purpose and on what legal basis.

We process only as much data as necessary. Services that transfer data to third parties and are not strictly necessary for operating the website are only loaded once you have given your consent in the cookie banner.

3. Legal bases

We base processing on the following legal bases under the GDPR:

• Consent (Art. 6(1)(a) GDPR, in conjunction with § 165(3) TKG 2021 for storing and reading information on your device)
• Contract and pre-contractual measures (Art. 6(1)(b) GDPR), for example for enquiries and orders
• Legal obligation (Art. 6(1)(c) GDPR), for example retention obligations under tax and commercial law
• Legitimate interest (Art. 6(1)(f) GDPR), for example in the secure and stable operation of the website

You can withdraw any consent you have given at any time with effect for the future, for example via the “Cookie settings” link in the footer of the website.

4. Storage period

We store personal data only for as long as is necessary for the respective purpose. It is then deleted, unless statutory retention obligations apply. We retain invoices and accounting records for seven years in accordance with § 132 BAO (Austrian Federal Fiscal Code). Specific retention periods are stated for the individual processing activities.

5. Your rights

You have the following rights:

• Access to the stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the competent supervisory authority. In Austria, this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

6. Hosting and server log files

Our website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The servers are located in Germany.

When you access the website, technical data is automatically stored in server log files: IP address, date and time, page accessed, amount of data transferred, referring page, and browser and operating system. We need this data to deliver the website, fix errors and fend off attacks. It is not merged with other data and is automatically deleted after a short time.

A data processing agreement in accordance with Art. 28 GDPR is in place with the host. The legal basis is our legitimate interest in the secure and reliable operation of the website (Art. 6(1)(f) GDPR).

7. TLS encryption

Our website is fully encrypted via TLS. You can recognise this by “https://” and the padlock symbol in your browser's address bar. This means that data you transmit to us cannot be read by third parties.

8. Contact, forms and email

If you contact us by email, phone or via a form on this website, we process the data you provide, for example your name, email address, phone number, company and your message. The forms (Elementor and Form Maker) run on our own server. The enquiry is sent to us by email and may also be stored in the website's database.

To send emails, we use the WP Mail SMTP plugin, which sends messages via our host's mail server. To combat spam, we use WP Armour (honeypot) and Really Simple CAPTCHA. Both work without external services.

We use your details exclusively to process your enquiry and to communicate with you about it. The legal basis is Art. 6(1)(b) GDPR if your enquiry is aimed at concluding a contract, otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). We delete the data once the enquiry has been dealt with and no retention obligations apply.

9. Customer and order data

To process orders, we process contact and contract data of our customers, for example name, company, address, email address, phone number, project content as well as billing and payment data. The legal bases are the performance of a contract (Art. 6(1)(b) GDPR) and statutory retention obligations (Art. 6(1)(c) GDPR). Where necessary for the project, we pass data on to partners such as print shops, signage companies or specialists from our network with whom we work on your order.

10. Cookies and consent management (Complianz)

Cookies are small text files that are stored in your browser. We use technically necessary cookies, for example to store your cookie selection or for the security of the website, without consent (§ 165(3) TKG 2021, Art. 6(1)(f) GDPR). We use all other cookies and comparable technologies only with your consent.

To obtain and manage consent, we use the WordPress plugin Complianz (Complianz B.V., Netherlands). It runs on our own server, and no data is transferred to the provider. Your selection is stored in cookies with the prefix cmplz_ stored, which expire after 365 days. The legal basis is Art. 6(1)(c) GDPR (proof of consent).

A complete list of all cookies with their purpose and retention period can be found in our cookie policy. There, and via the “Cookie settings” link, you can change your choice at any time.

11. Google Analytics (with consent only)

If you consent to the “Statistics” category in the cookie banner, we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service is integrated via the MonsterInsights plugin. Google Analytics evaluates how visitors use the website, for example which pages are viewed, for how long and from which device. For this purpose, cookies (for example _ga and _ga_*, lifetime up to 2 years) are set. Google Analytics 4 does not store IP addresses.

We use the reports to improve our services. The legal basis is your consent (Art. 6(1)(a) GDPR). Without consent, Google Analytics is not loaded. Analytics and Search Console are connected to our WordPress backend via the Google Site Kit plugin. No additional visitor data is collected in the process.

More information: Google Privacy Policy.

12. Google Ads (with consent only)

We run ads via Google Ads (Google Ireland Limited). If you consent to the “Marketing” category, we use conversion tracking to measure whether visitors, for example, send an enquiry after clicking an ad. For this purpose, cookies such as _gcl_au (lifetime 90 days) are set. We only receive aggregated statistics that do not allow us to identify individuals. The legal basis is your consent (Art. 6(1)(a) GDPR).

13. Meta Pixel (with consent only)

To measure the performance of our ads on Facebook and Instagram, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. The pixel is only loaded if you consent to the “Marketing” category. It records which pages you visit and whether you, for example, send an enquiry, and sets cookies such as _fbp (lifetime 3 months) for this purpose. Meta may link this data to your Facebook or Instagram account and use it for its own purposes. We are jointly responsible with Meta for the collection and transfer of this data (Art. 26 GDPR).

The legal basis is your consent (Art. 6(1)(a) GDPR). More information: Meta Privacy Policy.

14. Appointment booking with Calendly (with consent only)

On the contact page you can book a consultation via Calendly. The provider is Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA. The booking window is only loaded if you consent to the “Marketing” category. When you book, Calendly processes your entries (for example name, email address, appointment and topic) as well as technical data such as your IP address.

The legal bases are your consent to loading the service (Art. 6(1)(a) GDPR) and the preparation of a meeting or contract (Art. 6(1)(b) GDPR). More information: Calendly Privacy Notice.

15. Social media profiles

We have profiles on Instagram, Facebook, LinkedIn and Xing. On our website we only link to these profiles; no social media content is embedded. You are only redirected to the respective platform once you click a link. The privacy policy of the respective provider applies there.

For our Facebook and Instagram page, we are jointly responsible with Meta for the statistics (“Insights”) that Meta provides to us (Art. 26 GDPR). The legal basis for our presence is our legitimate interest in communicating with interested parties (Art. 6(1)(f) GDPR).

16. Fonts

All fonts on this website are loaded from our own server. There is no connection to Google Fonts or other font providers.

17. Security and spam protection

To protect against attacks, we use the security plugins Wordfence Security (Defiant Inc., USA) and All-In-One Security. In particular, IP addresses, requested URLs, time and browser identification are processed in order to detect and block suspicious requests. For this purpose, Wordfence compares IP addresses with the provider’s threat database. The legal basis is our legitimate interest in the security of the website (Art. 6(1)(f) GDPR). More information: Wordfence Privacy Policy.

18. Search engine tools and SEO

For search engine optimisation we use the Yoast SEO plugin, which runs on our server and does not transfer any visitor data to third parties. To manage the website in search engines, we use Google Search Console and Bing Webmaster Tools. We report new and updated pages to participating search engines via the IndexNow protocol. Only page addresses are transmitted, no personal data of visitors.

19. NFC business cards

For the digital profiles of our NFC business cards, we work with NFC21 GmbH, Mintarder Str. 12a, 45481 Mülheim an der Ruhr, Germany (nfc-vcard.de). When you order an NFC business card, we transfer the data you release for your profile (for example name, logo, contact details, links) to this provider. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Information on accessing a profile can be found in the nfc-vcard.de privacy policy.

20. Transfers to third countries

Some of the providers mentioned (Google, Meta, Calendly, Wordfence) also process data in the USA. Transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, insofar as the provider is certified under it, and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

21. Changes to this privacy policy

We update this privacy policy when our website, the services we use or the legal situation change. The version published here applies.