Privacy policy

Information pursuant to Art. 13 and 14 of the General Data Protection Regulation (GDPR) on the processing of personal data in connection with visiting and using this website.

1. Controller

2. General principles

We process personal data exclusively in accordance with the GDPR, the Austrian Data Protection Act (DSG) and other applicable data protection provisions. Personal data means any information relating to an identified or identifiable natural person.

As a general rule, you can visit this website without providing any personal data. Where personal data is processed, this is done on the basis of one of the legal bases set out below.

3. Hosting and server log files

This website is hosted by World4You Internet Services AG, Hafenstraße 35, 4020 Linz, Austria. The hosting provider automatically collects data about every access to the server (so-called server log files):

• IP address of the requesting computer
• Date and time of the request
• URL accessed and amount of data transferred
• Referrer URL (page of origin)
• User agent (browser and operating system identifier)

Purpose: Ensuring a trouble-free connection setup; detecting and fending off attempted attacks.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
Retention period: 14 days, after which the data is deleted automatically.

4. Contact form

If you send us a message via the contact form on this website, we process the information you submit (name, email, phone, company, topic, message) exclusively for the purpose of handling your enquiry.

The same procedure applies to registrations of interest on the industry pages and in the shop. If you open an industry page via the QR code in a letter from LEMCON.TECH, the address contains an identifier of that letter. If you submit a registration of interest there, the identifier is transmitted with it so that we can match your registration to the letter. The same applies to the contact form at /kontakt/ if you open it via the QR code in a letter or from an industry page opened in this way: the identifier is transmitted with your message so that we can match it to the letter; the form informs you of this. The same procedure applies to the enquiry at /unterweisungsvideos/; if the page is opened via the QR code in a letter or from an industry page opened in this way, the identifier from the letter is transmitted with the enquiry; the form informs you of this. If you do not submit anything, we do not evaluate the identifier; it then appears in the server log files like any other address accessed (section 3).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(a) GDPR (consent given by submitting the form together with the GDPR notice).
Retention period: until your enquiry has been dealt with conclusively; in the event of follow-up contact or the initiation of a contract, beyond that in accordance with the statutory retention periods (§ 132 of the Austrian Federal Fiscal Code (BAO): 7 years).

4.1 Spam protection for the contact form (Cloudflare Turnstile)

To protect the contact form against automated submissions, we use Cloudflare Turnstile, a service provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

Purpose of processing: Turnstile checks whether a submission of the contact form comes from a human or from an automated program. Without this check, the form could be misused for mass submissions and would be practically unusable as a means of contact.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in preventing misuse of the contact form and in ensuring that we can be reached via this form.

Data processed: When you open the contact page, the Turnstile widget is loaded from a Cloudflare server. In the process, your IP address and information about your browser and device are transmitted to Cloudflare and processed there, in particular browser type and version, operating system, language setting, screen properties, the address accessed and information about your behaviour on the page, such as mouse and keyboard input. From this information, Cloudflare forms an assessment and issues a single-use verification token. When the form is submitted, we verify this token server-side with Cloudflare. In doing so, we transmit exclusively the token itself and expressly not your IP address.

Cookies: In the configuration we use, Turnstile does not set any cookies for advertising or tracking purposes. The check is carried out without recognising you across websites.
Transfer to third countries: The processing also takes place in the USA. It is based on the standard data protection clauses adopted by the European Commission, which we have agreed with Cloudflare. In addition, Cloudflare has committed itself to its own technical and organisational safeguards.
Retention period: The retention period at Cloudflare is determined by Cloudflare as the controller of its own security infrastructure. We ourselves do not store any verification token or any of the information collected by Cloudflare.
Further information: cloudflare.com/privacypolicy

4.2 Limiting submissions (hashed IP address)

To prevent the contact form from being misused for mass submissions, we limit the number of messages delivered from any one internet connection within 24 hours to three.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in preventing misuse and in the proper operation of the contact form.

Data processed: We do not store your IP address. On our server, a non-reversible check value is calculated from the IP address (HMAC-SHA256 with a secret key that exists only on the server). Only this check value and the time of delivery are stored. Without the secret key, it is not possible to infer the IP address; matching against other data sets is therefore ruled out.

Retention period: Entries older than 24 hours are deleted automatically on the next submission.
Logging: Rejected and delivered submissions are recorded in a log file on the server in order to detect misuse and to trace technical faults. There, too, the IP address is not recorded in plain text, but only as a truncated check value. In addition, the time, the reason for any rejection and the selected subject of the enquiry are logged. The log file cannot be accessed via the internet; it is protected by the server configuration and by file permissions. It is overwritten once it reaches one megabyte.
Recipients: This data does not leave our server and is not disclosed to third parties.

4.3 Delivery of your message (sending by email)

Your form message is delivered to our mailbox as an email. It is submitted via an authenticated, STARTTLS-encrypted connection to the mailbox service of Google Ireland Limited, which we use for our business email. The email contains the information you provided as well as the time and the hashed check value from section 4.2, but not your IP address.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(a) GDPR (consent); the use of an email service is a necessary consequence of your choice to contact us via the form.
Processing on our behalf: A data processing agreement pursuant to Art. 28 GDPR is in place with Google. It forms part of the Google Workspace contract as the Cloud Data Processing Addendum.
Transfer to third countries: Processing in the United States cannot be ruled out in this context. For this, Google relies on the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission pursuant to Art. 45 GDPR) and additionally on the standard contractual clauses pursuant to Art. 46(2)(c) GDPR.
Retention period: as described in section 4; the email remains in the mailbox until your enquiry has been concluded and the statutory retention periods have expired.

4.4 Are you obliged to provide this data?

No. Providing the data is neither a statutory nor a contractual requirement. However, in order to be able to respond to an enquiry at all, we need your name, an email address, a description of your request and your consent to the processing; without this information, the form will not accept the message. Company and phone number are optional. Alternatively, you can reach us informally by email or phone at any time.

4.5 Test access (“Try for free”)

Companies can test a safety briefing module free of charge for 14 days with up to 3 people. For this we process the details from the form (company, VAT ID number or company register number, contact person, business email address, selected module) and, to limit submissions, a hashed IP address (section 4.2).

We use them to set up the test access, send the access links and, shortly before the end of the test, a notice stating when the test ends (Art. 6(1)(b) GDPR). So that each company tests only once, we keep the VAT ID or company register number and the test date for three years (Art. 6(1)(f) GDPR). We send an offer after the test only if you have consented in the form (Art. 6(1)(a) GDPR, § 174(3) TKG 2021); you can withdraw your consent at any time (Your rights).

We delete the remaining details three months after the end of the test unless a contract follows. The section safety briefing modules via link applies to the use of the module and the test records; for hosting and recipients, see sections 3, 4.1 and Recipients and storage location.

5. Enquiry form “Operating instructions” (Betriebsanweisungen)

On the page /betriebsanweisungen/ you can request an operating instruction. In doing so, we process the data you provide (name, company, email, phone, country, type of operating instruction, approximate number, message) and, if you upload any, the attached files (for example operating manual, safety data sheet or photos) exclusively for the purpose of handling your enquiry.

For the identifier from the QR code in a letter, the same applies as in section 4: if you open this page via such a QR code or from an industry page opened in this way, the identifier is transmitted with your enquiry so that we can match the enquiry to the letter; if you do not submit anything, we do not evaluate it.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measure at your request) or Art. 6(1)(a) GDPR (consent given by submitting the form together with the GDPR notice).

Uploaded files: Files that you submit via this form are used exclusively for the one-time delivery of your enquiry by email. For this purpose, they are held briefly in the internal processing memory of our web server and are deleted immediately after the email has been sent. The files are not stored on the web server beyond this; in particular, they are at no time located in a publicly accessible directory. The permitted formats are PDF, JPG, PNG, DOCX and XLSX, with a maximum of 5 files and a maximum of 20 MB in total.

Spam protection: As with the contact form, we use Cloudflare Turnstile and a server-side rate limit (see sections 4.1 and 4.2); the processing, legal basis and retention period correspond to what is described there. Submissions via this form are counted independently of the contact form.

Recipients: As with the contact form, delivery takes place via an authenticated, encrypted SMTP connection to our mailbox at Google Workspace (see section 4.3).
Retention period: until your enquiry has been dealt with conclusively; in the event of follow-up contact or the initiation of a contract, beyond that in accordance with the statutory retention periods (§ 132 BAO: 7 years). By way of derogation, uploaded files are subject to the immediate deletion on the web server described above; they do not remain on the server as attachments beyond delivery, but only in the delivered email in our mailbox.

Obligation to provide data: Name, company, email address, country and your consent to the processing of your data are mandatory fields; without this information, the form will not accept the enquiry. Phone number, type, approximate number, message and file uploads are optional.

6. Advertising letters to businesses and associations

We write to businesses and associations in Austria by post to draw attention to our occupational safety services. The letter states the source, purpose and legal basis and refers to this section for all further information pursuant to Art. 14 GDPR. The controller is LEMCON.TECH · Ingenieurbüro Lemmerer e.U. (contact details in section 1).

Categories of data: Company name, business address, industry and, where available, form of address, title, name and function of a contact person (for example in the management of a company or in the leadership of an association).
Source of the data: The addresses come from one of two sources; which one is stated in the respective letter. Either we purchase them from a commercial address publisher (currently FirmenABC, firmenabc.at), or we obtain them from publicly accessible sources: the imprint of your website, the companies register (Firmenbuch), the directories of the Austrian Economic Chamber (Wirtschaftskammer Österreich, WKO) (wko.at), or press reports.
Check before sending: Before sending, all addresses, regardless of their source, are checked against the list pursuant to § 151(9) of the Austrian Trade Regulation Act (Gewerbeordnung, GewO) (the “Robinson list” of the WKO). This list is made available to address publishers; an address publisher therefore carries out this check on our behalf. We also check against our own suppression list.

Purpose and legal basis: Direct marketing on the basis of our legitimate interest in drawing businesses’ and associations’ attention to our services (Art. 6(1)(f) GDPR; according to Recital 47 GDPR, direct marketing may serve a legitimate interest).
Recipients: Our printing and mailing service provider prints the letters, puts them into envelopes and hands them over to the Austrian postal service (Österreichische Post). It processes the data as a processor (Art. 28 GDPR). Its servers are located in Switzerland; for Switzerland there is an adequacy decision of the European Commission (Art. 45 GDPR). For the check against the Robinson list, the address publisher receives the company name, address and, where available, the name of the contact person; it processes this on our behalf for this purpose (Art. 28 GDPR).

Code in the letter: Every letter bears a random code. It contains no information about you and is linked to a letter only in our customer database. If you open the page via the QR code, the code is passed to a form that you submit yourself (sections 4 and 5). Our web analytics (section 9) do not record the code, only the campaign details without any personal reference; in the server log files it appears like any other address accessed (section 3).

Retention period: until you object, but no longer than three years after the last letter. After an objection, we store only the company name and address in a suppression list so that we do not write to you again.
Objection: You can object to the use of your data for advertising at any time without giving reasons (Art. 21(2) GDPR), informally by email to contact@lemcon.tech or by post to the address in section 1. After that, we will no longer use your data for advertising.
Your rights: Access, rectification, erasure, restriction of processing and objection (Art. 15 to 18 and 21 GDPR) as well as a complaint to the Austrian Data Protection Authority (Datenschutzbehörde); details in sections 17 and 19.

7. Newsletter (LEMCON.TECH Monatsbrief)

You can subscribe to the “LEMCON.TECH Monatsbrief” (monthly letter). It is published once a month and summarises what has appeared on the blog of this website. You can subscribe via the forms on this website and via the subscription page at news.lemcon.tech. Both lead to the same subscriber management system, which we operate ourselves at news.lemcon.tech: your entries are transmitted directly there, even if you fill in the form on this website.

Subscription via double opt-in: After you subscribe, we send you an email with a confirmation link. The subscription only takes effect once you open this link. If you do not confirm, we will not send you the monthly letter.

Data processed: Your email address and, if you provide it, your name. As proof of consent, we additionally store the time of confirmation and the IP address from which the confirmation was made. This record is necessary in order to be able to demonstrate consent in the event of a dispute (§ 174 of the Austrian Telecommunications Act 2021 (TKG 2021), Art. 7(1) GDPR).

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 174 TKG 2021. Consent is voluntary and can be withdrawn at any time.

Where the data is stored: The subscriber list is stored on a server that we operate ourselves. It is not outsourced to a newsletter service provider. The server is located in the data centre of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, which provides us exclusively with the operation of the machine (processing on our behalf pursuant to Art. 28 GDPR). This server is not the same one on which this website is hosted (see section 3).

Processor for sending: To deliver the emails, we use the email delivery service Mailjet GmbH, Alt-Moabit 2, 10557 Berlin, Germany (a company of the Sinch group). Mailjet processes the data exclusively for the purpose of delivery and in accordance with our instructions. According to the provider, processing takes place in data centres within the European Union (Frankfurt am Main and Saint-Ghislain, Belgium). A data processing agreement pursuant to Art. 28 GDPR is in place with Mailjet GmbH. Where data is transferred to third countries within the group of companies or by sub-processors, such transfer is based on the standard contractual clauses of the European Commission (Commission Implementing Decision (EU) 2021/914). Mailjet only ever receives the individual message being delivered, not the subscriber list. This also applies to the confirmation email for the subscription.

No performance tracking: We do not measure whether or when you open an email, and we do not count clicks. The links in the monthly letter lead unaltered to where they purport to lead; they are not routed via an intermediate server. No invisible tracking pixel is included. Tracking is both switched off in our mailing software and suppressed vis-à-vis the delivery service for every single message.

Unsubscribing: Every monthly letter contains an unsubscribe link at the end, which takes effect immediately and requires no reason to be given. You can also contact contact@lemcon.tech at any time.
Retention period: Your email address is stored for the duration of the subscription and removed from the mailing list when you unsubscribe. We then retain the proof of consent (time and IP address of the confirmation) for a further three years and delete it afterwards. This period corresponds to the general limitation period under § 1489 of the Austrian Civil Code (ABGB). Its sole purpose is to be able to demonstrate the lawfulness of the mailing in the event of a dispute; the proof is not used for any other purpose.

8. Online appointment booking

For the online booking of first calls, we refer, on the contact page, to a booking calendar provided by Google Ireland Limited (Google Calendar appointment booking). The calendar is not embedded in the page: it only opens in a new window when you click the “Choose a free slot” button. As long as you do not click, no data is transmitted to Google. Once you click, you leave this website; data is transmitted to Google servers (predominantly within the EEA, in certain cases to the USA), and Google’s privacy policy applies.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and consent pursuant to Art. 6(1)(a) GDPR, insofar as you actively use the booking calendar.
Further information: policies.google.com/privacy

9. Web analytics (Plausible Analytics)

This website uses Plausible Analytics, operated by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Plausible is a privacy-friendly web analytics solution that works without cookies and without personal tracking mechanisms. No unique identifiers are generated, IP addresses are not stored permanently and no data is passed on to third parties. All data is processed exclusively within the EU.

The following is recorded in aggregated form: pages visited, country of origin (determined from the IP address, which is not stored), referrer, browser and operating system used, and device type.

In addition, the following interaction events are counted anonymously and in aggregated form in order to assess the usefulness of the content:

• Outbound clicks: Clicks on links that lead to external websites (e.g. to authority websites or source references). The target URL is recorded, but not which person clicked.
• File downloads: Clicks on downloadable files (e.g. PDF attachments in blog posts). The file URL is recorded.
• Form submissions: The successful submission of a form on this website (e.g. the contact form). Only the fact that a form was submitted is recorded, not the content of the input fields.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring reach without cookies/identifiers).
Further information: plausible.io/data-policy

10. Map display (OpenStreetMap)

The contact page includes an embedded map provided by the OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). When the map is loaded, a connection is established to the OpenStreetMap servers, in the course of which your IP address may be transmitted to OpenStreetMap.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a low-data location display as opposed to commercial map services).
Further information: osmfoundation.org/wiki/Privacy_Policy

11. WhatsApp contact link

On the contact page, we provide a link to WhatsApp (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland). The link is only loaded when you actively click on it; without a click, no data is transmitted to WhatsApp. As soon as you use the link, Meta’s privacy policy applies.

Further information: whatsapp.com/legal/privacy-policy-eea

12. Company profiles on social networks (Facebook, Instagram, LinkedIn, YouTube)

We operate company profiles on Facebook (page “Lemcon Tech”) and Instagram (@lemcon.tech), both provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, and on LinkedIn, provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. There we provide information about our services in occupational safety and plant engineering and are available to answer questions. This website does not embed any content from these networks.

Data processed: If you follow our profiles, comment on, share or “like” posts, or send us a message, we see your public profile name, your profile picture and the content you share with us. We use this data only to reply to your message and to conduct the conversation on the platform.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in providing up-to-date information about our company and in communicating with interested parties. Where an enquiry about our services is concerned, Art. 6(1)(b) GDPR (pre-contractual measures).

Statistics (Page Insights), joint controllership: The networks provide us with aggregated statistics on the use of our profiles (for example reach, number of views, origin by region). We cannot identify individual persons from them. For these statistics, we are joint controllers with Meta (Facebook page) or LinkedIn respectively (Art. 26 GDPR). For the statistics of our Instagram account, we assume, as a precaution, joint controllership with Meta as well. The essence of the arrangements can be found here:

• Meta: facebook.com/legal/terms/page_controller_addendum
• LinkedIn: linkedin.com/legal/l/page-joint-controller-addendum

Under these arrangements, Meta and LinkedIn respectively assume primary responsibility for processing the statistical data and for fulfilling your rights. However, you can also contact us with your requests; we will forward them.

Instagram account @lemcon.tech: Meta’s agreement on joint controllership is called the “Page Insights Controller Addendum” (link above). As a precaution, we apply it to the statistics (insights) of our Instagram account in the same way as to the Facebook page. Here, too, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in evaluating the reach of our posts and aligning our services accordingly.
Your rights: as described in section 17 (access, rectification, erasure, restriction, data portability); you may object under Art. 21 GDPR at any time, informally, to contact@lemcon.tech. You can exercise your rights against Meta and against us.

What the networks process themselves: When you visit our profiles, Meta and LinkedIn process data under their own responsibility, including by means of cookies, and may transfer it to the USA. Meta Platforms, Inc. and LinkedIn Corporation are certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission pursuant to Art. 45 GDPR). You can change your settings on advertising and data use in your respective user account. Details: facebook.com/privacy/policy, help.instagram.com/519522125107875 and linkedin.com/legal/privacy-policy.

Publication of our posts: We publish posts via the networks’ interfaces. For Instagram, we make the images of a post briefly available for this purpose at medien.lemcon.tech, where Meta retrieves them; they are deleted there no later than three days after publication. The address medien.lemcon.tech is located on our own server at Hetzner Online GmbH, which also hosts the newsletter subscriber list (section 7), not at the hosting provider of this website. The server logs every retrieval (IP address, time, file retrieved, browser identifier) for security and troubleshooting purposes (Art. 6(1)(f) GDPR); these logs are deleted after 30 days at the latest.

12.1 YouTube channel and YouTube API Services

We operate our own channel on YouTube. For users in the European Economic Area, YouTube is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). On the channel, we publish short educational videos on occupational safety that are derived from our expert articles. This website does not embed any YouTube videos; merely visiting this website does not transmit any data to YouTube.

What Google processes: If you watch our videos on YouTube, subscribe to our channel, or comment on or rate videos, Google processes this data under its own responsibility, including by means of cookies, and may transfer it to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission pursuant to Art. 45 GDPR). Details can be found in Google’s privacy policy: policies.google.com/privacy. You can change your settings on advertising and data use in your Google account.
What we see: If you comment on a video, we see your public profile name, your profile picture and your comment; we use this information only to reply and to conduct the conversation on YouTube. In addition, YouTube provides us with aggregated statistics on the use of the channel (for example views, watch time, origin by country); we cannot identify individual persons from them.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in providing up-to-date information about our company and in communicating with interested parties.

Uploading via the YouTube API Services: Our videos are uploaded to our channel by an internal application on our own server via the YouTube API Services (YouTube’s programming interface). This application uses only our own Google account; there are no other users, no sign-in for third parties and no public user interface. Via the interface, we transmit our own videos with title and description and query the processing status of these videos. In addition, during set-up the application checks once that the signed-in account is our channel; after an interrupted upload, it checks only among our own videos whether the video has already arrived, so that no video appears twice. We do not retrieve or store any data of viewers, subscribers or other channels via the interface; the application does not display any YouTube content, does not show advertising and does not access end-user devices. In our internal publication record, we store for each of our own videos only the video ID assigned by YouTube, the link, the time and the visibility, for as long as the video is on the channel; while an upload is in progress, we additionally store the upload session address, which is deleted once the upload is complete. We do not share this information with third parties. Google’s privacy policy (policies.google.com/privacy) applies to the use of the YouTube API Services. We can revoke the application’s access to our Google account at any time on the security page of the Google account (security.google.com/settings/security/permissions); we then delete the application’s stored credentials. Questions about this application: contact@lemcon.tech.

12.2 Retention period and your rights (all profiles)

Retention period: Messages and comments remain on the platform until you or we delete them or you close your account. We ourselves do not store any of this outside the platform, unless an enquiry results in an assignment; in that case, the statutory retention periods apply.
Your rights: as described in section 17; objection pursuant to Art. 21 GDPR at any time, informally, to contact@lemcon.tech.

13. Advertising on Google and Microsoft

We place text ads in Google Search (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and in Microsoft Bing search (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland).

No advertising tag, no cookie. No program from Google or Microsoft is embedded on this website. We set no cookies for the ads and store nothing on your device. The automatic click identifiers of Google and Microsoft (gclid, msclkid) are switched off in our advertising accounts. If such an identifier nevertheless appears in the address, we do not store it.

Identifiers in the address. If you click on one of our ads, the address of the page you open contains identifiers of the ad, for example ?utm_source=google&utm_campaign=…:

• the numbers of the campaign, the ad group and the ad,
• the keyword from our advertising account for which the ad appeared (not the search query you entered).

These identifiers are the same for everyone who clicks on the same ad. They contain no information about you. Our reach measurement (section 9) evaluates them in aggregate. If you continue from the page you opened via an order link or order button, we pass the identifiers in the address on to that page.

When you order. If you order in the shop after arriving via an ad, we store these identifiers together with your order.

• Purpose: We see which ads and keywords lead to orders and allocate our advertising budget and bids accordingly.
• Disclosure: We do not pass your order on to Google or Microsoft.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is economical advertising in which we direct our budget to the ads that lead to orders.
• Storage period: We remove the identifiers 25 months after the order was received. We keep the order itself for the statutory retention periods.
• Objection: You can object to this processing at any time (Art. 21 GDPR). An e-mail to contact@lemcon.tech is sufficient.

Google and Microsoft. Google and Microsoft are themselves responsible for what they process on their own pages during the search and when you click on an ad:

• policies.google.com/privacy
• privacy.microsoft.com/en-gb/privacystatement

14. Fonts

This website uses exclusively locally hosted fonts (Inter, Source Serif Pro). No connection is made to Google Fonts or any other external font services.

15. Editorial area (content manager)

The interface we use to maintain the content of this website is located at /admin/. It is of no use to visitors, but it is technically accessible. Anyone who opens this address loads a software library via a content delivery network (unpkg.com); the IP address is transmitted to its operator.

The subsequent login concerns exclusively us as the operator. Visitors to this website do not log in anywhere and are not affected by it. Editorial access takes place via an account with GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. In the process, a short-lived technical cookie (oauth_state) is set, which serves exclusively to secure the login process and is deleted again afterwards. GitHub processes the login data in the United States. Without a login, no further data is processed.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in being able to maintain the content of this website without running our own server software.
Retention period: The cookie of the login process is deleted once that process has been completed. Beyond that, we do not store anything in this context.

16. Cookies and access to your terminal equipment

This website does not set any cookies when you visit it. Nor does it store anything in your browser’s local data storage (Local Storage, Session Storage). A consent banner is therefore not required — there is nothing for which we would need to ask your permission. Tracking or marketing cookies are not set; the reach measurement described in section 9 works without them.

Access to your terminal equipment within the meaning of § 165(3) TKG 2021 therefore does not take place. The sole exception is the technical cookie of the login process in the editorial area described in section 15, which is strictly necessary for the service expressly requested by the person logging in. Services that you only access by clicking — the booking calendar described in section 8 and the WhatsApp link described in section 11 — may set cookies on their own pages; their privacy policies apply there.

17. Your rights

You have the following rights vis-à-vis us with regard to the personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to data portability (Art. 20 GDPR)

Where processing is based on your consent, you have the right to withdraw that consent at any time. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal. You can send your requests to contact@lemcon.tech .

18. Automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place. We do not create profiles, we do not evaluate anyone by automated means, and we do not take decisions about persons that would be made solely by a machine.

For the sake of completeness: the contact form automatically checks incoming submissions for characteristics of unsolicited bulk mail. The result of this check merely flags a message — it does not decide whether we read it; we read every message that is delivered. If the spam protection rejects a submission, you immediately receive a notice with our phone number, so that this means of contact remains open to you.

19. Complaint to the supervisory authority

You have the right to lodge a complaint with the Austrian Data Protection Authority if you believe that the processing of your personal data infringes the GDPR.

Last updated: October 2026