Privacy policy
Information about how Pixel & Stoff processes personal data on this website.
1. Controller
Pixel & Stoff PSH e.U.
Inhaber: Angelo Hellmich
Haydn-Straße 16/7
4470 Enns
Österreich
E-Mail: office@pixel-stoff.at
Telefon: +43 (0)660 370 00 36
2. Scope
We process personal data in accordance with the GDPR, the Austrian Telecommunications Act 2021 and other applicable data protection rules. This policy describes processing required to provide this website, respond to enquiries and perform optional analytics and marketing measurement.
3. Data processed
Depending on how you use the website, we process technical access data such as time, requested resource, IP address, referrer, browser and device information. If you contact us, we process the contact and communication data you provide voluntarily. After your consent, Google Analytics and Meta may additionally process the usage, interaction and campaign data described below.
We need the required name, email and message fields to process and answer your enquiry. Without this information, we cannot handle your enquiry.
4. Purposes
We use data to provide the website securely and reliably, respond to enquiries, comply with legal obligations and – only after consent – measure usage, improve our offering, and measure and optimise our advertising.
5. Legal bases
Depending on the processing, the legal bases are Art. 6(1)(b) GDPR for contractual or pre-contractual measures, Art. 6(1)(c) GDPR for legal obligations, Art. 6(1)(f) GDPR for our legitimate interests in operating a secure, stable and efficient website, and Art. 6(1)(a) GDPR together with section 165(3) of the Austrian Telecommunications Act 2021 where consent is required.
6. Recipients and service providers
Data may be shared with hosting, infrastructure and email service providers to the extent required. Where necessary, we enter into data processing agreements under Art. 28 GDPR. Google and Meta receive analytics or marketing data only after your consent and as described below.
Hosting and technical infrastructure. Vercel Inc. (United States) hosts and delivers this website and processes technical access data including your IP address. Render Services, Inc. (United States) operates our API, database and scheduled background tasks in the Frankfurt region. Plus Five Five, Inc. / Resend (United States) delivers your enquiry and our reply, processing in particular your email address, name and message content.
International transfers. Vercel, Render and Plus Five Five / Resend are certified under the EU-US Data Privacy Framework. Render also incorporates the EU Standard Contractual Clauses as a fallback mechanism in its data processing addendum. Other transfers outside the EEA rely on an adequacy decision or the European Commission's Standard Contractual Clauses with supplementary safeguards. You may request a copy of the relevant safeguards using the contact details above.
7. Cookie choice
We store your choice under ps_consent_v2 in a technically necessary first-party cookie and in your browser's local storage. The record contains only the choice, language, decision time, a random receipt ID and notice version, but no directly identifying information. It is used to respect your decision and avoid showing the notice on every page view. Acceptance and rejection are each stored for 180 days.
The legal basis for this necessary storage is section 165(3) of the Austrian Telecommunications Act 2021. To the extent personal data is processed, we rely on our legitimate interest in a verifiable and user-friendly consent process under Art. 6(1)(f) GDPR.
We also store your display preference under ps-theme in local storage until you change it or clear browser storage. This strictly functional setting keeps the selected light or dark appearance between page views.
8. Google Analytics 4
If you allow analytics in the notice or settings, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics loads only after your consent. Before consent, the Google tag is not loaded and no data is transmitted to Google Analytics. The legal bases are Art. 6(1)(a) GDPR and section 165(3) of the Austrian Telecommunications Act 2021.
Google Analytics processes in particular a pseudonymous client ID, page views, visited URLs, referrers, timestamps, session and interaction data, and technical information such as browser, operating system, device category, language and screen resolution. We do not send names, email addresses or other directly identifying information to Google Analytics.
Google uses the IP address transmitted when a connection is established to derive an approximate location and select the relevant data centre. According to Google, IP addresses from EU or EEA traffic are then discarded and are not logged or stored in Google Analytics.
After consent, the first-party cookies _ga, used to distinguish pseudonymous users, and _ga_<ID>, used to retain session state, may be set. We limit their lifetime to a maximum of 180 days and do not automatically renew it on each visit. User- and event-level detail data in a standard GA4 property is limited to a maximum of 14 months; aggregated standard reports may remain available beyond that period.
Until Google Ads is activated on this website, Google advertising, remarketing and personalisation signals remain technically disabled even when Meta marketing consent is granted. We do not use Google User-ID and do not send user-provided contact data to Google Analytics.
The recipient is Google Ireland Limited. Processing by Google LLC or other Google companies outside the EEA cannot be fully excluded. For transfers to the United States, Google relies, among other safeguards, on Google LLC's certification under the EU-US Data Privacy Framework; Standard Contractual Clauses may be used for other international transfers. More information is available in Google's Privacy Policy.
9. Meta Pixel and Conversions API
If you allow marketing, we use Meta Pixel and Meta Conversions API provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Both services are used only after your consent. Their purpose is to measure, attribute and optimise our advertising and determine whether it resulted in a successful contact enquiry. The legal bases are Art. 6(1)(a) GDPR and section 165(3) of the Austrian Telecommunications Act 2021.
The browser pixel processes page views and, after a genuinely successful contact enquiry, the standard Lead event. Our server sends the same Lead event through Conversions API. Browser and server use the same random event ID so Meta can deduplicate them as one event.
For the server event, name and email address are normalised and hashed with SHA-256. The IP address, user agent, Meta identifiers _fbp and _fbc, page URL without query or fragment, language and enquiry category may also be processed. Your message is not sent to Meta. Server events that cannot be delivered temporarily may be kept in our access-controlled retry queue; successful Lead retries are deleted immediately and permanently failed entries after no more than 30 days.
According to Meta, the _fbp and _fbc cookies used for browser and campaign attribution generally have a lifetime of up to 90 days. Under its Business Tools Terms, Meta may retain event data received through the Business Tools for up to two years.
To demonstrate consent for a server-side Lead event, we store the random receipt ID, notice version, decision time, language, permitted categories and random Meta event ID when an enquiry succeeds. This receipt contains no name, email address, message, IP address or user agent and is automatically deleted after three years. The legal bases are Art. 6(1)(c) in conjunction with Art. 7(1) GDPR and our legitimate interest in legal defence under Art. 6(1)(f) GDPR.
For the collection and transmission of certain event data through Meta Business Tools, we and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR in accordance with Meta's terms. The arrangement allocates responsibility for compliance with GDPR obligations. Its essence is available in the Meta Controller Addendum. After transmission, Meta also processes certain data as an independent controller.
Meta may associate the data with existing Meta accounts and use it for measurement, attribution and advertising optimisation. Processing by Meta Platforms, Inc. in the United States cannot be excluded. Meta relies, among other safeguards, on its EU-US Data Privacy Framework certification and, where applicable, Standard Contractual Clauses. More information is available in Meta's Privacy Policy.
10. Withdrawal
You can withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing performed before withdrawal. When you withdraw consent, we stop future processing in the categories you disable and delete the Google Analytics and Meta cookies accessible to us in your browser:
11. Retention and your rights
Otherwise, we keep personal data only for as long as required for the relevant purpose or statutory retention obligations. Technical runtime and access logs at Vercel and Render are automatically deleted according to the applicable plan and, without an external log drain, after no more than 30 days. In particular, you have rights to access, rectification, erasure, restriction, data portability, withdrawal of consent and objection to certain processing. Contact: office@pixel-stoff.at.
This website does not use solely automated decision-making that produces legal or similarly significant effects concerning you, nor profiling within the meaning of Art. 22 GDPR.
Right to object under Art. 21 GDPR: You may object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. We will stop the processing unless compelling legitimate grounds or the establishment, exercise or defence of legal claims prevail.
You may also lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna. Information and contact details are available at dsb.gv.at.
12. Changes
We update this policy when the website, services or applicable law materially changes.