Privacy policy
How I process personal data under the GDPR and the Austrian Data Protection Act. Version of 14 October 2026.
- Controller
-
Viacheslav Hordiienko
VCSLV — Websites & Automatisierung
St. Anton im Montafon, Austria · full address in the Imprint
office@vcslv.at
I have not appointed a data protection officer: the size of the business does not require one. - In short
- There are no advertising pixels, cookies or third-party analytics on this site. I count visits myself, anonymously and without cookies. I receive your name and contact details only when you write to me yourself, through the form or a messenger, or book a call. Visit statistics, draft websites for companies and letters to companies are described separately below.
Visiting the site
When a page is opened, the hosting server records technical data: IP address, date and time, the page address, browser and device type. Without this the site cannot run or defend itself against attacks. The legal basis is legitimate interest (Art. 6(1)(f) GDPR). These records are kept only briefly, usually a few days, and are then deleted automatically. I do not analyse them or link them to individuals.
The site is hosted by Cloudflare. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers the pages through its server network, including servers in the EU, and processes the technical data listed above in doing so. A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Transfers to the USA are based on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework), under which Cloudflare is certified, and additionally on the EU standard contractual clauses.
Visit statistics
To understand which pages are read and whether the site works, I keep my own anonymous statistics, without third-party services. For each page view the following is stored: the time, the page address, the website you came from, the approximate city, region, country and network name that Cloudflare derives from the IP address, device and browser type, screen size, how long the page was open, how far it was scrolled, which sections were shown and which contact buttons were clicked. The IP address itself is not stored, no cookies are set, nothing is written to your browser for the statistics, and page views are not linked to each other by any identifier. The legal basis is legitimate interest (Art. 6(1)(f) GDPR).
The data is kept in a database at Cloudflare (see above) and deleted automatically after 12 months. I receive a daily, weekly and monthly summary of visits by email in my mailbox at easyname; it contains the same information as listed above. If your browser sends the Global Privacy Control or “Do Not Track” signal, no statistics are kept for you. You can also object by writing to the address above.
The enquiry form
In the form you give your name, a contact (phone, WhatsApp, Telegram or email) and how you prefer to be reached, what your business does and, if you wish, what you want to improve and a description of the task. This data is needed to reply to you and prepare an offer. The legal basis is pre-contractual measures and performance of a contract (Art. 6(1)(b) GDPR).
The enquiry is passed through the website server at Cloudflare and reaches me by email. My mailbox is hosted by easyname GmbH in Vienna, Austria. In case email delivery fails, a copy of the enquiry is kept at Cloudflare for 90 days and then deleted automatically. Your IP address is not stored with the enquiry. Using the form is optional: you can simply write to me by email or in a messenger.
Booking a call
You can pick a time for the free review right in the enquiry form. The site’s server asks the Cal.com service for free times: your browser does not connect to Cal.com, and the request contains none of your data. When you confirm a time, the site’s server passes your name, email address, time zone, language, your answers in the form (what your business does, what you want to improve, your message) and, if you choose a phone call, your phone number to Cal.com. Cal.com creates the booking and sends you a confirmation with a calendar invitation. You can also pick a time on a separate Cal.com page via the link on this site; you then enter your data there yourself. This data is needed to hold the call. The legal basis is pre-contractual measures (Art. 6(1)(b) GDPR). Video calls run on Cal Video, a service of the same provider. I do not record the call.
The provider is Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. Cal.com processes booking data on my behalf under its data processing agreement (Art. 28 GDPR). The data is processed in the USA; transfers are based on the EU standard contractual clauses or the EU-U.S. Data Privacy Framework. Which cookies the booking page itself sets is described in the Cal.com privacy policy. A confirmed booking with your name and email is also entered in my work calendar. Booking is optional: you can send the form or write to me directly.
Messengers and email
If you write to me on Telegram, WhatsApp or Instagram, those services process your data too, under their own terms, which I cannot influence. The servers of WhatsApp and Instagram (Meta) and some of Telegram’s servers are outside the EU. If that matters to you, write by email instead: the message goes to me alone.
Fonts and external services
The fonts, styles and scripts of this site are served from the same server as the pages themselves. No third-party content delivery networks are used, Google Fonts included, so ordinary browsing sends nothing beyond the hosting provider.
Sample sites
The six concepts in the showcase run entirely in your browser and contact no third-party domain. Their buttons and forms send nothing and store nothing: they show an interface, not a working service.
Draft websites for companies
From time to time I build a draft of a new website for a specific company from its publicly available content and show it via a link, for example in a letter. These drafts run on subdomains of vcslv.at, are closed to search engines and can only be reached through that link.
The drafts keep anonymous visit statistics: the time, the approximate location and network operator that Cloudflare derives from the IP address, device and browser type, screen size, how long the visit lasted, how far the page was scrolled, which sections were viewed and which contact buttons were clicked. The IP address itself is not stored; the statistics set no cookies and store nothing in the browser. This tells me whether a draft was viewed and what was of interest. The legal basis is legitimate interest (Art. 6(1)(f) GDPR). The data is kept in a database at Cloudflare and deleted together with the draft, after 12 months at the latest.
For new visits I receive a short email notification: the time, the approximate location and the device type. It is sent through the Resend service (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) under a data processing agreement (Art. 28 GDPR). Transfers to the USA are based on the EU-U.S. Data Privacy Framework, under which Resend is certified, and additionally on the EU standard contractual clauses. The notifications go to my Gmail mailbox (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
Some drafts show the current weather. For this, your browser fetches the weather data directly from the Open-Meteo service (open-meteo.com); as with any request on the internet, your IP address is transmitted to Open-Meteo. Only the coordinates of the place are requested, no data about you. The legal basis is legitimate interest (Art. 6(1)(f) GDPR).
Letters to companies
From time to time I write to companies by post to offer my services. I take the contact person’s name and the company address from public sources, usually the imprint on the company’s website. I use this data only for that letter and any correspondence that follows. The legal basis is legitimate interest in direct marketing (Art. 6(1)(f) GDPR). I do not pass the data on, and if there is no interest I delete it six months after the letter at the latest. You can object to this use at any time: a short message to the address above is enough, and you will receive no further letters. After that I keep only a note so that I do not write to you again. I do not make advertising calls or send advertising emails without your consent.
“Website des Monats” award
Once a month, for the “Website des Monats” (website of the month) award, I automatically check the publicly available websites of businesses in one sector in Vorarlberg: how the site looks on a phone, whether prices are shown, whether guests can book or send a request. The list of websites comes from OpenStreetMap. I store only the website address and the result of the check, no names, phone numbers or email addresses. The legal basis is legitimate interest (Art. 6(1)(f) GDPR). Only aggregate figures are published. If you do not want your website to be checked, write to me: I will delete the result and stop checking it.
I write to the best by post. A business is named publicly only with its consent, given through the form on the award page. This involves processing the business name, your name and role, your email address or phone number and the code from the letter. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with a short message. A copy of the form reaches me by email; I keep it while the business takes part in the award and for at most three years afterwards as proof of consent.
Phone assistant
In letters to companies I give a phone number that is answered by my digital assistant: a program based on artificial intelligence, not a person. It says so at the start of the call (Art. 50 of the EU AI Act). The assistant answers questions about the draft website, prices and how I work, and takes down your request: your name, your company, what it is about, how you would like to be contacted and, if you give them, your email address, a number to call back or a convenient time for a meeting. This involves processing your phone number (unless you withhold it), the time and length of the call, what you say and its transcript. The legal basis is your request and pre-contractual measures (Art. 6(1)(b) GDPR); if you call about something else, for example to stop receiving my letters, it is my legitimate interest in answering you (Art. 6(1)(f) GDPR).
Calls are received by Twilio Ireland Limited, 78 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland. The conversation is handled by ElevenLabs: Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA. To understand and answer questions, ElevenLabs uses a language model from one of its subprocessors. Both providers process the data on my behalf under data processing agreements (Art. 28 GDPR), including in the USA. Transfers are based on the EU-U.S. Data Privacy Framework or the EU standard contractual clauses. The audio of the call is not recorded or stored. ElevenLabs deletes the transcript and summary automatically after 90 days; I delete the connection data at Twilio (numbers, time, duration) after 90 days at the latest. I receive the summary and transcript by email and keep them as correspondence about your enquiry. On my phone I get only a short notice without your name, number or what was said. Calling is optional: you can just as well write to me by email.
Cookies and browser storage
The site sets no cookies. It stores just one technical value in your browser: the scroll position of the page, so that a reload or the back button returns you to the same spot. The value sits in session storage (sessionStorage), contains no personal data, is never transmitted and is deleted when you close the tab. This storage is strictly necessary for a function you use yourself (§ 165(3) TKG 2021), so no consent banner is needed.
Who receives the data
I do not sell data and do not pass it on for advertising. Access is limited to those without whom the work is impossible: the hosting provider, the email provider, the notification service for draft websites, the booking service, the phone assistant services, the calendar provider, and my tax adviser and public authorities where the law requires it.
How long data is kept
I keep the correspondence about an enquiry while we are in touch and for up to three years afterwards, in case of disputes within the limitation period. Documents connected to payment are kept for seven years, as §132 BAO requires. On request I delete data earlier, unless I am obliged to keep it.
Your rights
You have the right to a copy of your data and to have it corrected, deleted, restricted, transferred in a machine-readable format, and to object to its processing. Consent can be withdrawn at any time. An email to the address above is enough — I reply within a month, free of charge.
Complaints
If you believe I am handling data incorrectly, you can complain to the supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at.
Changes
When new services are added to the site I will update this text and change the version date at the top of the page.