Privacy policy

Information under Art. 13 and 14 GDPR

1 · Controller

The controller for data processing on this website is:

Until the formation is complete, Lucas Duch acts as a natural person; he is therefore also the controller within the meaning of the GDPR.

For any data protection question, an informal email to the address above is enough. A data protection officer is not required by law and none has been appointed.

2 · General principles

Protecting your personal data matters to us. We process your data solely on the basis of the applicable law (GDPR, Austrian Telecommunications Act 2021, Austrian Data Protection Act). This policy tells you which data we process and for what purpose.

You can visit our website without giving any personal details. Personal data is only collected when you actively send it to us — for instance through a form.

3 · Hosting and server logs

This website is hosted by easyname GmbH (Canettistraße 5/10, 1100 Vienna, Austria). The servers are located in the European Union. When the site is accessed, technically necessary data is automatically recorded in server logs:

• truncated IP address
• date and time of access
• page requested and amount of data transferred
• browser type, operating system and referring page

This processing is necessary to operate and secure the website. Legal basis: legitimate interest under Art. 6(1)(f) GDPR. A data processing agreement is in place with easyname. No transfer to third countries takes place.

4 · Contact and enquiry forms

If you contact us through a form, we process the data you provide:

Your enquiry is received on our own server in Austria (easyname GmbH, Vienna) and forwarded from there to our mailbox by email. No third-party provider is involved. For traceability, the enquiry is additionally stored in a file on the same server so that it is not lost if email delivery fails.

If our server does not respond, a prepared message to us opens in your email program. You then decide yourself whether to send it; in that case the data goes directly from your mailbox to ours. No third-party service is involved.

To protect against automated mass submissions, the form contains a field that is invisible to you and measures how long it takes to fill in. In addition, for one hour we store a one-way hash of your IP address, in order to limit the number of enquiries per sender. The IP address itself is not stored.

Legal basis: your consent under Art. 6(1)(a) GDPR (confirmed by ticking the box) and pre-contractual steps under Art. 6(1)(b) GDPR. You can withdraw your consent at any time by informal email.

5 · Newsletter

If you sign up for our newsletter, we store your email address and — if given — your name on our own server. No service provider is involved; your address does not leave our server.

Confirmation procedure (double opt-in). After signing up you receive an email with a confirmation link. Only when you click it are you subscribed. If you do not click it, your address is automatically deleted after 14 days. This procedure ensures that nobody can sign up somebody else's address.

What we store as proof. The time and IP address of the sign-up and of the confirmation. This is the proof of your consent — without it we could not show, in a dispute, that the sign-up came from you.

Unsubscribing. Every newsletter email contains an unsubscribe link. One click is enough; your entry is deleted, not merely marked as unsubscribed. We do not keep a list of former recipients.

Legal basis: your consent under Art. 6(1)(a) GDPR in conjunction with § 107 of the Austrian Telecommunications Act. You can withdraw it at any time.

6 · Event configurator

The event configurator runs entirely in your browser. Your entries — guest count, stage dimensions, equipment selection and room dimensions — are not transmitted to us unless you send an enquiry.

The PDF is likewise generated locally in your browser. The library needed for it, jsPDF , has been hosted on our own server since September 2026 and is loaded from there. Nothing is transmitted to third parties.

Only when you fill in and send the enquiry form is the configuration transmitted to us together with your contact details (see section 4).

7 · Internal planning area and client portal

At eventfuchs.com/studio we operate a password-protected, non-public area for the technical planning of events. The area is linked in the footer of our website but blocked for search engines. Without login details nothing there can be viewed.

Two groups have access: the accounts we use for our own planning, and clients for whom we set up an account for their project. Clients see only the projects assigned to them and released by us — no other projects, no costings, no purchase prices.

What we store for a project: name, client, contact person including contact details, venue, date, internal notes and the technical plan itself. Added to this are documents uploaded by us or by the client, comments on plans, appointments including acceptance or refusal, and notes and minutes from meetings.

In this context we send e-mails to clients: proposed dates with a calendar file to add to their diary, minutes after a meeting, and invitation and password-reset links. These are sent via the mail server of our host in Austria.

Release via a link: On request we release a plan via an unguessable link that can be opened without logging in. Whoever has this link sees the released plan. The link can be withdrawn and reissued at any time; it expires on a date set by us.

All of this data is held in a database on the same server that runs this website — with our host in Austria. It is not passed on to third parties.

Legal basis: performance of a contract or pre-contractual steps under Art. 6(1)(b) GDPR; for prospective customers, our legitimate interest in preparing quotes in an orderly way under Art. 6(1)(f) GDPR.

Retention: Project data is kept for the duration of the business relationship and then deleted within the statutory retention periods (seven years under § 132 BAO). For each project we store up to 60 intermediate versions of the plan so that we can return to an earlier state of work. In addition we create a daily backup of the database; we keep 14 daily copies and 6 monthly copies. Deleted data may therefore still be contained in a backup for up to six months, until that backup expires in the normal rotation.

Access is protected by username and password; the password is stored only as a one-way hash. After several failed attempts, access is temporarily locked.

For password resets we store an e-mail address for every account — for our own accounts just as for client accounts. If a new password is requested, we send from the address duch@eventfuchs.com via the mail server of our host in Austria a link that expires after 60 minutes.

8 · Analytics with Google Analytics

We use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). We use it to see how our website is used — for instance which pages are opened and where visitors leave the configurator.

Cookies are set and usage data is processed in pseudonymised form. The IP address is truncated by Google. There is no merging with other data and no identification of individual people.

Legal basis: your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time by deleting cookies in your browser or by installing the browser add-on to opt out of Google Analytics.

9 · External services and fonts

None are loaded. Fonts, styling and all program libraries are on our own server. When this website is opened, your IP address is not transmitted to any third party.

Until September 2026 this was different: the fonts came from Google and the PDF library from Cloudflare. Both have been changed.

The only remaining exception is Google Analytics — and only after you have given your consent in the cookie notice (see section 7).

10 · Retention periods

• Newsletter: until you unsubscribe; unconfirmed sign-ups 14 days
• Server logs: as a rule 30 days
• Enquiries: until fully dealt with, then until the statutory retention periods expire (up to seven years for tax purposes)
• Analytics data: at most 14 months
• Configurator data: not stored at all unless an enquiry is sent
• Project and portal data: duration of the business relationship, then until statutory retention periods expire (seven years under § 132 BAO)
• Backups: 14 daily copies and 6 monthly copies; deleted data remains in them until the relevant backup expires

11 · Your rights

You have the following rights:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to the processing (Art. 21 GDPR)
• Withdrawal of a consent already given, with effect for the future

An informal email to duch@eventfuchs.com is enough. We reply within one month.

12 · Right to complain

If you believe that the processing of your data infringes data protection law, you can complain to the supervisory authority:

Last updated: