Privacy Policy
Last updated: October 2026
We are committed to protecting the privacy of all our clients. We therefore always comply with the applicable data protection laws when processing personal data, in particular the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).
1. Controller
The controller within the meaning of Art. 4(7) GDPR responsible for the processing of personal data on this website is:
Kristina Hentschel
Giesshübler Str. 117/2
2372 Giesshübl
Austria
E: office@kristinahentschel.de
A data protection officer is not required by law and has not been appointed. For all data protection matters, an informal message to the email address above is sufficient.
2. What this website does not do
- Fonts are delivered from our own server. There is no connection to Google Fonts or similar services.
- Videos are delivered from our own server. No social media plugins, like buttons or videos from third-party providers such as YouTube are embedded.
- There is no advertising and no retargeting. Audience measurement only takes place with your consent (section 3.3).
- There are no user accounts, no newsletter and no online shop.
3. When you visit this website
3.1 Hosting and server log files
This website is hosted by World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, 4020 Linz, Austria. World4You processes the data on our behalf as a processor. The data is processed in Austria.
When you access a page, your browser transmits technically necessary data, which is stored in server log files:
- IP address of the requesting device
- date and time of the request
- page or file accessed
- access status / HTTP status code and amount of data transferred
- previously visited page (referrer), if transmitted
- browser type, browser version and operating system
This data is required to deliver the website and to ensure its stability and security. It is not combined with other data sources.
The legal basis is our legitimate interest in the secure and uninterrupted operation of the website pursuant to Art. 6(1)(f) GDPR. The server log files are deleted after 14 days.
3.2 Cookies and consent
Cookies are small text files that your browser stores on your device. We use technically necessary cookies without consent (Section 165(3) TKG 2021). All other cookies are only set on the basis of consent you have given.
To obtain consent, we use the consent tool Borlabs Cookie. It runs on our own server, and no data is transmitted to its manufacturer. We ask for your consent when you first visit the website. You can change or withdraw your choice at any time here or via the “Consent Settings” link at the bottom of every page.
The following cookies are technically necessary:
| Cookie | Purpose | Storage period |
|---|---|---|
borlabs-cookie | stores your choice in the cookie banner | 183 days |
borlabs-cookie-gcs | passes your choice on to Google Analytics so that it does not set cookies without consent | 183 days |
pll_language | stores the selected language of the website | 1 year |
The legal basis for the Borlabs cookies is our legal obligation to be able to demonstrate consent (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). The legal basis for pll_language is our legitimate interest in displaying the website in the selected language (Art. 6(1)(f) GDPR).
Irrespective of this, you can specify in your browser settings whether and which cookies are accepted, and delete stored cookies.
3.3 Audience measurement with Google Analytics 4
If you consent in the cookie banner, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This shows us how visitors use the website, for example which pages are viewed and for how long. The analysis is aggregated and helps us to improve the website.
The following data in particular is processed:
- pages viewed, date and time, time spent on the page
- referrer (the page you came from)
- device type, browser, operating system, screen resolution
- approximate location (country, region, city), derived from the IP address. Google Analytics 4 does not store the IP address.
The following cookies are set:
| Cookie | Purpose | Storage period |
|---|---|---|
_ga | distinguishes visitors | 2 years |
_ga_QYNH1YW7RN | stores the session state | 2 years |
Google stores the analytics data for 2 months and then deletes it automatically. If you visit the website again, this period starts over.
Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, so an adequacy decision of the European Commission applies to the USA (Art. 45 GDPR). We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). Without consent, Google Analytics is not loaded. You can withdraw your consent at any time with effect for the future via “Consent Settings”.
For more information, see Google’s privacy policy: https://policies.google.com/privacy
4. Contact form and contacting us
You can send us a message using the contact form. In doing so, we process:
- email address (required)
- first name, last name and company (optional)
- your message (optional)
Without an email address, we cannot reply to your enquiry. All other information is optional.
Before submitting, you confirm that you have read this privacy policy and consent to the processing. The legal basis is your consent (Art. 6(1)(a) GDPR). Where your enquiry relates to the conclusion or performance of a contract, the legal basis is additionally Art. 6(1)(b) GDPR. You can withdraw your consent at any time with effect for the future; an informal message to office@kristinahentschel.de is sufficient.
If you contact us by email or phone, we process the information you provide – usually your name, your email address or phone number and the content of your enquiry – in order to respond to your request. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract, otherwise our legitimate interest in responding to enquiries pursuant to Art. 6(1)(f) GDPR.
Enquiries submitted via the form reach us by email. For email, we use Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor. Microsoft may transfer data to Microsoft Corporation in the USA. Microsoft Corporation is certified under the EU-US Data Privacy Framework.
In addition, contact form submissions are stored in our website’s database.
We store your enquiry for as long as necessary to process it and delete it afterwards, unless statutory retention obligations apply. If the enquiry leads to an engagement, section 5 applies.
5. Data of prospective clients, clients and business partners
Independently of visits to the website, we process the data that prospective clients, clients, suppliers or business partners provide to us themselves – for example as part of an enquiry, when concluding a contract or during an ongoing business relationship. This includes first and last name, address, email address, phone number, names of contact persons, VAT identification number, bank details and contract data.
Data is only passed on to third parties where this is necessary for the performance of the contract, where we are legally obliged to do so or where you have consented. We have concluded the required agreements pursuant to Art. 28 GDPR with processors, for example in the areas of accounting, hosting or email.
The legal bases for the processing are:
- Art. 6(1)(b) GDPR for initiating and performing contracts,
- Art. 6(1)(c) GDPR for legal obligations, in particular retention obligations under tax and commercial law,
- Art. 6(1)(f) GDPR for our legitimate interests, such as asserting claims,
- Art. 6(1)(a) GDPR where you have expressly consented.
We delete this data as soon as it is no longer required for the respective purpose and no retention obligations apply. We retain documents relevant for invoicing for seven years in accordance with Section 132 of the Austrian Federal Fiscal Code (BAO). If processing is based on your consent, we delete the data after you withdraw it, unless there are legal reasons to the contrary.
6. Links to external websites
This website links to external sites, for example to reference projects or to LinkedIn. We have no influence on their content or data processing. Data is only transmitted to the respective provider when you click on such a link; from that point on, the provider’s privacy policy applies.
7. No automated decision-making
There is no automated decision-making within the meaning of Art. 22 GDPR and no profiling.
8. Your rights
With regard to your personal data, you have the following rights:
- access to the data processed (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- objection to processing based on a legitimate interest (Art. 21 GDPR)
- withdrawal of consent given, with effect for the future (Art. 7(3) GDPR) – for audience measurement (section 3.3) at any time via “Consent Settings”
For all of this, an informal message to office@kristinahentschel.de or to the contact details given in section 1 is sufficient. If processed data is inaccurate, we will correct it without delay and inform you accordingly.
If you believe that our processing of your data violates data protection law, we would appreciate hearing from you so that we can resolve the matter directly. Irrespective of this, you have the right to lodge a complaint with the supervisory authority:
Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
9. Changes to this privacy policy
We adapt this policy when the website or the underlying processing changes. You will always find the current version on this page; the date at the top shows when it was last updated. We will not restrict your rights under this policy without your express consent.