Privacy Policy

Protecting your data is not an add-on for us; it is part of our profession. This policy explains in plain language which personal data we process when you visit this website or contact us, and which we do not. This English version is provided for convenience; in case of discrepancies the German version prevails: Datenschutzerklärung (Deutsch)

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is Dark Layer e.U., owner Thomas Zraunig, Stephansplatz 8/20, 1010 Vienna, Austria.
Email: [email protected] · Phone: +43 670 6531511
See also our Imprint.

2. In brief

• We set no cookies ourselves and use no analytics or tracking tools, no advertising networks and no social-media plugins.
• Fonts are served from our own server. There is no connection to Google or any other font provider.
• The contact form's security check (Cloudflare Turnstile) is only loaded once you start using the form, not when you merely visit the page.
• We process personal data only when you contact us, plus what is technically necessary to deliver the website.
• There is no automated decision-making and no profiling.

3. Visiting the website

This website is delivered through Cloudflare (Cloudflare Pages, content delivery network, DNS and attack protection). When you visit, Cloudflare processes technically necessary connection data - in particular your IP address, date and time, the requested page, browser and operating-system information (user agent) and encryption details - to deliver the page and protect it against abuse and attacks. We do not keep our own access logs for mere page views.

The legal basis is our legitimate interest in operating the website securely and reliably (Art 6(1)(f) GDPR). Cloudflare acts as our processor (see section 8).

4. Contact form and enquiries

When you use the contact form, we process the information you enter:

• Required: first name, last name, email address.
• Optional: phone number, organisation, service of interest, urgency, how you found us, your message and up to three uploaded files (maximum 10 MB each).

For security reasons we additionally store a pseudonymised hash of your IP address (not the IP address itself), the country derived from your IP address and your browser identifier (user agent). These serve to prevent abuse, for example by limiting the number of submissions, and to investigate security incidents.

Purpose and legal bases

We use your information to answer your enquiry and to take pre-contractual steps (Art 6(1)(b) GDPR). We process the security information on the basis of our legitimate interest in protecting the form against abuse (Art 6(1)(f) GDPR). By ticking the box in the form you confirm that you have noted the confidential handling and agree to the processing.

Please submit only what is necessary for your request. If you disclose special categories of personal data (Art 9 GDPR, e.g. health data), we process them solely on the basis of your explicit consent (Art 9(2)(a) GDPR), which you give by submitting with the box ticked, and only as far as necessary to handle your request.

How it works technically

Your input is transmitted TLS-encrypted and processed by a Cloudflare function running on Cloudflare's global network. The enquiry and files are stored in a Cloudflare R2 storage bucket located in the European Union. We also receive an email notification containing your details and the names of uploaded files (the files themselves are not attached). Resend delivers it; our mailbox is hosted by Proton (see section 8).

Retention

• Enquiry record and uploaded files in Cloudflare storage: automatically deleted after 30 days.
• Security logs (event type, time, IP hash): automatically deleted after 90 days. Abuse-prevention counters: a few hours.
• The notification in our mailbox and our further correspondence with you: for as long as needed to handle your enquiry. If no engagement results, we delete it after 12 months at the latest. If a contract is concluded, we retain contract-relevant records in line with statutory retention duties (generally seven years, § 132 BAO, § 212 UGB).

5. Protecting the form: Cloudflare Turnstile

To protect against automated access (spam, bots) we use Cloudflare Turnstile when the contact form is used. The module is only loaded once you click into or type in the form. Your browser then loads content from challenges.cloudflare.com, and Cloudflare processes your IP address, TLS fingerprint, browser identifier (user agent), our website's identifier and further technical characteristics of your browser to determine whether the request comes from a human. When you submit, the result is confirmed server-side with Cloudflare, which includes your IP address.

Cloudflare acts as our processor for bot detection and, by its own account, as an independent controller to improve its bot detection (Cloudflare Turnstile Privacy Addendum). The legal basis is our legitimate interest in protection against abuse (Art 6(1)(f) GDPR). To the extent information is stored on or read from your device, this is solely to secure the service you expressly requested (the contact form) and only as far as strictly necessary (§ 165(3) Austrian Telecommunications Act 2021).

If you prefer not to, please do not use the form: you can always reach us by email, phone or Signal.

6. Fonts

The fonts used on this website (EB Garamond, Cormorant Garamond, Outfit) are stored locally on our server. No connection to Google or any other provider's servers is made when you load a page.

7. External links

This website links to external sites, for example to sources for studies, the Austrian Economic Chamber's register or the federal legal information system. You only leave our website when you click a link; from then on the provider's own privacy terms apply. We send no referrer information when you click.

8. Recipients and processors

We share data only as far as necessary for the functions described. We have data processing agreements with our service providers under Art 28 GDPR.

Cloudflare, Inc. (USA)

Hosting (Cloudflare Pages), content delivery network, DNS, attack protection, Cloudflare Turnstile, execution of the form function and storage (R2). For transfers to the USA Cloudflare relies on its certification under the EU-US Data Privacy Framework and, as a fallback, on Standard Contractual Clauses. Privacy policy · GDPR information

Resend (USA)

Delivery of the email notification about your enquiry to our mailbox. Processing takes place primarily in the USA; Resend complies with the EU-US Data Privacy Framework and uses Standard Contractual Clauses. Data processing addendum

Proton AG (Switzerland)

Email mailbox for [email protected]. Switzerland benefits from an adequacy decision of the European Commission. Privacy policy

Beyond this, we do not pass data to third parties unless legally required or necessary to establish, exercise or defend legal claims.

9. Communication by email, phone and Signal

If you contact us by email, phone or Signal, we process your details to handle your request (Art 6(1)(b) or (f) GDPR). Ordinary email is not end-to-end encrypted. For confidential content we recommend our public PGP key or Signal (on request). Signal is operated by Signal Messenger, LLC (USA); its own privacy terms apply.

10. Your rights

You have the following rights against us:

• Access to the data we process about you (Art 15 GDPR)
• Rectification of inaccurate data (Art 16 GDPR)
• Erasure (Art 17 GDPR)
• Restriction of processing (Art 18 GDPR)
• Data portability (Art 20 GDPR)
• Objection to processing based on legitimate interests (Art 21 GDPR)
• Withdrawal of consent with effect for the future (Art 7(3) GDPR)

An informal message to [email protected] is sufficient. If you believe the processing of your data infringes data protection law, you may lodge a complaint with the supervisory authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna
Email: [email protected] · Phone: +43 1 52 152-0
dsb.gv.at

You are also free to contact the supervisory authority at your place of residence.

11. Provision of data, automated decisions

Name and email address are required so that we can reply; all other details are optional. There is no automated decision-making, including profiling.

12. Changes

We update this policy when our processing or the legal situation changes. Last updated: 19 October 2026.