Privacy policy
Last updated: 13.01.2026
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation; “GDPR”), the person responsible must inform the person concerned about the processing of personal data. With this document, we inform you about the personal data processed.
Definitions
To make this privacy policy easier to understand, you will find a brief explanation of the terms used below.
Personal data (“data”) is all data that contains information about personal or factual circumstances of natural persons, such as name, address, email address, telephone number, date of birth, age, gender, social security number, video recordings, photos, etc. Data from legal entities is not subject to the provisions of the GDPR.
Processing is any process or series of processes carried out with or without the aid of automated processes in connection with personal data, such as collecting, organizing, storing, adapting or modifying, reading, querying, using, disclosing through transmission, dissemination or any other form of provision, reconciliation or linking, restriction, deletion or destruction.
The controller is the natural or legal person, authority, agency or other body which alone or together with others decides on the purposes and means of processing personal data.
Contract processor is a natural or legal person, authority, agency or other body that processes personal data on behalf of the person responsible.
Recipient is a natural or legal person, authority, agency or other body to which personal data is disclosed, regardless of whether it is a third party or not
Our contact details
If you have any further questions, we, as the person responsible for the data processing discussed herein, will be happy to answer them using the following contact details:
Kunsthof Scott-Moser
Ulrike Moser & Gus M. Scott
Dreihäusergasse 16, 2345 Brunn am Gebirge
Phone number: +43 650 651 84 08
Email: kunsthof@gmx.at
Purposes and legal basis of processing
Data may only be processed for a specific purpose and only if the processing can be based on an appropriate legal basis. Processing may be justified for the following reasons:
We process your data for the following purposes based on the following legal bases:
Transceivers
Recipients assist us in complying with legal or legal obligations, in initiating and fulfilling contracts, with services that require your consent, or in carrying out processing that is in our legitimate interest. We transfer or disclose some of the data to the following recipients (order processors or responsible persons) in particular:
We will only transfer your data to other recipients if you have given your express consent in accordance with Article 6 (1) (a) GDPR, this is legally permitted and is necessary in accordance with Article 6 (1) (b) GDPR to fulfill a contractual relationship with you, or if we have a legal obligation to do so under Article 6 (1) (f) GDPR to protect our legitimate interests and to assert, exercise or defend legal claims is necessary and there is no reason to It is assumed that you have an overriding legitimate interest in not sharing your data.
We intend to transfer the data to the following third countries: United States of America.
There is an adequacy decision from the European Commission for the United States of America. By decision of 10.07.2023, the European Commission has C (2023) 4745 final decided that the United States of America offers an adequate level of data protection within the meaning of Art 45 GDPR when our contractual partner enters the List of the EU/US data protection framework is registered. Information on how to add individual providers to this list can be found in the respective section of this privacy policy.
Unless there is an adequacy decision, we may only transfer data on the basis of appropriate guarantees, such as standard contractual clauses, binding internal data protection regulations, approved codes of conduct, approved certification mechanisms, etc. Under the conditions of Art 49 GDPR, a transfer may still be permitted. We will be happy to provide you with a copy of these guarantees for your particular case upon request.
There is no intention to transfer the data to an international organization.
Storage period
In principle, data is only stored for as long as is necessary due to legal storage obligations. In addition, storage may take place if this is necessary to enforce or defend claims by third parties. Important storage periods can be found below:
Webflow
The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter Webflow). When you visit our website, Webflow collects various log files, including your IP addresses.
Webflow is a tool for building and hosting websites. Webflow stores cookies or other recognition technologies that are necessary to display the page, to provide certain website functions and to ensure security (necessary cookies).
For details, see Webflow's privacy policy: https://webflow.com/legal/eu-privacy-policy.
Webflow is used on the basis of Art. 6 para. 1 lit. f DSGVO. We have a legitimate interest in presenting our website as reliably as possible. If a corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a DSGVO and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TTDSG. The consent can be withdrawn at any time.
Data transmission to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://webflow.com/legal/eu-privacy-policy.
The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA, which is intended to ensure compliance with European data protection standards when processing data in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. For more information, please contact the provider at the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000TT9jAAG&status=Active
Fonts
We use external fonts on our website, in particular Google Fonts, to present our content in a visually appealing and user-friendly way. These fonts are loaded directly from servers of the respective provider (in the case of Google Fonts from Google servers).
Your IP address is transmitted to the provider's server (e.g. Google in the USA) in order to correctly deliver the fonts to your browser. The provider could use this information to analyze font usage or improve its own services.
The use of these external fonts serves our legitimate interest in a uniform and appealing presentation of our online offering (Art. 6 para. 1 lit. f DSGVO). Data transfer to third countries such as the USA is based on the standard contractual clauses of the EU Commission.
For more information about data processing by Google, please see Google's privacy policy: https://policies.google.com/privacy
World4You
We use the web hosting provider World4You for our website. The service provider is the Austrian company World4You Internet Services GmbH, Hafenstraße 35, 4020 Linz, Austria.
You can find out more about the data that is processed through the use of World4You in the privacy policy at https://www.world4you.com/de/unternehmen/datenschutzerklaerung.html.
Services from Google
General
The provider of the following services is Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland. Google's privacy policy can be found here.
However, some services (such as Google Search or Google Maps) are provided by or transmitted to the following company: Google LLC, 1600 Amphitheatre Pkwy, Mountain View, California 94043-1351, USA Google LLC is based in a third country. Google LLC is on the list, meaning that data transfer to the USA is data protection compliant within the meaning of Art 45 GDPR. For more information about Google LLC certification, please here.
Some Google services use cookies. An overview of the cookies used, their purpose and storage period can be found in the cookie section of this privacy policy. For the use of Google services and the setting of the necessary cookies, your consent in accordance with Article 6 (1) (a) GDPR or Section 165 (3) TKG is obtained before processing. Your consent can be freely withdrawn at any time.
Prior consent is not obtained for cookies unless the sole purpose is to transmit a message or if this is absolutely necessary so that we can provide you with a service that you have expressly requested.
Google Ads
We use Google Ads (formerly Google AdWords) as an online marketing measure to promote our products and services.
Google Ads is used to better analyze user actions. When you click on one of our Google ads, the “Conversion” cookie from a Google domain is stored on your device.
We also use Google Ad Remarketing for our website.
The main cookies used in this context are:
Google Tag Manager
We use Google Tag Manager as an organizational tool with which we can manage website tags centrally and via a user interface. For example, tags are used to record your activities on our website. The tags mostly come from Google products such as Google Ads or Google Analytics.
With Google Tag Manager, no cookies are set and no data is stored. Instead, he acts as an administrator of the tags implemented in the system. The data is captured by the web analysis tools tags. In this sense, the data is sent through to the individual tracking tools and is not stored.
Google Analytics
Nature and purpose of processing
This website uses Google Analytics, a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
The service is used to analyze website usage and to continuously optimize our offerings. With the help of the statistics obtained, we can improve our offer and make it more interesting for you as a user.
Google Analytics uses so-called “cookies” (see section $” $Cookies$ “$), which are stored on your device and enable an analysis of your use of the website.
Categories of processed data
In particular, the following data is processed as part of Google Analytics:
IP address (is immediately pseudonymized by activating IP anonymization so that it is no longer possible to clearly identify the user).
The date and time of the website visit.
Pages visited and clicks.
Information about your device (browser, operating system, screen resolution).
Source of origin (from which website you came to us).
Metadata (e.g. geographical region, language setting).
Legal basis and consent (Austria)
The processing of data and the setting of cookies is carried out exclusively on the basis of your express and informed consent in the sense of:
Art. 6 para. 1 lit. a GDPR (consent)
Section 165 (3) TKG 2021 (consent for cookies that are not technically necessary and access to information on the device)
Your consent is obtained via our cookie management tool before loading the Google Analytics scripts.
Storage period
The data collected by Google Analytics and linked to cookies is automatically deleted after 14 months. The maximum lifespan of Google Analytics cookies is 2 years.
Third country transfer to the USA
By using Google Analytics, the collected data is usually transferred to Google LLC servers in the USA and stored there. The USA is considered a so-called third country outside the European Economic Area (EEA).
Guarantees:
The transfer is based on the EU-U.S. Data Privacy Framework (DPF), as Google LLC is certified under this framework and is therefore committed to maintaining an appropriate level of European data protection.
Residual risk:
Notwithstanding these guarantees, we would like to point out that the transfer to the USA involves a residual risk, as US security laws (such as the Cloud Act or FISA 702) can potentially give US authorities access to the data without the same effective remedies available to you as a data subject in the EU as under the GDPR. With your consent, you accept this risk.
Meta services
Meta Business Tools
Within our online offering, we use Meta Business Tools, which are operated and provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, (“Meta”).
The following processing operations are carried out exclusively on the basis of your express consent in accordance with Art. 6 para. 1 lit. a GDPR.
Meta Pixel
Meta pixel is a code that loads a collection of functions with which Meta can track its user actions on our website. The meta pixel can save your actions on our website in one or more cookies. For more information about Meta Pixel, see link. We also use custom audiences. You can find more information about this here.
The pixel collects information such as your IP address and user ID and compares this with the data from your Facebook account.
Meta uses different cookies depending on interaction and user behavior. For example, the following cookies are used:
Cookies
Cookies are text files that are stored on your device to recognize it. Cookies can contain information about the use of our offers and services. For cookies, due to the Judgment of the ECJ Planet49 GmbH, obtained consent even if the cookies are not personal.
Some of the cookies used are only stored until you close our website again (session cookies), whereas certain cookies are stored for a longer period of time and you can be recognized (persistent cookies). Some cookies are absolutely necessary for the website to function (essential cookies), others record visits and origin of the visitor and measure this data without the cookies being able to identify you (performance cookies). Certain cookies are used for marketing purposes (marketing cookies).
Insofar as personal data is also processed by individual cookies used by us, processing is carried out in accordance with Art. 6 para. 1 lit. b DSGVO either to execute the contract, in accordance with Art. 6 para. 1 lit. a GDPR if consent has been given or in accordance with Art. 6 para. 1 lit. f GDPR to protect our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the user experience.
The cookie statement when you visit the website for the first time allows you to select which cookies you want to allow. Marketing cookies require your consent. If you want to withdraw your consent or change your cookie settings, you can make this change directly in your browser.
Legal notice
Right to information
You have the right to request confirmation as to whether personal data is being processed; if this is the case, you have the right to information about this personal data. The following information is collected: the purposes of processing; the categories of personal data; the recipients or categories of recipients; if possible, the planned period for which the personal data will be stored or, if this is not possible, the criteria for determining this period; the existence of a right to correct or delete the relevant personal data or to restrict processing by the controller or a right to object to this processing; the existence of a Right to lodge a complaint with a supervisory authority; all available information about the origin of the data; the existence of automated decision-making, including profiling.
Right to rectification
You have the right to request that the person responsible correct incorrect and complete incomplete personal data.
Right to delete
You have the right to request that the person responsible delete personal data immediately, provided that one of the following reasons applies: The personal data is no longer necessary for the purposes for which it was collected. You withdraw your consent on which the processing was based and there is no other legal basis for processing. You object to processing (Article 21 (1) GDPR) and there are no legitimate reasons for processing or you object to processing in accordance with Article 21 (2) GDPR. The personal data was processed unlawfully. The deletion of personal data is necessary to fulfill a legal obligation. The personal data were collected in relation to information society services offered in accordance with Article 8 (1). The right to deletion does not exist insofar as processing is necessary to exercise the right to freedom of expression and information; to fulfill a legal obligation, to perform a task that is in the public interest; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes to assert, exercise or defend legal claims.
Right to restrict processing
You have the right to request the restriction of processing if one of the following conditions is met: the accuracy of the personal data is disputed for a period of time which enables the person responsible to verify the accuracy of the personal data; the processing is unlawful and you refuse to delete the personal data and instead request the restriction of the use of the personal data; the controller no longer needs the personal data, but you do it to assert, exercise or defend legal claims; you have filed an objection to processing in accordance with Article 21 paragraph 1 as long as it is not yet clear whether the legitimate reasons of the person responsible prevail.
If processing has been restricted, this personal data — apart from storage — may only be processed with your consent or to assert, exercise or defend legal claims or to protect the rights of another natural or legal person or for reasons of important public interest.
Right to data portability
You have the right to receive the personal data that you have provided to a controller in a structured, common and machine-readable format, and you have the right to transfer this data to another person responsible without hindrance from the person responsible to whom the personal data has been provided, provided that the processing is based on consent or on a contract and the processing is carried out using automated procedures.
When exercising the right to data portability, you have the right to have the personal data transmitted directly from one person responsible to another person responsible, insofar as this is technically feasible.
Right to object
For reasons arising from your particular situation, you have the right to object at any time to the processing of personal data carried out on the basis of Article 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions. The controller will no longer process the personal data unless he can prove compelling legitimate grounds for processing which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct marketing.
Right to withdraw consent
You have the right to withdraw consent based on Article 6 (1) (a) or Article 9 (2) (a) at any time without affecting the lawfulness of processing up to the time of withdrawal.
Right to lodge a complaint
You have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, T.: 00431521522569, E.: dsb@gsb.gv.at if you believe that the processing violates applicable data protection law.
Other information
The provision of personal data is sometimes required by law or necessary for the conclusion of a contract. In principle, you are not required to provide the data. If you do not provide the data, it is not possible to conclude a contract.
There is no automated decision-making, including profiling, in accordance with Article 22 paragraphs 1 and 4.