Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) is:

Viktor Schöll, Ausstellungsstraße 3, 1020 Vienna, Austria

Email: contact@schoell-v.com

Phone: +436644264425

2. General information about this policy

This privacy policy informs you about the type, scope and purposes of the processing of personal data when visiting and using this website. Personal data means any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR).

This website is password-protected; access is granted exclusively upon request. Content that is not publicly accessible remains protected accordingly.

3. Hosting (Vercel)

This website is hosted by Vercel Inc., 340 N 12th St, Suite 300, Philadelphia, PA 19107, USA (“Vercel”). When you visit the website, Vercel processes technically necessary data such as IP address, time of access, requested resources and browser type (server log files).

The servers are located in the EU (Frankfurt region, fra1). Any transfer to the USA is based on the EU Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework; a data processing agreement has been concluded with Vercel.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and functional operation of the website).

4. Access protection (password protection)

This website is password-protected to prevent unauthorised access. When you unlock it, a session cookie (portfolio_pw) is set that contains an HMAC-signed, cryptographically secured session token and is valid for 30 days (sliding). The cookie is technically necessary and does not contain any personal data.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of the website and its content).

5. Contact form and password request

When you send me messages via the contact form or the password-request form, I process the data you provide (name, email address, message). Transmission is handled by the service web3forms (web3forms.com), which forwards the data to my email address exclusively as a processor.

Legal basis: Art. 6(1)(b) GDPR (processing of your inquiry) and Art. 6(1)(f) GDPR (legitimate interest in communicating with interested parties).

The data is deleted as soon as the purpose of the inquiry has been fulfilled and no statutory retention obligations apply.

6. Appointment booking (Meetergo)

A booking system by Meetergo (meetergo.com) is embedded for scheduling appointments. When the embedded booking form loads, your IP address is transmitted to Meetergo. When you book an appointment, Meetergo processes the data required for this purpose (e.g. name, email address, requested time) as a processor on my instructions.

Legal basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures) and Art. 6(1)(f) GDPR (provision of an appointment scheduler). Meetergo's privacy policy applies to the processing by Meetergo: meetergo.com/en/privacy-policy.

7. Analytics (Umami)

This website uses the privacy-friendly analytics tool Umami (cloud.umami.is). Umami works without cookies and without personal identifiers: only aggregated, pseudonymised usage data is collected (e.g. page views, referrer, device type). Your IP address is not stored.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the website).

8. Local storage (localStorage)

Your theme (light/dark) and language preferences are stored exclusively locally in your browser (localStorage) and are not transmitted to servers.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a user-friendly presentation).

9. Cookies

This website uses no tracking, advertising or analytics cookies. Only a strictly necessary session cookie (portfolio_pw) is set to protect against unauthorised access (see section 4). It contains no personal data and is valid for 30 days (sliding).

The local storage of your theme and language preferences in the browser (localStorage) is not a cookie and is not transmitted to servers.

Since only strictly necessary storage within the meaning of § 165a of the Austrian Telecommunications Act 2021 (TKG) is used, no consent via a cookie banner is required. Should this change, this privacy policy will be updated accordingly.

10. Fonts

All fonts are hosted locally on this website's server. There is no connection to font providers (e.g. Google Fonts); no data is transmitted to third parties.

11. Email contact

If you write to me directly by email, I process your email address and the data contained in your message to handle your inquiry.

Legal basis: Art. 6(1)(b) GDPR.

12. External links

This website links to external services (e.g. LinkedIn, Signal). Clicking these links takes you off this website; the respective provider is the separate controller responsible for the data processing there.

13. Storage duration

Session cookie: 30 days (sliding). Inquiries via form or email: until the request has been dealt with; the data is then deleted unless statutory retention obligations (e.g. tax retention periods) apply.

14. Your rights

You have the following rights: access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing (Art. 21).

Where processing is based on consent, you may withdraw your consent at any time with effect for the future.

You also have the right to lodge a complaint with the competent supervisory authority: Austrian Data Protection Authority (DSB), Barichgasse 40–42, 1030 Vienna, Austria, dsb.gv.at.

15. Security

This website is transmitted exclusively over an encrypted HTTPS connection (TLS).

16. No automated decision-making

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place.

17. Changes and version

I reserve the right to adapt this privacy policy in order to comply with changed legal requirements or changes to the data processing.

Version: August 15, 2026.