Privacy policy

Controller

The controller within the meaning of Article 4(7) GDPR is:

Ardian Cubreli

[PLACEHOLDER: insert Ardian Cubreli's postal address — street, house number, postal code and city]

Vienna, Austria

No data protection officer has been appointed. Send privacy requests to the phone number or email address above.

Hosting and server logs

The website runs on a server that a hosting provider operates for the controller. The server writes log files when the site is requested. Those logs can include the IP address, date and time, requested address, HTTP status, amount of data transferred, the previously visited page if the browser sends it, and the browser type and operating system.

The application also stores technical error logs on the server. If an error occurs, those logs can include the IP address and the requested address. The logs are not used for advertising and are not combined into usage profiles.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure and stable operation of the website. Log files are kept only for as long as operation, security and troubleshooting require, and are then deleted. The recipient is the hosting provider, acting as a processor.

Cookies and local storage

The public pages set only cookies that are technically required. Consent is not requested for them. The site does not set analytics, marketing or tracking cookies, and it does not use an advertising network.

• Session cookie, wohn360tour-at-session by default: keeps a server-side session, including protection against cross-site requests. The value is encrypted, readable only over HTTP, and lasts 120 minutes. SameSite is Lax.
• XSRF-TOKEN: holds an encrypted security token for application forms. It also lasts 120 minutes, is limited to this website, and is required to operate the site.

The tour viewer and the sign-in and admin pages can store additional functional preferences. The home page does not.

• appearance: remembers light, dark or the system setting for one year. The same value is stored in the browser's local storage under the key appearance. The cookie is set when that application interface loads.
• sidebar_state: remembers, in the admin area and for seven days, whether the sidebar is open. It contains no contact details.

Fonts

The typefaces Inter and Instrument Sans are delivered by this website itself. The font files are fetched from Bunny Fonts when the site is built and are then served from this website's own server. While you view the site, your browser does not contact Google Fonts or Bunny Fonts for them. No personal data is sent to a font provider during a visit.

WhatsApp

Booking requests use a link to https://wa.me/436603968179. The website does not embed a WhatsApp plugin. Merely opening the page therefore sends no data to WhatsApp, and WhatsApp does not set a cookie here. The link can include a prefilled message.

If you open the link, you leave this website. WhatsApp, Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland, then processes data under its own privacy policy, in particular your phone number, the message content and technical metadata. A transfer to the United States can take place. Where the recipient is certified under the EU-US Data Privacy Framework, the transfer relies on the corresponding adequacy decision. Standard contractual clauses under Article 46 GDPR are used as well.

Messages you send are received by the controller at +43 660 3968179. The details you provide are processed, for example your name, phone number and information about the property. The legal basis is Article 6(1)(b) GDPR when the message is about a booking or a pre-contractual request, and otherwise Article 6(1)(f) GDPR in order to reply.

Phone and email

You can call +43 660 3968179 or email ardian.cubreli@gmail.com. The website does not record phone calls. When you call or email, the controller processes the details you provide, in particular your name, phone number, email address and the content of your message, in order to reply and to prepare an appointment.

Email sent to that address is received through Gmail. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google can transfer data to the United States. Where Google LLC is certified under the EU-US Data Privacy Framework, an adequacy decision applies; standard contractual clauses are used as well.

The legal basis is Article 6(1)(b) GDPR for pre-contractual and contractual communication, and Article 6(1)(f) GDPR for other enquiries. You are not legally required to provide data. Without contact details, the controller cannot carry out a tour.

Booking and payment

This website does not embed a booking calendar and does not take card payments. Cal.com is not used. Stripe is not used. Those services receive no data from this website. A booking is made by WhatsApp, phone or email.

If you place an order, the controller processes the details needed for it, such as your contact information, the property address and access notes, together with the 360° photographs, in order to create the tour and keep it available for the agreed period. That period is currently three years of hosting. The tour can be public, private or deleted, as agreed. The legal basis is Article 6(1)(b) GDPR.

Retention

• The session and the security cookies described above: 120 minutes.
• Server and error logs: only for as long as operation, security and troubleshooting require.
• Enquiries that do not become an order: until the enquiry is finished and no further correspondence is expected.
• Order and invoice records: for the term of the contract and afterwards for the statutory retention periods in Austria, generally seven years.

Recipients

Data is not sold. Recipients are the hosting provider for operation and log files, Meta or WhatsApp if you use the booking link, and Google Ireland Limited if you write to the Gmail address above. Authorities receive data only where the law requires it.

Your rights

You have the following rights against the controller. Send a request to the phone number or email address in the Controller section.

• Access to the data being processed, Article 15 GDPR.
• Rectification of inaccurate data, Article 16 GDPR.
• Erasure, Article 17 GDPR.
• Restriction of processing, Article 18 GDPR.
• Data portability, Article 20 GDPR.
• Objection to processing based on Article 6(1)(f) GDPR, Article 21 GDPR.
• Withdrawal of consent for the future, Article 7(3) GDPR, where processing is exceptionally based on consent. The website processing described here is not based on consent.

There is no automated decision-making, including profiling, under Article 22 GDPR.

Complaint to the data protection authority

You can lodge a complaint with the Austrian data protection authority, the Datenschutzbehörde. That does not affect your other rights.

Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, Austria. Phone: +43 1 52 152-0. Email: dsb@dsb.gv.at.