1. Person Responsible
Responsible for data processing on this website:
Madelines Studio e.U.
Veste Rohr 2e
2500 Baden
Austria
E-Mail: hi@madelines.at
Telephone number: +43 660 495 1204
2. Collection and Storage of Personal Data, Purpose, and Legal Basis of Processing
2.1 Visiting the Website
When you visit our website, information such as your IP address, browser type, operating system, referrer URL, and the date and time of your request is automatically collected by our web server.
Purpose of Processing: Ensuring a smooth connection to the website, guaranteeing system security and stability, and for administrative purposes.
Legal Basis: Art. 6(1)(f) GDPR (legitimate interest) in the security and functionality of the website.
2.2 Contact via Email or Contact Form
When you contact us via email or the contact form, your name, email address, and the content of your message will be processed.
Purpose of Processing: Handling and responding to your inquiry.
Legal Basis: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures) if your inquiry is related to fulfilling a contract; otherwise, Art. 6(1)(f) GDPR (legitimate interest) in efficiently handling inquiries.
2.3 Appointment Booking via Calendly
We use Calendly for appointment scheduling. When you book an appointment via Calendly, your contact information (name, email address) and appointment preferences are processed. Calendly is a service provided by Calendly LLC, 1315 Peachtree St NE, Atlanta, GA 30309, USA.
Purpose of Processing: Organizing and managing appointment requests.
Legal Basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest) in efficient appointment management.
Data Transfer to Third Countries:
Since Calendly is based in the USA, your data may be transferred there. This transfer is based on Standard Contractual Clauses pursuant to Art. 46(2) GDPR to ensure an adequate level of data protection. For more information, please refer to Calendly’s Privacy Policy.
2.4 Social Media Management Processing
If you use our Social Media Management services, we process the personal data required to provide these services (e.g., platform login data, content for posts). We use Hootsuite (Hootsuite Inc., 111 East 5th Avenue, Vancouver, BC V5T 4L1, Canada) to plan and manage social media content.
Purpose of Processing: Planning, creating, publishing social media content, and performance analysis.
Legal Basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest) in optimizing our services.
Data Transfer to Third Countries:
Since Hootsuite is based in Canada, data processing occurs in a country recognized by the EU as providing an adequate level of data protection under Art. 45 GDPR. For more information, please refer to Hootsuite’s Privacy Policy.
2.5 Presentation of Client Projects on Website and Social Media
We publish references and client projects on our website and social media platforms (e.g., Instagram, Facebook) to showcase our portfolio. This may include personal data such as company names, logos, or other identifiable content.
Purpose of Processing: Showcasing our work for marketing purposes.
Legal Basis: Art. 6(1)(a) GDPR (consent). You may withdraw your consent at any time.
3. Recipients of Personal Data
Personal data will only be disclosed to third parties if legally permitted or with your consent. Recipients of data may include:
* IT and hosting service providers (for providing and maintaining our website)
* Calendly LLC (for appointment scheduling)
* Hootsuite Inc. (for social media management)
* Social media platforms (e.g., Meta/Facebook, Instagram) for content publication,
* Legal advisors or authorities to fulfill legal obligations.
Data Transfer to Third Countries:
If personal data is transferred to third countries outside the EU (e.g., through the use of Calendly or social media platforms), this will only occur if an adequate level of data protection is ensured:
* Adequacy decisions by the EU Commission under Art. 45 GDPR
* Standard Contractual Clauses under Art. 46(2) GDPR, or
* Your explicit consent under Art. 49 GDPR
4. Retention Period of Personal Data
We retain personal data only as long as necessary to fulfill the purposes mentioned above or as required by law.
Inquiry data (contact forms, emails):
Deleted after the inquiry is completed unless legal retention obligations exist.
Contract-related data:
Stored for the duration of legal retention periods (e.g., 7 years under § 132 BAO for tax-relevant documents).
Appointment data via Calendly:
Deleted after the appointment unless further storage is required for contract performance.
Social media data:
Deleted when the processing purpose ceases or upon withdrawal of consent.
5. Data Subject Rights
You have the right to:
* Access your stored personal data
* Rectify incorrect data
* Delete your data (unless legal retention obligations apply)
* Restrict processing
* Data portability in a structured, commonly used, and machine-readable format (Art. 20 GDPR)
* Object to the processing of your data (Art. 21 GDPR).
If the processing is based on consent (Art. 6(1)(a) GDPR), you have the right to withdraw your consent at any time without affecting the legality of processing carried out prior to the withdrawal.
6. Right to Lodge a Complaint with the Supervisory Authority
If you believe that your data is being processed in violation of data protection laws, you have the right to lodge a complaint with the relevant supervisory authority.
In Austria, this is the
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Email: dsb@dsb.gv.at
7. Provision of Data
Providing your personal data is voluntary; however, failure to provide data may result in the inability to use certain services (e.g., appointment booking, contact).
8. Data Security
To protect your data, we use technical and organizational security measures (e.g., SSL encryption) to securely transmit confidential content.