← Back to site
EN DE

Privacy Policy of Pixel Adgency OG

Pixel Adgency OG
Schleifmühlgasse 6-8/815
1040 Vienna, Austria
info@pixeladgency.com
+43 660 5620275
VAT ID ATU77551034 · CRN FN567874i

processes personal data as the data controller in the course of its business activities. This policy explains what happens to personal data when you visit this website, and what happens to the data of our clients and business contacts.

1. This website sets no cookies and contacts no third parties

We state this first, because it makes most of what a privacy policy usually has to say unnecessary here.

  • No cookies are set. Not by us, not by our host, not for analytics, not for anything. That is why you have not been asked to accept any.
  • No third-party analytics, no tracking, no advertising pixels. We count visits with a simple counter of our own, described in section 3. It sets no cookie, stores nothing on your device, never keeps your IP address, builds no profile, and cannot follow you to another website or recognise you on another day.
  • Nothing is loaded from another company's servers. Our typefaces, videos, images and scripts are all served from this domain. No Google Fonts, no embedded maps, no embedded social feeds, no video platform.
  • Links to Instagram, LinkedIn, TikTok and map services are ordinary links. Nothing is sent to those companies unless you click one, at which point their own privacy policy applies.

2. Nothing is stored in your browser

This website stores nothing in your browser: no cookies, and nothing in its local or session storage. The little the site needs to remember while you move between pages — for example that the intro animation has already played, or which project the back button should return you to — is kept in the memory of the open page, and is gone as soon as you close or reload it.

3. What we can see from a visit

Like every web server, our host records technical request data: your IP address, the page requested, the date and time, your browser and operating system version, and the page you came from. This is what makes it possible to deliver a page to you at all, and to defend the site against attack and abuse. It is not combined with anything else and not used to identify you.

The legal basis is our legitimate interest in providing a functioning, secure website, Art. 6(1)(f) GDPR.

Our visitor statistics

To see how the site is used — which pages are read, for how long, and how people find us — we run a simple visitor counter of our own. It runs on this domain and on our host, Cloudflare; no analytics company is involved.

For each page view it records: the page address; the date and time; how long the page was visible on your screen, and how far down it you scrolled; the website you came from, as a domain name only, and a campaign name if the link you followed carried one (for example utm_source=newsletter); your country, which Cloudflare derives from the IP address; the type of device (phone, tablet or computer) and the name of your browser and operating system, without version numbers. It also records which of our projects you opened, in a preview or in the phone feed; taps on our email address, phone number, map and social-media links; whether the contact form was sent successfully; and, if you reach an address on our site that does not exist, that address, so that we can fix broken links.

To count visitors rather than page views, it stores a daily visitor code: a one-way cryptographic hash of your IP address and browser identification together with a random value that changes every day. The previous day's random value is deleted, so once a day has ended no one — including us — can trace a code back to an IP address, or match two days' codes to the same person.

What it does not do: it sets no cookie, stores nothing on your device, reads nothing stored on it, never stores your IP address, builds no profile, does not recognise you on a later day or on another website, and combines nothing with other data. We use the results only in aggregate, and only ourselves.

The statistics are kept in a Cloudflare database whose location is restricted to the European Union (see section 4), for 25 months, after which they are deleted automatically.

The legal basis is our legitimate interest in understanding how our website is used, so that we can improve it and see which of our work finds interest, Art. 6(1)(f) GDPR. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, your visit is not counted at all.

4. Hosting

This website is hosted on Cloudflare Pages, and the authoritative DNS for our domain is operated by Cloudflare as well. Both are services of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, which acts as our processor. Delivering the site necessarily means Cloudflare processes the request data described in section 3. DNS resolution itself happens before any connection to this website and is answered to your DNS resolver rather than to you directly.

Our visitor statistics (section 3) run on the same service: the counter is a Cloudflare Pages Function, and its results are stored in a Cloudflare D1 database whose location is restricted to the European Union.

Cloudflare is certified under the EU-U.S. Data Privacy Framework, and their Data Processing Addendum, which incorporates the EU Standard Contractual Clauses, applies to our account. On that basis, data transferred to the USA in the course of hosting is covered by Art. 45 GDPR and, in addition, by Art. 46(2)(c) GDPR.

Cloudflare's own privacy policy: cloudflare.com/privacypolicy

5. The contact form

If you use the contact form, we receive the name, email address, company name and message you enter, along with the services you tick. Name and email are required, because we cannot answer otherwise; everything else is optional.

We use this only to answer your enquiry and to correspond with you about it. The legal basis is Art. 6(1)(b) GDPR for steps taken at your request prior to entering a contract, and our legitimate interest in answering enquiries under Art. 6(1)(f) GDPR. We do not use it for marketing, and we do not pass it to anyone for marketing.

The form is delivered by a third party, and this is the one place your data leaves our own infrastructure. It is operated by Web3Forms (Web3Creative), which acts as our processor under a data processing agreement. Two consequences you should know about:

  • Web3Creative operates from India and runs the service on infrastructure provided by Amazon Web Services, Cloudflare and Hetzner. Transfers outside the EEA are made on the basis of the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR.
  • To filter spam, your IP address and email address may be passed to their spam-prevention subcontractors, CleanTalk and Akismet (a service of Automattic).

Web3Forms retains submission data for a maximum of three years from the date of submission, after which it is deleted automatically. We keep the correspondence itself for as long as described in section 8.

Web3Forms' privacy policy: web3forms.com/privacy

If you would rather not use the form, write to info@pixeladgency.com or call +43 660 5620275. Nothing passes through a third party that way.

6. Client and business-contact data

Beyond website visits, we process the following in the ordinary course of business:

  • name or company name
  • date of birth, or company register number
  • contact person
  • business address
  • contact details, in particular telephone number and email address
  • bank details
  • tax number or VAT ID
  • image and video files provided to us by clients for the performance of a contract, insofar as those contain personal data
  • To provide this website correctly, in a user-friendly manner and securely — Art. 6(1)(f) GDPR, our legitimate interest.
  • To produce visitor statistics about how this website is used (section 3) — Art. 6(1)(f) GDPR, our legitimate interest.
  • To handle and answer enquiries, and to correspond with prospective clients, clients and other contacts — Art. 6(1)(f) GDPR, and Art. 6(1)(b) GDPR where the enquiry concerns a possible contract.
  • To enter into and perform a contract — Art. 6(1)(b) GDPR.
  • To assert, exercise or defend legal claims — Art. 6(1)(f) GDPR.
  • To meet legal obligations, such as invoicing and statutory retention under tax and commercial law — Art. 6(1)(c) GDPR.

We do not process any data on the basis of consent, because nothing on this site asks for any.

8. How long data is kept

  • Website request data: for the short period our host keeps its logs, for delivery and security.
  • Visitor statistics (section 3): 25 months, then deleted automatically. A daily visitor code can no longer be traced to anyone once its day has ended.
  • Enquiries: until the enquiry has been dealt with conclusively, and thereafter for as long as the statutory limitation periods for possible claims require.
  • Contract and pre-contract data: until the end of the business relationship, and beyond that where the law requires it, in particular for tax retention obligations.
  • Form submissions held by Web3Forms: a maximum of three years, then deleted automatically.

9. Who else receives data

  • Our host, Cloudflare, as described in section 4, including for the visitor statistics.
  • The form provider, Web3Forms, as described in section 5.
  • Service providers we use to perform a contract — for example cloud, hosting or storage providers, providers of software including AI-assisted tools, and payment service providers.
  • Tax advisors, lawyers, authorities and courts, to meet legal obligations and to enforce or defend legal claims.

Where a recipient processes data on our behalf, we put a data processing agreement in place under Art. 28 GDPR. We do not sell personal data, and we do not share it for anyone else's marketing.

10. Transfers outside the EU

Where we work with partners outside the European Union to fulfil pre-contractual or contractual obligations, personal data may be transferred to those countries. Such transfers are made on the basis of an adequacy decision under Art. 45 GDPR, or on the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR. The two transfers that arise from this website itself are named in sections 4 and 5.

11. Automated decision-making

We do not use your data for automated decision-making or profiling.

12. Your rights

Insofar as we process your data, you have:

  • the right of access — Art. 15 GDPR
  • the right to rectification — Art. 16 GDPR
  • the right to erasure — Art. 17 GDPR
  • the right to restriction of processing — Art. 18 GDPR
  • the right to data portability — Art. 20 GDPR
  • the right to object — Art. 21 GDPR. Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your situation. If you object to direct marketing we will stop immediately; otherwise we will weigh the interests involved. You can object to the visitor statistics without writing to us: set your browser to send "Do Not Track" or "Global Privacy Control", and visits from that browser are not counted.
  • the right to lodge a complaint — Art. 77 GDPR, with the Austrian Data Protection Authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at

There is no right to withdraw consent listed here, because we do not rely on consent for anything.

Please use the contact details at the top of this policy to exercise any of these rights.

13. Changes to this policy

We will update this policy if the site changes in a way that affects it — for example if a cookie, an embedded service or a different host were ever introduced, or if our visitor statistics changed. The date below says which version you are reading.

As of: September 2026

© Pixel Adgency OG — All rights reserved