GENERAL INFORMATION

Protecting your personal data is important to us. We process your data exclusively on the basis of the applicable legal provisions, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). This privacy policy explains which personal data we process when you visit our website or contact us, for what purposes, on what legal basis and for how long.

DATA CONTROLLER

The entity responsible for processing your personal data is: Made in May Creative Studio e.U. Mag. Katharina-Anna Goetzendorfer, Apollogasse 7/6, 1070 Vienna Austria, hello@madeinmay.studio, +43 670 703 51 60

COLLECTION AND PROCESSING
OF PERSONAL DATA

When you visit our website, the following data is automatically collected: IP address of your device (anonymized), date and time of access, browser used and operating system, visited pages, referrer URL (previously visited page) These data are stored anonymously and used for statistical analysis and improvement of our web offer.

HOSTING

Our website is hosted by Webflow, Inc., 398 11th Street, Floor 2, San Francisco, CA 94103, USA ("Webflow"). When you visit our website, Webflow automatically processes technical data that your browser transmits, in particular your IP address, date and time of access, the pages visited, the referrer URL, browser type and operating system.Purpose: providing the website, ensuring its stability and security, and detecting misuse.Legal basis: our legitimate interest in the secure and reliable operation of our website (Art 6(1)(f) GDPR). Retention: log data is stored by Webflow for up to one year and then deleted. We have concluded a data processing agreement with Webflow under Art 28 GDPR. Data may be transferred to the USA; see Section 12.

COOKIES

Our website uses cookies and similar technologies. Cookies that are strictly necessary for the operation of the website (for example, to store your cookie choice) are set without consent (§ 165(3) TKG 2021; Art 6(1)(f) GDPR). All other cookies and services, in particular analytics and embedded videos, are only activated after you have given your consent via our cookie banner (§ 165(3) TKG 2021; Art 6(1)(a) GDPR). You can change or withdraw your consent at any time with future effect via the "Cookie settings" link in the footer of our website. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. An overview of the cookies used, their purpose and storage period is available in the cookie settings.

GOOGLE ANALYTICS

With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google). Google Analytics uses cookies to analyse how our website is used, for example which pages are visited and for how long, and the device, browser and approximate location (country or city). According to Google, Google Analytics 4 does not log or store IP addresses. We have disabled Google Signals and the collection of granular location and device data, and set the data retention period to two months.Legal basis: your consent (§ 165(3) TKG 2021; Art 6(1)(a) GDPR).Withdrawal: at any time via Cookie settings".Transfer: data may be transferred to Google LLC in the USA; see Section 12. Data processing terms: the Google Ads Data Processing Terms apply. Further information: https://policies.google.com/privacy tools.google.com/dlpage/gaoptout.

CONTACT BY FORM, EMAIL OR PHONE

If you contact us via the contact form, by email or by phone, we process the data you provide (such as name, email address, company, phone number and the content of your message) in order to handle your enquiry. Legal basis: the preparation or performance of a contract where your enquiry relates to one (Art 6(1)(b) GDPR); otherwise our legitimate interest in responding to enquiries (Art 6(1)(f) GDPR). Retention: we delete enquiries on request. Recipients: form entries are processed by Webflow (see Section 3). Our email service is Microsoft Outlook, provided via GoDaddy (Microsoft Ireland Operations Limited, Ireland / Microsoft Corporation, USA; GoDaddy Operating Company, LLC, USA).

NEWSLETTER

You can subscribe to our newsletter on our website. The only required information is your email address. Your first name is optional and is used to personalise the newsletter.We use the double opt-in procedure: after you subscribe, you receive an email with a link to confirm your subscription. We record the time of subscription and confirmation, and your IP address, in order to be able to prove your consent.Legal basis: your consent (Art 6(1)(a) GDPR; § 174 TKG 2021). Withdrawal: you can unsubscribe at any time via the link in every newsletter or by email to hello@madeinmay.studio. Retention: we store your data until you unsubscribe, and the proof of consent for up to three years thereafter.Service provider: [name, legal entity and address of the newsletter tool, e.g. Mailchimp: The Rocket Science Group, LLC (Intuit Inc.), USA]. We have concluded a data processing agreement with this provider. Transfer: see Section Retention

SOCIAL MEDIA

Links: our website contains simple links to our profiles on Instagram and LinkedIn. No data is transmitted to these platforms when you visit our website. Data is only transmitted when you click a link and are forwarded to the platform.Our profiles: we maintain company profiles on Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) and LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). When you visit these profiles, the respective platform processes your data under its own responsibility. For the statistics the platforms provide to us about our profiles, we and the platform are joint controllers (Art 26 GDPR). The platforms have agreed to take primary responsibility for this processing and for the rights of data subjects. Legal basis: our legitimate interest in presenting our work (Art 6(1)(f) GDPR). Further information: Instagram: https://privacycenter.instagram.com; LinkedIn: https://www.linkedin.com/legal/privacy-policy

EMBEDDED VIDEOS

We host and embed our videos using Cloudflare Stream, a service provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare). When you play a video, your browser connects to Cloudflare's servers. In doing so, Cloudflare processes technical data, in particular your IP address, the page visited, and information about your browser and device, in order to deliver the video and to protect the service against misuse. Cloudflare processes this data on our behalf on the basis of a data processing agreement under Art 28 GDPR. The video player does not set cookies for tracking or advertising purposes. Legal basis: our legitimate interest in presenting our work in a technically reliable and secure way (Art 6(1)(f) GDPR). Transfer: data may be transferred to the USA; see Section 12. Further information: https://www.cloudflare.com/privacypolicy/

TRANSFER TO THIRD COUNTRIES

Some of our service providers are located in the USA or process data there. For US companies certified under the EU-US Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission of 10 July 2023 (Art 45 GDPR). Otherwise, the transfer is based on the Standard Contractual Clauses of the European Commission (Art 46(2)(c) GDPR), supplemented by additional safeguards where necessary.

RETENTION

We store personal data only for as long as is necessary for the respective purpose, or as long as statutory retention obligations require (in particular seven years under § 132 BAO). The specific retention periods are stated in the respective sections.

YOUR RIGHTS

Under the GDPR you have the right to: access your personal data (Art 15), rectification (Art 16), erasure (Art 17), restriction of processing (Art 18), data portability (Art 20), object to processing based on legitimate interests (Art 21), withdraw your consent at any time with future effect (Art 7(3)). To exercise your rights, please contact us at hello@madeinmay.studio. We will respond within one month.If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority (Oesterreichische Datenschutzbehoerde), Barichgasse, 1030 Vienna, Austria, www.dsb.gv.at, or with the supervisory

OBLIGATION TO PROVIDE DATA AND AUTOMATED DECISIONS

You are not obliged to provide personal data. Without the data required for this purpose, however, we cannot respond to your enquiry or send you the newsletter. We do not use automated decision-making or profiling within the meaning of Art 22 GDPR.

CHANGES

We update this privacy policy when legal requirements or our services change. The current version is always available on our website.Last updated: September 2026

‍

‍