Privacy policy

The controller within the meaning of the GDPR is:

mumbler gmbh
Mirabellplatz 7, 5020 Salzburg, Österreich
E-mail: office@mumbler.gmbh
Phone: +43 699 10 150 700

No data protection officer has been appointed. No obligation to appoint one arises under Art 37 GDPR for this company, since the core business involves neither regular and systematic large-scale monitoring of data subjects nor large-scale processing of special categories of personal data (Art 9, Art 10 GDPR).

Personal data is processed for the following purposes:

• Providing the website and IT security (collection of server log files): the legal basis is Art 6(1)(f) GDPR. The legitimate interest lies in the stable, secure and uninterrupted operation of the website and in defending against attacks.
• Handling enquiries submitted through the contact form in connection with a possible engagement: the legal basis is Art 6(1)(b) GDPR (pre-contractual measures taken at your request).
• Handling other general enquiries: the legal basis is Art 6(1)(f) GDPR. The legitimate interest lies in responding to enquiries addressed to us.

Web analytics: this website embeds no analytics or tracking service by default. Should privacy-friendly traffic measurement be switched on, it would be exclusively Plausible Analytics, a cookieless service whose infrastructure runs in the EU (Germany). Plausible sets no cookies, stores no IP addresses and builds no cross-device or cross-site profiles; measurement is aggregate only. The legal basis would be Art 6(1)(f) GDPR (legitimate interest in statistical information about how the website is used). Whether such cookieless analytics may lawfully run without consent is the vendor's own position and is widely, though not universally, accepted; this will be confirmed with counsel before it is switched on. The technical provider of the contact-form endpoint and the hosting provider have not yet been chosen; this policy will be extended to cover that processing before it goes live.

Where necessary to achieve the purposes above, data is disclosed to the following categories of recipients:

• The hosting provider of this website (operated within the European Union)
• The e-mail infrastructure provider used to handle enquiries (operated within the European Union)

Both providers will be named here when the site goes into service.

Data is not disclosed to any other third parties.

Hosting and e-mail infrastructure are intended to be operated exclusively within the European Union; no transfer of data to countries outside the European Economic Area (third countries) is currently planned. Should that change with the choice of a provider, the safeguard applied under Art 44 et seq. GDPR, such as standard contractual clauses, is stated here.

Server log files are deleted after the retention period set by the hosting provider for IT-security purposes; that period is named here once the provider is settled. Data submitted through the contact form is deleted as soon as it is no longer necessary for the purpose for which it was collected and no statutory retention obligation applies.

Subject to the statutory requirements, you have the following rights:

• Right of access (Art 15 GDPR)
• Right to rectification (Art 16 GDPR)
• Right to erasure (Art 17 GDPR)
• Right to restriction of processing (Art 18 GDPR)
• Right to data portability (Art 20 GDPR)
• Right to object to processing (Art 21 GDPR)

Should any future processing be based on your consent (Art 6(1)(a) GDPR), you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing based on the consent before its withdrawal. This website currently carries out no processing based on consent.

Providing your data in the contact form is neither a statutory nor a contractual requirement. It is, however, necessary for us to process and respond to your enquiry; without it, your enquiry cannot be processed.

No automated decision-making, including profiling, within the meaning of Art 22 GDPR takes place.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. In Austria, this is the:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40-42
1030 Wien, Austria
E-mail: dsb@dsb.gv.at