1. Data Controller
Kaffee Raum Studio e.U. ("we", "us", "our") is the data controller responsible for your personal data.
- Company: Kaffee Raum Studio e.U.
- Proprietor: Markus Brenner
- Company register number: FN 567890x (Handelsgericht Wien)
- UID: ATU78901234
- Address: Neubaugasse 31, 1070 Wien, Austria
- Email: [email protected]
- Phone: +43 1 523 8841
2. Scope
This Privacy Policy applies to personal data collected through our website (kaffeeraum.at), contact forms, email correspondence, phone calls, and during the provision of café interior planning services. It is designed to comply with the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (Datenschutzgesetz — DSG), and guidance from the Österreichische Datenschutzbehörde (DSB).
3. Personal Data We Collect
3.1 Data you provide directly
- Identity data: full name, job title, company or café name
- Contact data: email address, phone number, postal address
- Communication data: messages sent via contact forms, email, or phone
- Project data: floor plans, site photographs, seating requirements, service style descriptions, and fit-out specifications you share during planning engagements
- Consent records: timestamps and scope of consents you have given
3.2 Data collected automatically
- Technical data: IP address, browser type and version, operating system, device type
- Usage data: pages visited, time spent, referral source, click patterns
- Cookie data: as described in our Cookie Policy
3.3 Data from third parties
- Business contact information from publicly available sources (e.g. Firmenbuch, Wirtschaftskammer)
- Referral data from contractors or architects who introduce you to our services (with your knowledge)
4. Purposes and Legal Bases
We process personal data only where a legal basis under Article 6 GDPR applies:
- Contract performance (Art. 6(1)(b)): To deliver café interior planning services, issue invoices, and manage project communications.
- Legitimate interests (Art. 6(1)(f)): To respond to enquiries, improve our website, prevent fraud, and maintain business records. Our legitimate interests are balanced against your rights and freedoms.
- Consent (Art. 6(1)(a)): For non-essential cookies, marketing emails, and processing of site photographs where required. You may withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)): To comply with Austrian accounting, tax (Umsatzsteuergesetz), and commercial law requirements.
5. Special Categories of Data
We do not intentionally collect special categories of personal data (e.g. health, ethnicity, trade union membership). If project data you provide incidentally contains such information, we will process it only with your explicit consent (Art. 9(2)(a) GDPR) or as necessary for occupational health and safety obligations (Art. 9(2)(b)).
6. Data Sharing and Processors
We do not sell personal data. We may share data with:
- Service providers (processors): Cloud hosting (within the EU/EEA), email services, accounting software, and project management tools. All processors are bound by data processing agreements (Auftragsverarbeitungsverträge) under Article 28 GDPR.
- Professional advisers: Lawyers, tax advisers (Steuerberater), and accountants, bound by confidentiality.
- Public authorities: When required by law (e.g. Finanzamt, Handelsgericht Wien).
A current list of sub-processors is available on request at [email protected].
7. International Transfers
We store and process data primarily within the EU/EEA. If a transfer outside the EEA becomes necessary, we will ensure appropriate safeguards under Chapter V GDPR — such as Standard Contractual Clauses (SCCs) approved by the European Commission — and inform you of the transfer, its purpose, and the safeguards applied.
8. Retention Periods
- Enquiry and contact form data: 24 months after last contact, unless a project begins
- Project and contract data: duration of contract plus 7 years (Austrian accounting law — Bundesabgabenordnung)
- Marketing consent records: until consent is withdrawn, plus 3 years for audit purposes
- Website analytics: 26 months (aligned with standard analytics retention)
- Cookie consent logs: 12 months
- Invoice and tax records: 7 years as required by Austrian tax law
After retention periods expire, data is securely deleted or anonymised.
9. Your Rights Under GDPR
As a data subject, you have the following rights:
- Right of access (Art. 15): Request a copy of personal data we hold about you.
- Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
- Right to erasure (Art. 17): Request deletion where data is no longer necessary, consent is withdrawn, or processing is unlawful.
- Right to restriction (Art. 18): Request that we limit processing in certain circumstances.
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format where processing is based on consent or contract.
- Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing.
- Rights related to automated decision-making (Art. 22): We do not use automated decision-making or profiling that produces legal effects.
To exercise any right, email [email protected] with the subject line "GDPR Request". We respond within 30 days as required by the DSG. We may request identity verification before processing your request.
10. Right to Lodge a Complaint
If you believe we have not handled your data correctly, you have the right to lodge a complaint with:
We encourage you to contact us first so we can address your concern directly.
11. Data Security
We implement appropriate technical and organisational measures under Article 32 GDPR, including:
- TLS encryption for data in transit
- Access controls and role-based permissions
- Regular backups with encrypted storage
- Staff training on data protection and confidentiality
- Incident response procedures with 72-hour breach notification to the DSB where required (Art. 33)
- Physical security measures at our Neubaugasse studio
12. Data Protection Contact
Kaffee Raum Studio e.U. has appointed an internal data protection contact. Reach them at [email protected] with the subject line "Data Protection".
13. Children's Data
Our services are directed at café operators and business professionals. We do not knowingly collect data from individuals under 16. If we become aware of such data, we will delete it promptly.
14. Telecommunications and Marketing
Direct marketing by email is sent only with your consent or where permitted under § 174 Telekommunikationsgesetz (TKG 2021). You may opt out at any time via the unsubscribe link in any marketing email or by contacting us directly.
15. Changes to This Policy
We may update this Privacy Policy to reflect legal or operational changes. Material changes will be posted on this page with an updated date. Where required under the DSG, we will seek renewed consent.
16. Contact
For any privacy-related questions:
- Email: [email protected]
- Phone: +43 1 523 8841
- Post: Kaffee Raum Studio e.U., Neubaugasse 31, 1070 Wien, Austria