Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Ambrosia e.U. (registered sole proprietorship), FN 505115t, Commercial Court Vienna
Owner: Ing. Markus Landauer
Redtenbachergasse 25/1/15, 1160 Wien, Austria
Email: office@skalar-modellbau.at · Phone: +43 680 1429550
VAT ID: ATU73959013

“Skalar Modellbau & 3D-Druck” is a business division of Ambrosia e.U.

No data protection officer has been appointed. On our current assessment there is no statutory obligation to appoint one under Art. 37 GDPR, as our core activity involves neither regular and systematic monitoring of data subjects on a large scale nor large-scale processing of special categories of data (Art. 9 GDPR).

2. Data processed & purposes

Contact enquiries: name, email, phone, project type, message, a share link where provided, submitted documents (plans, photos, CAD files) and the time of the enquiry — to handle your enquiry and prepare a quote.
Access data when the website is called up: when a page is requested, our EU-based hosting provider (statichost.eu, Stockholm/Sweden) processes the technically required connection data transmitted by your browser (in particular IP address, date and time of access, page/file requested, volume of data transferred, browser type and operating system, where transmitted) — transiently only, for technical delivery and to keep the site stable and secure. No evaluation beyond delivery takes place, and no user profile is built; we keep no server log files of our own (see sections 8 and 9).
Optional website analytics: only with your consent, we use Google Analytics to process pseudonymous cookie identifiers, page views, timestamps, technical usage and device data, approximate location data and the number of successfully submitted contact enquiries. Section 7 explains the details and your choices.

3. Legal bases

We process enquiries via the contact form, email or phone to take pre-contractual steps or to perform a contract (Art. 6(1)(b) GDPR). The technical delivery of the website and the secure operation of the form endpoint are based on our legitimate interest (Art. 6(1)(f) GDPR). Documents relating to orders are retained to comply with legal obligations (Art. 6(1)(c) GDPR).

Optional analytics and its cookies are based on your voluntary consent under Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). We store your privacy choice solely so we can respect it, relying on our legitimate interest in managing your settings (Art. 6(1)(f) GDPR). This local storage required for your choice falls within the exception for necessary operations under § 165(3) TKG 2021.

4. Whether you have to provide your data

Providing your data is neither required by law nor strictly required by contract, and you are under no obligation to provide it. To handle an enquiry, however, we need at least a way to reach you and some information about your project: without it we cannot process your enquiry, assess feasibility or send you a quote. No other consequences arise for you.

5. Contact form & spam protection

Data submitted via the contact form is used solely to handle your enquiry. It is sent to a form endpoint we operate ourselves (post.skalar-modellbau.at), running on our web hosting at INWX GmbH (EU). Your message and uploaded files are stored there in an area that is not publicly accessible; at the same time we receive a notification with the text of your enquiry (without files) in our mailbox office@skalar-modellbau.at. We promptly collect the files onto our own systems and then delete them from our active enquiry storage on the web hosting. When you submit the form, the provider's web server technically processes your IP address, date and time and the requested address in its server logs. Our form endpoint does not store your IP address and does not include form contents or files in its technical error messages. To prevent automated misuse, we use an invisible “honeypot” field and an overall rate limit. This counts only timestamps, without IP addresses or other visitor identifiers. No external CAPTCHA services are used.

6. Fonts (self-hosted)

This website embeds all fonts locally from its own server (self-hosted via Fontsource). There is no connection to Google Fonts or other external font servers; no IP addresses are transmitted to third parties in the process.

7. Cookies & website analytics

We use Google Analytics 4 only with your express consent to analyse page usage and the number of successfully submitted enquiries. You can reject analytics in the initial notice or make your choice in the settings. Without consent, we do not load the Google Analytics tag or send analytics or consent pings to Google. The website and contact form remain available regardless of your choice.

Your choice in this browser

We store your decision, the time and the choice version locally in your browser under skalar.analytics-consent.v1 (Local Storage). Your decision is valid for 180 days. We remove expired entries on your next visit and ask again. You can clear your browser storage sooner; we then ask again on your next visit as well. This entry contains no advertising or visitor identifier and is not sent to Google. If your browser blocks storage, your choice applies only to the current page visit.

Analytics data processed

Google Analytics processes pseudonymous browser and session identifiers, page views, timestamps and engagement duration, basic device and browser information, and approximate location. We send the page address without query parameters or a fragment. For an external referring page, we send at most its origin, consisting of protocol and domain, without a path or query parameters. A successfully submitted enquiry generates only a success event — no names, email addresses, phone numbers, messages, sharing links or uploaded files.

Your IP address is technically processed when connecting to Google. Google states that GA4 does not log or store it; for EU visits, it is used to derive approximate location data and then discarded. Analytics should therefore not be understood as anonymous data processing. Google Signals, advertising personalisation and enhanced automatic measurement, including form tracking, are disabled for our use. We do not use a User-ID to link analytics to customer accounts.

Analytics cookies and withdrawal

After your consent, the first-party cookies _ga (browser identifier) and _ga_<identifier> (session state) may be set. We limit their lifetime to 60 days and do not extend an existing lifetime on every page visit.

You can withdraw your consent at any time through “Privacy settings” in the footer. We then stop further analytics collection on that page and delete the Google Analytics cookies accessible to us. If you consent again after withdrawing, analytics resumes only on the next page visit. Form data you have already entered remains intact. Withdrawal does not affect the lawfulness of processing before withdrawal and does not automatically erase data already processed. You can contact us to request erasure.

Further information: Google's Privacy Policy, data processing on sites using Google services and Google's information on EU data and IP addresses.

Google Search Console and internal reports

We use Google Search Console to analyse our visibility in Google search results. We also display the search performance data provided there and our existing Google Analytics reports in a Google Data Studio report accessible only internally. This adds no tags or cookies to this website. Collection of Google Analytics data continues to require your consent. We do not send the contents of your contact enquiries to the report.

8. Recipients, processors & third countries

For hosting and contact enquiries, we engage the following service providers as processors (Art. 28 GDPR) within the EU/EEA:

Hosting: statichost.eu, operated by Variable Object Assignment, Sankt Paulsgatan 25, Stockholm, Sweden (EU) — data held in the EU via the subprocessors Hetzner Online GmbH (DE) and BunnyWay d.o.o. (Bunny, SI). According to the provider, visitor IP addresses are not stored; processing is transient, for delivery only. A data processing agreement under Art. 28 GDPR is in place with the provider and records this expressly.
Receipt of contact-form messages and email: INWX GmbH, Prinzessinnenstr. 30, 10969 Berlin, Germany (EU) — web hosting on which the form endpoint we operate ourselves runs and enquiries are stored until collected, as well as our email mailbox. A data processing agreement under Art. 28 GDPR is in place with the provider. No external form, newsletter or captcha service is used. INWX uses technical system and application logs and backup copies to operate, secure and restore its systems. The deletion of collected contact enquiries described here concerns our active enquiry storage on the web hosting.
Optional website analytics with consent: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service is subject to Google's data processing terms. Processing by Google LLC and other subprocessors outside the EU/EEA, particularly in the USA, is possible.
Internal reports with Google Data Studio: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing of the connected report data is subject to Google Data Studio's data processing terms. Processing by Google LLC and other subprocessors outside the EU/EEA, particularly in the USA, is possible.

Your data is not passed on to third parties for any purpose other than those named.

Google describes its participation in the EU-US Data Privacy Framework for certified US recipients and, where applicable, the European Commission's Standard Contractual Clauses among the bases for international transfers. We therefore cannot promise that analytics and report data is processed exclusively in Europe. Details of recipients and transfer mechanisms are set out in Google's information on international data transfers and the contractual documents linked there.

9. Retention period

Access data for page delivery: the website hosting does not store personal visit data. Processing is transient, taking place only while the page is delivered; we keep no server log files of our own, so no retention period applies.
Contact enquiries: in our active enquiry storage on the web hosting only until collected (usually a few days). Enquiries that do not lead to an order are deleted no later than 12 months after the last correspondence. If an enquiry leads to an order, we keep the documents for as long as required to perform the contract and to meet statutory (in particular tax and commercial-law) retention obligations.
Privacy choice and analytics cookies: your local choice is valid for 180 days; we remove expired entries on your next visit. Analytics cookies last for up to 60 days, as explained in section 7.
Google Analytics data: retention of user-level and event-level data in our GA4 property is set to two months, without resetting the period on new activity. This setting does not apply to aggregated standard reports, which may remain available for longer. Browser cookie lifetimes are separate. See Google's explanation of data retention.
Internal reports: Google Analytics retention settings do not automatically determine how long aggregated reports or cached query results in Google Data Studio are kept. See Google's explanation of data freshness for information about these caches.

10. Automated decision-making & profiling

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects or similarly significantly affects you takes place on this website. Every quote is reviewed and calculated by us personally.

11. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as to withdraw consent given. You may lodge complaints with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, dsb.gv.at).

12. Contact for data protection matters

Please contact: office@skalar-modellbau.at.