Privacy Policy.

LUMBRA Creative Studio is a sole proprietorship owned by Bastian Reicht. The controller responsible for the processing of personal data is:

Bastian Reicht LUMBRA Creative Studio Business address: [ENTER BUSINESS ADDRESS] Austria Email: office@lumbra.at

Personal data is any information relating to an identified or identifiable individual, such as a name, email address or IP address. We only process data for specific purposes and to the extent necessary.

Depending on the processing activity, we rely on one or more of the following legal bases: your consent pursuant to Art. 6(1)(a) GDPR; the performance of a contract or taking steps at your request before entering into a contract pursuant to Art. 6(1)(b) GDPR; compliance with a legal obligation pursuant to Art. 6(1)(c) GDPR; or our legitimate interests pursuant to Art. 6(1)(f) GDPR, in particular in the secure operation of the website and in handling general business communication.

The website is provided via the infrastructure of Vercel Inc. Vercel processes technical connection and usage data so that pages can be delivered, errors detected, and security and stability ensured. This may include the IP address, date and time, requested URL and resource, referrer, browser and device information, status codes, and error and security data.

The website and the server function of the contact form run within the Vercel environment. The specific execution region depends on the deployment configuration. Vercel Inc. is a US company; execution or provision within a European region does not rule out possible processing by Vercel or its sub-processors outside the EEA.

Technical access and security data is processed on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. Under the planned Vercel Pro plan, the retention period stated by Vercel for runtime logs is generally one day. Additional observability features or configured log drains may deviate from this. For international data transfers, the applicable safeguards from Vercel's contractual documentation apply, in particular Standard Contractual Clauses where required.

Further information: Vercel Privacy Notice and Vercel Data Processing Addendum.

If you use the contact form, we process the details you enter: name, company, email address, requested service, optionally a preferred timeframe, and your project description. Furthermore, the time of submission and technically required transmission information are processed. We use these details to respond to your enquiry and to prepare a possible project.

For specific project enquiries, the legal basis is Art. 6(1)(b) GDPR, insofar as the processing is necessary to take steps at your request before entering into a contract. For general enquiries, we rely on our legitimate interest in communication pursuant to Art. 6(1)(f) GDPR. Please do not submit special categories of personal data via the form unless this is necessary and has been agreed with us beforehand.

After submission, the form data is transmitted directly to Resend via a server-side function within the Vercel infrastructure. Resend processes the details in order to deliver the enquiry to our business mailbox office@lumbra.at. The email address provided in the form is set as the reply-to address. LUMBRA does not additionally store the enquiry in its own form database. Vercel and Resend may process the technical data required for operation, transmission, delivery and security in accordance with their respective contractual and privacy terms.

Resend is a US provider. According to Resend's DPA, primary processing operations take place in the USA; Resend lists Standard Contractual Clauses and other applicable transfer safeguards. Resend uses sub-processors, including Amazon Web Services.

Information: Resend DPA and Resend sub-processors.

If you contact us directly by email or reply to a response to your enquiry, we process your email address, the message content, attachments, and the time and transmission information required for communication. Depending on the content, this processing is based on Art. 6(1)(b) or (f) GDPR.

The business email mailbox office@lumbra.at is hosted with easyname GmbH. Emails are stored there and retrieved by us for communication purposes. easyname processes, in particular, sender and recipient data, message content, and technical delivery and security data in accordance with the terms applicable to the mailbox. We do not use the mailbox for newsletters or unsolicited advertising.

Further information: easyname privacy policy.

We generally delete enquiries that do not result in an order no later than six months after the last contact, unless legal retention obligations apply or further storage is necessary to assert, exercise or defend legal claims. This period applies to the enquiry communication we retain; technical logs maintained by the service providers used may be subject to their own, separately defined retention periods.

If an order is placed, we retain the documents required for contract performance for longer, insofar as this is necessary for carrying out the order, statutory retention and documentation obligations, or legal claims. The periods are governed by the applicable statutory requirements. Deletion periods agreed with, or set by, service providers may differ from this.

The website uses the fonts Manrope and Space Grotesk via Google Fonts. When a page is accessed, the browser establishes connections to Google's servers and retrieves the font files and stylesheets. These requests currently already occur when the page is loaded, not only after a selection is made in the cookie banner. This may transmit, in particular, the IP address, browser and device information, and the requested page to Google.

The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data through affiliated companies or sub-processors outside the EEA. The integration serves the consistent presentation of the website. The legal basis is our legitimate interest in a consistent and technically reliable presentation pursuant to Art. 6(1)(f) GDPR. Google Fonts are not used to analyse user behaviour.

Further information: Google Privacy Policy and Google Fonts FAQ.

The website uses browser storage technologies for the consent selection and the intro animation. The stored consent decision is kept in the browser's localStorage under the key lumbra-consent. It contains the consent version, the time of the selection, and your settings for statistics and external media. It becomes invalid after 180 days, after which you will be asked to make your selection again.

In addition, the intro animation uses the sessionStorage entry lumbra-intro-seen. It prevents the animation from being replayed during the same browser session. This entry is not used for statistics or profiling purposes and ends with the browser session.

Google Analytics is not currently integrated. Accordingly, no Google Analytics scripts or statistics cookies are set before consent to statistics is given. Details on the voluntary selection and on external media can be found in the next section.

On your first visit, you can separately select statistics and external media in the consent banner. Neither of these categories is pre-selected. You may decline all non-essential categories and continue to use the website. In the footer, you can change your selection or withdraw consent already given at any time via "Cookie settings".

The decision is stored in the browser for up to 180 days. The consent management is currently at version 2. If the categories or key consent wording change, a new selection may be required. Withdrawal applies to future processing and does not affect the lawfulness of processing carried out before consent was withdrawn. Where consent is required, storing or accessing information on your device is based on your consent pursuant to § 165(3) TKG 2021 (Austrian Telecommunications Act) and Art. 6(1)(a) GDPR.

On the "Projects" page and on the homepage, videos are embedded via the Vimeo player. The preview images are served from this website. Before you consent to "External media" or explicitly allow an individual video, no Vimeo player is loaded and no connection to Vimeo is established.

If you consent to external media, or select "Load this video only" following the notice, the player for the selected video is loaded from Vimeo. Vimeo may then receive, in particular, your IP address, device and browser information, the page accessed, and usage and playback information. The embed uses the Vimeo parameter dnt=1. This may reduce certain tracking functions but does not prevent the data transmission to Vimeo required for playback.

The provider is Vimeo.com, Inc., USA. The legal basis for the embed, following consent, is Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021. The one-off approval applies only to the selected video and does not change your stored general consent. If you withdraw consent to external media, loaded Vimeo players are removed. Consent can be withdrawn at any time via "Cookie settings".

Further information: Vimeo Privacy Policy.

Google Analytics 4 is not currently activated. The website currently contains no GA4 measurement ID and does not load any Google Analytics script. The "Statistics" consent category is prepared but is not currently used for any analysis. Should GA4 be activated in the future, this privacy policy will be updated prior to activation to reflect the actual configuration, data processing, retention periods and provider details. GA4 may only be loaded after active consent to "Statistics" has been given.

The website contains links to Instagram and, where applicable, to other external websites. As long as you do not click on a link, this generally does not load any Instagram feed or social media plugin. After clicking, you leave the LUMBRA website; from that point on, the privacy information of the respective provider applies.

For the purposes set out in this policy, personal data may be transferred in particular to Vercel, Resend, easyname, Google and Vimeo, as well as their respective sub-processors. In addition, authorities may receive data where this is legally required.

Vercel and Resend are US providers. Processing outside the European Economic Area cannot be ruled out for Google and Vimeo or their sub-processors either. Insofar as a transfer to a third country occurs, it relies on the applicable transfer mechanisms, such as an adequacy decision of the European Commission or Standard Contractual Clauses where required. Details and sub-processors may change in line with the providers' current contractual and privacy notices.

We do not promise that data will be processed exclusively within the EEA. International processing may occur in particular in connection with infrastructure, email and external media services.

We do not use the personal data collected through this website for solely automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction of processing and data portability, as well as the right to object to processing based on legitimate interests. You may withdraw consent at any time with effect for the future. To exercise your rights, please contact us at office@lumbra.at.

If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with a data protection supervisory authority. In Austria, this is in particular the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, email: dsb@dsb.gv.at, website: dsb.gv.at.

We use appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and unauthorised disclosure. The website is transmitted via HTTPS. No system can guarantee complete protection against all risks.

We update this privacy policy whenever the website, the services used, or the underlying processing activities change. The version published on the website at any given time applies.