Privacy­ policy

1. Scope and language

This privacy policy covers the English pages of fabian-martin.at: the home page, contact, thank-you page, legal notice and this page. For the German pages and for the login area, the newsletter, Smart Money, the Liegenschaftsradar and the Calendly call booking, the German Datenschutzerklärung applies. This English version is provided for your convenience; if the two versions differ, the German version prevails.

2. General

I process personal data only as far as it is necessary to run this website securely, for aggregated visitor statistics (section 3), to handle voluntary requests, for the AI chat if you start it, or for steps before a possible contract. Data is processed for specific purposes and in line with the applicable data protection law, in particular the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act.

Providing the website technically and protecting it against misuse and spam is based on Art. 6(1)(f) GDPR. My legitimate interests are the secure, stable and economical operation of the website and protecting the form against abusive submissions. Handling a request is based on Art. 6(1)(b) GDPR as far as it is aimed at a possible contract. I handle other voluntary requests on the basis of Art. 6(1)(f) GDPR; my legitimate interest is answering messages sent to me.

3. Hosting and visitor statistics (Netlify)

This website is hosted by Netlify. When you visit it, technically necessary access data may be processed, in particular IP address, date and time, the file requested, referrer, browser type and operating system. This serves the secure, stable and efficient delivery of the website.

Visitor statistics (Netlify Web Analytics): To see how many people visit the website and which pages they look at, I use Netlify Web Analytics. Netlify evaluates the access data mentioned above from its server logs. No script runs in your browser for this, no cookies are set and nothing is stored on your device. I only see aggregated numbers: page views, unique visitors per day or hour (Netlify counts different IP addresses for this), the most visited pages, addresses not found, the most frequent referring sites, views by location (determined by Netlify from the IP address; the map also shows locations with a single view) and the amount of data transferred. I don’t use these numbers to identify individual visitors and don’t combine them with other data. The numbers are only available to me for a short time (at most 7 days on my plan, according to Netlify); Netlify does not say how long it keeps the underlying logs. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is understanding the use of the website in aggregated form and improving content and services. You can object to this processing under Art. 21 GDPR (section 11).

Netlify may also process data outside the European Economic Area. For international transfers, Netlify refers among other things to appropriate safeguards such as standard contractual clauses and the EU-U.S. Data Privacy Framework. According to the provider, Netlify’s data processing agreement is part of its self-serve terms. More information is in Netlify’s privacy policy and its notes on GDPR, CCPA and data processing.

4. Contact form (Netlify Forms)

The contact form on the English contact page is processed by Netlify Forms. It processes topic, first name, last name, email address, your message and the confirmation that you have read this privacy policy, and your phone number if you provide one. The data is needed to assign and answer your request and, where applicable, to clarify steps before a contract. Topic, names, email address, message and the privacy confirmation are required; the phone number is voluntary. Without the required details the form cannot be sent. You are not obliged to use the form; you can also simply email me at kontakt@fabian-martin.at (section 6). Please don’t send health data, passwords, login details or contract details through the form.

Netlify stores form submissions in the forms area of the website account and uses Akismet, a service of Automattic Inc., USA, to check for spam. The submitted content and technical connection data may be processed for spam detection. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is detecting and blocking unwanted or harmful submissions. For transfers to third countries, Netlify refers to its data processing agreement, standard contractual clauses and the EU-U.S. Data Privacy Framework. More information is in Netlify’s notes on spam filters and Automattic’s privacy policy.

Netlify sends a notification with the form content to the Gmail mailbox I use. This means Google also processes the information. The provider in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Depending on the content of the request, the legal basis is Art. 6(1)(b) or (f) GDPR. Processing by Google LLC in the USA or other affiliated companies cannot be ruled out; Google refers to the EU-U.S. Data Privacy Framework and, where necessary, standard contractual clauses (Google privacy policy).

Form submissions at Netlify and the related notification emails are deleted as soon as they are no longer needed to finish handling the request, for possible steps before a contract or for statutory retention obligations. If we start working together, the data needed for that is processed separately for that purpose.

5. Contact management at Brevo

After the request has been stored at Netlify, the website transfers it server-side, independently of your browser, to my contact management (CRM) at Brevo: your email address, your first and last name, your phone number if given, and the source note “Kontaktformular” (contact form). The phone number is stored there only to call you back about your request, not for text messages or advertising. The contact is added to the list “Website fabian-martin.at – Anfragen” (requests). This list is used exclusively to handle your request and related communication; it is not used for advertising or newsletters and is deliberately topic-neutral. Topic, message and technical data such as IP address or browser identifier are not transferred to Brevo. If I already keep your contact at Brevo for another purpose, names and source note remain unchanged. For troubleshooting, the website logs only technical events at Netlify for this transfer, with the submission ID and a shortened email address; Netlify keeps these logs for at least 24 hours, on some plans 7 days.

The legal basis is Art. 6(1)(b) GDPR as far as your request is aimed at a contract or steps before a contract, otherwise Art. 6(1)(f) GDPR; the legitimate interest is handling, assigning and documenting requests in an orderly way. You can object to this processing (section 11).

Provider and my contractual partner is Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, a subsidiary of Sendinblue SAS, Paris. Brevo processes the data on my behalf as a processor (Art. 28 GDPR) under the data protection agreement that is part of the Brevo terms of use. According to Brevo, data is stored in data centres in France, Germany and Belgium. Some service providers used by Brevo may process data outside the EU or access it for support and maintenance, including in the USA, India and Canada; Brevo relies on the EU-U.S. Data Privacy Framework, standard contractual clauses and adequacy decisions of the European Commission. The website itself loads no Brevo script, tracker, pixel or cookie. Details are in the Brevo terms of use and the Brevo privacy policy; you can request a copy of the safeguards from me at kontakt@fabian-martin.at.

6. Contact by email, Gmail and phone

If you contact me at my business address kontakt@fabian-martin.at, I process the data you send via the associated mailbox and my Gmail mailbox to answer your request and communicate with you. The email hosting provider and Google process the communication data. The legal basis is Art. 6(1)(b) GDPR as far as the communication is aimed at a possible contract, otherwise Art. 6(1)(f) GDPR; the legitimate interest is answering the message you sent voluntarily.

If you write to me or call me about my services, for example a homepage or an AI workshop, I enter your email address, first and last name if you give it, and, if you give it to me for a call back, your phone number in my contact management at Brevo (section 5). It is the same requests list as for the contact form, with the source note “E-Mail” or “Telefon” (phone). I do not transfer the topic or content of your message, and I do not enter health or care information. If I already keep your contact for another purpose, names and source note remain unchanged. You will not receive advertising because of it, and the periods in section 10 apply. Legal bases and your right to object are the same as for the contact form.

7. Cookies and local storage

The public pages of this website set no analytics or marketing cookies and use no cross-site visitor tracking. No load times or other performance data of your visit are sent from your browser to me or to Netlify.

The home page can play sound, but only if you choose it yourself: when entering with “Enter with sound” or later with the sound switch in the header and menu. The sound is generated live in your browser (Web Audio); no audio files are loaded and no data is sent to me or third parties. Your choice only lasts while the page is open and is not stored in the browser. The same applies to the “Motion” switch, which pauses animations.

The showreel is hosted on fabian-martin.at itself; no video platform is embedded. On wide screens a silent preview starts once the film scrolls into view; only then does your browser load the film file from this website, which creates the access data described in section 3. With reduced motion, data saver or on narrow screens, the film only loads after your click. Captions are loaded only when you switch them on. No cookies are set and no playback data is sent to third parties.

The local times shown on the home page (Brooklyn, London, Singapore and Salzburg) are calculated by your browser from its own clock. Nothing is loaded, sent or stored for this. The question search, the live builder and the match check on the home page also run only in your browser; what you type and how you answer is neither sent nor stored.

The “AI chat” button itself sets no cookies and stores nothing in the browser. Before loading, it only checks in your browser whether an account of this website is signed in there; if so, the chat does not start, to protect your account. Nothing is stored or sent in the process. Only when you click it does the TeydraLab chat load and store the conversation and technical details about it in your browser (section 8).

8. AI chat by TeydraLab

On the English home page, as on some German pages, there is an “AI chat” button at the bottom right. Behind it is a chat assistant that answers questions about this website and my services using artificial intelligence. You are writing with an AI system, not with me. The chat is intended for people aged 14 and over. There is no chat button on the contact page or on the legal pages.

Before the click: As long as you don’t click the button, the website loads nothing from TeydraLab. There is no connection to TeydraLab, no cookies are set and no data is stored in your browser.

After the click: Only with your click does your browser load the chat program from teydralab.com and the chat window from widget.teydralab.com and fetch the settings of this chat from TeydraLab’s database. The technically necessary connection data is processed, in particular IP address, browser type and version, operating system, the address of this website and the time. The chat program also reports which website it is embedded on. TeydraLab stores the chat ID, the name of the website, times and how often the chat was loaded there, and deletes these entries no later than 90 days after the last load. TeydraLab uses your IP address only to limit misuse and keeps it only as a hashed identifier of an address range that expires after 24 hours at the latest. According to TeydraLab, the IP address is not stored permanently in identifiable form, and technical data is deleted after 30 days at the latest. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is providing the chat you requested with your click and protecting it against misuse.

Your messages: Before the chat processes your messages, it shows its own privacy notice, which you can accept or decline. Only if you accept do your messages go to TeydraLab and from there to an AI language model that generates the answer. The legal basis is then your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future in the chat under “view privacy”. With your consent, the chat can also read the page you have open, meaning address, title, visible text and type, state and position of controls, to answer more accurately. It can scroll to places, highlight them and suggest another page of this website, which only opens after your click. It cannot click, fill in or submit anything. According to TeydraLab, it does not capture what you type into form fields or passwords; the description of the page is generated anew for each answer and not stored permanently. To detect the language of a message, TeydraLab may send up to 500 characters of it to Web Cats UAB (DetectLanguage) in Lithuania.

AI model and recipients: TeydraLab chooses which language model generates an answer. According to TeydraLab (information from 24 October 2026), answers are generally generated by a language model at Scaleway S.A.S. in Paris, i.e. in the EU. TeydraLab’s data processing agreement also lists AI providers based in the USA through which answers can run: a DeepSeek model, routed via OpenRouter, Inc. and computed at A2 Labs Inc. (“Makora”), Deep Infra Inc. or alternatively Fireworks AI, Inc., and for more difficult questions models from OpenAI, Google, Perplexity, xAI or Microsoft. Your messages may therefore also be processed in the USA. As safeguards for these transfers, TeydraLab names standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR), and for Google and Microsoft additionally the EU-U.S. Data Privacy Framework (Art. 45 GDPR); for OpenAI and xAI, TeydraLab has not yet named a safeguard. You can request a copy of the safeguards from me at kontakt@fabian-martin.at. The full details, including storage periods of the individual providers, are in section 9 of the German Datenschutzerklärung.

What is stored: The chat stores the conversation and technical details about it in your browser’s storage, in the area of the chat window from widget.teydralab.com, so that the conversation is kept when you change pages or reopen the chat later. This storage only serves the chat you explicitly requested with your click (§ 165(3) Austrian Telecommunications Act 2021). The data remains until you delete your browser’s site data for fabian-martin.at and teydralab.com. A conversation archive on TeydraLab’s servers is switched off for this chat. File attachments and voice input are switched off; the microphone is also technically blocked on this website.

Processing on my behalf: TeydraLab processes this data on my behalf as a processor under Art. 28 GDPR. The provider is Teydra Lab (Meral Anna Hees, sole proprietorship), Ludwig-Richter-Straße 4a/Top3, 5020 Salzburg, Austria, email: official@teydralab.com. The full list of sub-processors is in TeydraLab’s data processing agreement, more information in TeydraLab’s privacy policy.

Please note: Don’t enter health data, financial, insurance or contract data, passwords or login details, or data about other people in the chat. The chat can be wrong, does not replace advice and makes no decisions; only answers I give you myself are binding. To reach me, please use the contact form or send me an email.

9. Local fonts and external links

The website loads its fonts and design assets locally. The exception is the AI chat: chat program and chat window come from TeydraLab after your click (section 8). External sites, such as the client websites under “Work” or LinkedIn, are only accessed when you actively click a link. From that moment, the respective provider processes the connection data needed for the visit, and its privacy policy also applies.

10. Storage periods

Personal data is stored only as long as it is needed to handle the request, for communication, for possible steps before a contract or for statutory retention obligations. Form submissions and notification emails that are no longer needed are deleted once the request is closed. I remove the assignment of a request from the contact form, by email or by phone to the Brevo requests list and the related phone number no later than 90 days after the last necessary step in handling the request; if we start working together, that transition is the last step, and the customer data needed for it is kept separately. If after this period there is no confirmed newsletter subscription, no account, no blocking note and no other documented purpose, I delete the Brevo contact completely. I check this monthly. For the AI chat, the periods in section 8 apply; for visitor statistics, see section 3.

11. Your rights

Within the statutory requirements, you have in particular the right of access, rectification, erasure, restriction of processing, data portability and objection. Consents given can be withdrawn with effect for the future. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at) or the supervisory authority in your EU country. If you live outside the EU, you may have additional rights under the law of your country; just write me and I will help.

Right to object under Art. 21 GDPR: Where I process data on the basis of Art. 6(1)(f) GDPR, for example storing and documenting your request at Brevo (requests list) or the visitor statistics, you can object to this processing at any time on grounds relating to your particular situation, for example by email to kontakt@fabian-martin.at. I will then no longer process the data unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

12. Updates

This privacy policy is updated as soon as the services, forms or processing operations used change. This site is currently being rebuilt for international clients; I will keep this page in step with it.

Back to the home page