fussfessel-hilfe.at
← Back to home

Privacy Policy

Version 1.8 of 10 October 2026

Protecting personal data matters to me. This policy describes what data is processed when you visit and use this service, for what purpose and on what legal basis. It fulfils the information obligations under Art. 13 and 14 of the General Data Protection Regulation (GDPR) as well as the requirements of the Austrian Data Protection Act (DSG) and sec. 165 of the Austrian Telecommunications Act 2021 (TKG 2021).

1. The essentials first

  • Visitor statistics work without cookies and without recognising individual persons.
  • Your entries stay on your own device. There is no account and no login.
  • Personal data is neither sold nor passed on to third parties for advertising purposes.

2. Controller

The controller within the meaning of Art. 4 (7) GDPR is:

Robert Thalhammer
Grabengasse 13/3/2
2630 Ternitz
Niederösterreich, Austria
E-mail: info@fussfessel-hilfe.at

No data protection officer has been appointed because the statutory conditions of Art. 37 GDPR are not met. All data protection enquiries go directly to the address above.

3. Hosting and servers

This website is hosted by IONOS SE, Elgendorfer Strasse 57, 56410 Montabaur, Germany. The servers are located in Germany and therefore within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS.

4. Server log files

When the website is accessed, data transmitted by the browser is automatically stored in server log files:

  • IP address of the requesting device
  • date and time of access
  • name and URL of the file retrieved
  • volume of data transferred and notification of successful retrieval
  • browser type, browser version and operating system
  • where applicable, the previously visited page (referrer)

This data serves technical operation, troubleshooting and the prevention of attacks. The legal basis is Art. 6 (1) (f) GDPR. Log files are generally deleted automatically after no more than seven days. This data is not merged with other data sources.

5. Visitor statistics (Cloudflare Web Analytics)

Cloudflare Web Analytics, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, is used to measure reach.

Cloudflare Web Analytics works without cookies and without recognising individual persons. Only aggregated values such as page views, country of origin, approximate loading time and browser and device type are collected. No profile is created, no cross-device tracking takes place, and the IP address is not stored.

The legal basis is Art. 6 (1) (f) GDPR. The legitimate interest lies in understanding which content is in demand and whether the website is working correctly. The data is stored for a maximum of seven days. The transfer to the USA is based on the Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR; Cloudflare is additionally certified under the EU-US Data Privacy Framework.

6. Cookies

No cookies are set — neither our own nor those of third parties. Only strictly necessary entries in the browser's local storage are used: the entry that allows the generated file to be retrieved again (seven days at most), the confirmation of the terms of use (24 hours at most) and the temporary storage of entries in session storage (only for the duration of the session, so that they are not lost on reload). All three serve only the function requested by the user; no consent is required for them under sec. 165 (3) TKG 2021. All entries can be deleted immediately at any time via the button in the assistant. A consent banner is therefore not required.

7. Data that stays on your own device

All entries made in the assistant are processed exclusively in the browser on your own device. The finished PDF file is generated locally in the browser. No input data is transmitted to the provider or stored there.

So that the generated file can be retrieved again, an entry is created in the browser's local storage (localStorage) and automatically deleted after seven days at the latest. In addition, confirmation of the terms of use is stored locally for a maximum of 24 hours.

So that entries are not lost if the page is accidentally reloaded, they are additionally kept in the browser's session storage (sessionStorage) while you work. This storage applies only to the respective browser window or tab, is deleted by the browser when it is closed and is removed automatically when the session ends (after two hours) at the latest. This temporary storage does not leave your own device either.

A button in the assistant allows all of this local data to be deleted immediately at any time.

8. Special note on criminal-law data

The information entered in the assistant may contain data relating to criminal convictions and offences within the meaning of Art. 10 GDPR. That is precisely why the service is built so that this information never leaves your own device: it is processed exclusively locally in the browser, is not transmitted to the provider and is not stored there.

The provider therefore never obtains knowledge of the content of the completed forms. Anyone who passes on the generated PDF file decides to do so entirely on their own.

9. Payment processing (Mollie)

Paid services are processed via Mollie, operated by Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. Mollie is a payment institution licensed in the Netherlands and handles the payment transaction only. The provider itself is the seller and the contracting party.

Payment data (in particular card or account details) is processed exclusively by Mollie and is at no time visible to the provider. Mollie is the controller for that processing; Mollie's privacy policy applies in addition.

Only the information required for the payment is transmitted to Mollie: amount, description of the service, an order number assigned by the provider and the e-mail address given by the customer. Only the following is returned to the provider: payment status, means of payment used, amount and time.

Mollie is based in the Netherlands and processes the data within the European Union. For card payments, transmission to the relevant card scheme may be necessary; details can be found in Mollie's privacy policy. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR for tax retention.

10. Order data on the web server

In order to process the purchase, the provider creates an order record on its web server. It contains: a randomly generated order number, the service purchased, the amount, the time, the payment status, the means of payment used, the invoice number, the unlock code generated, the e-mail address given by the customer and the record of consent to immediate performance: that the tick box was checked before payment, the time, the language and the wording of the declaration.

The content of the completed forms is not included. It never reaches the provider and is not stored anywhere.

The e-mail address is used exclusively to deliver the contract confirmation under sec. 7 (3) FAGG, the invoice and the unlock code. It is not used for advertising, not analysed, not combined with other data and not passed on to third parties.

The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR in conjunction with sec. 132 BAO. The provider stores the record of consent in order to be able to prove that the right of withdrawal has expired under sec. 18 (1) no. 11 FAGG (Art. 6 (1) (f) GDPR); it is retained together with the order record. Records relevant for accounting are retained for seven years and deleted thereafter. The unlock code is valid for seven days from payment and for no more than three devices; whichever occurs first ends its validity. For this purpose a random device identifier is stored for each activation; it permits no conclusions about the device or the person.

The server additionally keeps a technical log of the payment processes (time, order number, payment status, error messages). It serves troubleshooting only, contains no e-mail addresses and is deleted after no more than 90 days.

11. Purchase data and Art. 10 GDPR

The contents of the completed forms never reach the provider. Through the payment process, however, the provider does learn that a particular e-mail address purchased this product. Because that permits an inference about pending or concluded criminal proceedings, this data set is given special protection:

  • It is used exclusively to process the purchase and to meet tax obligations (Art. 6 (1) (b) and (c) GDPR).
  • It is not used for advertising, analysis, statistics or profiling and is not passed on to third parties.
  • No customer database and no purchase history relating to individual persons is maintained; the order records stand side by side without being linked.
  • Only the controller has access.
  • The records required for tax purposes under sec. 132 BAO are retained (seven years). No records beyond that are created.
  • The card or account statement shows the designation “EüH-Antragsassistent”; the name of the website does not appear there. The exact wording is assigned by the payment service provider and the account-holding bank; the provider has only indirect influence on it and it may change.

12. Translation function

A translation function can be called up on the website which uses the MyMemory service of Translated S.r.l., Via Indonesia 23, 00144 Rome, Italy. The service is only loaded after express consent. The text section to be translated is transmitted to Translated S.r.l. (established in the EU, no third-country transfer); the provider of this website does not receive it. Please do not enter any personal or criminal-law-related information into the translation function. The legal basis is Art. 6 (1) (a) GDPR (consent). Without consent, no connection is established.

13. Contact form

A contact form is available on the website. What is transmitted is the message entered there and the sender's address; any further details are optional. The message is delivered to the provider's mailbox and processed there like an ordinary e-mail. No third-party form service is embedded.

The legal basis is Art. 6 (1) (b) GDPR for enquiries relating to a contract and Art. 6 (1) (f) GDPR for other enquiries. Enquiries are deleted once they have been finally dealt with.

Important: the form is intended for general questions about the procedure and the product. Please do not submit any information about criminal proceedings, convictions or health data through it. Such information is not needed in order to answer your question.

14. Withdrawal via the website

A "Withdraw from contract" button is available on every page for withdrawing from the contract. It leads to a short form. What is transmitted is the name, the e-mail address for the acknowledgement of receipt, the invoice or order number or the date of purchase, and the time of receipt. No reason is requested.

The statement is delivered to the provider's mailbox; at the same time the customer receives an acknowledgement of receipt stating the content of the statement and the date and time of receipt. The only record kept on the web server is an entry in the technical log with the time and the invoice or order number, without name or e-mail address; it is deleted after 90 days at the latest. No third-party form service is embedded.

The legal basis is Art. 6 (1) (c) GDPR in conjunction with sec. 13a FAGG (withdrawal function and acknowledgement of receipt) and Art. 6 (1) (b) GDPR for handling the withdrawal. The statement and the acknowledgement form part of the records of the purchase concerned and are retained for seven years under sec. 132 BAO.

Important: please do not submit any information about criminal proceedings, convictions or health data through the form — it is not needed for the withdrawal.

15. Contact by e-mail

Anyone who makes contact by e-mail thereby transmits their e-mail address and the content of the message. This information is used exclusively to process the enquiry.

The legal basis is Art. 6 (1) (b) GDPR for enquiries relating to a contract and Art. 6 (1) (f) GDPR for other enquiries. E-mail traffic is processed by the respective e-mail provider, who acts as a processor in this respect. Enquiries are deleted once they have been finally dealt with. Anything kept longer is kept only because a statutory retention obligation applies — which concerns solely business correspondence that serves as an accounting record and must be retained for seven years pursuant to sec. 132 of the Austrian Federal Fiscal Code (BAO).

16. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

17. Is providing data mandatory?

  • The service can be used without providing any data. Only the data that arises technically when the website is accessed is processed, plus the details in an e-mail if someone writes.

There is no statutory obligation to provide personal data.

18. Retention periods

Personal data is stored only for as long as is necessary for the respective purpose or as required by statutory retention obligations. The specific periods are stated with the individual processing operations above. In addition:

  • server log files: seven days at most, in so far as the provider keeps them itself
  • e-mail enquiries: until the matter has been finally dealt with
  • records of consent given: for the duration of the accountability obligation under Art. 5 (2) GDPR
  • accounting and invoicing documents: seven years pursuant to sec. 132 BAO

19. Recipients and transfers to third countries

Personal data is not sold and is not passed on to third parties for advertising purposes. Disclosure takes place only to the service providers named above and to public authorities where there is a statutory obligation to do so, as well as to the tax adviser and bank to the extent necessary.

Where data is transferred to third countries outside the EU and the EEA, this takes place only on the basis of an adequacy decision of the European Commission or the Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR. The applicable basis is stated with each affected processing operation above.

20. Rights of data subjects

Under the GDPR you have the following rights:

  • Access (Art. 15 GDPR): which data is being processed
  • Rectification (Art. 16 GDPR): to have inaccurate data corrected
  • Erasure (Art. 17 GDPR): to have data deleted, unless a retention obligation applies
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR): to receive the data in a common format
  • Objection (Art. 21 GDPR) to processing based on a legitimate interest
  • Withdrawal of consent (Art. 7 (3) GDPR), at any time and with effect for the future

An informal message to the e-mail address above is sufficient to exercise these rights. A reply will be given within the statutory period of one month. To prevent misuse, proof of identity may be requested in case of doubt.

Separate notice of the right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of a legitimate interest under Art. 6 (1) (f) GDPR. Where your data is processed for direct marketing purposes, you may object at any time and without giving reasons; your data will then no longer be processed for that purpose. An informal objection to the e-mail address above is sufficient.

21. Right to lodge a complaint

Anyone who believes that the processing of their data infringes data protection law may lodge a complaint with the supervisory authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40-42, 1030 Wien, Austria
Phone: +43 1 52 152-0 · E-mail: dsb@dsb.gv.at · www.dsb.gv.at

22. Data security

The website is delivered exclusively over an encrypted TLS/HTTPS connection. Accounts are secured with strong, individual passwords and — where available — two-factor authentication. On the controller's side, only the controller has access. In addition, the service providers named above have access within the scope of their respective services, bound by confidentiality and — where they act as processors — by a contract pursuant to Art. 28 GDPR.

23. Changes to this privacy policy

This privacy policy is updated whenever the processing operations change — for example when a service is added or removed. The version published on this page is the one that applies.

Controller

Robert Thalhammer
Grabengasse 13/3/2
2630 Ternitz
Niederösterreich, Austria
E-mail: info@fussfessel-hilfe.at

Last updated: 10 October 2026