Controller
Steve Manera Productions e.U.
3200 Ober-Grafendorf, Lower Austria, Austria
Data processed and purposes
2.1 Server logs
When you open this website, our hosting provider (Vercel, Frankfurt region) records technically necessary log data: IP address, timestamp, URL requested, referrer, user agent. Legal basis: Art 6(1)(f) GDPR (legitimate interest in stable operation). Retention: 30 days.
2.2 Contact form (smart lead form)
If you contact us through the form on this website, we process: name, email, phone number (optional), business name (optional), message. Legal basis: Art 6(1)(b) GDPR (steps prior to entering into a contract) and Art 6(1)(a) GDPR (consent through the deliberate act of sending). Retention: up to 3 years after the last contact, then deletion. Purpose: handling your enquiry, preparing offers, customer care.
2.3 Audience measurement (Plausible Analytics)
We use Plausible Analytics (EU-hosted, cookieless, without personal tracking). Aggregated, anonymous usage statistics are recorded (page views, referrer, country, device type). No cookies, no persistent storage of IP addresses, no cross-site tracking. Legal basis: Art 6(1)(f) GDPR (legitimate interest in audience measurement without intruding on privacy).
2.4 Audience measurement (Vercel Web Analytics)
In addition, Vercel Web Analytics counts the page views of this website. Aggregated figures are recorded (page view, referrer, country, device type and browser); no cookies are set, no cross-device identifiers are assigned and no personal profiles are built. The IP address is only used to derive the country and is not stored. Processor: Vercel Inc., the same provider that operates this website (Frankfurt region), covered by the data processing agreement and standard contractual clauses. Legal basis: Art 6(1)(f) GDPR (legitimate interest in audience measurement without intruding on privacy).
2.5 Error tracking (Sentry)
In the event of technical errors, Sentry (EU region) records anonymised error data (error message, stack trace, browser version). No personal data from forms. Legal basis: Art 6(1)(f) GDPR (legitimate interest in stable operation).
2.6 Guest feedback (cockpit tool, cockpit.kiatelier.at)
For hospitality customers we offer the cockpit tool guest feedback: table QR code → rating 1–5, categories, optional free-text comment, optional contact email. Processed are: star rating, category tags, free-text comment (optional), contact email (optional, only if a reply is wanted), user agent (spam protection), table token (pseudonymised, no direct personal reference). Legal basis: Art 6(1)(f) GDPR (legitimate interest in measuring service quality); if a contact email is given, additionally Art 6(1)(a) GDPR (consent to a direct reply). Retention: anonymisation after 12 months (free-text comment, contact email, user agent → NULL; rating and categories remain for trend analysis), full deletion after 36 months (Postgres function anonymize_old_feedback_responses via pg_cron, daily at 03:45 UTC). Technical measures: row-level security tenant isolation, in-memory rate limit (5 submissions/10 min/IP+token).
2.7 Applicant management (cockpit tool, cockpit.kiatelier.at)
For hospitality customers we offer the cockpit tool applicant management (recording, assessing and status tracking of application data). Processed are: name, email address (additionally encrypted via pgcrypto/AES-256), phone number (additionally encrypted), position applied for, application source, status, internal rating 1–5, internal notes, file attachments (CV etc., URL reference). Legal basis: Art 6(1)(b) GDPR (pre-contractual measures at the request of the data subject); for unsuccessful applications, for the retention period, Art 6(1)(f) GDPR (legitimate interest in defending against claims under AGG/GlBG). Retention: anonymisation after 6 months (name, email, phone, notes, file attachments → NULL/ANONYMIZED; status and selection decision remain in the audit trail), full deletion after 24 months (Postgres function anonymize_old_hiring_applicants via pg_cron, daily at 03:30 UTC). The limitation periods under AGG/GlBG (14 days to notify plus 6 months to start proceedings in Austria) are covered by the six-month period. Encryption: in addition to Supabase encryption at rest, email and phone are encrypted on the application side with pgcrypto (AES-256, key PII_ENCRYPTION_KEY in the Vercel environment, not in the database). For a transitional period, plaintext columns remain as a read fallback until the application code is fully migrated (planned from 2026-06-01). Deletion request: the cockpit function “delete data” immediately sets personal data to NULL/placeholder; the audit trail remains.
Processors (Art 28 GDPR)
The following service providers process personal data on our behalf. Data processing agreements (DPA) are in place with all of them. All servers are located in the EU.
Vercel Inc.
Data processing agreement / DPASupabase, Inc.
Data processing agreement / DPAResend, Inc.
Data processing agreement / DPASentry (Functional Software, Inc.)
Data processing agreement / DPAPlausible Analytics (Plausible Insights OÜ)
Data processing agreement / DPAUpstash, Inc.
Data processing agreement / DPATransfer of data to third countries
For the website and the cockpit there is no regular transfer of data to countries outside the EU/EEA; the services used are hosted in the EU or offer EU-region data storage. If we set up AI workplaces for a business, their processing runs through a US provider — covered by standard contractual clauses in the data processing agreement, with no training on customer data.
Cookies
This website sets no tracking cookies. Technically necessary session cookies (authentication in the admin area) are set only after login and deleted after logout. The public pages set no cookies — the audience measurement described in 2.3 and 2.4 works without them.
Your rights
At any time you have the right to:
- Access to the data processed (Art 15 GDPR)
- Rectification of inaccurate data (Art 16 GDPR)
- Erasure (Art 17 GDPR)
- Restriction of processing (Art 18 GDPR)
- Data portability (Art 20 GDPR)
- Object to processing based on legitimate interests (Art 21 GDPR)
- Withdraw consent you have given (Art 7(3) GDPR)
An informal email to office@stevemaneraproductions.at is enough to exercise these rights.
Right to complain to the supervisory authority
You have the right to lodge a complaint with the Austrian data protection authority:
Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Vienna
www.dsb.gv.at
Changes to this privacy statement
We reserve the right to adapt this privacy statement to changes in the law or in our services. The current version is always available at kiatelier.at/datenschutz.