Privacy Policy

Privacy Policy

RC-Creations OG | Version: 15 September 2026

1. Controller

The controller responsible for processing personal data in connection with this website is:

RC-Creations OG

Weinberggasse 7

6800 Feldkirch

Austria

Email: robert@rc-creations.at

Company register number: FN 675582 d | VAT ID: ATU83355389

2. General information

We process personal data in accordance with applicable data protection law, in particular the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act and, where applicable, the Austrian Telecommunications Act 2021.

This Privacy Policy describes processing in connection with rc-creations.at. Under the current technical setup, the website does not use tracking cookies, Google Analytics or Meta Pixel.

3. Hosting and technical provision of the website

The website, its backend, database and all images and videos provided through the website are operated on a server administered by our technical service provider and hosted by xneelo in Johannesburg, South Africa.

When a website is technically delivered, data such as the IP address, access time, requested resource and technical browser/device information may be processed where required for secure and functional operation. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and technically error-free operation of our website.

South Africa is a third country outside the EU/EEA. Where personal data is transferred there in connection with hosting or technical administration, the safeguards required under Chapter V GDPR must be implemented, in particular the EU Standard Contractual Clauses where required. Appropriate data processing agreements must be concluded with processors.

Our technical administrator, Aiden Hemmings, has administrative/technical access where necessary to website data, including contact form submissions, the website database and retained visitor statistics. Access is limited to legitimate administration, maintenance and support purposes.

4. Contact form

When you contact us through our contact form, we process the information you provide in order to handle your enquiry and take steps prior to entering into a contract.

The data processed includes: name, email address, company (optional), selected services, message, date and time of submission and, technically, the IP address at the time of submission.

The legal basis is Article 6(1)(b) GDPR where the enquiry concerns steps prior to entering into a contract, and Article 6(1)(f) GDPR for other business enquiries. Our legitimate interest is handling and documenting incoming enquiries.

If no contractual relationship results, contact enquiries should generally be deleted no later than six months after final handling, unless statutory retention duties or legitimate reasons require longer storage. Where a contract is concluded, relevant data may be retained for longer in accordance with statutory retention periods and contractual documentation requirements.

Contact form data is stored in the website’s own database on the server located in South Africa and is not transmitted through an external form provider.

5. First-party visitor statistics

The website uses simple first-party visitor statistics without cookies and without an external analytics provider.

The page visited, referring page, time of visit and browser/device information (user agent) may be recorded. The IP address is technically available during transmission but is immediately anonymised for visitor-statistics purposes so that the full IP address is not retained in the statistics.

Processing is based on Article 6(1)(f) GDPR. Our legitimate interest is privacy-conscious internal analysis of website usage and technical optimisation of our website.

Anonymised statistics are not shared with external analytics providers. Once information has been irreversibly anonymised and is no longer personal data, the GDPR no longer applies to that information.

6. Language preference / Local Storage

The website stores your selected language (German/English) locally in your browser using Local Storage so that your preference can be retained across page views.

According to our technical service provider, this language preference contains no personal data and is not used for tracking or advertising. You can delete Local Storage data through your browser settings.

7. Fonts

Fonts used on the website are intended to be hosted locally on our own server. This means that loading fonts does not establish a connection to Google Fonts and no IP address is transmitted to Google for this purpose.

This description applies once local font hosting has been technically implemented. Before this Privacy Policy is published, it must be verified that Google Fonts are no longer loaded directly from Google servers.

8. Social media links

Our website contains ordinary links to external social media services, in particular Instagram and TikTok. No social media feeds, plugins, share buttons or tracking scripts from these providers are embedded in the website.

Only when you click such a link do you leave our website. Any subsequent processing by the relevant provider is governed by that provider’s privacy information.

9. Email communication

Our business email is operated through Google Workspace (Gmail). If you contact us by email, the information you send is processed for the purpose of handling the communication.

Depending on the context, processing is based on Article 6(1)(b) GDPR (pre-contractual steps/contract) or Article 6(1)(f) GDPR (general business communication and documentation). Google may act as a processor; the applicable Google data protection agreements and, where required, appropriate safeguards for international transfers must be in place.

10. Cookies and consent banner

Under the current technical setup, this website does not use tracking, marketing or analytics cookies. A consent banner for such purposes is therefore currently not required.

If non-essential cookies, external tracking services or comparable technologies are introduced in the future, they will only be activated after obtaining consent where required and this Privacy Policy will be updated accordingly.

11. Recipients and processors

Personal data is made available only to persons and service providers who need it for the relevant purposes. These may include our technical administrator, hosting provider xneelo and Google Workspace in connection with email communication.

Where required, data processing agreements under Article 28 GDPR must be concluded with processors.

12. International transfers

Hosting and technical administration may involve processing of personal data in South Africa. Where no adequacy decision of the European Commission applies, such transfers are based on appropriate safeguards under Article 46 GDPR, in particular the European Commission’s Standard Contractual Clauses where required.

Other service providers may also involve international transfers. Where this occurs, the safeguards required by applicable law will be implemented. Information regarding applicable safeguards can be requested at robert@rc-creations.at.

13. Retention

We retain personal data only for as long as necessary for the relevant purpose or as required by statutory retention and evidentiary obligations. Specific retention periods are described above where applicable. Statutory retention duties, including those applicable to business and tax records, remain unaffected.

14. Your rights

Subject to the applicable legal requirements, you have rights including access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

To exercise your rights, contact us at robert@rc-creations.at.

15. Right to lodge a complaint

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a competent supervisory authority. In Austria, the competent authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde).

16. Automated decision-making

No solely automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place in connection with this website.

17. Changes to this Privacy Policy

We may update this Privacy Policy if our website, the services used or applicable law changes. The version published on the website at the relevant time applies.