How I handle your data.

Information according to Art. 13 GDPR

I work with as little personal data as possible. This website uses Google Tag Manager with consent settings denied by default, sets no cookies itself and stores nothing locally in your browser. This page lays out clearly when and why data is processed and what rights you have.

Last updated · July 2026

Controller

The controller for data processing on this website is Petra van Leeuwen, Dorf 22, 6136 Pill, Tyrol, Austria.

Contact: petra@pferdezeitpetra.at. Further details can be found in the legal notice.

At a glance

In short:

This website sets no cookies itself and stores nothing in localStorage or sessionStorage.
Google Tag Manager is integrated, but Consent Mode defaults are set to denied. As long as no consent manager is active, no analytics, advertising or personalisation storage is granted.
Personal data is processed when you contact me or visit the website (technically required server logs and the request for the GTM script).
I use service providers that are either based in the EU or certified under the EU-US Data Privacy Framework (DPF).
You can exercise your rights at any time by writing an informal email to petra@pferdezeitpetra.at.

Serving the website

When you access this website, my hosting provider automatically records technical connection data: your IP address, date and time, user agent, requested URL, HTTP status code and referrer.

The purpose is delivering the website, keeping it secure and analysing errors. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and functional website).

These server logs are automatically deleted after approximately 30 days.

Contact by email and via a form

When you reach me via the email address shown or through a contact form on this website, I process the data you send me (typically your name, email address and the content of the message) solely to answer your inquiry.

Legal basis is Art. 6(1)(b) GDPR (initiation or performance of a contract) as well as Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Emails are stored in a business mailbox hosted by Microsoft Outlook. Messages sent through a contact form on this website are delivered to that mailbox via the email service Resend, Inc. (USA).

I keep your message only for as long as necessary to answer it and follow up. If no further contact results from the inquiry, the message is deleted after twelve months at the latest. Statutory retention duties remain unaffected.

Google Tag Manager, cookies and local storage

In short: the website sets no cookies itself. Google Tag Manager is integrated, but all consent storage types are denied by default.

I use Google Tag Manager (GTM-MC4XDW3T) to manage website tags centrally and cleanly. When the GTM script loads, a connection to Google is established. In particular, the IP address, time of access, browser and device information, and the page visited may be transmitted to Google.

Before Tag Manager loads, Google Consent Mode sets ad_storage, analytics_storage, ad_user_data, ad_personalization, functionality_storage and personalization_storage to denied by default; security_storage remains granted for security reasons. As long as no consent manager is active, no opt-in is sent to Google.

This website sets no cookies itself and stores nothing in localStorage or sessionStorage. The language selection also works without a cookie: the current language is visible in the URL (/en for English, / for German). Server access logs (see section 03) are created on my hosting side, not on your device.

At the moment, no analytics tools, advertising pixels, social media plugins or external embeds such as Google Maps, YouTube or Vimeo are active. If services are added in the future that store or read information on your device, I will put a consent manager in place beforehand (such as Klaro) and update this policy.

Recipients, third countries and retention

I use the following service providers. Where a provider is located in a third country, the transfer additionally relies on Standard Contractual Clauses under Art. 46 GDPR. The US providers listed below are certified under the EU-US Data Privacy Framework.

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Hosting and delivery of this website. Processes server logs (retained for approximately 30 days).
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Provides Google Tag Manager. Processes technical request data when the GTM script loads. Google LLC is certified under the EU-US Data Privacy Framework.
Microsoft Corporation and Microsoft Ireland Operations Ltd. Provides the business email mailbox (Outlook). Processes the content of incoming and outgoing emails for as long as they remain in the mailbox.
Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Delivery of contact form messages to the mailbox. Message content and metadata are kept only for as long as needed for delivery.

Your rights and how to complain

You have the following rights towards me at any time:

To exercise your rights, an informal message to petra@pferdezeitpetra.at is enough. I will reply as quickly as possible, at the latest within the legally prescribed time limits.

You also have the right to lodge a complaint with the supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

Access (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing based on a legitimate interest (Art. 21 GDPR)

Currency of this policy

This privacy policy was last revised in July 2026. If the services I use or applicable law change, I will update it accordingly.