Privacy Policy
Last updated: October 2026
Who is responsible
The controller for this website under the EU General Data Protection Regulation (GDPR) is:
Katarina Novak e.U.
Liebenauer Hauptstraße 82c
8041 Graz, Austria
Email: [email protected]
For any question about your data, write to the email address above.
What this website collects
Visiting the site
When you open this website, the hosting provider automatically records technical data that every browser sends: your IP address, the date and time of the request, the page or file requested, the referring page, and your browser and operating system. This is needed to deliver the site and keep it secure. The legal basis is my legitimate interest in running a secure website (Art. 6(1)(f) GDPR). These logs are kept only as long as needed for that purpose and are not combined with other data.
Contact form
When you send a request through the contact form, I receive your name, email address, the services you selected, the number of views, the deadline and your message. I use this only to answer your enquiry and prepare a quote. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
If the enquiry leads to a project, the correspondence becomes part of the project records and is kept as long as Austrian law requires for business records, usually seven years. If it doesn't, I delete it once the enquiry is closed. Form messages are delivered by Formspree, Inc., which processes them on my behalf under a data processing agreement.
Cookies and local storage
This website does not use tracking, analytics or advertising cookies. It stores two small entries in your browser's local storage: one to remember that you closed the cookie notice, and one for your language choice. These entries contain no personal data and never leave your device. You can delete them at any time in your browser settings.
Fonts, images and video
Fonts, images and the video are served from this website itself. The site does not load Google Fonts, social media plugins, maps, embedded videos or analytics tools, so no data is sent to those providers when you visit.
Who receives your data
I don't sell or rent personal data. It is shared only with the service providers I need to run this website, and only to the extent needed: Cloudflare, Inc. hosts the website and delivers it to your browser, and Formspree, Inc. forwards contact form messages to my mailbox. Both companies are based in the USA. Where a provider is located outside the EU or EEA, the transfer is protected by an adequacy decision, such as the EU-US Data Privacy Framework, or by the EU Standard Contractual Clauses.
Your rights
Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interest. To use any of these rights, email me at the address above.
You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
Changes to this policy
I may update this policy when the website or the law changes. The date at the top shows the latest version.
Back to the portfolio