Privacy Policy
Last updated: 25 October 2026
1. Privacy at a glance
This privacy policy explains which personal data we process when you visit this website or contact us, why we do so, and what rights you have.
In short: this website uses no analytics or advertising services, no tracking pixels and no cookies. Third-party content (booking forms, videos, podcast players) loads only when you click on it.
2. Controller
The controller responsible for data processing on this website is:
Werchota.ai FlexKapG
Lindauer Straße 20c, Top 7
6911 Lochau, Austria
Email: malcolm@werchota.ai
Phone: +43 676 6144904
You can reach us at this address with any question about data protection or to exercise your rights.
3. Hosting and server log files
This website is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. The server is located in a Hetzner data centre in Germany (Falkenstein). Hetzner processes the data on our behalf under a data processing agreement (Art. 28 GDPR). Hosting involves no transfer of data to countries outside the EU.
Each time the website is accessed, the web server automatically stores information that your browser transmits (server log files):
- IP address
- date and time of the request
- page or file requested
- referrer URL (the page you came from)
- browser type and operating system
We need this data to run the website securely and reliably and to detect attacks. It is not combined with other data and is deleted automatically after 90 days at the latest, unless it is needed to investigate a security incident. The legal basis is our legitimate interest in operating the website securely (Art. 6(1)(f) GDPR).
4. Storage in your browser (no cookies)
To remember your settings, the website stores a few values in your browser's local storage: your chosen language, the starting situation you last selected, and any filters you set. These values stay on your device and are not sent to us. You can delete them at any time in your browser settings.
This storage is technically necessary for the function you requested (§ 165(3) TKG 2021; Art. 6(1)(f) GDPR).
5. Enquiry form (submit a use case)
If you send us a use case through the form on this website, we process the information you enter:
- your description of the request and your answers to the questions in the form
- name, company, role, email address and, if provided, phone number
- the page from which you sent the form, and its language
The data is transmitted in encrypted form to our server at Hetzner and used only to handle your enquiry. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and the consent you give in the form (Art. 6(1)(a) GDPR). We delete the data once your enquiry has been fully handled, unless statutory retention obligations apply or it leads to an engagement.
6. Contact by email or phone
If you contact us by email or phone, we process your details (name, contact details, content of the enquiry) to handle your request. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, and otherwise our legitimate interest in responding (Art. 6(1)(f) GDPR).
For email we use Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes the data on our behalf.
7. Booking and forms via Fillout
For appointment requests and some forms we use Fillout, a service of Fillout, Inc., USA. The form loads only when you click the corresponding button (e.g. “Book a call”). From that moment, your IP address and the information you enter in the form are transmitted to Fillout.
The legal basis is your request (Art. 6(1)(b) GDPR) or your consent given by clicking (Art. 6(1)(a) GDPR). Data may be transferred to the USA. The transfer is based on the European Commission's standard contractual clauses (Art. 46 GDPR).
8. Videos (YouTube) and podcast players (Spotify)
On some pages you can play YouTube videos. A video loads only when you click it, and then in privacy-enhanced mode (youtube-nocookie.com). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you click, your IP address and technical data are transmitted to Google; a transfer to the USA is possible. Google is certified under the EU-US Data Privacy Framework.
Likewise, podcast players from Spotify (Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden) load only after you click.
In each case the legal basis is your consent given by clicking (Art. 6(1)(a) GDPR). Without a click, no data is transmitted to these providers.
9. Links to other websites
The website contains links to external services such as LinkedIn, Spotify, Apple Podcasts, YouTube and our community at chief.werchota.ai. You leave this website only when you click such a link. The respective provider is responsible for data processing there.
10. SSL/TLS encryption
For security reasons this website uses TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar.
11. Your rights
You have the right at any time to access the data we hold about you (Art. 15 GDPR), and to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).
Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). Where processing is based on our legitimate interest, you can object to it on grounds relating to your particular situation (Art. 21 GDPR).
Simply write to malcolm@werchota.ai.
12. Right to lodge a complaint
If you believe that we are not processing your data lawfully, you can lodge a complaint with the supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.
13. Changes to this privacy policy
We update this privacy policy when the website or the services we use change. The version published here applies.