Privacy policy

Stand: August 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Mario Lemberger
Mario Lemberger
Altomontestrasse 13
4040 Linz
Austria
E-mail: design@mariolemberger.com
Phone: 069917911981

2. Overview of Processing Activities

The following overview summarizes the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of Data Processed

• Master data (e.g. names, addresses)
• Contact data (e.g. email addresses, phone numbers)
• Content data (e.g. entries in online forms)
• Usage data (e.g. pages visited, access times)
• Meta, communication and procedural data (e.g. IP addresses, timestamps)

Categories of Data Subjects

• Communication partners
• Users

Purposes of Processing

• Provision of the online offering and user experience
• Contact requests and communication
• Security measures
• Managing and responding to inquiries

3. Legal Bases

Below you will find an overview of the legal bases under the GDPR on which we process personal data:

• Consent (Art. 6(1)(1)(a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual inquiries (Art. 6(1)(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
• Legitimate interests (Art. 6(1)(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights of the data subject.

4. Hosting

This website is hosted on external servers provided by a hosting service provider. Personal data collected on this website is stored on the host's servers. This may include, in particular, IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access data, and other data generated via a website.

Hosting is carried out for the purpose of fulfilling contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of providing our online services securely, quickly, and efficiently through a professional provider (Art. 6(1)(f) GDPR).

5. Contact

When you contact us (e.g. via contact form, email, phone, or social media) and within the context of existing user and business relationships, the information provided by the inquiring party is processed to the extent necessary to respond to contact requests and any requested actions.

Contact requests are processed on the basis of Art. 6(1)(b) GDPR (contractual or pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interests). Contact requests may be retained for up to 3 years.

6. Newsletter

On this website you can subscribe to our newsletter. To do so, we need your email address; any further details are optional.

Registration takes place directly in the Double confirmation process (Double Opt-In): After submitting, you will receive an email with a confirmation link. You will only be registered once you click it. As proof of consent, the time of registration and confirmation as well as the IP address used are recorded.

The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw it at any time with future effect — via the unsubscribe link at the bottom of every newsletter or informally at the address above. Withdrawal does not affect the lawfulness of processing carried out prior to that point.

After unsubscribing, your address will be removed from the mailing list. Records of your original consent may be retained to meet documentation obligations (Art. 6(1)(f) GDPR).

Sending is handled by a specialized service provider with whom a data processing agreement pursuant to Art. 28 GDPR is in place. We are happy to tell you which provider this is upon request. Your address will be used exclusively for the newsletter and will not be sold to third parties.

7. Orders, Invoices and Payments

When you place an order on this website — for goods, vouchers, courses or a membership — we process the information required to do so: name, billing and delivery address, email address, and where applicable phone number, as well as the contents and status of your order. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).

If you create a customer account, we additionally store your login credentials (your password exclusively as a non-reversible hash), as well as your order history and wish list. You can request the deletion of your account at any time.

We retain invoices and booking records for as long as tax and commercial law requirements demand (in Germany generally 10 years under § 147 AO and § 257 HGB, in Austria 7 years under § 132 BAO). The legal basis is Art. 6(1)(c) GDPR.

Payment Service Providers

Payments are processed via Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin, Ireland). Your payment details — card number, bank account, or Klarna and SOFORT information — are entered directly with Stripe directly with Stripe. We neither see nor store them; only the payment identifier, the amount, and the status (open, paid, refunded) reach us.

If PayPal is enabled as a payment method, those transactions are handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg — again with payment details entered directly on their platform.

The transfer of payment-related data to the respective service provider is based on Art. 6(1)(b) GDPR (performance of a contract). The privacy notices of the respective provider also apply; they bear independent responsibility for processing carried out on their end.

We will send you order, payment, and shipping confirmations by email to the address you provided.

8. Cookies and Local Storage

Our website uses cookies and your browser's local storage. Cookies are small text files that cause no harm to your device. They are stored either temporarily for the duration of a session (session cookies) or permanently (persistent cookies).

Technically necessary are entries without which the website cannot function: your session, the contents of your shopping cart and wish list, a login token in the members' or course area, and your decision in the cookie notice itself. They are stored on the basis of Art. 6(1)(f) GDPR and § 25(2) TTDSG (in Austria § 165(3) TKG) and do not require your consent.

Einwilligungspflichtig ist die Besucherstatistik (siehe nächster Abschnitt). Sie startet erst, wenn Sie im Cookie-Hinweis zustimmen. Lehnen Sie ab, wird nichts gespeichert und nichts übertragen.

You can change your decision at any time via the link "Cookie Settings" in the footer of the website. The withdrawal takes effect immediately and does not affect the lawfulness of any processing carried out up to that point.

9. Visitor Statistics (Audience Measurement)

Um zu erfahren, welche Inhalte gefragt sind, führen wir eine einfache, datensparsame Statistik. Sie läuft ausschliesslich nach Ihrer Einwilligung (Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TTDSG bzw. § 165 Abs. 3 TKG).

The following data is collected:

• the page of this website you visited
• the referral source (the page you came from)
• the type of device (phone, tablet, or computer)
• a randomly generated identifier stored in your browser so that multiple visits can be grouped into a single session

Nicht erfasst werden Ihre IP-Adresse, Ihr Name oder sonstige Angaben, die Sie unmittelbar identifizieren. Es findet keine Zusammenführung mit anderen Daten und keine geräteübergreifende Wiedererkennung statt; die Daten werden nicht an Werbenetzwerke weitergegeben.

Statistics are handled by the platform on which this website is operated; that provider acts as our data processor in accordance with Art. 28 GDPR. Only the operator of this website can access the analytics.

The identifier remains in your browser's local storage until you delete it. You can remove it at any time via your browser settings or withdraw your consent via "Cookie Settings".

10. Use of Artificial Intelligence

Some texts and images on this website were created with the assistance of AI systems and subsequently reviewed by our editorial team. AI-generated images are labelled as such.

This content is created in advance, within the operator's editorial system. When you visit this website, none of your data is transmitted to providers of AI systems: no chatbot runs here, and no AI analysis of your behaviour takes place. No automated decision-making within the meaning of Art. 22 GDPR occurs.

The language models used in the editorial area are provided by Anthropic, OpenAI, and Google. Their providers store submitted inputs for up to 30 days for abuse detection and do not use them to train their models.

11. SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can identify an encrypted connection by the fact that the browser's address bar changes from "http://" to "https://" and by the padlock icon in your browser bar.

When SSL or TLS encryption is active, the data you transmit to us cannot be read by third parties.

12. Your Rights as a Data Subject

As a data subject, you have the following rights under the GDPR:

• Right of access (Art. 15 GDPR): You have the right to request confirmation as to whether personal data is being processed.
• Right to rectification (Art. 16 GDPR): You have the right to immediate rectification of inaccurate personal data.
• Right to erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data.
• Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your personal data.
• Right to object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data.
• Right to data portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right of withdrawal (Art. 7(3) GDPR): You have the right to withdraw any consent you have given at any time.
• Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement.

To exercise your rights, please contact: design@mariolemberger.com

13. Currency and Updates to This Privacy Policy

This Privacy Policy is currently valid and was last updated in August 2026. As our website and services evolve, or in response to changes in legal or regulatory requirements, it may become necessary to update this Privacy Policy. The latest version of our Privacy Policy is available on this page at any time.