Privacy policy

Last updated 7 November 2026

This Privacy Policy applies when you visit our website, contact us with an enquiry or work with us in connection with our services.

1. Data controller and contact details

Dipl.-Ing. Julia Rosa-Leitner
Rosa-Leitner Interiors
Schreibühelweg 35a
6370 Kitzbühel
Austria

Telephone +43 664 2001832
Email office@rosaleitner-interiors.com

You can use these contact details to ask questions about data protection or exercise your rights.

2. Website and hosting

Our website is hosted by Wix.com Ltd., Israel. When you visit the website, Wix processes the data needed to deliver it and keep it secure. This includes, in particular, your IP address, the time of access, the page requested and technical information about your connection, browser and device.

This processing allows us to operate the website, detect technical issues and prevent misuse. The legal basis is our legitimate interest in providing a secure and reliable website under Article 6(1)(f) of the GDPR. Wix processes website visitor data under its Data Processing Agreement and uses subprocessors to provide its services. See section 10 for information about processing outside the European Economic Area. Wix Privacy Policy · Data Processing Agreement · Subprocessors

3. Cookies and cookie settings

Our website uses cookies and similar technologies that can store or access information on your device. Strictly necessary technologies enable the website functions you request, protect the website and help us apply your cookie preferences. Where this involves processing personal data, the legal basis is our legitimate interest in keeping the website secure and applying your preferences under Article 6(1)(f) of the GDPR.

Access to your device that is not technically necessary requires your prior consent under section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). Where this involves processing personal data, the legal basis is your consent under Article 6(1)(a) of the GDPR. Overview of cookies and their lifetimes as documented by Wix

You can set your preferences through Tornado’s Cookie Consent & GDPR banner. You can reject optional cookies directly in the banner. To reopen your settings, select the cookie icon at the edge of the screen. You can change your preferences there. To withdraw consent, select the option to reject all cookies. Cookie app provider information

4. Wix Analytics

Wix provides built-in visitor statistics to help us understand how our website is used and improve it. Depending on the report, Wix may process information about the pages visited, traffic sources, the timing and duration of visits, and the device and browser used. The provider is Wix, as described in section 2.

Optional visitor tracking requires your prior consent. Where it involves processing personal data, Article 6(1)(a) of the GDPR applies. Section 165(3) of the TKG 2021 also applies to access to your device. You can change your preferences using the cookie icon. Wix Analytics and consent

5. Contact form, email and spam protection

If you contact us through the contact form, we process your name, postal address, email address and the information you provide about your project. Providing your telephone number is optional. If you contact us by email or telephone, we process the contact and project details you share with us, along with any attachments you provide. We use this information to respond to your enquiry and, where appropriate, prepare a proposal.

For enquiries about entering into a contract with you, the legal basis is Article 6(1)(b) of the GDPR. We handle general enquiries and communications with company representatives under Article 6(1)(f) of the GDPR, based on our legitimate interest in effective business communication. To respond to an enquiry, we need the relevant contact and project details.

The contact form is provided through Wix Forms. Our business email service is provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. For this service, IONOS processes information including sender and recipient addresses, messages, attachments and the technical data needed for secure delivery. IONOS Privacy Policy

We protect the form using the Wix setting Advanced & reCAPTCHA. Wix uses its own spam filters and integrates Google reCAPTCHA. To detect automated submissions, the service may analyse technical information about the connection, browser and device, as well as how the form is used. The Wix filters may also take the contact details entered into account. If suspicious activity is detected, an additional check may be displayed. Google reCAPTCHA may set the _GRECAPTCHA cookie to assess risk.

Necessary spam prevention is based on our legitimate interest in keeping the contact form secure and functional under Article 6(1)(f) of the GDPR. Any access to your device that is not strictly necessary for the form you expressly request requires your prior consent under section 165(3) of the TKG 2021. Article 6(1)(a) of the GDPR applies to any processing of personal data based on that consent. Wix deletes submissions marked as spam after 30 days if they remain marked as spam. Wix guidance on form protection · Google reCAPTCHA information

6. Proposals, engagements and work with project partners

To prepare proposals, fulfil contracts, schedule appointments, coordinate projects and handle billing, we process contact and contract details, correspondence, project information such as plans and photographs of interiors, and billing and payment data.

Article 6(1)(b) of the GDPR is the legal basis for taking steps at your request before entering into a contract and for performing a contract with you. Article 6(1)(c) of the GDPR applies to legal obligations such as retaining tax records. When working with company representatives, we rely on our legitimate interest in coordinating the project under Article 6(1)(f) of the GDPR for the processing necessary for that purpose.

Depending on the engagement, appointed tradespeople, manufacturers, suppliers or other project partners receive the information they need for their role. We may also obtain contact details for people involved in a project from clients or participating companies. We use those details to coordinate the project. Where Article 14 of the GDPR applies, we provide the individuals concerned with further information about how their data is processed and where we obtained it.

7. Online design consultations

We use Zoom or Microsoft Teams for scheduled online meetings, depending on the appointment. We process contact and appointment details, documents shared for the consultation, and video and audio for live transmission. This may also include chat messages, screen-sharing content and technical connection data such as IP addresses, display names and the length of participation. We do not record meetings or create transcripts.

We process this information to prepare for and provide the consultation under Article 6(1)(b) of the GDPR. For company representatives, the legal basis is our legitimate interest in business communication under Article 6(1)(f) of the GDPR.

When we use Zoom, Zoom Communications, Inc., USA, and its contracted service providers may process data. For Microsoft Teams, the entities involved may include Microsoft Ireland Operations Limited, Ireland, and Microsoft Corporation, USA, depending on the account. See section 10 for information about transfers outside the European Economic Area. Zoom Privacy Statement · Microsoft Privacy Statement

8. Project photographs and references

We use photographs and plans to carry out your project. We generally publish project photographs, client testimonials and other references without personal data. If these materials could identify anyone, we obtain their freely given consent under Article 6(1)(a) of the GDPR before publication and explain the purpose and scope. You may withdraw your consent at any time with effect for the future using the contact details in section 1.

9. Links to social networks

Our website contains links to social networks. When you open a link, you visit the corresponding platform. The platform provider’s privacy policy applies to processing on that platform.

10. Recipients and transfers outside the European Economic Area

In addition to the technical service providers and project partners mentioned above, recipients may include tax advisers, accounting service providers, banks, and competent authorities or courts, where this is necessary for the relevant purpose or required by law.

Wix processes data in Israel, for which the European Commission has adopted an adequacy decision. Wix also uses affiliated companies and subprocessors in other countries, including the United States. For onward transfers to third countries, the Wix Data Processing Agreement provides for Standard Contractual Clauses or other appropriate safeguards under Article 46 of the GDPR. Wix Data Processing Agreement · Wix subprocessors

Data may also be processed outside the European Economic Area in connection with the integrated spam protection and the online meeting services described above. For transfers to US recipients, the adequacy decision for the EU–U.S. Data Privacy Framework may apply where the specific transfer is covered by the recipient’s valid certification. Where no relevant adequacy decision applies, appropriate safeguards under Article 46 of the GDPR, such as the EU Standard Contractual Clauses, may be used. For information about the safeguards used for a particular transfer, or to obtain a copy where applicable, please use the contact details in section 1. European Commission adequacy decisions

11. Retention and deletion

Enquiries that do not lead to an engagement are kept until we have finished dealing with them. We then delete them unless the records are needed for a follow-up matter, to comply with a legal obligation or to establish, exercise or defend legal claims where necessary.
Contract and project records are kept for the duration of the engagement and until all related matters are settled. Afterwards, we retain only the records required to comply with legal obligations or to establish, exercise or defend legal claims where necessary.
Records subject to tax retention requirements are generally kept for seven years from the end of the relevant calendar year under section 132 of the Austrian Federal Fiscal Code (BAO). Pending proceedings or specific legal obligations may require a longer period.
Technical access data is needed for as long as it serves website operation, security and troubleshooting. For a specific incident, the period depends on how long it takes to investigate the incident and pursue any necessary legal action.
References containing personal data remain published until the agreed purpose for publication ends or you withdraw your consent. Where necessary, we retain evidence of consent to comply with the obligation to demonstrate consent under Article 7(1) of the GDPR.
Emails, form submissions and copies of project files are subject to the deletion criteria for the matter to which they relate. The retention period for spam submissions is set out in section 5.

12. Your rights and how to complain

Subject to the conditions set out in the GDPR, you have the right to access your personal data and obtain a copy (Article 15), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18) and to data portability (Article 20).

Right to object. Under Article 21 of the GDPR, you may object on grounds relating to your particular situation to processing based on legitimate interests under Article 6(1)(f) of the GDPR.

You may withdraw your consent at any time with effect for the future. This does not affect the lawfulness of processing before you withdrew your consent. To exercise your rights, please use the contact details in section 1. For cookie consent, you can use the cookie icon.

You may lodge a complaint with a competent data protection supervisory authority. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna. Lodge a complaint with the Austrian Data Protection Authority · dsb@dsb.gv.at