Privacy policy

The controller responsible for your personal data within the meaning of Article 4(7) GDPR is Less Web Studio, Vienna, Austria.

For all privacy enquiries, including exercising your rights under the GDPR or the CCPA, write to [email protected].

We have not appointed a data protection officer, as the criteria in Article 37(1) GDPR are not met.

This policy applies to the website at lesswebstudio.com, including the project brief form and the website audit tool, and to correspondence arising from them.

It does not apply to third-party websites reached through links published here. Their operators are responsible for their own content and processing.

Project brief form. Your name, your email address, the answers you select or type in the questionnaire, and the interface language you completed it in.

Optional details, processed only where you provide them: company name, company email address, telephone number, preferred means of contact, and a Telegram username or WhatsApp number where you choose either.

Email correspondence. Where you write to us, the content of your message and your address.

Website audit tool. The website address you submit, the resulting report, and the unguessable link the report can be reopened with. The tool asks for no contact details, and we do not connect a report to you unless you tell us it is yours.

Analytics and advertising measurement. Pages viewed, referring channel, browser, operating system, language, and — where you accept — pseudonymous device and cookie identifiers and the identifier of an advertisement you clicked. Until you accept, none of it is tied to an identifier for you or your device.

We do not collect precise or approximate location or GPS data, contacts, microphone input, or files from your device.

We store neither your IP address nor your user agent alongside an enquiry. IP addresses are held in memory for rate limiting only and are never written to storage.

We do not knowingly collect any data from children. See Children below.

We do not sell, rent or trade personal data, and we do not share it for cross-context behavioural advertising.

To answer your enquiry and to take steps at your request before entering into a contract: your name, email address and questionnaire answers. Article 6(1)(b) GDPR.

To run an audit you asked for and to keep the report reachable at its link: the address you submitted and the report. Article 6(1)(b) GDPR, and Article 6(1)(f) for keeping a record of the reports we have issued.

To keep a record of enquiries received and quotations issued where no contract follows: our legitimate interest under Article 6(1)(f) GDPR.

To understand how the site is used, which pages and channels work, and whether an advertisement led to an enquiry: analytics and advertising data, on the basis of your consent under Article 6(1)(a) GDPR and §165(3) of the Austrian Telecommunications Act 2021. Where consent is refused, the measurement continues without cookies or identifiers, on the basis of our legitimate interest in aggregate statistics under Article 6(1)(f).

To meet legal obligations, in particular invoicing, accounting and tax: Article 6(1)(c) GDPR.

Giving us your data is voluntary and is required by neither statute nor contract. Without a name and an email address, though, we cannot answer an enquiry.

This website uses Google Analytics 4 and Google Ads, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to count visits, see which pages are read, see which channel visitors arrive by, and measure whether an advertisement led to an enquiry.

Where you consent, cookies are set: _ga and _ga_ followed by an identifier for Analytics, with a maximum lifetime of two years, and _gcl cookies for Google Ads.

Google's tag runs from the first page with every kind of storage switched off, under Google Consent Mode. Until you accept through the banner, it sets no cookies and stores no identifier on your device; it sends the address of the page you are on, which includes any advertising click identifier that address carries, but nothing that identifies you or your device. Accepting switches storage on. Refusing leaves it off.

IP addresses are anonymised by Google Analytics in all cases. Advertising storage, ad personalisation and ad user data are switched on only where you accept, and remain off otherwise.

You can withdraw consent at any time, with effect for the future, using the cookie settings control in the site footer. Withdrawing switches storage back off and deletes the Analytics and Ads cookies already set. Processing carried out before you withdrew remains lawful.

The project brief is held in the page while you fill it in and is sent only when you submit it. Nothing about it is saved in your browser: an older version of this site kept an unfinished brief under the key less.brief.v1, and the current one deletes that entry if it finds it.

Your answer to the cookie banner is stored under the key less.consent.v1 to record the choice you made.

Neither needs consent: the first is strictly necessary for a service you expressly asked for, and the second is the record of your own decision. This assessment is made under §165(3) of the Austrian Telecommunications Act 2021.

We do not sell, rent or trade your personal data. We share it only where necessary, and only with the following.

Google Ireland Limited, for Google Analytics and Google Ads. Google acts as a processor under its own terms and data processing agreement, and may also use the data for its own purposes in accordance with its privacy policy. Without your consent it receives a request carrying no identifier for you; with it, the cookies described above.

Our hosting and infrastructure provider, and Zoho, which hosts our email on its European servers. Each acts on our instructions under an agreement pursuant to Article 28 GDPR, processes your data only to run this website and carry our mail, and uses it for no purpose of its own.

Public authorities, where disclosure is required by law, by court order, or to protect the rights and safety of others.

If we ever sell or transfer the business, your data may form part of that transfer. We will tell you before that happens.

Where you have consented to analytics, data may be transferred to the United States. Those transfers rely on the European Commission's adequacy decision of 10 July 2023 concerning the EU-US Data Privacy Framework, and additionally on the standard contractual clauses adopted by the Commission.

Our hosting and email are provided within the European Union, so running this website and answering your mail involves no transfer outside it.

You can ask us for details of the safeguards that apply at [email protected].

Enquiries that do not lead to a contract, including the name, email address, telephone number and answers they contain: erased no later than twelve months after the last correspondence.

Data relating to concluded contracts: retained for seven years from the end of the financial year in which the contract was performed, in accordance with §132 of the Austrian Federal Fiscal Code and §212 of the Austrian Commercial Code.

Audit reports and their links: erased no later than twelve months after the report is generated.

Analytics data: retained for the period configured in the Google Analytics property, being fourteen months.

If you are in the European Economic Area or the United Kingdom, you have the right to ask us for a copy of the personal data we hold about you (Article 15 GDPR); to have inaccurate or incomplete data corrected (Article 16); to have your data erased (Article 17); to have processing restricted in certain circumstances (Article 18); to receive your data in a structured, commonly used, machine-readable format and have it sent to another controller (Article 20); and to object, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 21).

Where processing rests on consent, you may withdraw it at any time under Article 7(3) GDPR, without affecting the lawfulness of what was done beforehand.

Write to [email protected] to exercise any of these rights. We answer within one month of receipt, a period we may extend by two further months where the request is complex, as permitted by Article 12(3) GDPR.

You also have the right to complain to a supervisory authority under Article 77 GDPR, whatever other remedy you pursue. The competent authority in Austria is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, [email protected].

If you are a California resident, you have the right to know what personal information we collect, use and disclose; to request its deletion, subject to certain exceptions; to have inaccurate information corrected; and to opt out of the sale or sharing of personal information.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We will not discriminate against you for exercising any of these rights.

To make a request, email [email protected] with the subject line "CCPA Request". We answer within 45 days, and we may ask you to verify your identity first.

This website is not directed at children, and we do not knowingly collect personal data from anyone under 16, or under the age set by their member state where that age is lower, but never below 13.

If we learn that a child has given us personal data without the consent of a parent or guardian, we delete it promptly. If you believe your child has sent us something, write to [email protected].

We take appropriate technical and organisational measures to protect your data. The site is served exclusively over TLS, and access to stored enquiries and reports is restricted to the people answering them.

No transmission over the internet is ever completely secure. Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, we notify the supervisory authority within 72 hours of becoming aware of it, and the people affected where the law requires, in accordance with Articles 33 and 34 GDPR.

We may update this policy to reflect changes in how we process data or in the applicable law. The date of the current version is given above.

Where a change materially affects data already collected, we notify the people affected by email.

Less Web Studio, [email protected].

We aim to answer every legitimate request within one month.