Privacy Policy
Version 1.1 – 10 April 2026
We take the protection of your personal data very seriously. We process your personal data exclusively in accordance with applicable data protection law, in particular the General Data Protection Regulation (GDPR) and the Austrian legal provisions applicable to electronic communications and website operation, including § 165(3) TKG 2021 regarding cookies and similar technologies.
This Privacy Policy explains how we process personal data when you visit this website, contact us, or otherwise interact with our online presence.
1. Controller
Controller within the meaning of Art. 4(7) GDPR:
Thomas Nowack / on design
Westbahnstrasse 41/20
1070 Vienna
Austria
Email: info@o-n.design
Phone (AT): +43 676 49 700 40
Phone (DE): +49 151 14193626
2. Scope of processing
We process personal data only to the extent necessary for the provision of this website, for responding to enquiries, for ensuring website security and stability, and for fulfilling legal obligations.
We do not sell personal data.
3. Categories of personal data processed
When you visit this website, we may process in particular:
IP address
browser and device information
date and time of access
requested pages/files
referrer URL
log data relating to website security and technical operation
If you contact us, we may additionally process:
name
email address
telephone number
company name
content of your message
any other information voluntarily provided by you
If you use a contact form, the data entered into the form is processed for the purpose of handling your request.
4. Purposes and legal bases of processing
We process personal data for the following purposes and on the following legal bases:
a) Provision of the website
To make the website available, ensure technical functionality, maintain stability, and protect against misuse.
Legal basis:
Art. 6(1)(f) GDPR – legitimate interest in the secure and efficient provision of our website.
b) Responding to enquiries
If you contact us by email, telephone, or contact form, we process your data to handle your enquiry and communicate with you.
Legal basis:
Art. 6(1)(b) GDPR – where processing is necessary in order to take steps prior to entering into a contract or to perform a contract
Art. 6(1)(f) GDPR – legitimate interest in responding to business enquiries
c) Compliance with legal obligations
We may process data where necessary to comply with statutory retention, documentation, or disclosure obligations.
Legal basis:
Art. 6(1)(c) GDPR – compliance with a legal obligation.
d) Cookies and similar technologies
Where cookies or similar technologies are used that are not technically necessary, these are only used on the basis of your prior consent. Under Austrian law, non-essential cookies generally require prior consent under § 165(3) TKG 2021; WKO guidance states that technically necessary cookies may be used without consent, while non-essential cookies require prior opt-in. (wko.at)
Legal basis:
Art. 6(1)(a) GDPR – consent
§ 165(3) TKG 2021 – where applicable for storing or accessing information on the user’s device (wko.at)
5. Cookies and consent management
This website may use cookies and similar technologies.
A distinction must be made between:
technically necessary cookies, which are required for the operation, security, or core functionality of the website; and
non-essential cookies, such as analytics, marketing, or third-party tracking cookies.
According to Austrian guidance, only technically necessary cookies may be set without prior consent. Non-essential cookies may only be used after your active consent. WKO further notes that a mere notice is insufficient and that consent must be obtained in advance on an opt-in basis. (wko.at)
If a cookie banner is implemented on this website, you may manage your preferences there at any time.
6. Hosting via Wix
This website is hosted using Wix. Wix provides the website infrastructure and may process technical data necessary for website delivery, stability, and security. Wix states that it offers a Data Processing Agreement for its users. Wix also states that the cookies initially placed on a Wix website are generally categorized as essential, and that non-essential cookies require visitor consent where applicable. (support.wix.com)
Legal basis:
Art. 6(1)(f) GDPR – legitimate interest in secure and efficient website hosting.
Where consent is required for non-essential technologies: Art. 6(1)(a) GDPR and § 165(3) TKG 2021. (wko.at)
7. Recipients / processors
Your personal data may be disclosed to recipients only where necessary and legally permissible. In particular, this may include:
hosting and website infrastructure providers
IT and technical service providers
professional advisers, where necessary
public authorities or courts, where legally required
Where third parties process personal data on our behalf, this is done on the basis of an appropriate data processing agreement where required by law. Wix states that it provides a public and binding Data Processing Agreement for Wix users. (support.wix.com)
8. International data transfers
In the context of website hosting and related technical services, personal data may be processed outside Austria and, where applicable, outside the EEA.
Wix states that it may process personal data globally and that international transfers are supported through mechanisms such as adequacy decisions, Standard Contractual Clauses, and, where applicable, the EU-U.S. Data Privacy Framework. (support.wix.com)
Where data is transferred to a third country, we ensure that such transfer takes place only in accordance with Art. 44 et seq. GDPR and subject to appropriate safeguards.
9. Retention period
We retain personal data only for as long as necessary for the respective purposes, in particular:
for the duration required to process your enquiry
for the duration of an existing business relationship
for as long as statutory retention obligations apply
for as long as necessary for the establishment, exercise, or defence of legal claims
If the respective purpose no longer applies and there is no legal retention obligation, the data will be deleted.
10. Data subject rights
Under the GDPR, you have, subject to the applicable legal requirements, the following rights:
right of access
right to rectification
right to erasure
right to restriction of processing
right to data portability
right to object
right to withdraw consent at any time, where processing is based on consent
right to lodge a complaint with a supervisory authority
The Austrian Data Protection Authority lists the rights of the data subject on its website and accepts complaints where a person believes that processing violates the GDPR or Austrian data protection law. (data-protection-authority.gv.at)
Competent supervisory authority in Austria:
Austrian Data Protection Authority (Datenschutzbehörde) (data-protection-authority.gv.at)
To exercise your rights, please contact us at: info@o-n.design
11. Obligation to provide data
There is generally no legal or contractual obligation to provide personal data merely for visiting this website.
However, if you contact us, the provision of certain data may be necessary in order for us to process and respond to your enquiry.
12. Automated decision-making
No automated decision-making within the meaning of Art. 22 GDPR takes place through this website.
13. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy where necessary to reflect legal, technical, or organisational changes.
The version published on this website is the current version.
Design that brings ideas into form
