Privacy policy
Last updated: 15 September 2026.
1. Data controller and contact details
Trattner und Söhne Immobilien GmbH
Walfischgasse 6, Stiege 1/25, 1010 Vienna, Austria
Represented by Philipp Trattner
Email: Contact details in the legal notice
2. Accessing this website
This website is hosted by Vercel Inc. Visits involve processing your IP address, time of access, requested URL and technical browser and connection information to deliver content, identify errors and prevent attacks. The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in secure and reliable operation.
The website application does not maintain its own persistent access-log database. Vercel also processes technical operational and security data under its applicable retention rules. Retention depends on operational or security purposes and any legal obligations; we do not promise that all provider logs are deleted after 15 minutes.
3. Contact enquiries and email delivery
When you contact us by email, we process the contact details and content you provide to handle and respond to your enquiry. We do not automatically use them for newsletters or advertising campaigns.
You can send us an enquiry using the online contact form. The information below describes the processing involved. If the form or its security check is unavailable, you can still contact us directly by email.
The contact form requires your name and email address. The enquiry topic and message are optional. These details allow us to identify your enquiry and respond by email. The form cannot be submitted without the required details. Providing them is not legally required; use of the form is voluntary, and email is available as an alternative.
Contract-related enquiries are processed to take pre-contractual steps or perform a contract under Article 6(1)(b) GDPR. Other enquiries are handled under Article 6(1)(f) GDPR, based on our legitimate interest in appropriate communication. Acknowledging that you have read this privacy notice is not consent to advertising.
Your enquiry is transmitted over an encrypted connection to the form function hosted on Vercel and sent through Google Workspace/Gmail to our business email address. Our business address is both the sender and recipient; your email address is set as the reply-to address. Google processes contact details, message content and technical delivery data. The form application’s Google permission is limited to sending email and does not include inbox access. Visitors do not need to sign in to Google.
Enquiries are deleted once they have been handled, unless legal retention obligations or the establishment, exercise or defence of legal claims require further retention. If an enquiry leads to a business relationship, the applicable statutory retention obligations apply to the related records. The website application does not create an additional database of message content; delivered messages are processed in the business email mailbox.
4. Protecting the contact form
The enabled form is intended to use Cloudflare Turnstile, provided by Cloudflare Inc. This involves transmitting data such as IP addresses and browser, device and interaction signals to Cloudflare to distinguish automated access from human enquiries. Turnstile is loaded when using the available contact form, not as a general analytics service across all pages. Cloudflare also processes signals as an independent controller to improve its bot detection.
Cloudflare Turnstile Privacy Addendum
Upstash Redis is intended to limit repeated sending attempts and prevent duplicate emails. The application processes pseudonymised identifiers derived from the IP address and enquiry using a secret server key, random request identifiers, counters and delivery status. It does not store plain-text IP addresses, names, email addresses or message content there. Pseudonymised identifiers are not equivalent to anonymous data. Limits are evaluated over 15-minute windows and per UTC calendar day; duplicate-prevention identifiers expire after 24 hours.
The legal basis for these safeguards is Article 6(1)(f) GDPR. Our legitimate interest is to prevent spam, abuse and accidental duplicate submissions and to maintain the availability of our contact channel. If you do not wish to use these services, you can contact us directly by email.
5. Cookies, fonts and external content
We do not use Google Analytics, Meta Pixel or comparable advertising trackers. Fonts and images are loaded from this website. External maps, videos and social media widgets are not embedded. The website application does not set its own analytics or advertising cookies. The Turnstile information linked above and its technically necessary signals also apply to the intended form protection.
Links to other websites establish a connection to their destination only when clicked. The relevant provider is responsible for processing on that website.
6. Recipients and international processing
Access is provided to staff handling enquiries and technical providers used for the relevant purpose: Vercel for hosting and form processing and, when the form is enabled, Google for email delivery, Cloudflare for bot protection and Upstash for rate limiting and duplicate prevention. The data is not sold.
These international providers may process data outside the European Economic Area, particularly in the United States. A European server location does not exclude international support or subprocessing. The providers describe their respective processing locations, subprocessors and transfer mechanisms in the privacy and contractual documents linked below. The applicable data processing agreements and international transfer safeguards must be in place before enabling the intended form service. These may include an applicable adequacy decision or EU standard contractual clauses with any necessary supplementary measures. Information about the safeguards applicable to your data is available using the contact details in our legal notice.
Upstash: data processing terms
7. Your rights
Subject to the applicable legal conditions, you have the right of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Any separately given consent may be withdrawn at any time with effect for the future.
Please send these requests to Contact details in the legal notice. You may also lodge a complaint with a data protection supervisory authority. In Austria, this is the Austrian Data Protection Authority.
8. No automated decision-making
We do not make solely automated decisions with legal or similarly significant effects on this website and do not create advertising profiles. Technical limits on abusive form attempts protect the service.