Privacy policy
Version: March 2026
Data controller
No data protection officer has been appointed.
Hosting
Our websites are hosted by:
- Hetzner Online GmbH (Germany)
- World4You Internet Services GmbH (Austria)
Processing is based on Article 6(1)(f) GDPR: the legitimate interest in operating the website securely.
Server log files
The following data is processed when you visit the website:
- IP address
- Date and time
- Pages accessed
- Browser type
- Operating system
This data ensures the technical operation of the website and is deleted regularly.
Cookies & consent management
A consent management tool, such as Cookiebot, may be used to manage consent.
Cookies are only set where technically necessary or permitted following consent.
Google Analytics
If enabled, we use Google Analytics (Google Ireland Ltd.). Personal data, such as a truncated IP address, may be processed.
Transfers to the United States are based on Standard Contractual Clauses.
LinkedIn Insight Tag
We use the LinkedIn Insight Tag provided by LinkedIn Ireland Unlimited Company. Personal data may be processed in this context.
Contacting us
When you contact us by email, the data you provide is processed to handle your enquiry.
Job applications
Applications are accepted exclusively by email. The data is processed solely for the application procedure.
After the procedure ends, the data is deleted unless a statutory retention obligation applies.
CRM & newsletter (Kit)
We use Kit, a CRM and email tool, to manage contacts and send newsletters. Transfers to third countries may take place on the basis of Standard Contractual Clauses.
Bookkeeping & accounting
For invoicing, we use:
- sevDesk GmbH (Germany)
Use of AI systems, AI agents and automated workflows
We use AI-supported systems and automated workflows to support administrative, strategic and operational processes.
11.1 Client-related AI use
When performing contracts and handling enquiries, we use AI systems, particularly Anthropic's Claude API, to:
- structure client enquiries
- create proposal and invoice templates
- prepare CRM data
- automate internal process steps
Personal data is processed only where necessary for contract performance.
Processing takes place via API access. Personal data is not used for training. Chat and API logs are automatically deleted after no more than seven days.
11.2 Internal AI use
We also use AI tools such as:
- OpenAI
- Google Gemini
- Perplexity
- NotebookLM
- Miro AI
- Canva AI
These systems are used exclusively with anonymised, abstract or strategic content. No specific client data or identifiable personal information is entered.
11.3 AI agents & workflow orchestration
To automate processes, we use AI agents together with workflow software, n8n. We operate n8n ourselves and host it on infrastructure in Germany.
The systems serve solely to support processes. Agent systems do not independently store personal data permanently. Permanent storage takes place exclusively in the designated primary systems, such as CRM or accounting.
11.4 Automated decisions
No fully automated decision-making with legal or similarly significant effects within the meaning of Article 22 GDPR takes place.
Documents with legal relevance, such as proposals, invoices and payment reminders, are checked by a responsible person before final dispatch.
11.5 Transfers to third countries
Where AI providers based outside the EU are used, transfers take place on the basis of appropriate safeguards under Articles 44 et seq. GDPR, such as Standard Contractual Clauses or the EU–U.S. Data Privacy Framework.
Social media
We maintain profiles on:
- YouTube
The privacy policies of the respective platforms apply.
Payment processing
Payments are made exclusively by bank transfer.
Data subject rights
You have the right to:
- Access
- Rectification
- Erasure
- Restriction of processing
- Data portability
- Object
Complaints may be lodged with the Austrian Data Protection Authority.
To exercise your rights, please contact: hello@sabrina-pm.com
Version: March 2026 · Sabrina Pils-Matiasek e.U. · Vienna, Austria