Privacy

PRIVACY NOTICE

This page is a working English draft. It is not legal advice and it is not the final privacy notice for this website. Operator facts are incomplete. Tracking listed below is already active. A consent banner is not yet in place. Do not treat this text as a published GDPR Art. 13 notice until an Austrian lawyer has locked the facts, the legal bases, the retention periods, and the processor contracts. Publishing this draft does not make the live tracking lawful.

Last drafted: 26 August 2026.

GDPR Art. 13; Austrian DSG

This notice describes how we process personal data when you use https://oleskostudio.com, including the commission forms on /commission and the film playback on this site.

Controller

GDPR Art. 13(1)(a); Art. 4(7)

Sebastian Olesko

Vienna, Austria

Legal form and street address: [TO FILL]

Email: sebastian@oleskostudio.com

Phone: [TO FILL]

We are the controller for this website. OLESKO / OLESKO Studio is the name we use for the studio. [TO FILL. confirm the exact controller name once the legal form is locked.]

Data protection officer

GDPR Art. 13(1)(b); Art. 37

We have not appointed a data protection officer.

GDPR Art. 37 requires a DPO only in the cases it lists: a public authority or body (with a court exception); core activities that consist of regular and systematic monitoring of people on a large scale; or core activities that consist of large-scale processing of special-category data or criminal-conviction data.

On the face of that article, a solo operator whose core activity is commissioned filmmaking is not in those mandatory cases. Whether the live use of analytics and advertising pixels changes that assessment is a question for a lawyer. We do not invent a DPO we do not have.

Supervisory authority

GDPR Art. 13(2)(d); Art. 77; Austrian DSG

You may lodge a complaint with the Austrian data protection authority:

Österreichische Datenschutzbehörde

Barichgasse 40-42

1030 Vienna

Austria

Email: dsb@dsb.gv.at

https://www.dsb.gv.at

What this site does

This is a commercial studio site. We make commissioned owner films from images the client supplies. The commission forms on /commission are requests, not orders. We do not send an automatic reply to a form submission.

Hosting

GDPR Art. 13(1)(e); Art. 28

The site is hosted on Webflow. Webflow, Inc. is established in the United States. Hosting necessarily involves processing of technical data (for example IP address, request logs, and the content of a form while it is transmitted). Whether a written processor contract is in place, and on what transfer tool, is [TO FILL].

1. Commission forms

GDPR Art. 6(1)(b); Art. 6(1)(f); Art. 13

Where. Two Webflow forms on /commission.

Fields we collect. Name (required), email (required), automobile (required), idea (required), phone (optional).

What happens. Webflow sends the submission to sebastian@oleskostudio.com. A submission is a request to discuss a possible commission. It is not an order and it does not form a contract. We do not send an automatic reply. If you give a phone number, we may use it to call you about that request. We do not use the form for a newsletter or for other marketing unless you later agree to that in a separate, documented way. [TO FILL. confirm no other use.]

Legal basis. The natural reading of a commission request is GDPR Art. 6(1)(b): processing necessary to take steps at the request of the data subject prior to entering into a contract. Some counsel prefer Art. 6(1)(f) (legitimate interest in answering a business enquiry) where no contract is yet in view. A lawyer must lock one basis. We do not rely on Art. 6(1)(a) for the form itself. Phone is optional; if you do not give it, we will use email only.

Recipients. The mailbox operator of sebastian@oleskostudio.com: [TO FILL. e.g. the email host]. Webflow, as the form processor, sees the submission in transit.

Retention. [TO FILL. how long form emails and any copies are kept if no commission follows, and how long they are kept if a commission is agreed.]

Whether you must provide the data. Name, email, automobile, and idea are required to send the form. Without them we cannot receive the request. Phone is not required.

2. Cookies, pixels, and similar technologies. current state

ePrivacy Directive Art. 5(3) as amended by Directive 2009/136/EC; TKG 2021 § 165(3); GDPR Art. 6(1)(a)

Austrian implementation of the cookie rule is TKG 2021 § 165(3) (Telekommunikationsgesetz 2021, RIS Gesetzesnummer 20011678). The Datenschutzbehörde states that this provision implements ePrivacy Directive Art. 5(3), and that non-essential storage or access on a terminal device needs prior, informed, active consent.

Honest current state. The tools named below are already live. A verified cookie / consent banner is not yet in place. That means non-essential tracking (at least Google Analytics 4 and the two Meta Pixels) is running without the consent TKG 2021 § 165(3) and GDPR Art. 6(1)(a) require. This is a compliance gap. This page does not invent a banner that does not exist. A privacy page does not make that tracking lawful.

The legal basis for non-essential cookies and pixels, once a banner exists, is GDPR Art. 6(1)(a) (consent), in addition to the TKG 2021 § 165(3) terminal-equipment rule. Legitimate interest is not a substitute for that terminal-equipment consent.

2.1 Google Analytics 4

Provider: Google (Google Ireland Limited / Google LLC, United States).

How it is loaded: Webflow Google Site Tools.

Measurement ID: G-30WQTE8M3F.

What we understand it does on this site: page_view only.

This is not a strictly necessary tool. It needs prior consent. It is currently active without a consent banner.

Data typically involved includes online identifiers, IP address, and page-view data. [TO FILL. confirm no additional GA4 events, no Google Signals, no advertising features, and the actual cookie / storage list after a technical scan.]

Transfer: Google is a US group. See “Transfers outside the EEA” below.

Processor contract / DPA: [TO FILL].

2.2 Meta Pixel (two IDs)

Provider: Meta (Meta Platforms Ireland Limited / Meta Platforms, Inc., United States).

How it is loaded: custom code on this site.

Pixel ID in use: 1042175558712638.

These are advertising / measurement pixels. They are not strictly necessary. They need prior consent. They are currently active without a consent banner.

Data typically involved includes cookie identifiers, IP address, browser data, and information about pages viewed. Meta may combine this with other data it holds. Whether an Art. 26 arrangement with Meta is in place is [TO FILL].

Transfer: Meta is a US group. See “Transfers outside the EEA” below.

Processor / joint-controller documentation: [TO FILL].

2.3 Mux (film playback)

We use Mux to play films on this site. Mux, Inc. is established in the United States.

Playback of a film the visitor has chosen to watch can, in principle, fall under the “strictly necessary for a service explicitly requested” exception in ePrivacy Art. 5(3) and TKG 2021 § 165(3). but only for storage or access that is actually necessary to play the film. Mux Data, if enabled, can set a first-party cookie. We have not independently verified this site’s Mux configuration (player only vs Mux Data; cookies on or off). That is grey. We do not claim Mux is cookieless.

If Mux Data cookies or similar analytics storage are active, they are not strictly necessary for playback and need consent. If only delivery of the stream the visitor requested is involved, a lawyer may treat that part as necessary.

Transfer: Mux is US. See below.

Processor contract / DPA: [TO FILL].

2.4 Other cookies

[TO FILL after a technical scan. Webflow, consent tools once added, security, or other first-party cookies.]

3. Transfers outside the EEA

GDPR Art. 13(1)(f); Chapter V; Art. 45; Art. 46

Google, Meta, Mux, and Webflow are US organisations. Use of their services involves a transfer of personal data to the United States (at least IP address and online identifiers; for the form, also the form fields while Webflow handles the submission).

The European Commission has adopted an adequacy decision for the EU-US Data Privacy Framework: Commission Implementing Decision (EU) 2023/1795 of 10 July 2023. That decision covers transfers to US organisations that are actually certified on the Data Privacy Framework List. We have not verified the current listing of Google, Meta, Mux, or Webflow for this notice.

Where a recipient is not covered by an adequacy decision, GDPR Art. 46 requires appropriate safeguards, typically the Commission’s standard contractual clauses (SCCs). We do not invent DPA or SCC details we do not have.

Transfer tool actually in place for Google, Meta, Mux, Webflow, and the email host: [TO FILL].

4. Other processing we do not invent

Email correspondence after a form or a direct email: same purpose as the request or the exchange; legal basis [TO FILL. typically Art. 6(1)(b) or 6(1)(f)].

Legal obligations (tax, bookkeeping) if a commission is invoiced: Art. 6(1)(c); retention [TO FILL].

We do not operate a user account, a shop checkout, or a newsletter on this site. [TO FILL. confirm.]

5. How long we keep data

GDPR Art. 13(2)(a); Art. 5(1)(e)

Form emails and related notes: [TO FILL]

Server / host logs: [TO FILL]

Analytics and advertising data held by Google and Meta: [TO FILL. actual GA4 and Pixel retention settings]

Mux playback / Mux Data: [TO FILL]

We do not guess a retention period we have not decided.

6. Your rights

GDPR Arts. 15, 16, 17, 18, 20, 21, 7(3), 77

You have the right to access your personal data; rectify inaccurate data; erase data in the cases Art. 17 provides; restrict processing in the cases Art. 18 provides; object to processing based on Art. 6(1)(f), including any direct marketing; data portability where the processing is based on consent or on a contract and is carried out by automated means; withdraw consent at any time, where processing is based on consent, without affecting processing that was lawful before withdrawal; and lodge a complaint with the Datenschutzbehörde (Art. 77; contact above).

To exercise these rights, write to sebastian@oleskostudio.com. We may need to confirm your identity.

No consent mechanism exists on the site today, so there is currently nothing to withdraw in the banner sense. That is part of the gap described above, not a claim that the tracking is lawful.

7. Automated decisions

GDPR Art. 13(2)(f); Art. 22

We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you. The forms are read by a person. There is no automatic reply and no automatic acceptance of a commission.

8. Obligation to provide data

GDPR Art. 13(2)(e)

You are not under a statutory duty to use this site or to send a commission request. If you send a request, the required fields are those listed in section 1. Tracking listed in section 2 is currently loaded without a choice. That is the gap a lawyer must fix.

This draft is not legal advice. It is not final. Do not treat it as a published privacy notice until a lawyer locks it.