Privacy policy

1. Controller

Julian Kocmut
JK Concepts
Grottenhofstraße 9b
8053 Graz
Austria

Email: office@jkconcepts.at
Phone: +43 676 487 91 38

2. Hosting, server logs and email

This website is hosted by hosttech GmbH, Warwitzstraße 9, 5020 Salzburg, Austria. Our email mailbox and the sending of notifications from the contact form are also operated through the same provider. hosttech processes the data as a processor on our behalf (Art. 28 GDPR) so that the website can be delivered, emails can be delivered and technical operation is secured.

When a page is accessed, server logs may record in particular the IP address, date and time, the address requested including any URL parameters, the previously visited page (referrer) and information about the browser and operating system. Technical error messages of the website application are logged without the content of your enquiry. We use this information exclusively for secure operation, error analysis and defending against abusive access. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in providing the website securely and without disruption.

Log data is deleted as soon as it is no longer needed for these purposes. In the event of a specific security incident, the affected entries may be kept until the incident has been clarified and any claims enforced.

The website and email mailbox are operated on servers in Switzerland. An adequacy decision of the European Commission under Art. 45 GDPR exists for Switzerland. You can find further information in hosttech’s privacy policy.

3. Contact by form, email or phone

If you write to us or call us, we process the information you provide. Through the contact forms, this is your name, email address, the type of request and your message as well as – depending on the form – urgency, company, website address, a preferred maintenance plan, software in use, the number of people involved and whether you are authorised to act for a company. In the project check on the homepage, you also select answers about your project (such as goals, starting point, timeline, budget or company size) and can provide a phone number if you would like a call back. We also store on which page and through which form the enquiry was submitted. Which information is mandatory is marked in each form.

We need the mandatory information to assign and answer your enquiry; without it we cannot process the enquiry. Voluntary information helps us assess your request better. If the message relates to a possible or existing assignment, the legal basis is Art. 6 (1) (b) GDPR. For other business communication, we base the processing on Art. 6 (1) (f) GDPR; our legitimate interest is the proper handling of your enquiry.

If you reach a page via a campaign URL and submit an enquiry on that page, the form transmits the campaign parameters contained in the address (utm_source, utm_medium, utm_campaign, utm_term) as well as Google or Microsoft click identifiers (gclid, msclkid) together with your enquiry; they are stored with the enquiry and listed in the notification to us. The form only reads this information from the current address and does not store it in your browser. It is used exclusively to assign the enquiry to the respective advertising campaign. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in being able to understand which advertising measures lead to enquiries.

To protect against automated abuse, the network address is converted into an HMAC value with a secret key when the form is submitted, which is used to limit the number of enquiries for a short time. The unaltered address is not stored for this purpose. The counter is valid for 15 minutes, a block after more than five attempts for 30 minutes from the last attempt; the value is then deleted at the next clean-up. It is not stored with your enquiry. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protecting the form against spam and overload.

Enquiries received via the form are first stored in the website’s database so that we can process them and no enquiry is lost if sending the email fails temporarily. There they are deleted automatically after twelve months. We delete enquiries in our email mailbox once the enquiry has been completed and there are no statutory retention obligations or legitimate reasons for further storage. If an assignment results, we keep the documents required for it for the statutory periods, in particular seven years under § 132 of the Austrian Federal Fiscal Code (BAO); the legal basis for this is Art. 6 (1) (c) GDPR. The recipient of your enquiry is our hosting and email provider as processor; as part of an assignment, billing data may also be transferred to a tax adviser and to authorities where this is necessary or required by law.

4. Privacy settings and audience measurement

So that we can respect your privacy choice, we store the version of the consent, your decisions on the optional analyses and the time of your choice in your browser’s local storage. This setting contains no random visitor identifier and is requested again after 180 days at the latest. You can change your choice at any time via “Privacy settings” in the page footer. This storage is strictly necessary to implement your choice and is therefore permitted without consent under § 165 (3) of the Austrian Telecommunications Act 2021 (TKG 2021); the legal basis is Art. 6 (1) (f) GDPR, our legitimate interest is respecting your decision.

For basic audience and interaction measurement, page views, clicks on predefined link targets, the opening of FAQ items, successfully stored contact forms as well as the display of the privacy dialog and the choice made there are counted without a visitor or session identifier and immediately aggregated into hourly totals per page. Only the page is recorded, for link clicks a controlled target (internal target page, contact, email, phone, download or a broad external platform category), for registered advertising campaigns a campaign code we define taken from the page address, and the status of your privacy choice. For a form submission, only the “contact form” counter for the originating page is increased; form content, name, email address and contact reference number are not used for this. These statistics do not store IP addresses, IP hashes, referrers, URL query parameters (apart from the campaign code mentioned), ad click identifiers, mouse coordinates, visible link texts or user agent details. These statistics reveal neither cross-page usage paths nor returning visitors; the aggregated counters are deleted after 730 days at the latest. No cookies or identifiers are stored on your device for these statistics. The script only transmits the stated information about the page and the respective interaction as well as your privacy choice; the previously visited page (referrer), screen and other device properties are not read. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in understanding the use of the website in aggregated form and improving content.

To protect the statistics endpoints (including that of the extended analytics) against automated abuse, the requesting network address is temporarily converted into an HMAC value with a secret key. This short-lived value is used exclusively to limit requests, is not linked to statistics data and is deleted after the protection period expires. The unaltered address is not stored by the analytics application; regardless of this, the information in section 2 applies to technical server logs.

Only with your consent can extended analytics also be activated. For this, a random visitor identifier is stored in local storage for a maximum of 180 days and a separate session identifier in session storage; if you arrive via a campaign link, the campaign assignment is also stored in session storage for the duration of the session. The session identifier is renewed after 30 minutes without activity. The browser transmits the identifiers exclusively to our own servers, where they are pseudonymised with HMAC-SHA-256 before storage; the original identifiers are not stored in the database.

Extended analytics records page views in their order within a session, clicks on links with a controlled target (internal target page, contact, email, phone, download or a broad external platform category), views of contact links, the opening of FAQ entries, the start of a form entry, the scroll depth reached in steps of 25, 50, 75 and 100 per cent, the visible time spent on a page in steps of 30 seconds, 1 minute and 3 minutes, and a form submission confirmed by the server. For the session, the start and end, entry and exit page and a broad device class are also stored. Only aggregated reports such as frequent page sequences, session duration and returning visits are created from this; mouse movements, screen recordings and entered texts are not recorded. At the start of a session, the source category, a recognised search, social or AI platform, the normalised hostname of the referring website, a registered campaign code and cleaned campaign details from utm_source, utm_medium, utm_campaign and utm_content may also be stored. Controlled campaign, ad group and ad identifiers may also be stored; individual ad click identifiers, on the other hand, are not included in the analytics. Full referrers, referrer paths, search terms, URL query parameters, fragments and credentials are not stored. Only the type of an event is recorded, not its visible label or an entered value.

If you submit an enquiry while extended analytics is active, the form also transmits your session identifier so that the successful submission can be assigned to your pseudonymous session and linked to a campaign contact from the last 90 days. Form entries, names, email addresses, messages and contact reference numbers are not stored for analytics, the identifier is not stored with your enquiry, and we do not merge enquiry and analytics data.

Pseudonymous analytics data is deleted no later than 365 days after the last activity. On withdrawal, the identifiers in the browser are deleted and deletion of the associated pseudonymous visitor, session and event data is requested. The legal basis is your consent under Art. 6 (1) (a) GDPR, for storing the identifiers on your device and reading information from it (such as the previously visited page and the screen width) in conjunction with § 165 (3) TKG 2021; consent can be withdrawn at any time with effect for the future.

We do not currently use advertising platforms such as Google Ads or Meta; no scripts from advertising providers are loaded and no data is transmitted to them. Should we use such services in future, this will only happen with your separate consent (Art. 6 (1) (a) GDPR, § 165 (3) TKG 2021), independently of the extended analytics, and we will first add the providers, the data processed and possible transfers to third countries to this privacy policy.

Fonts, images and JavaScript files are served from our own web server; no connection to Google Fonts or a general CDN is established. No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

5. External links

The website contains links to external websites, for example to LinkedIn, to websites of projects mentioned and to further sources. Only when you open such a link does the respective operator receive technically necessary connection data and process it in accordance with its own privacy policy.

6. Your data protection rights

Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consent you have given at any time with effect for the future (Art. 7 (3) GDPR), for example via “Privacy settings” in the page footer; this does not affect the lawfulness of the processing carried out until the withdrawal. To exercise your rights, a message to office@jkconcepts.at is sufficient.

Right to object: Where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with a supervisory authority (Art. 77 GDPR). In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna.

7. Version

October 2026