Effective date: 18 July 2026
Website: https://apartmenttheory.at/
Contact: info@apartmenttheory.at

1. Introduction

We take the protection of your personal data seriously. This Privacy Policy explains how personal data is collected and processed when you visit the Apartment Theory website, submit a project enquiry, or contact us by email or telephone.

Personal data is processed in accordance with the General Data Protection Regulation of the European Union (“GDPR”), the Austrian Data Protection Act, the Austrian Telecommunications Act 2021 and other applicable Austrian and European data protection laws.

Apartment Theory is a shared trading name. It is not a separate legal entity or registered company.

2. Joint Controllers

The Apartment Theory website is jointly operated by two legally independent sole proprietors:

Anna Gaál
Sole proprietor
Trading name: Apartment Theory
Ludwiggasse 14/1
1140 Vienna
Austria
Phone: +43 676 7452687
Email: info@apartmenttheory.at

Official WKO disclosure:
Anna Gaál – WKO legal disclosure

Bálint Mező
Sole proprietor
Trading name: Apartment Theory
Ludwiggasse 14/1
1140 Vienna
Austria
Phone: +43 676 5395565
Email: info@apartmenttheory.at

Official WKO disclosure:
Bálint Mező – WKO legal disclosure

Anna Gaál and Bálint Mező jointly determine the purposes and means of processing personal data collected through this shared website and therefore act as joint controllers within the meaning of Article 26 GDPR.

They have agreed that:

• enquiries submitted through the shared website or sent to the shared email address may initially be accessed and handled by both controllers;
• requests concerning data protection rights can be submitted to the shared email address info@apartmenttheory.at;
• both controllers are responsible for ensuring that website visitors receive appropriate information about the processing of their personal data;
• data protection requests concerning the shared website will be handled jointly;
• once an enquiry or project has been assigned to one of the sole proprietors, that sole proprietor acts as an independent controller for the subsequent quotation, contractual relationship, project performance, accounting and invoicing.

The respective contracting party is identified in the individual quotation, order confirmation, agreement or invoice.

You may exercise your GDPR rights against either joint controller, irrespective of their internal allocation of responsibilities.

3. Contact Form and Project Enquiries

When you submit an enquiry through the website, we may process the following personal data:

• your name;
• your email address;
• the service you are interested in;
• information and descriptions relating to your project;
• the date and time of your enquiry;
• your consent or acknowledgement relating to this Privacy Policy;
• technical information such as your IP address, where recorded by the website, hosting system or security tools.

The information submitted through the contact form may be stored in the protected WordPress database and delivered to the shared Apartment Theory email address.

Purpose of processing

We process this information to:

• receive and respond to your enquiry;
• understand the scope of your project;
• provide information about our services;
• prepare a quotation;
• communicate with you;
• take steps at your request before entering into a contract.

Legal basis

The legal basis is Article 6(1)(b) GDPR where processing is necessary to take steps at your request before entering into a contract.

Where the enquiry does not directly relate to a potential contract, processing may be based on Article 6(1)(f) GDPR, our legitimate interest in responding to communications and managing business enquiries.

Retention period

If no contractual relationship is established, enquiry data will generally be deleted no later than 12 months after the last substantive communication or closure of the enquiry, unless continued storage is necessary for the establishment, exercise or defence of legal claims.

If a contractual relationship is established, information relevant to the contract, accounting or invoicing may be retained for the applicable statutory retention period. Accounting documents and invoices are generally retained for seven years under Austrian tax and commercial requirements.

4. Contact by Email or Telephone

If you contact us directly by email or telephone, we process the information you provide, which may include:

• your name;
• your email address;
• your telephone number;
• the content of your message;
• information relating to your property, accommodation or project.

The purposes, legal bases and retention periods described in Section 3 also apply to direct email and telephone communications.

Please do not send sensitive personal data unless it is necessary for your enquiry and has been specifically requested.

5. Technical Data and Server Logs

When you access the website, certain technical data may be processed automatically by the hosting provider and website systems.

This may include:

• IP address;
• browser type and version;
• operating system;
• date and time of access;
• requested page or file;
• referring website;
• HTTP status information;
• error and security logs.

Purpose

Technical data is processed to:

• provide the website;
• maintain system and network security;
• detect misuse or attempted attacks;
• diagnose technical problems;
• ensure the stable and reliable operation of the website.

Legal basis

Article 6(1)(f) GDPR, based on our legitimate interest in operating a secure, functional and reliable website.

Retention period

Technical logs are retained only for as long as necessary for security, error analysis and system operation. They are normally deleted or anonymised within 90 days, unless longer retention is necessary to investigate a security incident, prevent misuse or establish, exercise or defend legal claims.

6. Cookies and Consent Management

The website uses CookieYes to manage cookie preferences and document consent choices.

The following technically necessary cookie is currently used:

Cookie: cookieyes-*
Provider: Apartment Theory / CookieYes
Purpose: Stores the visitor’s cookie consent preferences
Duration: Up to one year
Category: Necessary

Necessary cookies are required for the operation of the website and consent management. They do not require prior consent.

At the effective date of this Privacy Policy, the website does not use active analytics, advertising or marketing cookies.

If analytics, advertising, embedded content or other non-essential technologies are introduced in the future, they will only be activated after the visitor has provided prior consent where required. The cookie list and this Privacy Policy will be updated accordingly.

The legal basis for optional cookies and the related processing is Article 6(1)(a) GDPR and the applicable provisions of Section 165 of the Austrian Telecommunications Act 2021.

You may accept, reject or customise optional cookies through the cookie banner. You can change or withdraw your choice at any time using the cookie settings button displayed on the website.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7. Locally Hosted Fonts

The fonts used on this website are stored locally on the Apartment Theory hosting server.

No connection to Google Fonts servers is established for the delivery of website fonts, and visitors’ IP addresses are not transmitted to Google for this purpose.

8. External Links and Social Media

The website may contain links to third-party websites and social media profiles, including Instagram.

A connection to those external services is established only when you actively follow the relevant link. The external provider then processes personal data according to its own privacy policy.

We do not control and are not responsible for the privacy practices or content of external websites.

9. Processors and Service Providers

We use service providers to operate, maintain and secure the website. These providers may process personal data on our behalf and according to our instructions.

Hosting and email services

Sybell Informatika Kft.
1138 Budapest, Tomori utca 34., 2nd floor
Hungary
Website: https://sybell.hu/

Sybell provides web hosting, server infrastructure and email services. Website content, form submissions, emails and technical logs may be stored on its systems.

Website development and technical maintenance

Kovács Csaba Zsolt, sole proprietor – Webstudio22
1224 Budapest
Dózsa György út 160/A/2
Hungary
Website: https://webstudio22.hu/

Webstudio22 provides website development, maintenance and technical support and may have administrative access to the website where necessary for these services.

Consent management

CookieYes Limited
3 Warren Yard, Warren Park
Wolverton Mill, Milton Keynes
MK12 5NW
United Kingdom
Website: https://www.cookieyes.com/

CookieYes provides cookie consent management and may process consent status, consent identifiers, time of consent and limited technical information necessary to operate and document the consent mechanism.

The service providers may process personal data only to the extent necessary to provide their contracted services or where required by law.

10. Other Recipients

Personal data may also be disclosed where necessary to:

• tax advisers, accountants or legal advisers;
• public authorities, courts or law enforcement bodies where required by law;
• IT security specialists where necessary to investigate or prevent a security incident;
• establish, exercise or defend legal claims.

Personal data is not sold or rented to third parties.

11. International Data Transfers

The hosting and website maintenance providers listed above are located within the European Union.

CookieYes Limited is located in the United Kingdom. Transfers to the United Kingdom may be based on the European Commission’s adequacy decision under Article 45 GDPR.

Where a service provider uses sub-processors outside the European Economic Area or a country covered by an adequacy decision, transfers must be protected by an appropriate legal mechanism, such as the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where required.

12. Your Rights

Subject to the conditions of the GDPR, you have the right to:

• obtain information about the processing of your personal data;
• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive personal data you provided in a structured, commonly used and machine-readable format where the right to data portability applies;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a competent supervisory authority.

You may exercise your rights by contacting:

info@apartmenttheory.at

Please provide sufficient information to allow us to identify the relevant data and process your request. We may request additional information where necessary to verify your identity.

We will respond without undue delay and generally within one month, as required by the GDPR.

13. Right to Lodge a Complaint

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority.

Austrian Data Protection Authority
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria

Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

14. Automated Decision-Making

We do not use automated decision-making or profiling through this website that produces legal effects or similarly significantly affects website visitors.

15. Data Security

We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures include, where appropriate:

• encrypted HTTPS connections;
• access restrictions;
• password-protected administrative access;
• software and security updates;
• backups;
• limited service-provider access;
• technical monitoring and security logging.

No internet-based system can guarantee absolute security. However, we regularly review the measures used to protect personal data.

16. Obligation to Provide Data

You are not legally required to submit an enquiry through the website.

However, certain information, such as your name, email address and project details, is necessary for us to respond to your enquiry or prepare a quotation. Without this information, we may not be able to process your request.

17. Changes to this Privacy Policy

We may update this Privacy Policy where the website, services, processors or applicable legal requirements change.

The latest version will always be made available on this website. The effective date shown at the beginning indicates when the policy was last materially updated.