Privacy

Controller

Thomas Kürzl, Kollersteig 53–55, 3400 Klosterneuburg, Austria. Email: tom@doptom.com.

Visiting the site

When a page is requested, the hosting provider processes technical data such as IP address, time, requested address and browser identifier to deliver the page and protect it from abuse. The legal basis is the legitimate interest in secure operation (Art. 6(1)(f) GDPR).

The site does not use analytics or advertising tools.

Cookies and browser storage

Signing in sets a session cookie. It is technically necessary to stay signed in and expires after twelve months or when you sign out.

The rental request basket is stored in your browser and is not sent to us until you submit a request.

Videos

Films and commercials are embedded via Vimeo (Vimeo, Inc., USA). Showing a video connects to Vimeo and transmits your IP address. Embeds use the “do not track” parameter; according to Vimeo, no tracking cookies are set.

Registration

For the protected area we store your name, email address and optionally company and website. Sign-in works through a one-time code or one-time link by email. If you set a password in your account, you can sign in with it; the password is stored only as a salted hash (scrypt), never in plain text.

The purpose is access to the full portfolio. The legal basis is your consent or the initiation of a working relationship (Art. 6(1)(a) and (b) GDPR). Your account is deleted on request at any time.

Rental requests

For a rental request we process name, company, VAT ID, email, phone, project details, period and requested equipment in order to prepare a quote and handle the rental contract (Art. 6(1)(b) GDPR).

If you provide your own insurance, you also give the insurer and policy number and can upload the insurance certificate. The file is stored encrypted, can only be viewed by the lessor and is deleted automatically twelve months after the rental period ends, or after six months for requests that do not lead to a contract. We also record which version of the rental terms you accepted.

On pick-up we check a photo ID and make a copy for new customers. It is deleted once the equipment has been returned and all claims have been settled (rental terms, section 5). The legal basis is our legitimate interest in protecting the rented equipment against loss (Art. 6(1)(f) GDPR).

If no contract is concluded, the data is deleted after six months. Once a contract is concluded, the statutory retention period of seven years applies (§ 132 BAO).

Newsletter

When you sign up for the newsletter, you first receive an email with a confirmation link. Only after clicking it does the subscription take effect. We store the email address, the time of sign-up and confirmation, and the version of the consent text in order to prove consent (Art. 6(1)(a) and Art. 7(1) GDPR, § 174 TKG 2021).

Newsletters are sent via Resend, Inc., USA, where the email address and its unsubscribe status are held. Every email contains a link to unsubscribe immediately; you can also withdraw consent at any time by writing to tom@doptom.com.

If you tick the newsletter box when registering, clicking the sign-in link completes the subscription — the link confirms the address just as the confirmation email would. You can switch the newsletter on or off in your account at any time.

After unsubscribing, the address is no longer contacted. We keep proof of the earlier consent for up to three years; on request we delete the address entirely.

Service providers

Hosting: Netlify, Inc., USA.

Database: Neon, Inc., servers in Frankfurt am Main.

Email delivery for sign-in links, request confirmations and newsletters: Resend, Inc., USA.

Data processing agreements are in place with all providers. Transfers to providers in the USA are based on the EU-US Data Privacy Framework or standard contractual clauses.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent at any time. Write to tom@doptom.com.

You may also lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.