Privacy Policy of Nikolett Kustos Studios

We have crafted this privacy policy (version 06.06.2024-112808185) to provide you with clear and comprehensive information on how we handle your personal data (hereafter referred to as "data"). This document complies with the General Data Protection Regulation (EU) 2016/679 and relevant national laws. Our goal is to explain which data we, as data controllers—and the processors we employ (e.g., service providers)—process now and in the future, and to inform you of your legal rights.

In short: We aim to give you a transparent overview of how we process your data.
We only process personal data within the legal frameworks required for our business activities. Should you have any questions, please do not hesitate to contact us using the details provided below or in our legal notice.

Scope of Application

This privacy policy applies to all personal data processed by our company and by companies we have engaged as data processors. Personal data refers to information as defined by Article 4 No. 1 of the GDPR, such as names, email addresses, and postal addresses. Processing personal data enables us to provide and bill for our services, whether online or offline.

This privacy policy applies to all personal data processed by our company and by companies we have engaged as data processors. Personal data refers to information as defined by Article 4 No. 1 of the GDPR, such as names, email addresses, and postal addresses. Processing personal data enables us to provide and bill for our services, whether online or offline.

Legal Basis

In the following privacy policy, we provide transparent information on the legal principles and regulations—specifically the legal bases of the GDPR—that allow us to process personal data.

Regarding EU law, we refer to the REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can access this EU General Data Protection Regulation online on EUR-Lex, the gateway to EU law, at [this link](https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679).

We only process your data if at least one of the following conditions is met:

1. Consent (Article 6 Paragraph 1 lit. a GDPR): You have given us your consent to process data for a specific purpose. An example is storing data you entered in a contact form.
2. Contract (Article 6 Paragraph 1 lit. b GDPR): To fulfill a contract or pre-contractual obligations with you, we process your data. For instance, if we enter into a purchase agreement with you, we require personal information in advance.
3. Legal Obligation (Article 6 Paragraph 1 lit. c GDPR): If we are legally obligated, we process your data. For example, we are required by law to keep invoices for accounting purposes, which typically contain personal data.
4. Legitimate Interests (Article 6 Paragraph 1 lit. f GDPR): In cases of legitimate interests that do not override your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data to operate our website securely and efficiently, which constitutes a legitimate interest

Other conditions, such as the performance of tasks carried out in the public interest or the exercise of official authority, and the protection of vital interests, generally do not apply to us. Should such a legal basis become relevant, it will be indicated at the appropriate place.

In addition to the EU regulation, national laws also apply:
- In Austria, this is the Federal Act on the Protection of Natural Persons in the Processing of Personal Data (Data Protection Act), abbreviated as DSG.
- In Germany, the Federal Data Protection Act (BDSG) applies.
- If other regional or national laws apply, we will inform you in the following sections.

Contact Information of the Data Controller

If you have questions about data protection or the processing of personal data, don’t hesitate to contact us:

Nikolett Kustos Studios e.U.  
Nikolett Kustos  
Kendlerstrasse 2A/3/14, 1140, Vienna  
Authorized representative: Nikolett Kustos  
Email: nikolettkustos@gmail.com  
Phone: +4368120678946  
Legal Notice: http://nikolettkustos.com/legal

Storage Duration

Our general principle is that we only store personal data for as long as necessary to provide our services. This means we delete personal data once the reason for processing no longer exists. In some cases, we are legally required to retain certain data even after the original purpose no longer applies, such as for accounting purposes.

If you request the deletion of your data or withdraw your consent for data processing, we will delete the data as promptly as possible unless there is a legal obligation to retain it.

Rights Under the General Data Protection Regulation

According to Articles 13 and 14 of the GDPR, we inform you about the following rights you have to ensure fair and transparent data processing:

- Right of Access (Article 15 GDPR): You have the right to know if we process your data. If we do, you have the right to access the data and the following information:
 - The purpose of the processing
 - The categories of data being processed
 - The recipients of the data and how data security is ensured if the data is transferred to third countries
 - The storage duration of the data
 - The existence of rights to correct, delete, or restrict processing, and the right to object to processing
 - The right to lodge a complaint with a supervisory authority
 - The source of the data if we did not collect it from you
 - Whether profiling is conducted, meaning whether data is automatically evaluated to create a personal profile of you

- Right to Rectification (Article 16 GDPR): You have the right to request that we correct any inaccuracies in your data.

- Right to Erasure (Article 17 GDPR): You have the right to request the deletion of your data ("right to be forgotten").

- Right to Restriction of Processing (Article 18 GDPR): You have the right to request that we restrict the processing of your data, meaning we can only store it but not use it further.

- Right to Data Portability (Article 20 GDPR): You have the right to receive your data in a commonly used format upon request.

- Right to Object (Article 21 GDPR): You have the right to object to the processing of your data, which may result in a change in how we process your data. If the processing of your data is based on Article 6 Paragraph 1 lit. e (public interest, exercise of official authority) or Article 6 Paragraph 1 lit. f (legitimate interest), you can object to the processing. We will then assess as quickly as possible whether we can legally comply with your objection. If data is used for direct marketing purposes, you can object at any time, and we will no longer use your data for direct marketing. If data is used for profiling, you can object at any time, and we will no longer use your data for profiling.

- Right Not to Be Subject to Automated Decision-Making (Article 22 GDPR): Under certain circumstances, you have the right not to be subject to a decision based solely on automated processing, including profiling.

- Right to Lodge a Complaint (Article 77 GDPR): You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR.

In short: You have rights—don't hesitate to contact us if you have any questions or concerns!

If you believe that the processing of your data violates data protection law or that your data protection rights have been violated in any other way, you can file a complaint with the supervisory authority. In Austria, this is the Data Protection Authority, whose website can be found at [https://www.dsb.gv.at/](https://www.dsb.gv.at/). In Germany, each federal state has its own data protection commissioner. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:

Austria Data Protection Authority
Head: Dr. Matthias Schmidl
Address: Barichgasse 40-42, 1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at