Privacy policy
This website is deliberately built to collect as little as possible: no cookies, no tracking, no third-party analytics services, no external fonts, no social plugins.
Last updated: October 2026
Controller
A2 Digital Works e.U., owner Aykut Akçam, Vienna, Austria (FN 689975w, Commercial Court of Vienna). Contact: hello@a2digitalworks.com. The full postal address is in the imprint.
What this website does not do
No cookies are set. Fonts, images, video and scripts are served from our own server — the only exception is the preview on the Ori Live page, which at your request shows your own start page in a window (see “Ori Live”). There are no advertising pixels, no data-transmitting social buttons, no audience measurement by third parties and no profiling. We count page views ourselves — without cookies and without recognising you again; see “Visitor statistics without cookies”.
Server log files
When you open a page, the hosting provider processes technically necessary access data: IP address, date and time, file requested, volume transferred, referrer and browser identification. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, fault-free operation). This data is not merged with other sources and is deleted after a short period.
If your browser finds that content breaks this website’s security policy (Content Security Policy), it reports that to our server. Only the page concerned and the kind of violation are stored — no IP address, no browser identification. The reports serve troubleshooting alone and are deleted after 30 days.
Visitor statistics without cookies
We count how often our pages are opened — on our own server, from the server log files, without cookies, without a script in your browser and without any third-party service. So that a visitor counts only once per day, a short value (hash) is formed from the IP address, the browser identification, a secret key and the date. It recognises the same visitor only on the same day and is deleted after two days.
Only totals are stored permanently: views per page, visitors per day, the referring website (domain name only), the country (as transmitted by Cloudflare), the device type and the time of day. There is no recognition across several days, no profile and no merging with other data. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding how the website is used and improving it).
Hosting
The website is operated at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, under a data processing agreement. Processing takes place inside the European Union.
Delivery through Cloudflare
The website is delivered through the network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (content delivery network, DNS and protection against attacks). To route requests and fend off attacks, Cloudflare processes technically necessary connection data such as the IP address. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in fast, secure delivery). Cloudflare is certified under the EU-US Data Privacy Framework; the EU standard contractual clauses apply in addition. A data processing agreement is in place with Cloudflare.
Contact form and project enquiry
When you submit the enquiry form, your entries (name, email address, optionally company, and your answers about the project) are transmitted to our server in encrypted form, stored there and delivered to us by email. To prevent abuse, your IP address is used briefly in a shortened, encrypted form for rate limiting only and is not linked to your enquiry. Should the transmission fail, a prepared email opens in your mail application instead.
We process enquiries to answer them and to prepare a possible contract (Art. 6(1)(b) GDPR). We keep them for at most 24 months unless a contract or statutory retention periods require longer storage.
Booking an appointment
When you choose a time on the page “Book an appointment”, we process your name, your e-mail address, your phone number for a phone call, the place you name for a meeting in person, optionally your business and topic, and the day, time and kind of appointment. The details are sent to our server in encrypted form and stored there. You receive a confirmation by e-mail with a calendar file and a personal link through which you can view, move or cancel the appointment. That page sets no cookies and can only be reached through the link. A reminder by e-mail may follow the day before. The booking page stores nothing in your browser.
We enter the appointment in our company calendar at Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a data processing agreement is in place with Google). To show free times we read from our calendars only whether a time is busy. For a video appointment a Google Meet link may be created there. To prevent abuse we use your IP address briefly for rate limiting; it is not stored. Ori, our assistant, can name free times but never enters an appointment itself.
The legal basis is the preparation of a possible contract at your request (Art. 6(1)(b) GDPR). We delete appointments no later than 12 months after the appointment — on our server and in the calendar — unless a contract or statutory retention periods require longer storage.
Suggestions for company name and address
In some forms (funding check, offer, booking, Ori Live) the page suggests matching addresses as you type and, for Austrian companies, entries from the Austrian company register. Our own server fetches these suggestions: addresses via the Google Maps Platform (Google Ireland Ltd., Dublin; Places API) for Austria, Germany and Switzerland, company data via the public company-register interface of the Austrian Ministry of Justice. Only the text you type is transmitted; your IP address is not sent to Google because our server makes the request. Nothing is stored before you submit the form. You can ignore the suggestions and type everything by hand.
Newsletter
For the newsletter we store your email address, the time of sign-up and confirmation, and the chosen language. Sign-up uses double opt-in: it only takes effect once you click the confirmation link in the sign-up email; unconfirmed sign-ups are deleted after seven days. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in every issue or by emailing hello@a2digitalworks.com. Sending runs through our own server and Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Opens and clicks are not tracked.
Ori, our assistant on this website
When you ask Ori a question in the bottom right, your text is transmitted to our server in encrypted form and forwarded from there to Anthropic, PBC (San Francisco, USA), which operates the language model and generates the answer. Only your message and the previous messages of the same conversation are transmitted — no IP address, no name, no account. We do not store conversations; our server logs per request only the time, language, text volume (tokens) and whether the answer succeeded. Anthropic processes the data on our behalf under a data processing agreement with EU standard contractual clauses and does not use it to train its models. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in answering visitor questions immediately); using Ori is your choice — everything is also available on this website and through the enquiry form. Please do not give Ori sensitive data. If the service is unavailable, Ori answers from a fixed list of answers inside your browser without transmitting anything; the window then says so.
Ori Live: see Ori on your website
On the Ori Live page (/en/ori-live/) you can enter your own web address. Our server then fetches the public start page at that address, plus up to twelve further public sub-pages your website links in its menu or sitemap (together with its stylesheets, its logo or site icon and its robots.txt — if a site forbids automatic reading there, we do not read it). From it the server detects colours, font and logo and passes the text of these pages to Anthropic, PBC (San Francisco, USA), which generates a greeting and sample questions from it. If you ask Ori questions in the preview (five at most), the text of these pages and your questions also go to Anthropic to generate the answer. Anthropic processes the data on our behalf under a data processing agreement with EU standard contractual clauses and does not use it to train its models.
The content read stays only in our server's memory and is deleted after two hours at the latest; nothing of it is written to disk. Our server logs for each run only the time, duration, text volume (tokens) and whether it succeeded — not the address, not the text, not your questions. We use your IP address briefly in hashed form for rate limiting (three previews a day at most); it is not stored.
For the view we show your start page in a window on our page — the only place on this website where anything is loaded from another server, and only after you entered an address yourself. Your browser then fetches the page directly from its server; that site's privacy policy applies. We load the window without your browser's cookies (where the browser supports this) and without telling it which page the request comes from. If your site does not allow being embedded, we show a recreation built from the content read.
Please enter only addresses of public websites you may use for your business, and do not ask Ori questions containing sensitive data. The legal basis is Art. 6(1)(b) GDPR (your wish to try our service) or Art. 6(1)(f) GDPR (our legitimate interest in demonstrating our service). If you then request a quote, we handle your details as described under “Contact form and project enquiry” (for ordering the 7-day test see “Ori on our clients’ websites”); with the request we then also store the web address and the key data of the preview (detected name, colours, number of questions asked) — not the text of your site and not the conversation.
Ori on our clients’ websites
Businesses can order Ori from us for their own website. There he is integrated via a small script that the visitor's browser loads from our server (a2digitalworks.com, servers at Hetzner in Germany). The respective business is the controller for processing on such websites; we process the data only on its behalf (Art. 28 GDPR) and on its instructions. The privacy policy of the website where you use Ori therefore applies first.
What happens: when the script loads and with each question our server technically receives your IP address and the time (see “Server log files”). Ori sets no cookies. So that the conversation survives a change of page, your browser keeps it in the session storage of this tab; it disappears when you close the tab. Your questions go together with the conversation so far to Anthropic, PBC (USA), which generates the answer — on the basis of EU standard contractual clauses and without use for training. We do not store the content of conversations; we only count how many conversations and messages there are per website (with a hashed conversation identifier, deleted after 13 months). We use your IP address briefly in hashed form to limit abuse.
If a business orders the 7-day test on our Ori Live page, we store its details (company, contact person, e-mail, phone, address, VAT ID, website), the time it accepted the terms and a hashed value of its IP address as proof. The legal basis is Art. 6(1)(b) GDPR (contract) and (c) (retention duties); invoice data are kept for seven years (Austrian Federal Fiscal Code, § 132 BAO). For this we read the website's public start page and store the text read, the colours, the font and the logo for the term of the contract, at most three months beyond it.
Customer form and online signature
New customers receive a personal link by email to a customer form hosted on our own server. There you enter the details we need for quotes, contracts and invoices: company, legal form, company register number and VAT ID, contact person, address, email address, phone number, preferred payment methods and notes. The page sets no cookies and can only be reached through that link; the link is valid for 30 days. We can see whether and when the link was opened.
You sign the customer form directly on the screen. In doing so we store the drawn signature, the name you typed, date and time, your IP address and your browser’s identifier — as proof of who submitted the form and when. We send the signed customer form to you and to ourselves as a PDF by email. The form asks for bank details only if you give us a SEPA direct debit mandate in it; otherwise you enter your bank details exclusively when paying with our payment provider Stripe.
The legal basis is taking steps prior to and performing the contract (Art. 6(1)(b) GDPR) and, for the evidence data of the signature, our legitimate interest in being able to prove it (Art. 6(1)(f) GDPR). We keep the customer form for the duration of the business relationship and afterwards for as long as statutory retention periods require. Invitations that are never completed are deleted after 90 days.
Offers and contracts online
We send offers and contracts by email — with a personal link to a page hosted on our own server. The page shows the document, sets no cookies and can only be reached through that link; we can see whether and when the link was opened. You accept or decline an offer online there. A contract is signed by us first, then by you — directly on the screen.
With your acceptance or signature we store the drawn signature, name, role, place and date, the time, your IP address, your browser’s identifier and a checksum of document and signature — as proof of who agreed and when. We send the signed document to you and to ourselves as a PDF by email. If you decline, we store the time and, if you give one, your reason.
The legal basis is taking steps prior to and performing the contract (Art. 6(1)(b) GDPR) and, for the evidence data of the signature, our legitimate interest in being able to prove it (Art. 6(1)(f) GDPR). We keep accepted offers and signed contracts for the duration of the business relationship and afterwards for as long as statutory retention periods require.
Invoices and payment
Anyone who receives an invoice from us gets it by email — with a personal link to a payment page hosted on our own server. The page shows the invoice number, amount, due date and our bank details; it sets no cookies and can only be reached through that link. We can see whether and when the payment page was opened and the invoice downloaded there — not whether you read the email: the invoice email contains no tracking pixel. We store customer data, invoices and incoming payments on our server. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); we keep invoices and accounting records for seven years as required by law (Art. 6(1)(c) GDPR, Section 132 of the Austrian Federal Fiscal Code).
If you choose “pay online” on the payment page, you are forwarded to Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). For this we transmit the invoice number, the amount and your email address. You enter your payment details — card, bank account or PayPal account — exclusively at Stripe; we neither see nor store them. Stripe only tells us whether and when the payment was received. Stripe processes the data to handle the payment and to prevent fraud as a controller in its own right, may set its own cookies on its pages and may transfer data to the USA; details are in Stripe’s privacy policy (stripe.com/privacy).
If you pay by bank transfer, the booking appears on our business account at the bank Qonto. Our server reads the incoming payments there — date, amount, sender’s name and payment reference — in order to match them to the invoice. You can pay any invoice by bank transfer without using Stripe.
For our bookkeeping the server also reads the debits on the same account — date, amount, recipient’s name and booking text — in order to match them to the receipts. We do not store other parties’ account numbers or account balances in the process. Incoming payments and debits are accounting records and are kept for seven years like these.
We file copies of our accounting records — outgoing invoices, incoming receipts, lists of account movements, accepted offers and signed contracts — in an orderly folder at Dropbox (Dropbox International Unlimited Company, Dublin, Ireland), which we share with our tax adviser. Dropbox also stores data on servers in the USA; details are in Dropbox’s privacy policy (dropbox.com/privacy). The legal basis is our legitimate interest in orderly bookkeeping and compliance with statutory record-keeping and retention duties (Art. 6(1)(f) and (c) GDPR).
Local storage
We store in your browser (localStorage or sessionStorage) only your choice between light and dark appearance and — while you fill in the enquiry form — your progress, so nothing is lost when you change pages. This never leaves your device and is not evaluated. You can delete it at any time in your browser settings.
Email communication
If you write to us, we process your message and contact details in order to deal with your request. Our email runs on Google Workspace (Google Ireland Limited) under a data processing agreement. Email transmission over the internet can have security gaps; complete protection against third-party access is not possible.
Our profiles on social networks
In the footer we link to our profiles on Instagram, LinkedIn, TikTok, YouTube and Threads. These are plain links: this website embeds no content, buttons or tracking pixels of these networks, and nothing is transmitted to them unless you click one of the links. Once you open a profile, the privacy terms of the respective provider apply — Instagram and Threads: Meta Platforms Ireland Limited; LinkedIn: LinkedIn Ireland Unlimited Company; TikTok: TikTok Technology Limited (Ireland); YouTube: Google Ireland Limited. We have no influence on their processing. If you send us a message there, we use it only to answer you (Art. 6(1)(b) or (f) GDPR).
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection. An informal message to hello@a2digitalworks.com is enough.
You also have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.
