Privacy.
1. Controller
Manuel Mayrhofer (“metic.”), Linden 118, 4372 St. Georgen am Walde, Austria. Email: office@metic.studio
2. In short
This website works without advertising cookies and without third-party analytics or tracking services. For simple visitor statistics I use my own cookie-free tool on my server (section 3). Fonts, images and code are served from its own server, and the site does not load content from third parties on its own. The only exception is YouTube videos, and only once you click them (section 6). I only process personal data as far as necessary to run the website, for the visitor statistics or to handle your enquiry.
3. Hosting and visiting the website
The website runs on a server of Hostinger International Ltd. (Cyprus) in a data centre in Frankfurt am Main, Germany. Hostinger processes data as a processor under Art. 28 GDPR.
When you visit a page, the server processes technically necessary connection data: IP address, time, requested address, amount of data transferred and browser identifier. They are only used to deliver the page and keep operations secure; access logs containing these data are not stored. The legal basis is my legitimate interest in secure, working operations (Art. 6 (1) (f) GDPR).
Visitor statistics: to see which pages are read and how visitors find the website, I use the open-source software Umami. It runs on my own server at Hostinger (see above); the data are not passed on to any other provider.
For each page view, the following are recorded: the address visited, the page you came from, browser, operating system, device type, screen size, language, and country, region and city derived from the IP address. In addition, individual events are recorded: submitting a form (only the type of project and the budget range, no content and no contact details), clicks on the email address, the phone number, “Start a project” or links to other websites, and hidden details found on the site.
The IP address itself is not stored. To count visits, Umami combines the IP address and browser identifier with a key that changes every month into a checksum (hash). Visits can therefore only be grouped within one calendar month. I only evaluate the data in aggregate and do not try to identify individual visitors.
Umami does not set cookies and does not store anything in your browser’s storage. If you have switched on “Do Not Track” in your browser, you are not recorded. The legal basis is my legitimate interest in understanding how the website is used and improving it accordingly (Art. 6 (1) (f) GDPR). The statistics are deleted automatically after 24 months.
4. Contact form and project enquiry
When you submit a form, I process your details: name, email address and message, optionally phone number, company and existing website, and for a project enquiry also the kind of project, budget and time frame. The purpose is to answer your enquiry and, where applicable, to make an offer. The legal basis is taking steps at your request prior to entering into a contract (Art. 6 (1) (b) GDPR).
The details are stored in the website’s database on the server named above. In addition, I receive a notification by email; the email service is also operated by Hostinger as a processor.
Providing details is voluntary. Without name, email address and message, however, I cannot handle your enquiry.
Retention: if no contract results, I delete your enquiry no later than 30 days after our communication has ended. If it leads to a contract, I keep the documents as long as needed to fulfil it and for the statutory retention periods beyond that (usually seven years under § 132 of the Austrian Federal Fiscal Code, BAO).
5. Cookies and browser storage
The website sets a single cookie: “metic-lang” remembers the language of the site (value “de” or “en”, lifetime one year). On your first visit, the language is taken from your browser’s language setting.
The site also keeps a few settings in your browser’s storage (local and session storage): the colour scheme, whether sound is on, whether you already know the magnifier, which hidden details you have found and whether the intro has already run in this session. These never leave your browser and are not transmitted to me.
Both serve solely to provide the site the way you use it and are strictly necessary for that (§ 165 (3) of the Austrian Telecommunications Act 2021, Art. 6 (1) (f) GDPR). You can delete the cookie and the storage in your browser at any time. Signing in to the content management system uses another cookie; that only concerns me as the operator.
The site does not set cookies of other providers on its own. That can only happen once you start a YouTube video (section 6).
6. YouTube videos
In some articles, for example in the journal, I show videos from my YouTube channel. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
The videos are embedded with a two-click solution: when the page loads, you only see a preview image from this website’s own server, and there is no connection to YouTube. Only when you click the video does your browser load the YouTube player in privacy-enhanced mode (youtube-nocookie.com).
From that click on, Google receives data from your browser, in particular your IP address, date and time, the address of the page with the video, information about your browser and device, and how you use the player. YouTube may use cookies or similar technologies on your device. If you are signed in to Google, Google can link the visit to your account. According to Google, playback in privacy-enhanced mode is not used to personalise your experience on YouTube or advertising.
The legal basis is your consent, which you give with the click (Art. 6 (1) (a) GDPR; for cookies and storage on your device, § 165 (3) of the Austrian Telecommunications Act 2021). It applies only to the video you clicked during the current page visit; the website does not remember your choice. You can withdraw your consent at any time with effect for the future by closing or reloading the page; you can delete cookies set by YouTube in your browser. Without a click, no video is loaded and the rest of the page works as usual.
Google may also transfer the data to Google LLC in the USA. For companies certified under the EU-US Data Privacy Framework, the European Commission has found an adequate level of data protection (Art. 45 GDPR); Google LLC is certified under it. The list of certified companies is available at www.dataprivacyframework.gov.
How long Google keeps the data and what exactly Google uses it for is beyond my control. For more, see Google’s privacy policy and YouTube’s notes on privacy-enhanced mode.
7. Links to other websites and social networks
Links to projects and profiles lead to external websites. Only when you click one are data transmitted to its operator; their privacy policy applies there.
This also applies to my profiles on Instagram and YouTube, which I link to at the bottom of every page and on the contact page. They are plain links: this website does not use social media plugins such as “like” buttons or embedded feeds, so simply visiting it transmits nothing to these networks. The providers are Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (Instagram, privacy policy), and Google Ireland Limited (YouTube, see section 6).
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). A message to office@metic.studio is enough.
If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
There is no automated decision-making, including profiling.
Last updated: October 2026