Skip to content

Privacy notice

How we handle your request data

This notice covers this website, the “Start a project” form and e-mail contact with us.

Who is responsible

LazyHead e.U. (ORT301 is its brand), owner Andrii Snikhovskyi, Morizgasse 2/2/14, 1060 Vienna, Austria, FN 682664 v, Handelsgericht Wien. E-mail: office@ort301.com. Full details in the imprint.

What we process and why

  • Name, company (optional), e-mail address, your message, budget and timeline (optional), and the content of e-mails you send us — to answer your request and prepare a scope or proposal. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
  • Publicly available information about your company — if you write from a company e-mail domain or give a company name, we automatically fetch the home page of the company’s website and have public facts (business, industry, location) summarised with Google Gemini and Google Search so that we can assess the request. We do not research private individuals: for requests from free e-mail providers without a company name, nothing is looked up. If a company is run by one person (e.g. a sole trader), this public information may relate to that person. Source: publicly accessible websites and search results (Art. 14 GDPR). Legal basis: our legitimate interest in assessing incoming requests (Art. 6(1)(f) GDPR); you may object at any time. For this search, Google also processes the search query as an independent controller under its own terms.
  • A salted hash of your IP address — used only to limit abuse of the form (rate limiting) and deleted after 30 days. The address itself is not stored. Legal basis: legitimate interest in protecting the service (Art. 6(1)(f) GDPR).

Where the data is stored

Requests are stored in our own CRM system, hosted by Hetzner Online GmbH (Gunzenhausen, Germany) in data centres in the EU under a data processing agreement (Art. 28 GDPR). Only we have access to it. We never pass your data to advertising networks.

AI-assisted processing

When a request arrives, its content (name, company, e-mail address and message) is automatically translated and summarised, and a draft reply is prepared, using Google Gemini (Google LLC, USA / Google Ireland Ltd., Ireland) as our processor. Later messages in the conversation are translated in the same way, and we also use Gemini to organise open requests internally. Transfers to the USA are based on the EU-US Data Privacy Framework or EU standard contractual clauses. There is no automated decision-making within the meaning of Art. 22 GDPR: every reply is reviewed and sent by a person. Legal basis: Art. 6(1)(b) GDPR and our legitimate interest in handling requests efficiently and in several languages (Art. 6(1)(f) GDPR).

E-mail

E-mails to office@ort301.com are received by Cloudflare Email Routing, forwarded to our mailbox at Google Workspace (Google Ireland Ltd.; data processing agreement with EU standard contractual clauses) and copied into our CRM, where they are handled in the same way as requests sent through the form. Cloudflare does not keep the content after delivery. The automatic acknowledgement of receipt and our replies are sent through Resend (Resend, Inc., USA; data processing agreement with EU standard contractual clauses). If our CRM is temporarily unavailable, requests from the form are delivered to our mailbox by e-mail via Resend.

Website delivery and technical data

This website is delivered by Cloudflare (Cloudflare, Inc., USA; data processing agreement with EU standard contractual clauses and EU-US Data Privacy Framework certification). To deliver pages and protect against attacks Cloudflare processes technical connection data (IP address, request headers, time, and browser error reports via Network Error Logging); short-lived security logs are kept by Cloudflare. Legal basis: legitimate interest in a secure, fast website (Art. 6(1)(f) GDPR).

How long we keep it

We delete data as soon as it is no longer needed:

  • Requests that do not lead to a project: 12 months after our last contact.
  • Requests marked as spam: after 30 days.
  • The IP address hash: after 30 days.
  • Backups of our CRM are overwritten after 14 days.
  • If a contract follows, the data becomes part of the project file and is kept for the statutory retention period of seven years (§ 132 BAO, Austrian Federal Fiscal Code).

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability. The fields marked with * are needed to reply to your request; without them we cannot process it. Contact us through the form or the address in the imprint. You may lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at).

Right to object (Art. 21 GDPR)

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR) — in particular the research on publicly available company information, the AI-assisted organisation of requests and the IP address hash — you may object to this processing at any time on grounds relating to your particular situation. A short message to office@ort301.com is enough; we will then stop the processing unless we can demonstrate compelling legitimate grounds for it.

Cookies and tracking

This website sets no cookies of its own and uses no analytics or tracking. Cloudflare may set a strictly necessary security cookie (for example __cf_bm) that does not identify you across sites. Fonts are served from this site only.

Version 2.0 — 2 October 2026.