Terms & Conditions

Last updated: June 12, 2025

Privacy Policy

Last updated: 2 August 2026

This policy explains what personal data we process when you use kookie-kollective.com, why, on what legal basis, and what rights you have. It is written to the GDPR (DSGVO) and the Austrian Telecommunications Act 2021 (TKG 2021).

1. Controller

Kookie Kollective GmbH
Viaduktbögen 11, 6020 Innsbruck, Austria
Commercial register (Firmenbuch): FN 647947p
VAT ID (UID): ATU81817802
Court of jurisdiction: Innsbruck
Email: info@kookie-kollective.com
Phone: +43 660 6727899

We have not appointed a Data Protection Officer, as we are not required to under Art 37 GDPR.

2. What we process, at a glance

Server log data — automatically, to deliver and secure the site
Contact form submissions — when you choose to write to us
Usage statistics — how the site is used
Advertising measurement — only with your consent

We do not sell personal data. We do not use it for automated decision-making or profiling that produces legal effects concerning you.

3. Hosting and server logs

This website is hosted by Webflow, Inc. (398 11th Street, San Francisco, CA 94103, USA). When you visit, your browser transmits data that is stored in server log files: IP address, date and time, page requested, referrer URL, browser and operating system.

Legal basis: Art 6(1)(f) GDPR — our legitimate interest in delivering the site reliably and securely. This data is not merged with other sources and is not used to identify you.

We also use Cloudflare, Inc. as a content delivery network and for bot protection (including Cloudflare Turnstile on forms). This is technically necessary to protect the site from abuse. Legal basis: Art 6(1)(f) GDPR.

4. Contact forms and email

Our contact pages collect your name, company, email address and your message. We use this only to respond to your enquiry and to take steps at your request prior to entering into a contract.

Legal basis: Art 6(1)(b) GDPR where your enquiry relates to a possible engagement; otherwise Art 6(1)(f) GDPR, our legitimate interest in responding to enquiries.

Retention: enquiries are kept for as long as needed to deal with them and for any subsequent business relationship. Where commercial or tax law requires it, records are retained for seven years (§ 132 BAO).

5. Cookies and similar technologies

We set no cookies for statistics or advertising until you allow them. When you first visit, a consent banner lets you accept all, reject all, or choose individually. You can change your decision at any time — see section 9.

Cookies we use

NameSet byPurposeDurationLegal basiskookie-consentKlaro (our own server)Stores your consent decision so we do not ask again180 daysExempt — § 165(3) TKG 2021. Required to honour your choice_ga, _ga_ENW1BED4JMGoogle Analytics 4Distinguishes visitors and measures site usageUp to 2 yearsConsent — Art 6(1)(a) GDPR_gcl_auGoogle AdsMeasures whether an advert led to an enquiry90 daysConsent — Art 6(1)(a) GDPR_fbpMeta PixelMeasures advertising performance on Facebook and Instagram90 daysConsent — Art 6(1)(a) GDPR

Cloudflare may set short-lived cookies strictly for security and bot protection. These are technically necessary and are not used for analysis or advertising.

6. Website statistics (Umami)

We run Umami, an open-source analytics tool, on our own server at analytics.kookie-kollective.com. It tells us which pages are visited and roughly where visitors come from.

Umami is cookie-free. It stores nothing on your device, sets no identifier, and does not track you across websites. IP addresses are not stored — they are used only momentarily, in hashed form, to distinguish one visit from another, and are then discarded. The data is not shared with anyone and never leaves our own infrastructure.

Legal basis: Art 6(1)(f) GDPR — our legitimate interest in understanding how our website is used. Because no information is stored on or read from your device, this does not require consent under § 165(3) TKG 2021. This is why some basic statistics continue even if you decline everything else.

7. Google Analytics 4

With your consent we use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It uses cookies to help us understand how the site is used — pages viewed, time on site, approximate location, device and browser.

IP anonymisation is active: your IP address is shortened by Google within the EU before transmission. We have activated Google Consent Mode v2, which means Google tags are only loaded after you consent.

Legal basis: Art 6(1)(a) GDPR. Retention: 14 months.

8. Advertising measurement

Google Ads (Google Ireland Limited) — with your consent, we measure whether a visit that began with one of our adverts resulted in an enquiry. We see aggregate totals, not which individual took which action.

Meta Pixel (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland) — with your consent, we measure the performance of our advertising on Facebook and Instagram. Meta may act as an independent controller for parts of this processing; see Meta's privacy policy.

Legal basis: Art 6(1)(a) GDPR for both. Neither loads before you consent.

9. Withdrawing or changing your consent

You can change your decision at any time, with effect for the future, by opening the consent settings from the banner. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.

You can also delete cookies in your browser settings, or block them entirely — though parts of the site may then not work as intended.

10. Transfers outside the EU/EEA

Some of our providers are US companies or may process data in the United States. Where that happens, transfers are based on the EU-US Data Privacy Framework (an adequacy decision under Art 45 GDPR) and, where applicable, on Standard Contractual Clauses under Art 46(2)(c) GDPR.

Providers involved: Google, Meta, Webflow and Cloudflare. Despite these safeguards, we cannot rule out that US authorities may access data under local law.

11. Your rights

Under the GDPR you have the right to:

Access your personal data (Art 15)
Rectification of inaccurate data (Art 16)
Erasure (Art 17)
Restriction of processing (Art 18)
Data portability (Art 20)
Object to processing based on legitimate interest (Art 21)
Withdraw consent at any time (Art 7(3))

To exercise any of these, write to info@kookie-kollective.com. We respond within one month.

12. Complaints

If you believe our processing infringes the GDPR, you may complain to the Austrian supervisory authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Vienna, Austria
www.dsb.gv.at · dsb@dsb.gv.at

13. Changes to this policy

We update this policy when our processing changes. The date at the top shows the current version.

‍