Privacy Policy

1 November 2026

The controller responsible for processing personal data on this website is:

André Fuentes Vasquez, AMULEY
Wichtelgasse 37/25
1160 Vienna, Austria
Email: andre@amuley.eu

If you have any questions about data protection or wish to exercise your rights, you can contact us at this address.

The website is provided via Cloudflare Workers and Static Assets. In the process, Cloudflare processes technical information that your browser transmits when accessing the site. This includes, in particular, your IP address, the requested address, the time of access and technical details about your browser, connection and request.

This processing enables the website to be delivered, misuse to be prevented and reliable operation to be ensured. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in a functional and secure website.

For this purpose, Cloudflare processes connection and security information within its infrastructure. This is distinct from any additional logs that we generate ourselves in the website application. Our application does not write contact content or error messages containing personal data to its own application logs.

Technical data is processed in line with its purpose for delivery, security and error handling. The retention period is determined in particular by technical necessity, the investigation of specific security incidents and legal obligations. You can find information on processing by Cloudflare in its privacy policy.

If you write to us at andre@amuley.eu, we process your email address, the content you send us and, where applicable, your name, other contact details and attachments. In addition, there is technical message information, such as the time of sending and receipt and the email headers.

We use this data to handle your enquiry and to communicate with you. If your enquiry relates to a possible assignment or an existing contract with you, the necessary processing is based on Art. 6(1)(b) GDPR. Other enquiries and communication with contact persons at a company are handled on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in responding to business matters and maintaining traceable communication.

To receive, store and handle emails, we use Gmail as part of Google Workspace. Google processes message content and the technical data required for the email service. Google Workspace is used here as a business email service; simply visiting our website does not establish any connection between your browser and Gmail.

For technical proof of delivery, Google provides an email log search covering a period of 30 days. For Gmail and admin logs, Google specifies six months. These technical logs are distinct from the messages in the mailbox and their deletion. Further information can be found in Google's overview of log retention periods.

You are not obliged to send us an enquiry. Without a reachable contact address and the information required to handle it, we may not be able to respond to your request.

If you use the contact form, we process your name, your email address, your message and the language of the enquiry. Your name, email address and message are required to handle and respond to the enquiry. The data is transmitted via HTTPS to our Cloudflare Worker. The Worker passes the details required to send the email to Resend (Plus Five Five, Inc., USA). The message is sent from website@forms.amuley.eu to our Google Workspace mailbox andre@amuley.eu. Your email address is used as the reply-to address. No automatic reply is sent.

To protect against automated or abusive requests, the application checks the origin and validity of the request, an additional technical form field and the frequency of requests. For the frequency check, a value is derived from your IP address or your network range using a secret key. This value, rather than the original IP address, is passed to the rate-limiting function. It is pseudonymised and, using the secret key, can be matched to known IP addresses or network ranges. The technical check field, the IP address and the derived value are not part of the contact email generated. No external CAPTCHA service is used.

The legal bases for handling your enquiry are the same as for email communication. Technical protection against misuse is based on Art. 6(1)(f) GDPR; our legitimate interest is protecting the contact channel and its availability.

The application does not create an additional enquiry database. Cloudflare processes the request for technical form handling and protection against misuse. For delivery, Resend processes the message content and sending data such as sender, recipient, reply-to address, subject, message ID, time and delivery status. We then handle the message in the Google Workspace mailbox. Resend may check messages to prevent misuse. According to the provider, a small sample of emails is processed for security purposes on dedicated infrastructure operated by Resend at RunPod. Regular sending via the email API does not transmit content to Anthropic; this applies to separate AI editor and support features. Your browser receives a message ID as technical confirmation of acceptance.

General completed enquiries that do not lead to an assignment are, as a rule, deleted no later than six months after the communication has ended. Deletion is carried out manually by the controller. If the data is no longer needed earlier and there are no reasons to the contrary, we may delete it sooner.

In the case of ongoing specific contract negotiations or existing assignments, we store the necessary data for as long as they are being handled and carried out. Documents subject to statutory retention obligations are kept in accordance with those obligations. For books, records and supporting documents relevant for tax purposes, Section 132 of the Bundesabgabenordnung (BAO), the Austrian Federal Fiscal Code, generally provides for seven years, calculated from the end of the relevant calendar year; where relevant proceedings are pending, longer retention may be required. This period does not apply across the board to every general enquiry.

Where certain data is required to establish, exercise or defend specific legal claims, we may continue to retain it for as long as necessary for this purpose. The legal basis in this respect is Art. 6(1)(f) GDPR; for statutory retention obligations, it is Art. 6(1)(c) GDPR.

Deletion in the active mailbox and final deletion from the email provider's systems are technically separate processes. After a deletion instruction that we can no longer reverse, Google describes a technical deletion period of no more than 180 days, subject to retention required by law. Further details can be found in the Cloud Data Processing Addendum.

For sending the form, Resend stores email and log data for 30 days on the free plan, according to its privacy information. According to its security information, backups are kept for seven days. After the Resend account has ended, remaining customer data is deleted within 90 days in accordance with the Data Processing Addendum, unless further storage is required or permitted by law. These provider periods are distinct from our retention of the enquiry received in the Google Workspace mailbox.

We do not use cookies for advertising or audience measurement in the website application. The application does not store personal data in Local Storage or Session Storage. Fonts and images are delivered with the website files. No analytics or advertising scripts and no external media, map or social media embeds are included.

For hosting and the technical operation of the contact form, we use services from Cloudflare, Inc., USA. For sending the form, we use Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. For business email, we use Google Workspace. To provide their services, these providers may use affiliated companies and further sub-processors. The providers publish their lists for Cloudflare services, Resend and Google Workspace.

Processing outside the EU or the EEA, in particular in the USA, is therefore possible. Cloudflare, Inc. and Google LLC participate in the EU-U.S. Data Privacy Framework. For transfers to these companies that are covered by this framework, the corresponding adequacy decision of the European Commission under Art. 45 GDPR forms the basis. For other transfers to countries without an applicable adequacy decision, the providers' terms include standard contractual clauses; their application depends on the respective transfer and, where necessary, includes supplementary safeguards. For details, see the Cloudflare Customer DPA, the Google Data Processing Addendum and Google's information on transfer mechanisms. You can also request further information or a copy of the relevant safeguards from us.

For Resend, Ireland (eu-west-1) has been selected as the sending region. This setting determines where emails are sent from; it does not result in storage exclusively within the EEA. Resend stores customer data, including message content and delivery logs, in the USA. For processing on our behalf and transfers to third countries, the Resend Data Processing Addendum provides for the EU standard contractual clauses. You can also find information on processing in Resend's privacy policy.

Subject to the statutory requirements, you can request access to your personal data, its rectification or erasure, and the restriction of processing.

The right to data portability applies where processing is based on consent or a contract and is carried out by automated means.

Objection: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process this data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

For the processing described here, we do not require consent under data protection law as a condition for a contact enquiry. No solely automated decision-making with legal or similarly significant effects, including such profiling, takes place in connection with this website.

You also have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42
1030 Vienna, Austria
Email: dsb@dsb.gv.at
Website: dsb.gv.at

If the data processing on this website changes, we will update this Privacy Policy accordingly.