Skip to content

Privacy policy

As of: October 2026

This is a translation of the German privacy policy; the German version is legally binding.

We take the protection of your personal data seriously. We process your data exclusively on the basis of the statutory provisions (General Data Protection Regulation, Austrian Data Protection Act, Austrian Telecommunications Act 2021). Below we inform you about the processing of personal data when you visit this website.

1. Controller

The controller responsible for data processing on this website is:

Altbaumanufaktur Interior & Design GmbH
FN 371554 d
Rudolfsplatz 9
1010 Vienna
Austria
Email: wien@bonstingl.at
Phone: +43 664 260 86 05

For questions about data protection, you can reach us using the contact details above. No data protection officer has been appointed.

2. Your rights

In principle, you have the rights of access, rectification, erasure, restriction of processing, data portability and objection. If you believe that the processing of your data violates data protection law or that your data protection rights have otherwise been infringed, you can lodge a complaint with us or with the data protection authority.

Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna
Email: dsb@dsb.gv.at
Web: www.dsb.gv.at

3. Hosting and server log files

This website is operated as a static website by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you access the website, the server automatically processes data that your browser transmits for technical reasons – in particular your IP address, the date and time of access, the page requested, the amount of data transferred, and the browser type and operating system.

This processing is technically necessary to deliver the website and is based on our legitimate interest in operating the website securely and reliably (Art. 6(1)(f) GDPR).

Netlify processes data in the course of providing and securing the website. Processing in the USA and other third countries is possible. Netlify provides a data processing agreement incorporated into its terms. You can find more information in its GDPR and data processing notes and in Netlify’s privacy policy. Under section 14 of Netlify’s current data processing agreement, covered transfers to the USA are based on the EU-US Data Privacy Framework. Where it does not apply, the agreement provides for the European Commission’s standard contractual clauses. Netlify publishes the sub-processors it uses and their locations in its list of sub-processors.

We do not evaluate these log data ourselves. Netlify stores them only for as long as necessary to provide and secure the website; Netlify’s privacy policy does not state a fixed retention period.

4. Contacting us

You can reach us via the contact form on this website, by email or by phone. When you contact us, we process the data you provide (such as your name, email address, phone number and message) solely to handle your enquiry, for example to arrange a viewing, and in case of follow-up questions.

In the contact form, first name, last name and email address are required. You may add a phone number and your message voluntarily. The language in which you are viewing the website is also transmitted. The form is processed by the Netlify Forms service; the data you submit is sent to Netlify and stored there. A hidden additional field is used to detect automated spam submissions. In addition, according to its documentation on spam filters, Netlify checks all form submissions with the Akismet service by Automattic. This involves processing the input data required for spam detection. Further information can be found in Akismet’s privacy policy. This check serves our legitimate interest in protection against abusive submissions (Art. 6(1)(f) GDPR). The provider details and transfer safeguards described in section 3 apply to Netlify.

The legal basis is the performance of pre-contractual measures or of a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR).

Where an enquiry gives rise to books, records or related documents that must be retained, a retention period of seven years from the end of the relevant calendar year generally applies under § 132 of the Austrian Federal Fiscal Code (BAO). Longer retention may be necessary in relevant pending tax proceedings. The legal basis for complying with statutory retention obligations is Art. 6(1)(c) GDPR.

We delete enquiries that do not lead to a business relationship and are not subject to a statutory retention obligation no later than six months after the last contact. This includes the form submissions stored at Netlify as well as the related emails.

5. Map (Mapbox)

To show the location of the apartment, we embed a map from the Mapbox service of Mapbox, Inc., USA, on the homepage. The map only loads when you scroll to the map section. Your browser then loads map data (map tiles, map style and labels) directly from Mapbox servers; in doing so, your IP address and technical information about your browser and device are transmitted to Mapbox.

Mapbox records every map load, among other things to bill its usage. For this purpose, the map stores a random identifier with a timestamp in your browser’s local storage (entries “mapbox.eventData”) and reports the map load to Mapbox.

The map is embedded on the basis of our legitimate interest in clearly showing the location of the apartment (Art. 6(1)(f) GDPR). Mapbox is certified under the EU-US Data Privacy Framework; transfers to the USA are based on it. According to its product privacy policy, Mapbox deletes IP addresses within 30 days. Further information can be found in Mapbox’s privacy policy; Mapbox answers questions about data protection at privacy@mapbox.com.

We serve the historical city map of 1858 (“1858 Version”) from our own server; no data is transferred to third parties.

6. Fonts

The fonts used on this website are served from our own server. No connection to third-party servers is made, and no data is transferred to providers such as Google Fonts.

7. Cookies and audience measurement

This website does not set any cookies. For simple audience measurement, we use PostHog in permanently cookieless mode with its EU endpoint. This involves processing page views and information about the browser, operating system, device and referring domain. URL parameters and URL fragments are not included in the analytics events.

PostHog uses neither cookies nor local storage or session storage for this analysis. Your IP address and browser identifier are transmitted to PostHog for technical reasons and used there, together with the website domain, for a hash identifier that changes daily. No permanent user profiles are created. Form inputs, clicks and session recordings are not captured. Your browser’s Do Not Track setting is respected.

Information about the method can be found in the documentation on cookieless tracking and in PostHog’s privacy policy.

Apart from the map identifier described in section 5, this website does not store any information in your browser.

8. Data security

This website is delivered exclusively over an encrypted connection (HTTPS/TLS). This means that data transferred between your browser and our server cannot be read by third parties.

9. Changes to this privacy policy

We update this privacy policy as soon as the data processing on this website changes. The version published here applies.