Privacy Policy

Last updated: 6 October 2026

This policy explains what personal data is processed when you visit lechnerbrothers.com and when you contact us. Our former domain christophlechner.com forwards to lechnerbrothers.com; this forwarding also runs through Cloudflare (see section 2). The site is small: it has no cookies, no analytics scripts, no tracking, no advertising, no embedded social media content, no contact form, no newsletter and no user accounts.

1. Who is responsible

Email: [email protected]

The controller is the person who decides why and how personal data is processed.

2. Hosting and server log files

The website is hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare also provides our domain and DNS services. Cloudflare delivers the site through a network of servers in many countries, so your request is usually handled by a server close to you.

When you open the site, your browser sends technical data to the server, and the server logs it. This can include your IP address, the date and time of the request, the page requested, the referrer URL, and browser and operating system information. We need this data to deliver the site, keep it secure, detect misuse and fix errors. We do not use it for analytics or tracking and do not combine it with other data for that purpose. We only look at aggregated visitor numbers in Cloudflare's dashboard.

Legal basis: our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).

Storage period: Log data is kept only as long as needed for these purposes, or longer if the law requires it. The retention period is set by Cloudflare.

Cloudflare processes this data for us as a processor under a data processing agreement (Art. 28 GDPR).

3. Transfers to the USA

Cloudflare and Google are based in the USA, and OpenAI (see section 4) can process data there as well. Data can therefore be transferred to the USA and processed in other countries where these companies run servers. Cloudflare and Google are certified under the EU-U.S. Data Privacy Framework. Where a company is not certified, or where otherwise required, the transfer relies on the EU Standard Contractual Clauses.

4. Contact by email

Our mailbox for [email protected] is provided by Google Workspace, a service of Google Cloud EMEA Limited, Dublin, Ireland. Google stores incoming and outgoing emails for us.

If you write to us, we process your email address, your message, any attachments and anything else you choose to send. We use it to answer you, to handle partnership or sponsoring inquiries and, where relevant, to prepare or carry out a contract.

Legal basis: steps before entering into a contract, or performing one (Art. 6(1)(b) GDPR). For other messages, our legitimate interest in answering and managing communication (Art. 6(1)(f) GDPR). We do not rely on consent unless we ask for it separately.

Google processes your message for us as a processor under a data processing agreement (Art. 28 GDPR).

We use an AI assistant, ChatGPT, provided by OpenAI Ireland Limited, Dublin, Ireland, to help us read and sort emails and to draft replies. For this, OpenAI processes the content of emails sent to us. We write, check and send every reply ourselves, and no decisions are made automatically. OpenAI can process data in the USA, see section 3.

Storage period: We keep a message as long as the request or the business relationship needs it. If an email is part of business or tax records, we keep it for the legal retention period. In Austria, business records generally have to be kept for seven years (Section 132 BAO). This does not mean every email is kept that long.

We only pass your data on to the processors named in this policy, to professional advisers or authorities where the law requires it, or where needed to establish, exercise or defend legal claims. We do not sell personal data.

Sending information by email is voluntary. Without it, we may not be able to answer you.

5. Links to other websites

The site links to our profiles on social platforms (for example Instagram, TikTok, YouTube and Snapchat) and to third-party websites such as media articles. These are plain links. Nothing is sent to those providers when you only visit our site. Once you click a link, you leave our site and the privacy policy of that provider applies.

6. No automated decisions

We do not make decisions based solely on automated processing, including profiling.

7. Security

The site is delivered over an encrypted HTTPS connection (TLS). Email can have security gaps on its way to us, so please do not send highly sensitive information by regular email.

8. Your rights

Under the GDPR you have the right to:

• access your data and get a copy (Art. 15)
• have wrong data corrected (Art. 16)
• have your data deleted (Art. 17)
• have the processing restricted (Art. 18)
• receive your data in a common, machine-readable format (Art. 20)
• object, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21)
• withdraw a consent you gave, with effect for the future (Art. 7(3))

To use any of these rights, write to [email protected]. We may ask for information we reasonably need to confirm your identity.

You can also complain to a supervisory authority, in particular in the EU country where you live or work. In Austria this is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, email: [email protected], website: dsb.gv.at.

9. Changes

We update this policy when the site, the processing or the law changes. The version on this page is the current one.