1. Controller and scope
Matthias Kloss
Eschenweg 6
4052 Ansfelden
Austria
Privacy contact: hello@ja-atelier.at.
This notice describes ja-atelier.com, its embedded example websites and the interactive demo. Separate wedding websites on other domains need their own notices reflecting their actual operation.
2. Website access and hosting
When you visit, the server processes connection data needed to deliver the website, such as your IP address, time, requested address, browser information and, where available, referring page. This supports delivery, troubleshooting and protection against abuse. The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in a secure, functioning website.
The host is World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, BT3, 4020 Linz, Austria. See World4You’s privacy information.
Our website and the information and files stored in our enquiry and order service are hosted with World4You. World4You states that its servers are located exclusively in EU countries. This is not a blanket assurance of EU-only processing by every external service. World4You server location information.
We concluded an Article 28 GDPR data processing agreement with World4You on 6 November 2026. Hosting-level log configuration and retention are managed by World4You. According to the provider’s response of 6 November 2026, logs are deleted after 14 days. World4You creates daily backups covering the previous 20 days for webspace and 13 days for databases. Information deleted from the active system may remain in backups until these backup retention periods expire. According to the provider, individual backups or logs cannot be deleted manually.
3. Enquiries and offers
When you submit an enquiry, we process your name, email address, optional wedding details, message and invitation file to respond and prepare an offer (Article 6(1)(b) GDPR). Enquiries and attachments are stored in a protected server area at World4You. Our team receives a notification at hello@ja-atelier.at. Attachments require an authenticated administrator account.
Enquiries that have not resulted in a contract are deleted after 180 days the next time the enquiry service is used. Where offers exist, they are included only if they too are older than 180 days, expired for at least one day, and have no acceptance, checkout, payment or extension history. Associated drafts and attachments are deleted with them. A daily maintenance command is prepared; its hosting schedule is not yet configured. Offer, contract and invoice records are retained as required by applicable law and, where necessary, for legal claims. Please do not send health information or guest lists through this form.
A necessary session cookie protects forms and administration. A temporary hash of the IP address and attempt counter helps prevent abuse and is removed after its rate-limit period. These safeguards serve our legitimate interest in secure operation (Article 6(1)(f) GDPR).
4. Local demo storage
The interactive demo keeps invitations, example guests, responses, language groups, seating plans and simulated feature purchases, domain selections and renewals in Local Storage in your browser. Selected demo album photos, captions and approval status are kept in a local browser database (IndexedDB). These are not uploaded to an album server or shared across devices.
This storage allows you to use the selected demo features across views and continue on a later visit. Where personal data is involved, the basis is Article 6(1)(f) GDPR: our legitimate interest in providing the demo you choose to use. This local storage is not used for advertising or profiling.
Demo data remains until the relevant demo is reset, pictures are deleted, or you clear this site’s browser data. Your browser may remove it earlier if storage is limited. Local demo data has no automatic expiry date. Please use fictional guests and avoid sensitive information or private photographs of other people.
The Ezgi & Matthias example also remembers the selected language locally (key “wedding-language”). Device-storage access must be assessed separately from the GDPR processing basis under Section 165(3) Austrian TKG 2021 or Section 25 German TDDDG. Optional storage that is not strictly necessary must be made subject to prior consent before production launch.
5. Fonts, tracking and external links
Fonts are served from this website. Loading them therefore does not connect to Google Fonts. Optional Google Ads conversion measurement is described below.
Google Maps and Google Calendar links open the provider only when clicked. Its privacy terms then apply. Opening a prepared calendar link sends the event details contained in the link to Google. You can use the downloadable calendar file instead.
6. Stripe payments and separate services
Where an online payment has been enabled for an order, it is processed through Stripe Checkout. The merchant is Matthias Kloss trading as JA. ATELIER. We transmit the order reference, email address, description, amount and currency to Stripe to perform the contract (Art. 6(1)(b) GDPR). Payment details are entered on Stripe’s hosted checkout page; we do not receive full card numbers or security codes.
Stripe returns payment references and payment status. We use these to allocate payments and handle refunds or disputes. Stripe also processes technical and transaction data for fraud prevention and its legal obligations. Stripe’s roles, recipients, retention periods and safeguards for international transfers are described in its privacy notice and data processing agreement. Visiting our homepage or using the public demo alone does not load Stripe Checkout.
Domain choices and purchases in the public demo remain simulations. Before productive use of a guest album or a separate wedding website, the applicable hosting, access and deletion arrangements are provided separately.
7. Recipients and transfers
The hosting provider receives connection data necessary to serve the website. Demo guest entries, responses and selected photos are not sent to JA. ATELIER or a photo provider by the demo. This demo does not disclose them for advertising. Legal obligations may require disclosures to public authorities or courts.
The World4You data processing agreement provides for processing predominantly within the EU/EEA and allows necessary transfers outside the EEA subject to the safeguards in Articles 44-49 GDPR. Its service-dependent subprocessor list includes IONOS SE and Arsys Internet S.L.U. for technical operations, Google Cloud EMEA Limited and Microsoft Ireland Operations Limited for internal collaboration and security, and Dixa ApS for customer support. Inclusion in that list does not mean that every listed provider receives data from every hosting product. Changes are subject to the contractual information and objection procedure. We do not give a blanket assurance that all support access and related processing stays within the EU.
8. Your rights
Subject to the applicable conditions, you have rights of access, correction, deletion, restriction and portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Consent may be withdrawn at any time for the future without affecting earlier lawful processing.
Contact the controller above to exercise your rights. We have no server-side access to locally stored demo data; you can delete it through the relevant demo controls or your browser’s site-data settings. This demo does not use automated decisions with legal or similarly significant effects.
You may complain to a competent supervisory authority, particularly where you ordinarily live or work. In Austria: Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at.
Online withdrawal and termination declarations
We process your name, email address, contract identification, declaration and receipt time to receive and handle withdrawal and termination declarations, send an email acknowledgment and document compliance. The legal bases are Article 6(1)(b) and (c) GDPR; necessary evidence for legal claims may be retained under Article 6(1)(f). Declarations are stored privately on our hosting server and sent via World4You email to you and hello@ja-atelier.at. They are accessible to the operator in the protected administration area. Retention follows the associated contract and statutory recordkeeping duties; records relevant to accounting are generally retained for seven years from the end of the relevant calendar year, and longer where proceedings or other legal duties require it. No automatic refund or marketing subscription results from using the form.
The termination form additionally processes the type of termination, any reason voluntarily supplied and the requested end date. These are acknowledged with the declaration and receipt time. Contract identification and the specific end date are subsequently checked; the form does not automatically delete data or issue a refund. A legally effective termination does not depend on our approval.
Google Ads conversion measurement (optional)
We use the Google tag for Google Ads (Google Ireland Limited, Ireland). Cookies and advertising identifiers are used only with your consent. It uses advertising cookies (including cookies with names beginning _gcl_) and visit and device data, such as IP address, browser and advertising click identifiers, to measure whether an ad led to a successfully received enquiry or a confirmed purchase of the Basis or Signatur plan or of the photo album. Premium enquiries are measured separately. On our public information pages, we also measure clicks on live examples, the demo dashboard and “Try in WhatsApp”. These click events are for observation only and have no revenue value. A WhatsApp click does not confirm that a message was sent or received; message contents, recipients and the WhatsApp link are not sent to Google. For purchases, we send the paid amount, currency and an order reference for deduplication; a checkout start or pending payment is not counted. We send a random enquiry identifier to prevent duplicate counting. For enhanced conversions, after a successfully received enquiry and only with your advertising consent, we also send a SHA-256 hash of the email address entered in the form to Google Ads in the “Rabattomio” account. The address is first normalised and hashed in your browser; the plain-text address is not sent to Google. Google can match this hash with Google accounts to improve attribution of enquiries to ads, including across devices. The hash is pseudonymous and remains personal data; a successful match is not guaranteed. Click events and purchases do not include an email hash. Our tracking does not persist the hash in browser storage. Enquiry text, names, other contact details, uploaded files and wedding details are not sent through this tag. We do not enable personalised advertising.
Without consent, the Google tag loads in a restricted mode: it sets and reads no cookies. Google then receives only cookieless, pseudonymous basic data (page viewed, time, truncated IP address) and uses it to estimate reach and conversions. You can refuse without affecting the website or form. You can withdraw consent at any time using “Cookie settings” in the footer. We remember your choice in Local Storage for up to 180 days; clearing browser storage removes it earlier. Withdrawing consent stops future measurement and removes this site's Google advertising cookies where accessible.
The basis for optional measurement and cookie access is your consent. We process the cookieless basic data on the basis of our legitimate interest in measuring reach without cookies (Article 6(1)(f) GDPR). Google may process data in the USA and other countries. Google's processing and retention information is available in its privacy policy and cookie information. This measurement is used on our marketing and booking pages, and on the private order page to confirm purchases. This includes the offer page and the order page of the photo album. An album's pages for guests, administration, the photo wall and the recap remain without a Google tag. Private access tokens and other query or fragment data are removed from the page address sent by this tag. Administration and wedding demos remain excluded.
Google Analytics: optional statistics
With your separate consent, we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. JA. ATELIER's independent Analytics account measures page views and interactions on our public pages, wedding examples and public demo dashboard. These include navigation, language changes, viewed sections, opened FAQs and invitations, calendar and WhatsApp clicks, demo features used, form starts, field editing without its content, validation errors and successful submissions, plan choices, checkout steps and confirmed purchases. Repeated interactions may also be recorded to understand the sequence of a visit. We do not record your screen. Purchases include the amount, currency, plan or product and an order reference to prevent duplicate counting. Pending or failed payments do not count as purchases.
Google processes visit and device data, such as IP address and browser information, and uses statistics cookies including _ga and _ga_… . We limit these Analytics cookies to 180 days. Our event measurement does not send names, email addresses, message text, uploads, guest data or private wedding content. Page addresses are sent without query parameters and fragments; private order pages do not generate Analytics page views; there we only measure payment steps and confirmed purchases. Real wedding administration, internal test areas and embedded previews remain excluded. Google Signals, personalised advertising and automatic form measurement are disabled.
You can allow or reject statistics and Google Ads advertising measurement separately. Each purpose stays inactive without consent; without optional consent, only the cookieless basic data described above is processed. The legal basis is consent under Article 6(1)(a) GDPR and, for device access, Section 165(3) of the Austrian Telecommunications Act 2021. We remember your choice for up to 180 days. Withdrawing consent through “Cookie settings” stops future measurement and deletes accessible cookies for the purpose you disable. The website and booking work without optional measurement.
Google may process data in the USA and other countries. Google's data processing terms and their applicable safeguards govern processing and international transfers. See Google's privacy policy and data use on partner websites. Analytics user and event data are retained for two months; aggregated reports may remain available longer.