Privacy Policy
Last updated: 15 October 2026
This policy explains, in accordance with Art. 13 of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (Datenschutzgesetz, DSG), which personal data we process on www.fullstacc.com and in connection with applications for our agency services.
1. Controller
Kerstin Bachler (“FullStacc™”), Kahlspergstraße 50/7, 5411 Oberalm, Austria
Electronic contact: Please use our contact form at fullstacc.com/#apply. Messages sent through the form are delivered directly to our business email inbox and answered from there.
We have not appointed a data protection officer and are not legally required to do so.
2. Hosting and server log files (Netlify)
This website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you visit the website, technically necessary data are processed: IP address, date and time, page requested, referrer, browser and operating system. Purpose: delivering the website and keeping it stable and secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Netlify acts as our processor (Art. 28 GDPR). Log retention: as per Netlify's standard retention (approx. 30 days). For transfers to the USA, see section 7.
We do not use analytics, advertising or tracking tools. Fonts are loaded from our own server, so no connection to Google servers is made.
3. Application form
FullStacc™ is a private, application-only marketing agency. When you apply via the form on our website, we process:
- required: name, email address, company, chosen offer, budget range, message;
- optional: current homepage URL, budget notes.
Purpose: reviewing your application, contacting you about it, and preparing an individual offer if applicable. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). Providing the required data is necessary to assess your application; without it we cannot process your request. Submitting the form is a non-binding request and does not create a contract.
Technical processing: form submissions are received and stored by Netlify Forms (Netlify, Inc., see section 2) as our processor and forwarded by email to our mailbox (see section 4). Netlify Forms is the only form relay. A hidden “honeypot” field is used for spam protection; no CAPTCHA service is used.
Confirmation email: after you submit the form, we send you an automatic confirmation email to the address you entered. For this, your name, email address and the offer you selected are passed to our email-sending provider Resend (Plus Five Five, Inc., operating as Resend, 2261 Market Street #5039, San Francisco, CA 94114, USA) as our processor. The email is sent from noreply@updates.fullstacc.com; replies go to our mailbox (see section 4). Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps taken at your request). Resend keeps delivery logs only for the period set by its service; the email content is not used for any other purpose.
Retention: if your application is declined, or you do not accept our offer, we delete your application data (in Netlify Forms and in our mailbox) after 6 months. If a contract is concluded, the data become part of the client file (section 5).
4. Email communication (DreamHost)
When you email us, or when we receive form notifications and correspond with you about your application or project, we process your name, email address, the content of the messages and any attachments. Legal basis: Art. 6(1)(b) GDPR (pre-contractual and contractual communication) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Our mailbox is hosted by DreamHost (New Dream Network, LLC, PMB #327, 417 Associated Road, Brea, CA 92821, USA) as our processor. Retention: emails relating to applications that do not lead to a contract are deleted after 6 months; business correspondence relating to contracts is kept for up to seven years under § 132 Austrian Federal Fiscal Code (BAO) and § 212 Austrian Commercial Code (UGB), where applicable.
5. Clients and contracts
For agency projects we process the contact and contract data of our clients and their contact persons (name, business contact details, project content, billing data). Legal basis: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (retention of accounting records, seven years under § 132 BAO) and, for contact persons, Art. 6(1)(f) GDPR. Where we process personal data on a client's behalf (e.g. when running campaigns or managing content on a client's behalf), we do so as a processor under a separate data processing agreement (Art. 28 GDPR). In client projects we use ChatGPT (OpenAI), Claude (Anthropic), Supabase, Netlify and GitHub. These providers are used only under data processing agreements. Transfers of personal data to them in the United States are made under the EU-US Data Privacy Framework or standard contractual clauses.
6. Video (Vimeo, loaded only on click)
We embed a video from Vimeo (Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA). It loads only when you click the play button, and only then is a connection to Vimeo made. Vimeo then receives your IP address, device and browser information, among other data, and may store or read information on your device. We use the “Do Not Track” parameter (dnt=1); according to Vimeo, this means no analytics cookies are set. Legal basis: your consent given by clicking, Art. 6(1)(a) GDPR and § 165(3) Austrian Telecommunications Act 2021 (TKG 2021). To withdraw: once you reload the page, the video is no longer loaded. You can delete cookies that have already been stored in your browser. Vimeo's privacy policy: vimeo.com/privacy.
7. Transfers to third countries (USA)
Netlify, DreamHost, Resend and Vimeo are based in the USA.
Netlify, Inc. states that it is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Its data processing agreement also includes the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
DreamHost (New Dream Network, LLC) provides for these transfers in its customer data processing addendum by the European Commission's standard contractual clauses for controllers to processors (Art. 46(2)(c) GDPR).
Resend (Plus Five Five, Inc.) states in its data processing addendum that it complies with the EU-US Data Privacy Framework (Art. 45 GDPR). The addendum also includes the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
Vimeo.com, Inc. states that it complies with the EU-US Data Privacy Framework (Art. 45 GDPR) and that it uses standard contractual clauses where appropriate. Its data processing addendum applies those clauses if the Framework does not cover the transfer.
8. Cookies and local storage
Our website itself sets no cookies and does not use browser storage for tracking or marketing. Third-party cookies can only be set after you click to play the Vimeo video (section 6).
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21). You may withdraw any consent at any time with effect for the future (Art. 7(3)). Electronic contact: Please use our contact form at fullstacc.com/#apply. Messages sent through the form are delivered directly to our business email inbox and answered from there. We do not use automated decision-making, including profiling (Art. 22 GDPR); every application is reviewed by a person.
10. Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority. In Austria, this is the
Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria
Web: www.dsb.gv.at
You may also complain to the supervisory authority in the EU member state where you live or work.