Legal
Privacy Policy
Privacy Policy
Last updated: 25 October 2026. This policy explains data processing on our website, for contact enquiries and when using optional external services.
1. Controller and contact
The controller is Hezal Helin Sahin, MA., trading as Reflection THE AGENCY, Lorenz Reiter Straße 1/1/44, 1110 Vienna, Austria.
For privacy enquiries, contact us at office@reflection-agency.com.
2. Website delivery and security
We use Vercel Inc., USA, to host the published website. Vercel processes connection data, including IP address, requested URL, time, browser information and response status, to deliver content, diagnose errors and prevent attacks. The legal basis is our legitimate interest in a secure, reliable website under Article 6(1)(f) GDPR.
Technical logs are retained as necessary for operations, troubleshooting and security; specific security incidents or legal obligations may require longer retention. This website does not use Vercel Web Analytics or Vercel Speed Insights.
3. Local fonts, media and browser settings
Our fonts and directly embedded image and video files are served through this website. They do not require a connection to Google Fonts. The local site search runs in your browser.
We store your language choice in localStorage under reflection-language until you or your browser delete it. Your YouTube choice is stored under reflection-privacy-v3 for 180 days; older choices under reflection-privacy-v1 or reflection-privacy-v2 are carried over for YouTube only. Umami does not use this choice. In sessionStorage, rfx_seen remembers whether the opening animation has already been shown during the current browser session. These settings support the requested functionality and remember your choice; they are not used for advertising tracking.
The legal basis for these necessary settings is Article 6(1)(f) GDPR; storage falls under the exemption for necessary functions in Section 165(3) of the Austrian Telecommunications Act 2021. You can delete these entries in your browser settings.
4. Contact form and email
When you contact us, we process your name, email address, selected topic and optional company, phone and message details to handle your enquiry. Required fields are marked in the form. The form cannot be submitted without them; you can also email us directly. Please do not send sensitive personal data that is unnecessary for your enquiry.
For contract and project enquiries, the legal basis is Article 6(1)(b) GDPR; for other enquiries it is Article 6(1)(f) GDPR, our legitimate interest in responding to your message. Analytics consent is not required to submit the form.
The form sends your details to our server, which uses Resend (Plus Five Five, Inc., USA) to email office@reflection-agency.com. Resend processes message content, sender/reply address, recipient address and delivery information. Our mailbox provider also processes the incoming message. This does not subscribe you to a newsletter; open and click tracking are disabled for these form emails.
We retain enquiries as necessary to handle them and any follow-up questions. Contract-related records are retained for statutory obligations or to establish or defend legal claims, then deleted. Resend states a 30-day retention period for email and log data on its standard plans. This does not govern the copy in our mailbox.
5. Cookieless web analytics with Umami Cloud
We use Umami Cloud from Umami Software, Inc., USA, for cookieless measurement of website usage and usability. Analytics starts when a page is opened, without prior consent and independently of your YouTube choice. We rely on our legitimate interest in improving our website under Article 6(1)(f) GDPR for this limited audience and usage measurement. We do not use it for personalized advertising or cross-site user profiles.
We record page views and selected interactions, such as contact buttons, form steps and submission status, language changes or manually started videos. We do not send form contents, names, email addresses, search terms or individual user IDs for this purpose. URL query parameters, fragments and the referring website are excluded from analytics data.
Umami receives the cleaned page path, page language and technical browser information from the network request. Network requests also expose your IP address. Umami processes it for delivery, approximate location and a rotating visitor identifier. According to the provider, it is not stored as a field in analytics records, but may appear in separate operational and security logs. Cookie-free analytics therefore does not mean that no personal data is processed.
Analytics data is retained according to the retention rules of the cloud plan used and only for as long as needed for usage analysis. If your browser sends Do Not Track or Global Privacy Control, we do not load Umami or send analytics events. You can enable this signal in a supporting browser or object to processing on grounds relating to your particular situation by contacting office@reflection-agency.com. YouTube settings do not affect analytics. Disabling analytics later does not automatically delete data already transmitted.
6. YouTube and external links
YouTube videos are embedded through youtube-nocookie.com only after your consent to external media. The provider in the EEA is Google Ireland Limited, Ireland. Loading a video shares your IP address, browser details and information about the embed with Google; further processing may occur during playback or if you are signed in to Google. Privacy-enhanced mode does not prevent all data transfers. The legal basis is Article 6(1)(a) GDPR and, where applicable, Section 165(3) of the Austrian Telecommunications Act 2021.
Withdrawing consent removes loaded embeds and prevents further activation without consent. It does not automatically erase data already processed by the provider; retention follows Google’s privacy information. Social media and other external links are ordinary links. If you follow them, the destination provider’s privacy information applies.
7. Recipients and processing outside the EEA
The providers named above and their technical subprocessors support hosting, email delivery and web analytics. Processing outside the European Economic Area, particularly in the United States, is possible. A European server or sending region alone does not exclude these transfers.
The published data processing terms of Vercel, Resend and Umami provide, in particular, EU Standard Contractual Clauses for applicable international transfers. These are intended to provide appropriate safeguards outside the EEA. Details and a copy of the relevant safeguards are available through the following terms or on request from us.
8. Your rights and withdrawal
Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. You can withdraw consent at any time with future effect; processing before withdrawal remains lawful.
Use the privacy settings at the bottom of the page or the button below to manage YouTube consent. To object to web analytics or for other requests, contact office@reflection-agency.com. Do Not Track and Global Privacy Control are respected as described above. We do not make decisions based solely on automated processing of your website usage that have legal or similarly significant effects.
You can lodge a complaint with a data protection supervisory authority, particularly where you live, work or believe an infringement occurred. In Austria, this is the Austrian Data Protection Authority.