Privacy Policy

Manuel Fischer, advertising agency (Truebound)

Last updated: 6 November 2026

This policy explains which personal data I process as an advertising agency, why I need it and what rights you have.

1. Controller

Manuel Fischer, advertising agency (Truebound), Enzesfelder Straße 16, 2544 Leobersdorf, Austria, [email protected] · +43 660 9949245

2. What data I process and why

I need contact and billing details for quotes and orders; without them I cannot conclude a contract. There is no automated decision-making or profiling.

I usually receive the data directly from you. Sometimes it comes from third parties, for example from your employer or a client who names you as a contact person, from the organiser of an event or from publicly accessible sources such as company websites.

3. Data processed on behalf of clients

If I process personal data on behalf of a client, for example member data, the client is the controller. In that case the client's privacy policy applies, and I process the data only on the client's instructions under a data processing agreement.

4. Photos and videos at events

At events I usually take photos and videos on behalf of the organiser. In that case the organiser is the controller and their privacy policy applies (section 3). For my own purposes, as references on my website and my channels, I use recordings on the basis of my legitimate interest in presenting my work (Art. 6(1)(f) GDPR). I only show recordings in which individual persons are recognisably the focus with their consent (Art. 6(1)(a) GDPR). If you do not wish to be photographed or filmed, please tell me on site. You can object to publication at any time; I will then remove the recordings as far as I can.

5. Recipients

Data is only received by those who need it for the respective purpose: my tax adviser, banks and payment service providers, the services listed in section 6 as processors, and public authorities where I am legally obliged to disclose it.

6. Services I use

I only record conversations if all participants have agreed beforehand. I also use AI tools for texts, design and editing; I only enter personal data there if a data processing agreement is in place with the provider and the provider does not use the data for training. Programs such as DaVinci Resolve run locally on my devices. For the statistics of my Instagram and Facebook pages I am jointly responsible with Meta (Art. 26 GDPR). You can find the essence of the arrangement with Meta at facebook.com/legal/terms/information_about_page_insights_data. You can also exercise your rights directly with Meta.

7. Transfers to third countries

Some services process data outside the European Economic Area, mainly in the USA and the United Kingdom. This only happens if the requirements of Art. 44 et seq. GDPR are met: for the United Kingdom and for providers certified under the EU-US Data Privacy Framework, on the basis of an adequacy decision of the European Commission; otherwise on the basis of standard contractual clauses. You can obtain a copy of the standard contractual clauses on request from [email protected].

8. Retention

I only keep data for as long as necessary for the purpose. I keep accounting records for seven years (Section 132 of the Austrian Federal Fiscal Code, BAO). I delete enquiries that do not lead to an order after 12 months. I delete recordings of meetings as soon as the transcript is finished, at the latest after three months. I keep photos and videos from events for as long as I use them as references.

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent at any time; processing carried out until then remains lawful. To do so, write to [email protected].

Right to object: If I process data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. I will then no longer process the data unless I can demonstrate compelling legitimate grounds or need it to establish, exercise or defend legal claims.

You can also lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, [email protected].

10. Website

My website is hosted by Cloudflare (section 6). When the site is accessed, Cloudflare processes technically necessary access data such as IP address, time and browser in order to deliver the site and protect it against attacks; this data is only stored for as long as necessary for these purposes. If a request looks suspicious, for example because the browser identifier is missing, Cloudflare may show a brief security check; anyone who passes it receives the technically necessary cookie "cf_clearance", which only records that the check was passed. Beyond that, the website does not set any cookies and does not use any analytics or marketing tools; if anything of this kind were added, it would only be with your consent.

11. Security

I protect data with encrypted transmission, personal accounts with two-factor authentication and restricted permissions.

This is a translation. In case of any discrepancy, the German version prevails.