TOPEINS
Privacy Notice
1. Controller and contact
The controller for the processing described below on www.topeins.at is:
SAV GmbH
Capistrangasse 5/62, 1060 Vienna, Austria
Email: studio@topeins.at
Phone: +43 664 1177000
You may also use these contact details to exercise your data protection rights or withdraw consent.
2. Visiting the website and technical delivery
When you visit our website, technical data needed to transmit and display its content is processed. This includes your IP address, the requested internet address and connection and request information such as time, browser information and technical status information.
We use Cloudflare Pages with Pages Functions for hosting, delivery and server-side website functions, and Cloudflare D1 for model administration. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare also processes technical connection data for security and protection against attacks. When technical errors occur, the website may log the event, requested path and a shortened error message. The enquiry assistant does not submit its input to these server functions.
The legal basis for technical delivery and security is Article 6(1)(f) GDPR. Our legitimate interests are a functioning, reliable and secure website. Section 3 applies to enquiry content and section 4 to model profiles.
The D1 database is configured for EU jurisdiction: the database runs and persistently stores data within the EU. This does not mean that all website data is processed exclusively in the EU. Delivery, function requests, access checks and associated technical data may be processed through Cloudflare's worldwide network. See section 7 for recipients and international processing.
3. Enquiry assistant, email, WhatsApp, SMS and telephone
Draft in your browser: Our enquiry assistant turns your input into a message in your browser. Name and email address are required for this. Other information includes the enquiry topic, telephone number, preferred date, time or duration and free text; the topic may be preselected. The assistant does not send your input to a form server or store it in our website database. It does not use cookies, localStorage or sessionStorage for this. The draft remains available in the browser while you use it. Choosing “Copy” deliberately places it on your device's clipboard.
You then decide whether and through which channel to contact us:
- Email: The link opens your email program with the recipient and draft. The email is transmitted to us only when you send it in that program. Our studio@topeins.at mailbox is hosted by hosttech GmbH, Warwitzstraße 9, 5020 Salzburg, Austria. Hosttech processes incoming messages and associated delivery and administration data.
- WhatsApp: Choosing “Share draft with WhatsApp” opens an external WhatsApp link. Opening the link already passes the prepared message and technical connection data to WhatsApp, even before you send the message to us. Sharing the draft with WhatsApp is based on your voluntary consent under Article 6(1)(a) GDPR through this explicit choice after the corresponding notice. You can use email or telephone instead. Withdrawal takes effect for the future and cannot reverse a transfer that has already occurred. For users in the EEA, WhatsApp is provided by WhatsApp Ireland Limited, Ireland, a Meta company. WhatsApp also processes data in its own responsibility; information, including international processing and your rights, is available in the WhatsApp Privacy Policy. You then send the message to us yourself within WhatsApp.
- SMS: The link passes the recipient number and draft to your messaging app. You initiate sending there; your messaging or telecommunications provider and the recipient process the data needed for delivery.
- Telephone: When you call us, we process the information you provide and, where transmitted, your telephone number to handle your enquiry.
Once your enquiry reaches us, we process your contact details, its content and associated correspondence to respond, clarify services and, where relevant, prepare an offer. Article 6(1)(b) GDPR applies to enquiries directed towards a contract with you. For other enquiries and contacts acting for a business, processing is based on Article 6(1)(f) GDPR; our legitimate interest is appropriate business communication. Using an external channel does not provide blanket consent to advertising or unrelated processing.
You do not have to use the assistant or WhatsApp. Without sufficient contact details and relevant information, we may be unable to answer your enquiry. Please enter only data needed for your request. Section 8 covers retention of enquiries we receive. Independent processing by the communications providers you choose is also governed by their privacy information.
4. Public model profiles
We publish model profiles to introduce the models and their photographic work. Publication is based on the scope of each model's voluntary consent under Article 6(1)(a) GDPR. A profile may include a display or professional name, photographs and image descriptions, a biography, announced visiting periods and links to external profiles. Publicly accessible profile data also contains technical profile and appointment identifiers, page identifiers, gallery information and publication status information used for display and allocation. Internal consent records, rights notes and administration logs are not included in the public profile.
Profile data and visiting periods are stored in Cloudflare D1. Web versions of photographs and associated website files are also stored at GitHub for building and providing the website and delivered through Cloudflare. Web photographs intended for publication are used without embedded GPS/EXIF metadata. These providers support the consent-based publication; section 7 covers international processing.
Public profiles can be accessed worldwide. Visitors can save or share content and search engines can index it. The end of an announced visit does not automatically end publication: a published direct profile link may remain accessible while consent and the publication purpose continue.
Consent may be withdrawn at any time with effect for the future by emailing studio@topeins.at or using our other contact details above. Processing based on consent before withdrawal remains lawful. Following withdrawal, we stop the publication based on that consent and arrange necessary removal from the public services under our control, including caches we control. Any further retention requires a separate legal basis. We cannot directly delete copies held by independent third parties; our statutory erasure and information duties remain unaffected.
We publish profiles only for the purpose covered by consent and not beyond effective withdrawal. Consent records may be retained separately with restricted access where needed to meet our accountability obligations under Article 7(1) GDPR or to establish, exercise or defend specific legal claims. The applicable legal basis is Article 6(1)(c) or (f) GDPR respectively. This does not permit continued public display after withdrawal.
5. Protected administration and preview access
The administration area is protected by Cloudflare Access. A one-time code is sent to an authorised email address when signing in. The email address, IP address, time, country information and session data needed for authentication and access checks are processed. The authenticated application is configured for a twelve-hour session. The CF_Authorization authentication cookie demonstrates access authorisation. Signing out or revoking access may end a session earlier.
Changes in model administration are additionally logged with the administrator identifier, action, affected record identifier, time and status or detail information. This processing secures access, makes changes traceable and supports investigation of errors or misuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and accountable administration.
Where a protected preview also requires authentication, the corresponding access controls apply there as well. They do not apply indiscriminately to everyone visiting freely accessible pages. Authentication duration is distinct from retention of authentication and change logs.
6. Cookies, fonts, external links and newsletter link
On the freely accessible website pages, we do not use analytics or marketing trackers, and the website code does not set cookies or persist data in localStorage or sessionStorage. Cloudflare Web Analytics is not configured for this website. The Manrope and Instrument Serif fonts and embedded website images are loaded from the website's own host. Google Fonts, YouTube videos, maps and CAPTCHA services are not embedded. Authentication required for protected access is described in section 5.
Links to external services, such as Google Maps directions, Instagram, other model platforms or the newsletter page hosted by Mailchimp, are outgoing links. These services are not loaded as embedded content merely by opening our page. Opening a link connects your browser to the relevant provider, which may receive your IP address, browser information and, depending on browser and link settings, the referring page. The WhatsApp link additionally passes the draft as explained above.
Newsletter registration takes place on the linked page. The information provided there and separate consent to be obtained there apply to registration; using this website or making an enquiry does not subscribe you to advertising.
Where access to your device is strictly necessary for a function you expressly request, such as authentication or handing over a message, the exception in section 165(3) Austrian Telecommunications Act 2021 applies. Any additional use requiring consent would need your prior consent. The basis for processing personal data is stated in the relevant sections.
7. Recipients and processing outside the EEA
Within SAV GmbH, access is limited to those who need it for their tasks. We use technical providers for the functions described:
| Recipient / service | Processing |
|---|---|
| Cloudflare, Inc., USA | Hosting and worldwide delivery, website functions, D1 database, access protection and technical security processing |
| hosttech GmbH, Warwitzstraße 9, 5020 Salzburg, Austria | Domain administration, DNS and email mailbox, including incoming enquiries |
| GitHub | Storage and versioning of website files, including web photographs intended for publication; provision for building the website |
| Selected communications provider | Email, WhatsApp or SMS as described in section 3 |
| General public | Model information published under section 4 |
The D1 database's EU setting does not confine all other processing to the EU. In particular, Cloudflare and GitHub may process data in the USA and other countries outside the European Economic Area. Their published data protection agreements provide, among other mechanisms, for EU Standard Contractual Clauses and, where the relevant conditions are met, the EU-US Data Privacy Framework. The clauses impose data protection safeguards on recipients; the Framework covers only participating US recipients and processing within its scope.
Further provider information: Cloudflare Data Processing Addendum, GitHub privacy information and international transfers and Hosttech privacy notice. You may request information about the transfers and safeguards applying to your data and, where relevant, a copy by emailing studio@topeins.at. The policy linked in section 3 also applies to WhatsApp's own international processing.
8. Retention
Enquiries received: We retain enquiries and associated correspondence within our responsibility for handling and keeping track of communication for no longer than twelve months from receipt, then delete them. This covers email and messages received through the channels offered. Data is deleted earlier if no longer needed for these purposes and no other lawful basis requires or permits retention. A draft solely in the browser does not create an enquiry database on our website. Retention on your device or by communications providers acting in their own responsibility may differ.
Invoice and accounting records: We normally retain data and documents needed for invoicing and statutory bookkeeping for seven years. The period starts at the end of the calendar year to which the records relate; statutory calculation rules apply where the financial year differs. Pending tax proceedings or other mandatory statutory obligations may require longer retention. The legal basis is Article 6(1)(c) GDPR together with the applicable record-keeping duties, particularly section 132 of the Austrian Federal Fiscal Code (BAO). This exception concerns the necessary records and does not justify retaining all enquiries for seven years.
Model profiles and records: The consent-based publication purpose and withdrawal rights in section 4 apply. Hiding a profile and deleting stored data are distinct steps. Consent records are subject to the accountability or legal-claims purposes described there; the invoice retention period does not automatically apply to photographs or profiles.
Technical data and backups: Retention depends on the duration needed for access security, investigation of specific errors or security incidents and the necessary recovery window. Further retention requires an independent purpose and legal basis. The configured Access application session is twelve hours; this does not imply a twelve-hour log retention period. Website content may be cached for delivery. Technical cache validity does not authorise continued publication after consent is withdrawn.
9. Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with effect for the future.
Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then stop processing the affected data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims. You may object to processing for direct marketing at any time without giving reasons.
Please send requests to studio@topeins.at or to the postal address above. We normally respond within one month. If an extension permitted by law is necessary, we will inform you of the reasons within that month.
You may lodge a complaint with a data protection supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, email: dsb@dsb.gv.at, website: www.dsb.gv.at.
Last updated: 13 November 2026.