Legal
Privacy
Controller
The controller for the processing of personal data on this website is Leia-Sophie Holding GmbH. Full details are listed in the imprint. For any privacy matter, a message to office@leiasophieholding.com is enough.
Hosting
This website is hosted by Vercel Inc. Technical data such as IP address, browser information, requested URL and time are processed for delivery, diagnostics and protection against abuse. Images in Vercel Blob use the same infrastructure. The legal basis is our legitimate interest in secure, reliable operation (Art. 6(1)(f) GDPR).
Inquiry form
The inquiry form transmits name, email, proposed date, location, language and message to answer your request and, where applicable, prepare an offer (Art. 6(1)(b) GDPR). Resend (Plus Five Five, Inc.) sends the inquiry to our Gmail mailbox and a confirmation to your address. Resend and Google, as the mailbox provider, therefore receive the respective messages. Resend states that email and log data are retained for 30 days on the Pro plan used here. Mailbox inquiries are retained only as necessary; statutory retention obligations also apply if a contract follows. The form does not automatically transfer data to Pipedrive or the client portal. For reliable processing, we additionally store inquiries in our Upstash database in Frankfurt for up to 90 days, encrypted in transit. This includes the form information, receipt time, sending status and whether a personal reply has been recorded. Automation through n8n regularly checks pending inquiries and triggers internal reminders; the scheduler does not receive form contents. An automatic confirmation is not a personal reply or booking confirmation.
Images and galleries
Photographs are delivered through Vercel Blob, which processes technical access data. Publication permissions and image usage rights are agreed separately from an inquiry. External profiles are linked rather than embedded.
Cookies
The NEXT_LOCALE cookie may remember the selected language. The md_admin cookie maintains administrator login for up to twelve hours and is not intended for ordinary visitors. Cookiebot stores your choice in CookieConsent; its configured lifetime is twelve months. Optional tracking starts only after consent to Statistics. “Cookie settings” reopens your choices. Without Cookiebot configuration, the site instead uses the local md-consent entry; the two banners never run together.
Audience measurement
After consent to Statistics, Vercel Web Analytics and Speed Insights may collect page views and performance measurements, such as page path, referrer, browser, device category and loading times. Vercel states that these services do not use analytics cookies. We nevertheless load them only with consent (Art. 6(1)(a) GDPR). Inquiry contents are not passed as analytics parameters.
Google Analytics 4 and inquiry measurement
Where configured, Google Analytics 4 loads only after consent to Statistics. The recipient is Google Ireland Limited; processing by Google LLC in the USA is possible. It measures page views, usage and acquisition data, plus generate_lead after a successful inquiry submission. No name, email address or message is attached to that event. Google processes the IP address for the technical connection; according to Google, GA4 does not log or store it. The legal basis is Art. 6(1)(a) GDPR. The intended property retains event data for two months and user data for fourteen months; new activity can reset user retention. Aggregated reports are not subject to these periods. This integration does not grant advertising storage, Google Signals or ad personalisation. You can change or withdraw consent prospectively through “Cookie settings”.
Protection against automated requests
The inquiry form and administrator login limit repeated requests using Upstash Redis. The database is configured in Frankfurt. The website server derives a keyed digest from the IP address and application scope; it does not send the raw visitor IP to Redis for this purpose. For this rate limit, Redis stores the digest, timestamps and random identifiers, not messages or email addresses. Entries expire ten minutes after the last permitted attempt. The legal basis is Art. 6(1)(f) GDPR for protection against abuse.
Consent management and service providers
Cookiebot, provided by Usercentrics A/S, manages your choices and records consent. It processes technical connection data, domain, time, choices and a consent identifier to implement and document your decision (Art. 6(1)(c) GDPR). Providers may also process data outside the EEA. Details of subprocessors, locations and available data processing agreements are linked below. Contact us about privacy at office@leiasophieholding.com.
External links
Instagram and Behance are linked only, no content from these providers is embedded. An exchange of data therefore begins only once a link is clicked. From that point on, the privacy terms of the respective provider apply.
Rights of data subjects
Data subjects have the right of access, rectification, erasure, restriction of processing, data portability and objection. A message to office@leiasophieholding.com is enough to exercise these rights. Where there is reason to believe that processing infringes the GDPR, a complaint can be lodged with the Austrian Data Protection Authority (dsb.gv.at).
Contact
office@leiasophieholding.comUpdated: 20 September 2026. Information about the services used is updated when they change.