Legal · Privacy
Privacy Policy
What data this website processes, why it is required and which rights data subjects have.
1. Controller
Martin Trixner, TRIXNER digital solutions
Ferihumerstraße 38, 4040 Linz, Austria
Callback: Request a callback
E-Mail:
2. General Information on Data Processing
Personal data is processed only insofar as this is necessary for the secure operation of this website, the handling of enquiries or the performance of pre-contractual and contractual tasks. The relevant legal bases are, in particular, Article 6(1)(b), (c) and (f) GDPR and, where consent is obtained, Article 6(1)(a) GDPR.
3. Hosting and Server Logs
The website is hosted on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, and is managed using SpinupWP. When the website is accessed, technically necessary log data may be processed, including the IP address, time, requested address, amount of data transferred, referrer, browser and operating system.
Processing is carried out to provide the website securely and reliably, analyse errors and prevent abusive access on the basis of legitimate interests under Article 6(1)(f) GDPR. Server logs are deleted after 14 days during regular operation. They are retained for longer only where necessary to investigate a security incident, preserve evidence or establish, exercise or defend legal claims.
4. Contact and Callback Form
When you contact us by form, email or telephone, the information you provide is processed to handle your enquiry and, where applicable, take pre-contractual steps. The callback form may collect your name, company, email address, telephone number, preferred day and time window, and a message.
The legal basis is Article 6(1)(b) GDPR where an enquiry concerns a contract or pre-contractual steps; otherwise it is the legitimate interest in handling the enquiry under Article 6(1)(f) GDPR. Enquiries that do not result in a contractual relationship are deleted no later than twelve months after processing has been completed. Documents relevant under contract or tax law are generally retained for seven years in accordance with statutory retention obligations; longer retention may be required for pending proceedings or compelling legal reasons.
4a. Telephone callback requests and voice messages
We use Twilio to receive and route incoming calls. This involves processing transmitted phone numbers, menu selections, call time, duration and technical connection data. The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual enquiries, or otherwise Article 6(1)(f) GDPR based on our legitimate interest in handling enquiries and operating a secure telephone service.
After the telephone notice, you can freely choose between an AI assistant and a traditional voice message. You may also hang up without leaving a message and contact us at the email address given in section 1. Martin Trixner returns calls personally. A preferred callback time is not a binding appointment.
AI assistant and consent
We use ElevenLabs for the AI assistant. The conversation is processed automatically and converted into text; content is transmitted to ElevenLabs and participating language model providers. Google Gemini with a provider-managed fallback model function is configured for the conversation. The assistant collects your name, callback number, enquiry, preferred callback time and contact email address, and summarises these details at the end for you to check. It does not make decisions with legal or similarly significant effects.
We base AI processing on your voluntary consent under Article 6(1)(a) GDPR, expressed by deliberately selecting the AI option after the notice. You may end the call at any time and withdraw consent for future processing by using the email address given in section 1. Withdrawal does not affect the lawfulness of processing already performed. Section 4 applies to subsequent handling of your enquiry. Please do not provide passwords, payment details, health information or other confidential information that is not required for your enquiry.
Audio recording of AI conversations is disabled in our ElevenLabs agent configuration. Conversation transcripts, extracted callback details and technical metadata are nevertheless processed. For new AI conversations from 28 September 2026, ElevenLabs is configured to automatically delete transcripts and personal conversation data after seven days. The rule does not apply retrospectively to older test conversations. It does not automatically cover forwarded callback requests, all provider logs or backups. Storage with no residual retention is not promised. The optional use of new data for model improvement has been disabled in the ElevenLabs account.
We require a contact email address for callback requests taken by the AI assistant. Martin Trixner may use it to contact you about your enquiry or changes to your preferred callback time. Providing the address is not a statutory requirement, but it is a prerequisite for this automated callback route. No callback request is forwarded without an unambiguously captured address that you have confirmed. Alternatively, you can email us directly at ; traditional voice messages remain available as a separate contact route. Subsequent handling is based on the legal grounds in Section 4. The address is not used for advertising.
An additional email acknowledgement remains optional. It is sent via Microsoft 365/Outlook after the call only if you expressly request it, confirm the address and approve a complete callback request. Declining only this acknowledgement does not prevent a callback request. The acknowledgement contains no conversation transcript and does not confirm a fixed appointment. The email address is subject to the same retention settings at the AI provider as the other conversation data. The retention criteria in Section 4 apply to forwarded enquiries, acknowledgement emails and their mailbox copies.
The AI assistant classifies the stated enquiry. Clearly unsolicited sales offers are referred to ; no callback request or automatic customer acknowledgement is created for these. Unclear enquiries with complete, confirmed contact details are forwarded for personal review, without an automatic calendar file or customer acknowledgement. Classification may be incorrect; for personal review, you can contact us at any time at . The retention settings described above also apply to conversation data from abandoned or unforwarded enquiries.
Traditional voice message without AI analysis
If you select a voice message, you hear a notice before recording starts. After the tone, you can voluntarily leave a message of up to two minutes. By doing so, you consent to the recording for handling your enquiry under Article 6(1)(a) GDPR. Twilio records the message, which is forwarded to Martin Trixner. This route uses neither automatic transcription nor AI analysis; the message is not transmitted to ElevenLabs. You may instead hang up and email us. Consent can be withdrawn for the future by using the email address given in section 1.
Forwarding and retention
Our n8n automation forwards callback details or voice messages to Martin Trixner's business Microsoft 365/Outlook mailbox. Voice messages are sent as audio attachments, creating received and sent email copies. The telephone workflows do not retain execution histories. A delivery register stores technical references and delivery status to prevent duplicate messages, but no names, phone numbers, transcripts or audio files. Temporary processing files and mailbox content are separate from this register.
The purpose-based retention criteria in section 4 apply to forwarded enquiries and their email copies. Twilio audio files belonging to this telephone assistant are automatically deleted after confirmed delivery once both the recording and its registration are at least 30 days old. The cleanup job checks the delivery register regularly. Messages that have not been successfully delivered or have unresolved technical issues are retained pending review. Martin Trixner deletes the Microsoft/Outlook copies manually; no automatic deletion is configured for these. Twilio describes a further 40-day retention of recording metadata after an audio file is deleted. At Microsoft, recoverable-item folders and retention requirements can delay final deletion. Technical registers and logs are retained for reliable delivery, troubleshooting and necessary evidence; no uniform automated 30-day period applies to these. You can request access or erasure at the email address given in section 1.
Recipients and international processing
Depending on the selected route, recipients include Twilio, ElevenLabs and participating language-model providers and subprocessors for the AI route, and Microsoft for message delivery and mailbox storage. Twilio also processes certain account and communications-usage data as an independent controller. Exclusively European processing is not promised; processing in the United States and other countries outside the European Economic Area is possible.
The providers' data protection addenda govern processing on behalf of customers and international transfers, including standard contractual clauses, applicable adequacy decisions and other safeguards described there. Further information and subprocessor lists are available in the provider documents below. You can obtain further information on safeguards at the email address given in section 1. Section 16 describes your rights and the competent supervisory authority.
ElevenLabs: data processing and safeguards
ElevenLabs: privacy and subprocessor information
5. Gravity Forms
Gravity Forms is used for website forms. Form entries may be stored in the WordPress database and sent to TRIXNER digital solutions by email. Access is restricted to authorised persons. Storage and deletion depend on the purpose of the enquiry and applicable documentation and retention obligations.
5a. Spam protection with Cloudflare Turnstile
We use Cloudflare Turnstile to protect our contact form, callback form and online appointment booking against automated requests and abuse. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.
Loading the security check establishes a connection to Cloudflare. Cloudflare processes, in particular, the IP address, browser information, characteristics of the encrypted connection and the origin of the request. The check may begin when one of these forms is displayed, independently of consent to optional services. Our server-side verification sends the verification token to Cloudflare, not the names, email addresses or messages entered in the form.
We base processing for the protection of our forms on Article 6(1)(f) GDPR. Our legitimate interest is to prevent automated bulk submissions, abusive callback requests and unauthorised appointment bookings, and to maintain the availability of our services. These forms cannot be submitted without a successful security check. Alternatively, you can contact us at the email address provided in section 1. See section 16 for the right to object.
Cloudflare processes verification signals as a processor to protect our website. It also processes these signals as an independent controller to improve its own bot detection.
Processing may take place in the United States and other countries outside the European Economic Area. Cloudflare describes reliance on the EU-US Data Privacy Framework for transfers to the United States and on standard contractual clauses for other transfers or as an alternative safeguard. Details and contractual safeguards are described in the Cloudflare privacy policy and data processing terms linked below.
We use the verification token for the individual form check and do not store it as a form field. Cloudflare determines retention according to the processing purpose, the nature of the data, security risks and legal requirements. The linked notices do not specify a single fixed deletion period for all Turnstile data. Retention of your actual enquiry is governed by the relevant sections of this policy.
6. AI & Data Readiness Selfcheck and Results Email
The voluntary Readiness Selfcheck processes answers to 15 questions about strategy, processes, data, systems and delivery readiness. Your name and email address, and optionally your company, are also collected to provide the personal assessment. The answers are used automatically to calculate an overall score, dimension scores, a readiness level and general recommendations. The result is displayed immediately on the website and sent by email.
Processing is carried out to provide the assessment expressly requested and to handle any related enquiry under Article 6(1)(b) GDPR; otherwise, it is based on the legitimate interest in providing and improving the Selfcheck under Article 6(1)(f) GDPR. Optional consent to receive further practical information is separate, voluntary and based solely on Article 6(1)(a) GDPR. It can be withdrawn at any time with effect for the future. Without this consent, the information is not used for marketing communications.
Selfcheck entries that do not result in a contractual relationship are deleted no later than twelve months after processing has been completed. The automated assessment is provided only as non-binding guidance. It has no legal or similarly significant effect and does not replace an individual professional review. No PDF report is currently generated.
7. Online Appointment Booking with Microsoft 365
Microsoft Bookings is used via the Microsoft Graph API to select and book an introductory online meeting. The data processed includes your name, email address, optional company, topic and message, the selected appointment, your time zone and technically required booking data. The information is transmitted to Microsoft 365 on the server side to check availability, create the appointment in Microsoft Bookings and Outlook, generate a Microsoft Teams link and send booking confirmations.
The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Bookings data is stored within the Microsoft 365 platform in Exchange Online and is subject to the retention and compliance rules configured there. The legal basis is Article 6(1)(b) GDPR where the appointment serves pre-contractual measures; otherwise, processing is based on Article 6(1)(f) GDPR and the legitimate interest in efficient appointment scheduling. Microsoft 365 is governed by Microsoft's contractual data protection terms. Microsoft provides an EU Data Boundary for its European online services; limited transfers outside this area may nevertheless take place under Microsoft's contractual terms and appropriate safeguards.
A meeting is not recorded or transcribed automatically. Recording or transcription is only started after all participants have been informed and have expressly consented. You can still take part in an introductory meeting without recording or transcription. Before such processing is enabled, its purpose, retention period, recipients and any AI-assisted documentation process will be defined separately and communicated transparently.
8. Email Delivery via Mailjet
Mailjet, a Sinch Email service, is used for reliable delivery of transactional emails and form notifications. The email address, name, message content, sending time, delivery status and technically necessary routing information may be processed. Processing is carried out to handle enquiries and ensure reliable communication under Article 6(1)(b) or (f) GDPR.
Mailjet states that customer data is stored in data centres in Frankfurt am Main and Saint-Ghislain, Belgium. The data processing agreement forms part of Mailjet's contractual terms. As Sinch operates internationally and uses subprocessors, data may in some cases be processed outside the European Economic Area. Mailjet states that appropriate safeguards, in particular standard contractual clauses, are used for such transfers. Sending and delivery data is stored only for as long as required for delivery, security, error analysis or legal obligations; the periods in Section 4 apply to the content of an enquiry.
9. Local Web Fonts
The Inter and JetBrains Mono fonts are served locally from this website. Loading the fonts therefore does not establish a connection to Google Fonts.
10. Cookies and Consent Management
We use Borlabs Cookie to manage privacy preferences. The displayed dialog allows visitors to select optional services and stores their decision. Technically necessary cookies and local storage access may be used for this purpose. Processing serves to manage and document these preferences and comply with applicable consent requirements; the legal basis is Article 6(1)(c) or (f) GDPR, as applicable.
For optional services requiring consent, the consent given in the dialog under Article 6(1)(a) GDPR is the relevant basis. You can reopen and change your selection through the website’s privacy settings. Technically necessary functions, such as login, language selection and form security, are described separately. The Turnstile check, which currently loads independently of optional consent, is explained in section 5a.
11. Multilingual Content with TranslatePress
TranslatePress is used to provide the website in multiple languages. The language selection may be stored locally in the browser. Public content is not automatically sent to an external translation service during regular operation. If this function is enabled in the future, the associated data transfer will be reviewed separately in advance.
12. No Web Analytics in the Current Setup
No services for personal audience measurement or marketing tracking are currently used. Before such services are added, they will undergo technical and legal review and, where required, be integrated through consent management.
13. Recipients and Processors
Personal data is shared with service providers only where needed for hosting, server administration, maintenance, security, appointment management or communication. These include Hetzner Online GmbH for hosting, SpinupWP for technical server administration, Microsoft for Bookings, Outlook and Teams, Mailjet for email delivery, and Cloudflare for Turnstile form protection. Cloudflare’s different roles and possible transfers to third countries are described in section 5a. The legally required agreements are concluded with processors. Any further disclosure takes place only where legally required or supported by a valid legal basis.
Telephony also uses Twilio, and the AI assistant uses ElevenLabs with participating language-model providers; section 4a describes the details, retention and international processing.
14. Data Security
The website is provided over an encrypted TLS connection. Appropriate technical and organisational measures are used to protect data against loss, unauthorised access and misuse. Complete protection during data transmission over the internet cannot, however, be guaranteed.
15. Provision of Data and Automated Decisions
Information marked as mandatory is required to process a contact, callback or appointment-booking request or to provide the requested Selfcheck assessment. Without this information, processing, booking or delivery of the result may not be possible. There is no legal obligation to provide the data. The automated Selfcheck assessment is non-binding and has no legal or similarly significant effect. This website does not otherwise make decisions based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.
16. Your Rights
You also have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
Personal access to the AI Workspace demo
For the requested trial access, we store your name, company, email address, selected demo role and, optionally, your intended use case. A 14-day trial starts when you verify your email address. New sign-in links do not extend this period. These details are used to provide and support the trial; requesting access does not subscribe you to a newsletter.
The sign-in link can be used once and is valid for 30 minutes. The technically necessary “trx_workspace” cookie is used for your session, no longer than the trial period. The application stores link and session tokens only as hashes. To prevent abuse, we use limited counters with rotating derived values instead of storing the IP address in plain text. Unverified requests are deleted after 7 days; verified demo requests and saved demo histories are deleted 90 days after the trial ends. General server logs and processing by the email delivery provider are described in the relevant sections of this policy.
The selected role inserts your name and company into the example case. The AI receives fictional identities; contact details from registration are not automatically transmitted to it. AI is an integral part of this demo. You must confirm that you have read the AI notice and the privacy information when requesting a login link. After you redeem the link, we record the confirmed notice version and the time of confirmation. Existing users who have not confirmed the current notice will see it before their next entry. This confirmation is deleted with the demo request according to the retention periods stated above. Only when you request an analysis or reply draft do we transmit your inquiry text and, where needed for the relevant step, the technical question and feedback together with approved fictional product information through the AI gateway Requesty to Google (Gemini for analysis) or OpenAI (for reply drafts). Analysis uses a European Google endpoint. Exclusively European processing is not promised for the complete workflow; the OpenAI endpoint may retain content for up to 30 days under the provider terms. Disabling content logging at Requesty does not amount to a deletion commitment by all participating providers. Use only fictional information in all input fields; do not enter confidential information or other people’s personal data. Known profile details are replaced with example identities before an AI call; this does not provide general detection of personal data in free text.
The AI call disables additional storage of the response in the API response history. This is not a commitment that the provider stores no data at all: by default, OpenAI describes abuse-monitoring logs for up to 30 days and possible longer retention for security or legal reasons. Processing exclusively within Europe is not guaranteed for this demo. Further details are available in OpenAI’s information on API data processing.
The knowledge sources are retrieved on the server from a separate, approved demonstration collection in Supabase. The demo does not write lead or customer data there. Its replies are non-binding AI drafts. Email delivery to example customers and CRM updates are simulated. For access to or deletion of your demo request, please use the contact details above.
17. Updates to This Policy
This privacy policy is updated when the website, services used or legal requirements change. Last updated: 28 September 2026.