Privacy Policy
As of July 6, 2026
The protection of personal data is important to us. In this Privacy Policy, we explain what personal data is processed when you visit this website or contact us, for what purposes this is done, and what rights data subjects have under the General Data Protection Regulation.
This Privacy Policy applies to the foundation-three.com website, including its subpages.
1. Data Controller
This website is operated as part of the “Foundation Three” joint website. The joint controllers within the meaning of the General Data Protection Regulation are:
F3A GmbH
Stolzenthalergasse 3/1
1080 Vienna
Austria
Email: [aa@foundation-three.com](mailto:aa@foundation-three.com)
Management: Alexander Ahmad, MArch
Commercial Register Number: FN 634180 v
Commercial Register Court: Vienna Commercial Court
Christoph Reichelt
Siebensterngasse 52/16
1070 Vienna
Austria
Email: [cr@foundation-three.com](mailto:cr@foundation-three.com)
F3M e.U.
Stolzenthalergasse 3/1
1080 Vienna
Austria
Email: [mh@foundation-three.com](mailto:mh@foundation-three.com)
Owner: Maximilian Hammerl
Commercial Register Number: FN 644879 b
Commercial Register Court: Vienna Commercial Court
General contact address: [hello@foundation-three.com](mailto:hello@foundation-three.com)
If you have any questions about data protection or the processing of your personal data, you can contact us at any time using one of the email addresses listed above.
2. General Information on Data Processing
We process personal data only to the extent necessary to provide this website, respond to inquiries, initiate or conduct business relationships, comply with legal obligations, or protect legitimate interests.
Personal data refers to any information relating to an identified or identifiable natural person, such as a name, email address, phone number, IP address, or the content of communications.
3. Legal Basis for Processing
The processing of personal data is based, in particular, on the following legal grounds:
Art. 6(1)(a) of the GDPR – Consent
if you give us your explicit consent, for example for certain external content or non-essential cookies.
Art. 6(1)(b) GDPR – Contract or precontractual measures
if the processing is necessary to handle an inquiry, prepare a quote, or perform a contract.
Art. 6(1)(c) GDPR – legal obligation
when we are legally required to retain or disclose data, for example in connection with tax or corporate law obligations.
Art. 6(1)(f) GDPR – legitimate interest
if the processing is necessary for the secure, stable, and cost-effective provision of the website, for communication, for the documentation of business processes, or to prevent misuse, and no overriding interests of data subjects preclude it.
4. Website Visits and Server Log Files
When you visit this website, technically necessary information is processed so that the website can be displayed and the stability and security of the system can be ensured. This may include, in particular, the following data:
* IP address
* Date and time of access
* Page or file accessed
* Amount of data transferred
* Browser type and version
* Operating system
* Referrer URL
* Hostname of the accessing computer
* Status messages and error codes
This data is processed to provide the website from a technical standpoint, detect attacks or misuse, analyze errors, and ensure system security.
The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure and reliable operation of the website.
Server log files are stored only as long as necessary for the purposes stated. They may be stored for a longer period if this is necessary to investigate security incidents or to assert, exercise, or defend legal claims.
5. Hosting and Technical Service Providers
Hosting, maintenance, and technical service providers may be used to operate this website. These service providers process data on our behalf to the extent necessary for the operation, security, and maintenance of the website.
Where required by law, appropriate agreements with data processors are entered into in accordance with Article 28 of the GDPR.
Note for the final publication: The specific hosting provider should be reviewed internally and added here if it is to be named or if there are any specific data transfers to third countries.
6. Contact via email or phone
When you contact us by email, phone, or through other specified contact channels, we process the data you provide. This may include, in particular:
* Name
* Email address
* Phone number
* Company or organization
* Details of your inquiry
* Communication data and metadata
* Project- or contract-related information, if applicable
Your data is processed to handle your inquiry, communicate with you, initiate or carry out projects and business relationships, and document our communications.
The legal basis is Article 6(1)(b) of the GDPR, insofar as the contact relates to precontractual measures or a contract, as well as Article 6(1)(f) of the GDPR based on our legitimate interest in efficient and transparent communication.
Contact and communication data will be stored for as long as necessary to process the inquiry. In addition, data may be stored if there are legal retention requirements or if storage is necessary to assert, exercise, or defend legal claims.
7. Contact Forms
The publicly visible contact page currently lists direct contact options via email and phone. If contact forms are used on individual subpages or in the future, we will process the data entered there solely for the purpose of handling the respective inquiry.
This may include, in particular, your name, email address, phone number, message text, time of transmission, and technical metadata.
The legal basis is Article 6(1)(b) of the GDPR for pre-contractual or contractual inquiries, and Article 6(1)(f) of the GDPR based on our legitimate interest in processing incoming inquiries.
8. Cookies and Local Storage
This website may use technically necessary cookies or similar technologies to provide basic functionality. Technically necessary cookies are required for the website to function properly.
Non-essential cookies—particularly those used for analytics, marketing, embedded media, or external services—are used only if there is an appropriate legal basis for doing so, specifically your consent pursuant to Article 6(1)(a) of the GDPR.
You can delete, block, or restrict cookies in your browser settings. If you block cookies, the website's functionality may be limited.
9. External Links
This website contains links to external websites and services, specifically to Instagram and a Google Maps address link.
When you click on an external link, you will leave our website. From that point on, the respective provider is responsible for any further data processing. We have no control over what data external providers process when you visit their websites.
Please review the privacy policies of the respective providers.
10. Instagram
This website contains a link to our Instagram page. Simply visiting our website does not, in principle, result in any data being transmitted to Instagram via this link. A connection to Instagram or Meta is established only when you click on the link.
Instagram is provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
When you access Instagram, Meta may process personal data, including, in particular, your IP address, device information, usage data, interactions, and, if applicable, information from your Instagram or Facebook account, provided that you are logged in.
We do not have full control over the nature, scope, and purposes of Meta’s data processing. Meta is generally responsible for data processing on Instagram.
The legal basis for including this link is Article 6(1)(f) of the GDPR. Our legitimate interest lies in promoting our work and our studio through social media and providing an easy way for people to contact us and access information.
11. Google Maps / Google Address Link
This website includes a link to an address via Google Maps or Google. Simply visiting our website does not, in principle, cause a map to load. A connection to Google is established only when you click on the link.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
If you use the Google Maps link, Google may process personal data, including your IP address, location data, search and usage data, and technical information about your device and browser. If you are signed in to your Google Account, Google may associate this data with your account.
We have no control over how Google processes your data after you click the link. Please review Google's privacy policy.
The legal basis for providing this link is Article 6(1)(f) of the GDPR. Our legitimate interest is to make it easy for visitors to find our address.
12. Embedded media, especially YouTube
Some subpages may include external media content, particularly videos from YouTube. If such content is included, personal data may be transmitted to the respective provider when the video is loaded or played.
YouTube is a Google service. The provider in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When using embedded YouTube videos, the following data in particular may be processed:
* IP address
* Device and browser information
* Page accessed
* Time of access
* Usage and interaction data
* Cookie or tracking information, if applicable
* Data from your Google Account, if applicable, provided you are signed in
Unless YouTube videos are technically necessary, they should not be loaded until you have given your consent. The legal basis in this case is Article 6(1)(a) of the GDPR.
In the rare event that external media are loaded without prior consent, this will only occur if there is a legitimate interest pursuant to Article 6(1)(f) of the GDPR and no overriding interests of data subjects preclude it. Our legitimate interest may lie in the appealing presentation of our projects and services.
We recommend embedding YouTube videos in a privacy-friendly manner, for example, using a two-click solution or a similar consent mechanism.
13. Project Content, Images, and Credits
This website features projects, work, images, graphics, and, where applicable, credits for individuals or companies. To the extent that personal data is identifiable—such as names, likenesses, or professional roles—it is processed for the purpose of presenting our services, references, and project work.
The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in presenting our work, our references, and our professional activities.
To the extent that a disclosure is based on consent, Article 6(1)(a) of the GDPR serves as the legal basis. Consent that has been given may be withdrawn at any time with future effect.
14. Applications
If you submit your application materials to us via email, we will process the personal data contained therein solely for the purpose of reviewing your application and conducting the application process.
This may include, in particular, your name, contact information, resume, transcripts, portfolio, work samples, and any other information you provide.
The legal basis is Article 6(1)(b) of the GDPR, to the extent that the processing is necessary for the implementation of precontractual measures, and, where applicable, Article 6(1)(f) of the GDPR.
Application data will be deleted as soon as it is no longer needed for the application process, provided there are no legal requirements to retain it or consent has not been given to retain it for a longer period.
15. Customer, Project, and Business Partner Data
If you are a customer, project partner, supplier, or other business partner, we process personal data that is necessary for establishing, conducting, and managing the business relationship.
These may include, in particular:
* Name and contact information
* Company, job title, and professional contact information
* Quote, contract, and invoice information
* Project information
* Communication content
* Payment and accounting information
The legal bases are Article 6(1)(b) of the GDPR for the performance of a contract or the implementation of precontractual measures, Article 6(1)(c) of the GDPR for compliance with legal obligations, and Article 6(1)(f) of the GDPR based on our legitimate interest in the orderly conduct of business.
16. Retention Period
We retain personal data only for as long as is necessary for the respective purposes.
In addition, we retain data when there are legal retention requirements, particularly those under tax and corporate law, or when such retention is necessary to assert, exercise, or defend legal claims.
As soon as the relevant purpose no longer applies and there are no retention requirements or legitimate interests in further storage, personal data will be deleted or anonymized.
17. Recipients of Personal Data
Personal data may, to the extent necessary, be disclosed to the following categories of recipients:
* Technical service providers and hosting providers
* IT and maintenance service providers
* Email and communication service providers
* Tax, accounting, and legal advisory services
* Banks and payment service providers
* Government agencies, courts, or other public authorities, to the extent required by law
* Project partners, to the extent necessary for project implementation
Data will only be disclosed if there is a legal basis for doing so, if the disclosure is necessary to fulfill a contract, if there is a legal obligation to do so, if consent has been given, or if there is a legitimate interest.
18. Data Transfers to Third Countries
When using certain external services, particularly Google or Meta services, personal data may be processed outside the European Union or the European Economic Area.
Such a transfer takes place only if the requirements of Articles 44 et seq. of the GDPR are met, in particular if there is an adequacy decision by the European Commission, if appropriate safeguards such as standard contractual clauses have been agreed upon, or if explicit consent has been given.
19. Data Security
We take appropriate technical and organizational measures to protect personal data from loss, misuse, unauthorized access, disclosure, alteration, or destruction.
This website uses HTTPS/TLS encryption. This protects the communication between your browser and our server.
20. No automated decision-making
We do not use any fully automated decision-making processes within the meaning of Article 22 of the GDPR that produce legal effects on you or similarly significantly affect you.
21. Your Rights
Under the GDPR, you have the following rights in particular:
* Right of access pursuant to Art. 15 GDPR
* Right to rectification pursuant to Art. 16 GDPR
* Right to erasure pursuant to Art. 17 GDPR
* Right to restriction of processing pursuant to Art. 18 GDPR
* Right to data portability pursuant to Art. 20 GDPR
* Right to object pursuant to Art. 21 GDPR
* Right to withdraw consent pursuant to Art. 7(3) GDPR
* Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR
If the processing is based on your consent, you may withdraw that consent at any time, effective for the future. The lawfulness of the processing up until the withdrawal remains unaffected.
If the processing is based on Article 6(1)(f) of the GDPR, you may object to the processing at any time on grounds relating to your particular situation.
To exercise your rights, you may contact the data controllers listed above.
22. Right to File a Complaint with the Data Protection Authority
If you believe that the processing of your personal data violates data protection laws, you have the right to file a complaint with a supervisory authority.
The following is responsible for Austria:
Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
Phone: +43 1 52 152-0
Email: [dsb@dsb.gv.at](mailto:dsb@dsb.gv.at)
23. Changes to This Privacy Policy
We may update this Privacy Policy in response to legal, technical, or organizational changes, or when new services are introduced on the website.
The current version published on this website applies.