Privacy notice
Controller
Sebastian Maximilian Knorr
Kreuzgasse 26, 8010 Graz, Austria
E-mail: kontakt@sebastian-knorr.com
Scope
This website sets no cookies and uses no tracking or analytics services. Fonts, images and scripts are served from this domain, so no third-party service is contacted when you visit. I process personal data only when you write to me through a form or by e-mail, or when I write to you as described under “Business e-mails to companies”. Beyond that, the only technically necessary processing is that of server logs by the hosting provider.
Hosting
This website is hosted by Netlify (Netlify, Inc., 512 2nd Street, San Francisco, CA 94107, USA). When you visit, Netlify processes technically necessary server logs such as IP address, time of access, page requested and browser type. The purpose is the secure and stable operation of the website. The legal basis is my legitimate interest in secure operation (Art. 6(1)(f) GDPR). Transfers to the USA are based on the EU Standard Contractual Clauses in Netlify’s data processing agreement.
Drafts for companies (see “Business e-mails to companies”) are served from entwurf.sebastian-knorr.com, which is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA). The same terms apply, that is technically necessary server logs, the same legal basis and the EU Standard Contractual Clauses in Cloudflare’s data processing agreement.
Enquiry forms
If you write to me through a form, I process the details you enter. On the home page these are the kind of project, your name, your e-mail address, your description and, if given, your company or website and the timeframe you have in mind. On the page “Company analysis” they are your question, the question you chose there, your company, your name, your e-mail address and, if given, your phone number. The only purpose is to reply to your enquiry. The legal basis is Art. 6(1)(b) GDPR, steps taken at your request before entering into a contract.
All forms are processed by Netlify Forms, a service of the hosting provider Netlify (see above). Netlify stores the entry and forwards it to me by e-mail. Transfers to the USA are covered by the Standard Contractual Clauses named above. Entries that do not lead to an assignment are deleted once the enquiry is closed and no retention duty applies.
Contact by e-mail
If you write to me, I process your e-mail address and the content of your message in order to reply. The legal basis is Art. 6(1)(b) GDPR where it concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR. My mailbox is hosted by Google (Google Workspace, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Messages that do not lead to an assignment are deleted once the enquiry is closed and no retention duty applies.
Business e-mails to companies
I write to directors of limited companies, including in the United Kingdom, to offer them a specific piece of work. This may be a draft of a new website or a short analysis of their company’s public record. I write at most twice, and not at all once you ask me to stop. This section gives the information required by Art. 14 GDPR, because the data did not come from you.
What I process. Your name, your role in the company with the date of your appointment, and your business e-mail address. In addition, public details of the company, that is its name, registered number, address and website. For an analysis I also read the company’s records at Companies House, that is its annual accounts, registered charges and filing history.
Where it comes from. The public register of Companies House and your company’s own website.
Purpose and legal basis. I offer a service that is relevant to your company’s business. The legal basis is my legitimate interest in business-to-business marketing (Art. 6(1)(f) and Recital 47 GDPR). I write only to incorporated companies, use no tracking pixels and send no attachments.
Counts for whole sectors. For analyses I also read the register of people with significant control. From it I use the month and year of birth only for a count across a whole sector. It shows in how many companies all owners are aged 60 or over. Each such figure covers at least ten companies and names no person and no company. The register extracts behind it stay on my own computer, are passed on to no one and are deleted at the latest twelve months after download. The legal basis is again Art. 6(1)(f) GDPR.
Drafts and analyses. A website draft for your company sits on a private page that search engines are asked not to index. It is taken offline 21 days after my e-mail. An analysis of your company goes to you alone.
Who receives it. No one else. My mailbox is hosted by Google and the drafts by Cloudflare, both as processors.
How long. If you do not reply, I delete your data and anything I prepared for your company three months after my e-mail. If you ask me not to write again, I keep only your e-mail address on a suppression list. That way I can respect your request.
Your right to object. You can object to this use of your data at any time, free of charge, by replying “unsubscribe” or by writing to kontakt@sebastian-knorr.com (Art. 21(2) GDPR). I will then not contact you again.
Links
The link to Spant leads to a website of the same controller. Its own privacy notice applies there.
Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may also complain to a supervisory authority. Mine is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at. If you live in the United Kingdom, you may also contact the Information Commissioner’s Office (ico.org.uk).
Last updated: November 2026
This is a translation of the German original, which prevails in case of doubt.