Privacy Policy

I only process personal data where it is needed for this website, your inquiry and my work as a wedding singer. Here is which data that is, what I use it for and which rights you have.

1. Controller and contact

The controller for data processing on this website is Deborah Posadas Saucedo, sole proprietor, Dominikanergasse 2/7, 8020 Graz, Austria.

If you enter into a contract with Deborah Posadas KG (company register no. FN 622276 m, Regional Court for Civil Matters Graz, Dominikanergasse 2/7, 8020 Graz), the KG is responsible for processing your contract data. Your quote shows which of the two is your contracting party.

For any questions about data protection, you can reach me at mail@deborahposadas.com or +43 681 2023 05 26. I have not appointed a data protection officer, as this is not legally required.

2. Hosting, server logs, cookies and consent

Hosting. This website is hosted by Squarespace Ireland Ltd., Le Pole House, Ship Street Great, Dublin 8, Ireland. When you open the site, Squarespace processes technical data such as your IP address, browser type, operating system, the page you visit and the date and time, so that the site is displayed correctly and stays secure (server log files). Data may be transferred to Squarespace Inc. in the USA. A data processing agreement is in place with Squarespace. The legal basis is my legitimate interest in a reliable and secure website (Art. 6(1)(f) GDPR).

Cookies. I set technically necessary cookies, for example for displaying and securing the site, without your consent. All other cookies and similar technologies (analytics and advertising, see section 4) are only set and loaded after you have agreed in the cookie banner. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021.

You can withdraw or change your consent at any time with effect for the future. To do so, use the small cookie icon at the edge of the page (the "pill"), where you can make your choice again. The cookie banner is the solution built into the website by Squarespace. You can also block or delete cookies in your browser, in which case the site may work with limitations.

3. Inquiry form, Kreativ.Management, email, WhatsApp, scheduling, video calls

Inquiry form and Kreativ.Management. When you use the inquiry form on this website, your details are sent directly to the management software app.kreativ.management. This includes your contact details (for example name, email address, phone number) and the details about your wedding that you enter (for example date, location, wishes). The fields in the form may change over time. What I process is the information you enter there. There I manage client data, calendar, tasks, messages, quotes and invoices. The provider is Hochzeit.Management GmbH, with which I have a usage agreement and a data processing agreement. The data is stored exclusively on servers in the EU, specifically in Linz, Austria. The legal basis is the performance of pre-contractual measures and of a contract (Art. 6(1)(b) GDPR), otherwise my legitimate interest in handling inquiries efficiently (Art. 6(1)(f) GDPR).

Email. If you write to me by email, I process your message and contact details to answer your request. Emails run through Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and are read and answered with Apple Mail. A data processing agreement is in place with Google. The legal basis is Art. 6(1)(b) or (f) GDPR.

Phone and WhatsApp. If you call me or write to me on WhatsApp Business (WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland), I process your number and the content of your message to handle your request. Messages are end-to-end encrypted, but WhatsApp receives metadata and may share it with Meta in the USA. I use WhatsApp based on my legitimate interest in fast communication (Art. 6(1)(f) GDPR). If you prefer not to use it, please write to me by email.

Scheduling with Calendly. You can book the First Note Call through Calendly (Calendly LLC, 271 17th St NW, Atlanta, Georgia 30363, USA). For this, your details and preferred time are passed to Calendly so that the appointment can be planned and held. A data processing agreement is in place with Calendly. The legal basis is Art. 6(1)(b) GDPR.

Video calls with Zoom. For video conversations I use Zoom (Zoom Communications Inc., 55 Almaden Boulevard, San Jose, CA 95113, USA). Zoom processes your contact details, connection data such as IP address and device type, and the content you share in the call. Calls are not recorded unless you expressly agree beforehand. A data processing agreement is in place. The legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f).

4. Analytics and advertising

The following services only run if you have expressly agreed in the cookie banner (Art. 6(1)(a) GDPR, Section 165(3) Telecommunications Act 2021). You can withdraw your consent at any time, see section 2. Without your consent these services set no cookies, and the Meta Pixel sends nothing to Meta. In that case Google Analytics only sends limited measurement signals without cookies (Google Consent Mode).

Squarespace Analytics. Squarespace Ireland Ltd. evaluates how the website is used, for example pages viewed, clicks, origin and approximate location. For this, cookies and information about your browser, device and IP address are processed. Data may be transferred to Squarespace Inc. in the USA. A data processing agreement is in place with Squarespace.

Google Analytics 4. Google Ireland Limited analyses how the website is used so that I can see which content couples find interesting. This involves usage data such as page views, time on page, device and origin, plus a cookie identifier. Google Analytics 4 does not store IP addresses. Retention in Google Analytics is limited to a maximum of 14 months. Google may transfer data to the USA. A data processing agreement is in place with Google. You can also prevent collection with the browser add-on at https://tools.google.com/dlpage/gaoptout?hl=en.

Google Ads. I run ads on Google. To measure whether an ad led to an inquiry, I use conversion measurement from Google Ireland Limited. Google sets cookies or similar identifiers and learns that you visited my website after clicking an ad. I only receive aggregated reports and no information that identifies you personally.

Meta Pixel. I run ads on Instagram and Facebook. The Meta Pixel (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland) tells Meta that you visited my website after clicking an ad and sets a cookie for this. This lets me measure whether the ads work and improve them. If you have a Meta account, Meta can link the data to your profile and use it for its own purposes. For the collection and transfer of this data to Meta, I am jointly responsible with Meta (Art. 26 GDPR). You can find the agreement at https://www.facebook.com/legal/controller_addendum. Meta is responsible for processing after the transfer. You can exercise your rights regarding data stored at Meta directly with Meta. To limit personalised advertising from Meta, use the ad settings in your Meta account.

5. Social media

I run profiles on Instagram and TikTok (@deborahposadaswedding). No Instagram or TikTok content is embedded on this website, so no data is sent to these networks while you only visit the site. If you click a link to a profile, you leave my website and the privacy policy of that network applies.

If you message me on Instagram or TikTok, I process your message and profile details to reply. The networks also process this data under their own rules. The legal basis is Art. 6(1)(b) or (f) GDPR.

Instagram. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. For the statistics of my profile (Page Insights, for example reach and audience) I am jointly responsible with Meta (Art. 26 GDPR). Details of the agreement: https://www.facebook.com/legal/terms/page_controller_addendum. Instagram's privacy policy: https://privacycenter.instagram.com/policy/

TikTok. For users in the European Economic Area the provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. TikTok's privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en

The details in my legal notice also apply to these profiles.

6. Contracts, retention, third countries

Contracts and invoices. For quotes, contracts, our collaboration and billing, I process your master and order data (for example name, address, contact details, wedding details, payment information). The legal basis is Art. 6(1)(b) GDPR, and for bookkeeping and tax also Art. 6(1)(c) GDPR. Payment is made by bank transfer after a quote. No payments are processed through the website.

Recipients. Your data is only passed to service providers I need for my work (Squarespace, Kreativ.Management, Google, Calendly, Zoom, Meta) under data processing agreements, and to my tax advisor and authorities where the law requires it. Data is not passed on to third parties for their own advertising.

Retention. I delete inquiries that do not lead to a contract after one year at the latest. I keep contract and invoice data for as long as the law requires, in Austria generally seven years (Section 132 Federal Fiscal Code, Section 212 Commercial Code). Data based on consent is stored until you withdraw it. Cookies and tracking identifiers expire according to the settings of the respective provider.

Third countries. Some of the providers named are based in the USA or may transfer data there. This happens on the basis of the EU Commission's adequacy decision on the EU-US Data Privacy Framework where the provider is certified, otherwise on the basis of the EU Standard Contractual Clauses. For cookie-based services, your consent applies in addition.

7. Your rights and complaints

You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). Where I process data based on my legitimate interest, you can object on grounds relating to your particular situation (Art. 21 GDPR). You can withdraw consent you have given at any time with effect for the future. Processing before withdrawal remains lawful. To do so, simply write to mail@deborahposadas.com.

No automated decision-making, including profiling, that has legal effects on you takes place.

If you believe I am processing your data unlawfully, you can complain to the Austrian Data Protection Authority: Barichgasse 40 to 42, 1030 Vienna, email dsb@dsb.gv.at, www.dsb.gv.at. Before you do, I would be glad if you got in touch with me so that we can clear it up.

Last updated: 1 November 2026.