Last updated: 3 November 2026
This privacy policy tells you, in line with Articles 13 and 14 of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG), which personal data we process on this website, why, on what legal basis, who receives it and how long we keep it.
In short: we use no advertising tools and no tracking cookies; we count visits with cookieless statistics (section 10). We process only the data needed to run the website and to handle your request.
JJW Project Solutions e.U.
Owner: Jeremy Wilhelm
Marxergasse 11/19, 1030 Vienna, Austria
Phone: +43 664 3834 667
Email: office@jjw.at
Companies register number: FN 617994s
For any question about data protection and to exercise your rights, write to office@jjw.at. Our company is not legally required to appoint a data protection officer.
This website and the applications for the AI readiness check, the offer and booking are run by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. On every visit Vercel processes technically necessary data: IP address, date and time, the address requested, the amount of data transferred, browser and operating system, and the page you came from (referrer).
Purpose: delivering the website, stability and security, defending against attacks. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Vercel keeps these logs only briefly and processes them as our processor (Art. 28 GDPR).
IONOS: Our domains and their name resolution (DNS) are managed by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. We also send this website's automatic emails, such as confirmations and reports, through IONOS's servers. In doing so IONOS processes your email address, your name and the content of the message.
Microsoft 365: Our mailbox office@jjw.at, which receives your enquiries and our internal notifications, is run by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
Legal basis: Art. 6(1)(b) GDPR where the communication serves entering into or performing a contract, otherwise Art. 6(1)(f) GDPR (answering your enquiry). Both providers are our processors.
When you write to us through the contact form, we process your name, email address, phone number, message, your answer to "How did you hear about us?" and the language you used. Your enquiry is stored in our customer management system (see section 9). You receive an automatic confirmation, and we receive an internal notification (see section 3).
Purpose: handling and answering your enquiry; we use your answer on how you heard about us to understand which channels make us known. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries and in understanding how people find us).
When you submit a profile through "Join the network", we process the details in the form (name, email address, location, focus, experience, specialist areas, LinkedIn profile, availability, work model, willingness to travel, contract form, message) and, if uploaded, your CV. The CV is kept in non-public storage and can only be opened by us after signing in with two-factor authentication.
Purpose and legal basis: reviewing your admission to the network (Art. 6(1)(b) GDPR). If you have also consented to joining our pool, we keep your profile for up to 18 months and contact you about suitable assignments (Art. 6(1)(a) GDPR). We pass your profile or contact details to a potential client only with your separate consent for that specific assignment. You can withdraw your consent at any time, with effect for the future, by emailing office@jjw.at.
Please do not submit special categories of personal data (for example on health or religion).
For the AI readiness check we process your contact details (first and last name, email address, phone number, company, role, industry, company size, region) and your answers. From these we calculate your readiness level and create a PDF report, which we email to you and store in our customer management system and in Google Drive (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
AI-assisted analysis: For the written analysis in the report, we send an extract of your answers to OpenRouter, Inc. (USA), which passes it to a language model of Anthropic, PBC (USA). Your name, email address, phone number and company name are not sent; only industry, company size, role, region, your answers and results, and anything you write in free-text fields. Please do not enter other people's personal data in the free-text fields. The analysis is a recommendation; it has no legal or similarly significant effect on you (no automated decision within the meaning of Art. 22 GDPR).
Purpose: preparing your individual analysis, sending the report and contacting you about next steps. Legal basis: your consent (Art. 6(1)(a) GDPR), given before you submit and revocable at any time with effect for the future, and Art. 6(1)(b) GDPR where you request an offer.
Your personal offer page is reached through a link containing a randomly generated access key; without that link the page cannot be opened. Please do not share the link.
For appointments we use Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA. On pages that offer booking, a Calendly script is loaded when the page opens or when you click the booking button, so Calendly receives your IP address and technical data about your browser. When you book, Calendly processes what you enter (name, email address, chosen time, notes) and may set cookies in the booking window. We copy the booked appointment into our customer management system.
Legal basis: Art. 6(1)(b) GDPR (arranging a meeting) or Art. 6(1)(f) GDPR (convenient scheduling). More information: calendly.com/privacy.
We protect our forms with Turnstile by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile checks that a submission comes from a person and processes your IP address and technical characteristics of your browser and device for that purpose. We also limit the number of requests per sender; for this we store an encrypted value derived from your IP address (not the IP address itself) for at most one day.
Legal basis: our legitimate interest in protection against spam and misuse (Art. 6(1)(f) GDPR). More information: cloudflare.com/privacypolicy.
We store enquiries, profiles, AI readiness checks and bookings in our customer management system. Supabase, Inc. runs the database for us on servers in Ireland (EU). Only we have access, and only after signing in with two-factor authentication. Supabase is our processor.
This website sets no cookies of its own and uses no tracking or advertising services. All fonts are loaded from our own server; no data is sent to Google Fonts. Cookies can only be set by third parties whose window you actively open (Calendly, see section 7).
Visitor statistics (Vercel Web Analytics). To understand how our website is used, we use Vercel Web Analytics. It sets no cookies and builds no user profiles. It records the page visited, the referring page, country and region, device type, operating system and browser. A visit is recognised by a hash value that is discarded after 24 hours; it is not linked to you or your IP address, and there is no tracking across websites. We only see aggregated figures. Legal basis: our legitimate interest in improving our website (Art. 6(1)(f) GDPR).
For the website's security, your browser tells us if a page tries to load content from a source that is not allowed (Content Security Policy). These reports contain the page concerned without parameters, the blocked source and the browser identifier, but no IP address; we delete them after 90 days. Legal basis: Art. 6(1)(f) GDPR.
We link to our profiles, for example on LinkedIn. These are plain links, not embedded plugins: no data is transferred until you click a link and open the provider's page, where the provider's privacy policy applies.
Your data is received only by us and by the service providers named above, who process it on our behalf. We pass it to other third parties only with your consent or where the law requires it.
Some providers are based in the USA (Vercel, Cloudflare, Calendly, OpenRouter, Anthropic, Supabase) or may transfer data to the USA as part of an international group (Microsoft, Google). Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
After that we delete or anonymise the data, unless a legal retention obligation applies.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future; processing carried out before the withdrawal remains lawful. Simply write to office@jjw.at.
If you believe we are not processing your data lawfully, you can complain to the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.
Providing data is voluntary. Without the details marked as required, however, we cannot handle your enquiry, profile or AI readiness check.
All connections to this website are encrypted (HTTPS). Access to our customer management system is limited to us and protected with two-factor authentication.
We update this privacy policy when our website or the legal requirements change. The version published here applies.
