Privacy Policy
Last updated: 5 October 2026
The protection of your personal data is important to us.
This Privacy Policy explains how personal data is processed when you visit www.droptogether.com, contact us through the website or otherwise communicate with Drop Together.
Drop Together is a shared brand operated jointly by Isabel Drasl and Christina Lao, who are independent sole traders.
1. JOINT CONTROLLERS
The joint controllers responsible for the processing of personal data in connection with this website are:
Isabel Drasl
Seidlgasse 12A
1030 Vienna
Austria
and
Christina Lao
Seidlgasse 12A
1030 Vienna
Austria
E-mail
hi.drop.together@gmail.com
Website
www.droptogether.com
Isabel Drasl and Christina Lao jointly determine the purposes and means of the relevant processing of personal data in connection with the Drop Together website and related enquiries and therefore act as joint controllers within the meaning of Article 26 GDPR.
We have entered into an arrangement governing our responsibilities under Article 26 GDPR.
As we jointly operate Drop Together, both controllers participate in decisions concerning the processing of personal data. We jointly take responsibility, where applicable, for providing information about our processing activities, responding to requests from data subjects, implementing appropriate safeguards, appropriately engaging processors and responding to data-protection incidents.
You may exercise your rights under the GDPR against either controller.
For simplicity, our common contact point for privacy-related enquiries is:
This does not limit your right to contact either controller individually.
2. PERSONAL DATA WE PROCESS
Depending on how you interact with our website, we may process information including:
your name and e-mail address;
information you submit through our contact form;
information you provide when communicating with us;
browser, network and device information;
IP address where processed by our website infrastructure;
referring website;
pages visited and interactions with our website;
date and time of website activity; and
cookie and consent preferences.
We process personal data only where an appropriate legal basis under the GDPR applies.
Depending on the processing activity, this may include:
Consent — Article 6(1)(a) GDPR
Where you have given your consent, including for non-essential analytics and performance cookies.
Contract or pre-contractual measures — Article 6(1)(b) GDPR
Where processing is necessary to respond to an enquiry relating to a potential engagement or to perform a contract.
Legal obligation — Article 6(1)(c) GDPR
Where processing is necessary to comply with a legal obligation.
Legitimate interests — Article 6(1)(f) GDPR
Where processing is necessary for our legitimate interests, such as securely operating and administering our website or responding to general business communications, provided those interests are not overridden by your rights and interests.
3. SQUARESPACE — WEBSITE AND HOSTING
Our website is created and hosted using Squarespace.
Squarespace provides the technical infrastructure required to display, secure and operate our website.
In connection with the provision of the website, Squarespace may process technical information such as IP address, browser, network and device information and information relating to website access and interaction.
Where such processing is necessary for the secure and reliable operation of the website, we process this information on the basis of our legitimate interest in providing a secure and functional website pursuant to Article 6(1)(f) GDPR.
Further information about Squarespace's processing of personal data can be found in Squarespace's Privacy Policy.
4. CONTACT FORM AND E-MAIL
If you contact us through the contact form on our website or by e-mail, we process the information you provide.
This may include your name, e-mail address, the content of your message and any other information you voluntarily provide.
Our website contact form is provided through Squarespace.
We use this information to receive, review and respond to your enquiry and, where applicable, to discuss or establish a potential business relationship.
If your enquiry concerns a potential or existing contractual relationship, processing is based on Article 6(1)(b) GDPR.
For other general communications, processing may be based on our legitimate interest in receiving and responding to enquiries pursuant to Article 6(1)(f) GDPR.
Both Isabel Drasl and Christina Lao may access and respond to Drop Together enquiries as part of our joint operation of Drop Together.
Please do not submit sensitive or confidential information through the general contact form unless it is necessary for your enquiry.
5. SQUARESPACE ANALYTICS
We use Squarespace Analytics to understand how visitors use our website and how our content performs.
Depending on your cookie preferences and the functionality provided by Squarespace, this may involve information such as:
browser, network and device information;
referring website;
pages visited;
IP address;
interactions with the website;
timestamps; and
information relating to website traffic and visitor sessions.
We use this information to understand matters such as visits, pageviews, traffic sources and engagement with our website.
Squarespace uses analytics and performance cookies for certain analytics functionality.
Non-essential analytics and performance cookies are restricted on our website and are only used after you have provided the relevant consent through our cookie settings.
The legal basis for processing associated with these non-essential analytics and performance cookies is your consent pursuant to Article 6(1)(a) GDPR.
If you decline non-essential cookies, you can continue to use our website. Certain analytics information available to us may then be less complete.
We do not currently use Google Analytics, Meta Pixel or comparable third-party advertising or marketing tracking technologies on this website.
We have also disabled the Squarespace Activity Log.
6. COOKIES AND COOKIE CONSENT
Our website uses cookies and similar technologies.
Necessary Cookies
Certain cookies and similar technologies are necessary for the secure operation and basic functionality of the website.
Where these technologies are technically necessary to provide the website or functionality requested by you, they may be used without consent where permitted by applicable law.
Analytics and Performance Cookies
Squarespace also provides analytics and performance cookies that help us understand how visitors use our website.
These cookies are treated as non-essential on our website and are restricted unless you consent to their use.
Depending on Squarespace's current technology and configuration, analytics cookies may be used to identify unique visitors, understand visitor sessions and generate website-usage statistics.
Your Cookie Choices
When you visit our website, our cookie banner allows you to:
Accept all — allow non-essential analytics and performance cookies;
Decline all — continue with essential cookies only; or
Manage cookies — manage your available cookie preferences.
You can also use the Cookie Preferences option on our website to review or change your choice later.
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before your consent was withdrawn.
7. VIDEO CONTENT
Videos displayed on our website are uploaded directly through Squarespace rather than embedded through external video platforms such as YouTube or Vimeo.
Squarespace may process technical information when this content is delivered to your device.
We do not currently use YouTube or Vimeo embeds on this website.
8. EXTERNAL LINKS AND SOCIAL MEDIA
Our website may contain links to external websites and social-media platforms, including Instagram.
These are ordinary external links. We do not currently embed an Instagram feed or Instagram posts directly into the Drop Together website.
When you choose to follow an external link, you leave our website. The operator of the external website or platform may then process personal data independently in accordance with its own privacy policy.
We do not control the independent processing carried out by those external websites and platforms.
9. SERVICE PROVIDERS AND RECIPIENTS
Personal data may be processed by service providers where this is necessary to operate our website or business.
This currently includes, in particular, Squarespace, which provides our website platform, hosting, website forms and analytics infrastructure.
Other technical service providers may process information where necessary to provide communications or infrastructure used by us.
Where a service provider processes personal data on our behalf, we take appropriate steps to ensure that the processing is subject to applicable data-protection requirements.
We do not sell your personal data.
10. INTERNATIONAL DATA TRANSFERS
Some service providers involved in operating our website may process personal data outside Austria or the European Economic Area.
Where personal data is transferred outside the EEA, an appropriate transfer mechanism under Chapter V GDPR is used where required.
Depending on the recipient and destination, this may include an adequacy decision of the European Commission or appropriate safeguards such as Standard Contractual Clauses.
Further information regarding Squarespace's international data processing is available in Squarespace's Privacy Policy.
11. STORAGE AND RETENTION
We retain personal data only for as long as necessary for the purpose for which it was collected or for as long as required by applicable law.
Information relating to an enquiry may be retained for as long as reasonably necessary to respond to and manage that enquiry.
Where an enquiry develops into a contractual or business relationship, relevant information may be retained for the duration of that relationship and for applicable statutory retention periods afterwards.
Cookie and technical information may be retained for the periods applicable to the respective technology and processing purpose.
When personal data is no longer required and there is no legal basis requiring or permitting continued retention, it will be deleted or anonymised as appropriate.
12. YOUR RIGHTS UNDER THE GDPR
Subject to the requirements and limitations of applicable law, you have the right to:
request information about and access to your personal data (Article 15 GDPR);
request correction of inaccurate or incomplete personal data (Article 16 GDPR);
request deletion of your personal data (Article 17 GDPR);
request restriction of processing (Article 18 GDPR);
receive certain personal data in a portable format (Article 20 GDPR);
object to certain processing based on legitimate interests (Article 21 GDPR); and
withdraw your consent at any time where processing is based on consent (Article 7(3) GDPR).
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
To exercise your rights or ask a question regarding your personal data, contact:
As Isabel Drasl and Christina Lao act as joint controllers for the relevant Drop Together processing, you may exercise your rights against either controller.
13. RIGHT TO LODGE A COMPLAINT
If you believe that the processing of your personal data infringes applicable data-protection law, you have the right to lodge a complaint with a competent supervisory authority.
In Austria, the competent supervisory authority is:
Österreichische Datenschutzbehörde
Austrian Data Protection Authority
Austrian Data Protection Authority
14. DATA SECURITY
We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
Our website uses encrypted HTTPS/TLS connections to protect information transmitted between your browser and the website.
No method of electronic transmission or storage can guarantee absolute security.
15. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy if the way we operate our website changes, if we introduce or remove services or technologies, or if applicable legal requirements change.
The current version will be published on this website.
If we introduce additional technologies such as Google Analytics, Meta Pixel, newsletter software, booking systems or third-party embeds in the future, we will review this Privacy Policy and our cookie-consent settings and update them where necessary.
Last updated: 5 October 2026
CONTACT
Do you have any questions? We’re looking forward to hearing from you!