Your Vienna DSG audit, passed first try
You need a WordPress build that survives an Austrian DSG audit on day one, with every plugin inventoried against §§ 26-37 obligations and a cookie banner that holds up under a Datenschutzbehörde review. We deliver that package: audit-ready WordPress, documented technical and organisational measures, and a TKG 2021 § 165 compliant consent layer that names the right data controller.
The Austrian rulebook touching the technical layer covers DSG (Datenschutzgesetz) §§ 26-37, TKG 2021 § 165 for cookie and tracker consent, Datenschutzbehörde enforcement decisions that bind webshop and lead-gen operators, and RTR oversight for telecom-adjacent services. Knowing where these rules end and pragmatic engineering begins is what separates a Vienna-relevant developer from someone who just speaks WordPress.
| Regulation | What it covers | What we do |
|---|---|---|
| DSG §§ 26-37 | National data protection alongside DSGVO | Documented processing register, 2FA on wp-admin, encrypted backups |
| TKG 2021 § 165 | Cookie and tracker consent for electronic communications | Server-side consent log, banner audited against DSB decisions |
| Datenschutzbehörde decisions | Enforcement precedent on webshops and lead-gen | DSB-aware form flows, Google Fonts hosted locally, no silent loaders |
WordPress development for Vienna and all of Austria: your external digital engine
The Austrian economy runs on a dense KMU sector regulated under WKO (Wirtschaftskammer Österreich) and a Vienna start-up scene that frequently leans on FFG R&D grants for digital R&D. Add the alpine tourism industry, the financial cluster around Wiener Börse, and a public sector that contracts under DSGVO plus the national Datenschutzgesetz (DSG). Every one of these audiences arrives at WordPress with non-negotiable requirements around uptime, data residency, and consent.
Looking for a competent technical partner for your WordPress project in Vienna, Graz, Linz, Salzburg, or Innsbruck? Tired of agency markup for engineering work that gets outsourced downstream anyway, or freelancers who disappear mid-project?
I am Mariusz Szatkowski, a senior freelance WordPress engineer based in Gdynia, EU. WPPoland is my publication, portfolio, and registered trade name. I work directly with Austrian businesses as an extended technical bench: theme rebuilds, WooCommerce performance audits, plugin development, headless integrations, and the long tail of post-launch maintenance. For scopes that need more than one engineer, I bring in named senior collaborators from a vetted network and you sign one contract.
Our WordPress services
Custom theme development
Custom themes are appropriate when the editorial team needs to publish without filing a developer ticket every time. We build block themes (theme.json driven, FSE-aware) with a pattern library that maps to the brand’s actual content types: Mitarbeiterprofile, Pressemeldungen, Veranstaltungen, Standorte. Where the brand already runs on Adobe CC, we ship the design tokens through a Style Dictionary export so the same colors and spacings drive Figma, the WordPress editor, and the Tailwind config. The result is an editor who can ship a new Standort page in twenty minutes without breaking the layout.
WooCommerce online shops
Austrian e-commerce sits on top of a specific payment stack: EPS Online-Überweisung (operated through STUZZA across the major banks), Klarna AT for invoice and instalments, Sofort/Klarna Pay Now, MasterCard SecureCode and Visa Secure under PSD2 SCA with 3DS2, and AmazonPay where the cart skews toward cross-border retail. We integrate against Mollie, Stripe, and Adyen depending on which acquirer the merchant already has. Shipping wires up to Österreichische Post (with the Post Modul plugin or a custom REST integration for label printing), DHL Austria for parcels above 31.5 kg, and GLS Austria for B2B same-day in the Vienna metro area. Tax configuration covers the 20 % standard USt., 13 % for accommodation and cultural events, and 10 % for groceries, with OSS reporting for cross-border B2C inside the EU.
A representative engagement: a Vienna-based fashion retailer running WooCommerce on a shared host, 30+ active plugins, TTFB 1.8 s on category pages. The fix was unglamorous, autoload prune (Action Scheduler logs were dragging 18 MB of options into every request), object cache via Redis on the same datacenter, and a single product feed query rebuilt as a SQL view. TTFB landed at 600 ms without changing host or theme.
Plugin development
Custom plugins are a last resort, used when no existing plugin maps to the workflow. Typical examples on Austrian projects: a connector to BMD or RZL accounting that pushes WooCommerce orders as draft invoices, a custom REST endpoint feeding a partner network’s product data, or a Gutenberg block library that enforces accessibility per WACA (Web Accessibility Compliance Austria) and BGStG.
Performance optimization
Core Web Vitals are diagnostics, not goals. We measure LCP, INP, and CLS against real Austrian users via the CrUX dataset for the .at domain and add a private RUM stream to fill the long tail. The work is mostly removing weight: deferring third-party scripts (the WKO seal, Wienerlinien feeds, Cookiebot config), serving AVIF behind a CDN with Vienna PoP (Cloudflare or BunnyCDN both have one), and replacing TinyMCE-era patterns with block-based equivalents that do not load 400 kB of legacy JS for a contact page.
Maintenance and support
Maintenance covers the Tuesday Wordfence advisory, the WooCommerce 9.x release that breaks a checkout customisation, and the host migration when World4You sunsets a Plesk node. Plans differ by traffic class and risk profile. We do not bundle “managed hosting”; the merchant chooses Anexia (datacenter Vienna), World4You, easyname, or a Hetzner box in Falkenstein, and we operate against whatever stack is in place.
When WordPress fits the Austrian market, and when it does not
WordPress is the right call for content-led brands, B2B service firms, tourism operators with a CMS-heavy publishing rhythm, and WooCommerce shops doing under roughly 50 k orders per month. PHP 8.3 plus WordPress 6.7 on a 4 vCPU / 8 GB box from Anexia or Hetzner with Redis object cache will hold up to several hundred concurrent checkout sessions before the database becomes the bottleneck.
It is the wrong call for: high-throughput marketplaces (Shopify Plus or a custom Hydrogen build will be cheaper to operate at five-figure daily order counts), publishing operations that need a structured content model with strict editorial workflows (TYPO3 has the better admin UX for that and is what most Austrian government tenders specify), and SaaS dashboards (Next.js with a separate auth provider is the honest answer).
The RTR (Rundfunk und Telekom Regulierungs-GmbH) is the relevant authority on cookie consent enforcement in Austria, and its decisions track the Austrian Data Protection Authority’s interpretation of TTDSG-equivalent rules. Practically: Google Analytics 4 with consent mode v2, server-side tagging where feasible, and a CMP that records consent under DSG Article 96. Cookiebot, Usercentrics, and Borlabs all have configurations that pass an Austrian audit when set up correctly. None of them pass out of the box.
The Austrian multilingual reality
“Mehrsprachig” is not the same problem in Vienna as it is in Berlin. The default editorial language is German with Austrian spelling and vocabulary (DE-AT: Jänner, Feber, Erdäpfel, Marillen, Paradeiser; not the DE-DE Januar/Februar/Kartoffeln/Aprikosen/Tomaten). For tourism, hospitality, and any consumer-facing brand, getting this right is a trust signal, not a stylistic choice.
Beyond DE-AT, the relevant minority languages under the Volksgruppengesetz are Slovenian in southern Carinthia (Kärnten), Hungarian in Burgenland, Croatian also in Burgenland, and Czech and Slovak in Vienna for specific public communications. Few private-sector projects need full localisation into all of these, but tourism boards and public-sector portals usually do.
The technical stack:
- Polylang Pro is our default for two- to four-language sites. Stable, predictable URL structure, low overhead, fine for SEO when hreflang is set on the meta level rather than the plugin’s default JSON output.
- WPML with WPML String Translation and WPML Multilingual CMS when the team needs translation memory, integration with PhraseTMS or memoQ, and a vendor agency editing strings directly through the WordPress dashboard.
- MultilingualPress for multisite topologies, which is how some larger Austrian groups structure separate market sites for AT, DE, CH, and IT/Südtirol.
Translation review workflow we recommend: machine pre-translation through DeepL Pro (German-to-German variant handling is good but not perfect for AT), professional review by a native DE-AT editor, technical QA by the developer to verify slugs, hreflang, and OG tags. We do not deliver English-only content into Polylang and call it multilingual.
Data protection beyond the DSGVO checklist
DSGVO is the framework. The Austrian Datenschutzgesetz (DSG) and the rulings of the Datenschutzbehörde are what determines whether your contact form is actually compliant. Article 32 DSGVO mandates technical and organisational measures appropriate to the risk; for a typical WordPress site that translates into encrypted backups stored in EU-resident object storage (Hetzner Storage Box, OVH Object Storage, or Wasabi Frankfurt), TLS 1.3, MFA on wp-admin, an audit log plugin (Activity Log or WP Activity Log), and a documented Verarbeitungsverzeichnis listing every third-party script that touches the visitor.
For agencies serving regulated sectors (Steuerberater, Rechtsanwälte, medical practices), an additional Auftragsverarbeitungsvertrag (data processor agreement) under §29 DSG is mandatory before we receive admin credentials.
Our development process
Discovery, scoping, build, staging review, launch. We commit to weekly demos in staging from week two onward. Code lives in a private GitHub repo, deployment is automated via GitHub Actions to the staging environment on every push, to production on tag. Staging is a full mirror of production data minus PII, refreshed weekly. Pre-launch, we run Lighthouse, axe-core, and a manual cross-browser pass on the latest Firefox, Chrome, Safari, and Edge, plus iOS Safari and Chrome Android.
Pricing
All pricing is individual and tied to project scope. Fixed-price for defined scope, T&M for ongoing work, monthly retainers for maintenance. Contact us for a no-obligation conversation about your WordPress project in Austria.
