Legal information

Datenschutz

What data we process, why, for how long, and who we share it with.

Revision 1.0 · in effect from [date]

1. 01

   Who we are

   The controller responsible for processing (Verantwortlicher) is [company name, address, e-mail]. We do not appoint a data protection officer — our processing does not fall under the cases of mandatory appointment under Art. 37 GDPR.

2. 02

   What data

   Account: e-mail, password hash, name, language. Orders: delivery and billing address, order contents and status, batch number. Payment: payment status and the last digits of the card (full payment data is processed by Stripe; we do not see or store it). Enquiries: the text of the message. Technical: IP address, browser type, necessary cookies.

3. 03

   Why and on what basis

   Performance of a contract (Art. 6(1)(b) GDPR) — orders, delivery, account, warranty. Consent (Art. 6(1)(a) GDPR) — newsletter, optional cookies. Legitimate interest (Art. 6(1)(f) GDPR) — fraud prevention, website security. Legal obligation (Art. 6(1)(c) GDPR) — accounting and taxes.

4. 04

   Who receives it

   Only contracted processors: payments — Stripe; e-mail — [Resend]; hosting and database — [Vercel, Supabase]; delivery — [carrier] (recipient's name and address). Data is never sold or passed on to advertising networks.

5. 05

   Transfers outside the EEA

   Possible at the level of our processors; the legal basis is an EU Commission adequacy decision or Standard Contractual Clauses (SCC). The current list of processors is set out in section 4.

6. 06

   Retention periods

   Account — until deletion. Orders, invoices and related correspondence — [7] years, as required by Austrian accounting and tax law. Enquiries without an order — 2 years. Newsletter consent and its confirmation log — until withdrawal plus 3 years as evidence.

7. 07

   Your rights

   Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), and withdrawal of consent at any time (7(3)) without affecting the lawfulness of processing carried out before the withdrawal. Data export and account deletion are available directly in your account. Response time — 1 month.

8. 08

   Complaint

   Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb.gv.at.

9. 09

   Children

   This site is not intended for persons under 16 years of age; we do not knowingly collect their data.

10. 10

    Security

    TLS across the entire site, passwords stored only as hashes, restricted access to data, payments through a PCI DSS certified provider.

11. 11

    Changes

    We notify you of material changes by e-mail or a clearly visible notice; the revision date is shown in the page header.

This site is not intended for persons under 16 years of age. TLS is used across the entire site, and passwords are stored only as hashes.