Privacy Policy
Version: 15 October 2026 (Rev. 11)

1 Controller

Bodyfit Handels KG
Brand: The Virtù Line
Wiener Straße 190, 4020 Linz, Austria
Phone: +43 5356 90990
Email: info@bodyfit-shop.at
Authorised representative: Daniel Hofer (general partner)

2 Data protection officer

Due to the nature and scope of our data processing, we are not obliged to appoint a data protection officer pursuant to Art. 37 GDPR. Please send data protection enquiries directly to info@bodyfit-shop.at.

3 General information on data processing

We process personal data exclusively on the basis of the statutory provisions, in particular the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). Processing only takes place if there is a legal basis under Art. 6 (1) GDPR:

(a) – consent of the data subject
(b) – performance of a contract or pre-contractual measures
(c) – compliance with a legal obligation
(f) – legitimate interests, unless overridden by the interests of the data subject

Where we rely on Art. 6 (1) (f) GDPR for processing, our legitimate interest is stated in the respective section.

4 Accessing the website and server log files

When you simply access the website, technically necessary data is collected: IP address, date and time, amount of data transferred, source of the request, browser used, operating system and language.

Legal basis: Art. 6 (1) (f) GDPR.
Legitimate interest: ensuring the stable operation of the website, detecting and defending against attacks.
Storage period: a maximum of 14 days, followed by deletion or anonymisation.

5 Hosting and shop system – Shopify

This website is operated on the Shopify platform (Shopify International Limited, 2nd Floor, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify processes personal data on our behalf to provide the shop, process orders and ensure availability. Data may be transferred to the USA and Canada; Shopify is certified under the EU-US Data Privacy Framework.

Legal basis: Art. 6 (1) (b) GDPR and Art. 6 (1) (f) GDPR (legitimate interest: provision of a stable, secure shop system).
Details: shopify.com/legal/privacy.

5.1 Shopify Network Intelligence

Within the Shopify platform, we use centrally provided marketing, recommendation and optimisation functions, collectively referred to as "Shopify Network Intelligence". These include in particular automated reminders of incomplete orders (see section 6b), Shop Campaigns, Audiences, review management and the sender configuration for Shopify Email.

Data processed: aggregated order, reach and behavioural data within the Shopify network, insofar as required for the respective function.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in optimising sales and marketing processes and in providing up-to-date e-commerce functions).

Third-country transfer: takes place within the processing relationship with Shopify described in section 5 (USA and Canada, EU-US Data Privacy Framework or adequacy decision for Canada).

Objection: via the privacy settings in the Shopify customer account and on request at info@bodyfit-shop.at.

6 Order processing

When you place an order, we process the data necessary to perform the contract: first and last name, delivery and billing address, email address, telephone number, order contents, payment data.

Legal basis: Art. 6 (1) (b) GDPR.
Retention period: seven years pursuant to Section 132 Austrian Federal Fiscal Code (BAO) and Section 212 UGB, followed by deletion.
Consequences of not providing data: providing the mandatory information above is necessary to conclude and perform the purchase contract (Art. 13 (2) (e) GDPR). Without this data, the purchase contract cannot be concluded or performed.

6a Gift cards for third parties

When you purchase a gift card for another person, we process the recipient data you provide (name or short name, email address and any personal message) solely to send the gift card and the message to the recipient.

Legal basis: Art. 6 (1) (b) GDPR (performance of the contract with you) and Art. 6 (1) (f) GDPR (legitimate interest in completing the gift).

The recipient data is not used for any other purpose – in particular not for advertising. Should the recipient object to the processing, please forward this to us at info@bodyfit-shop.at; we will then delete the data without delay.

6b Reminders of incomplete orders

If you have entered your email address during the ordering process but have not completed the order, our shop system may automatically send you a reminder of your open shopping cart.

Data processed: email address, contents of the shopping cart (selected products, variants, quantities), any delivery and billing address entered, subtotal, time of abandonment.

Legal basis: your consent given during the ordering process pursuant to Art. 6 (1) (a) GDPR and Section 174 Austrian Telecommunications Act (TKG). The reminder is only sent if you have expressly consented in the checkout to the use of your contact details for reminders and marketing purposes. Without consent, no reminder is sent.

You can object to the further use of your data for this purpose at any time with effect for the future by replying to the reminder email or contacting us informally at info@bodyfit-shop.at. The lawfulness of the processing carried out until withdrawal remains unaffected (Art. 7 (3) GDPR).

Storage period: incomplete shopping cart data is stored in our shop system for a maximum of 90 days and then automatically deleted, unless a contract is concluded from the order.
Recipients of the data: exclusively us as the controller and Shopify as the processor within the hosting and shop system described in section 5.

7 Payment service providers

All card and account data is transmitted in encrypted form directly to the respective payment service provider during the ordering process. We ourselves do not receive or store complete card numbers, CVV codes or bank access data. Payments are processed exclusively via providers certified under the Payment Card Industry Data Security Standard (PCI DSS).

We use the following payment service providers. Data processing is based in each case on Art. 6 (1) (b) GDPR.

Shopify Payments – Shopify International Limited, Dublin, Ireland. Processes credit and debit card payments (Visa, Mastercard, American Express, Maestro) and, depending on the device, Apple Pay and Google Pay. Data transmitted: name, billing address, card and transaction data.
PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. When paying via PayPal, the data required for processing is transmitted to PayPal.
Klarna – Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden. If you choose a Klarna payment method (invoice, instalments), Klarna transmits the data required for identity and credit checks to credit agencies (in Austria including KSV1870, CRIF GmbH; in Germany including SCHUFA Holding AG). On the basis of this data, Klarna makes an automated individual decision within the meaning of Art. 22 GDPR on accepting the order with the chosen payment method. You have the right to request a review of this automated decision by a natural person at Klarna and to express your point of view. Details and privacy information: klarna.com/at/datenschutz.
Prepayment / bank transfer – made manually to our business account at Raiffeisenlandesbank Oberösterreich AG. No data is transmitted to third-party service providers.

Strong customer authentication (SCA). For online payments by card or comparable means of payment, strong customer authentication is required in most cases under the EU Payment Services Directive (PSD2) and the Austrian Payment Services Act 2018 (ZaDiG 2018). In addition to the card or account information, your payment is confirmed by a second independent procedure – for example via a confirmation app, SMS code or biometric procedure of your card issuer or financial institution. Authentication takes place directly between you and your financial institution or the responsible payment service provider; we ourselves do not receive any authentication data.

Legal basis: Art. 6 (1) (c) GDPR in conjunction with Section 87 ZaDiG 2018 and Delegated Regulation (EU) 2018/389 (RTS on SCA).

8 Shipping service providers

For delivery, we transmit name, delivery address and, where applicable, email or telephone number to the parcel or freight service provider commissioned in each case (e.g. Österreichische Post AG, DHL, GLS, DPD and freight partners for large equipment).

Legal basis: Art. 6 (1) (b) GDPR.

9 Cookies and consent management

When you access the website, technically necessary cookies are set (shopping cart, session management, security, language selection).

Legal basis: Art. 6 (1) (f) GDPR.
Legitimate interest: ensuring the basic functions of the shop.

Non-essential cookies and tracking technologies are only loaded after your active consent. Consent is managed via the cookie banner integrated in Shopify and Shopify's associated Customer Privacy API. This ensures that third-party scripts – in particular analytics and advertising cookies – are only executed after your consent. You can withdraw your consent at any time via the footer link "Cookie preferences".

Legal basis: Art. 6 (1) (a) GDPR and Section 165 (3) TKG.

The following tools are only loaded with active consent:

Shopify Analytics – reach analysis within the Shopify platform. Provider: Shopify International Ltd. Storage period up to 24 months.
Google Analytics 4 – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Web analytics service for evaluating page views, time spent, user interactions, device information and conversion and e-commerce data (purchases, cart actions). Our measurement ID: G-RLRRXJ181N. IP addresses are processed in truncated form. Cookie storage period up to 24 months. Transfer to the USA possible (EU-US Data Privacy Framework). You can additionally deactivate tracking via the browser add-on tools.google.com/dlpage/gaoptout.
Google Tag (Google & YouTube app) – Google Ireland Limited. Overarching tag container (tag ID GT-NF7F9H4W) which, together with Google Analytics 4, enables the connection to other Google services (Google Merchant Center, possibly Google Ads). Storage period up to 24 months. Transfer to the USA possible (EU-US Data Privacy Framework).
Meta Pixel (Facebook & Instagram) – Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. Conversion tracking, retargeting for advertisements on Facebook and Instagram. Storage period up to 180 days. Transfer to the USA possible (EU-US Data Privacy Framework). For the integration of Facebook and Instagram Shopping as a sales channel and joint controllership under Art. 26 GDPR, see section 15.3.

10 Bot protection and security

In the login and ordering process, we use Shopify captcha mechanisms to protect the website against automated requests, spam and attacks. Technical data is processed (IP address, browser information, mouse pointer and keyboard interactions).

Legal basis: Art. 6 (1) (f) GDPR.
Legitimate interest: protecting the website infrastructure and ordering processes against misuse.

11 Functional apps and processors

For the operation of the shop, we use the following applications, which process personal data on our behalf:

Translate & Adapt – translation of shop content (Shopify's own app).
Shopify Email (Messaging) – sending emails to customers as part of order processing.
Google & YouTube (sales channel app) – Shopify integration by Google Ireland Limited. Establishes the connection between our shop and Google services (Google Analytics 4, Google Merchant Center, possibly Google Ads). Processes product information and aggregated order data for product synchronisation, conversion measurement and listing maintenance.
Sufio – creation and sending of invoices. Provider: Sufio s.r.o., Bratislava, Slovakia (EU). Processes the data required for invoicing (name, billing address, VAT ID if applicable, order and payment data). Additional legal basis: Art. 6 (1) (c) GDPR (tax and commercial law obligations).
Matrixify – import and export of shop data (products, orders, customers) for data maintenance. Provider: ITissible, SIA, Kuģu iela 28 – 5, Riga, LV-1048, Latvia. Import and export files are stored with Amazon Web Services in the USA; the transfer is based on EU Standard Contractual Clauses (Art. 46 GDPR). Deletion no later than one month after uninstalling the app or on our instruction.
Shopify Inbox (chat) – chat on our website. Provider: Shopify International Limited, Ireland (see section 5). We process the messages you enter, your name and email address if provided, and technical data to assign the conversation. We store chat histories like other enquiries (see section 13).

Legal basis in each case Art. 6 (1) (b) and (f) GDPR.
Legitimate interest: proper handling of business processes and multilingual provision of our offering. Data processing agreements pursuant to Art. 28 GDPR are in place with all processors.

11.1 Electronic withdrawal function (EU withdrawal button)

To fulfil our statutory obligations under Section 13a FAGG and Directive (EU) 2023/2673, we provide an electronic withdrawal function on our website through which you can declare your withdrawal directly online. To operate this function, we use the Shopify application "Revoq – EU Withdrawal Button".

Provider and processor: Jonas Busch (sole trader), email: hello@buschbytes.com, website: https://www.consumer-withdrawal.eu. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider; processing takes place exclusively on our instructions.

Purpose: receipt and processing of your electronic declaration of withdrawal, sending the legally required acknowledgement of receipt on a durable medium (by email, with date and time of receipt) and documentation and administration of the withdrawal process.

Data processed: name, email address, order number, date and time of the declaration of withdrawal and its confirmation, processing status, language preference, where applicable the items affected by the withdrawal and a voluntary comment, technical identifiers for assignment to your order (Shopify order and customer ID) and metadata on sending the confirmation email. Your IP address is processed only temporarily to prevent misuse (spam protection) and is not stored permanently.

Legal basis: Art. 6 (1) (c) GDPR (compliance with a legal obligation in conjunction with Section 13a FAGG) and Art. 6 (1) (b) GDPR (performance of the contractual or pre-contractual reversal); for the temporary processing of the IP address Art. 6 (1) (f) GDPR (legitimate interest in preventing misuse).

Sub-processors: to provide the function, the provider uses the following sub-processors:

Supabase Pte. Ltd – database hosting – Frankfurt (Germany), EU
Fly.io Inc. – application and server hosting – Amsterdam (Netherlands) and Frankfurt (Germany), EU
Resend Inc. (Plus Five Five, Inc.) – sending the acknowledgement of receipt – Ireland (EU); EU-US Data Privacy Framework, supplemented by EU Standard Contractual Clauses
Sentry (Functional Software Inc.) – technical error monitoring (without personal end-customer data) – Frankfurt (Germany); EU-US Data Privacy Framework, supplemented by EU Standard Contractual Clauses
Crisp IM SAS – merchant-side support chat (without end-customer data) – France, Netherlands and Germany, EU
Shopify Inc. – access to order data to assign the withdrawal – Canada; EU adequacy decision, supplemented by EU Standard Contractual Clauses

Third-country transfer: processing essentially takes place within the EU/EEA (infrastructure in Frankfurt and Amsterdam). Insofar as individual sub-processors process data outside the EU/EEA, an adequate level of data protection is ensured by an adequacy decision, the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

Storage period: the data processed in the application is automatically deleted after 90 days; after the use of the application ends, within 30 days. Statutory retention obligations for the documents underlying the order remain unaffected.

12 Customer account

You can voluntarily create a customer account. The data stored there is used for order history, address management and simplified order processing.

Legal basis: Art. 6 (1) (b) GDPR. You can delete the account yourself at any time or have it deactivated by sending us a message.

13 Contacting us

If you contact us by email, phone or contact form, your details are processed to handle your enquiry. Enquiries submitted via our contact and enquiry forms are stored and processed in our CRM system HubSpot (HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA; acting as our processor under a contract pursuant to Art. 28 GDPR). Transfers to the USA are based on the EU-US Data Privacy Framework or Standard Contractual Clauses (see section 14).

Legal basis: Art. 6 (1) (b) GDPR for contract-related enquiries, otherwise Art. 6 (1) (f) GDPR.
Legitimate interest: prompt response to enquiries.
Storage period: until the enquiry has been fully processed, for a maximum of three years.

13.1 No disclosure to distribution partners

The Virtù Line is sold exclusively by Bodyfit Handels KG. We handle your enquiries ourselves; they are not forwarded to distribution partners.

14 Recipients and third-country transfers

Data is only transferred to third countries (in particular the USA and Canada) to recipients with whom Standard Contractual Clauses pursuant to Art. 46 GDPR are in place or who are certified under the EU-US Data Privacy Framework. On request, we will provide you with a copy of the safeguards.

15 Sales channels and third-party platforms

In addition to our online shop www.virtu-line.com, we offer our products via further sales channels provided or integrated by Shopify. When these channels are used, personal data of visitors and customers is also processed by the respective platform operator. Below we inform you about the main data flows:

15.1 Shopify Shop app

Provider: Shopify Inc., 151 O'Connor Street, Ottawa, Ontario, K2P 2L8, Canada (for customers in the European Economic Area: Shopify International Ltd., 2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland).
Purpose: displaying our products in the Shopify Shop app, processing orders, order tracking, recognising the customer via their Shopify account.
Data processed: order data, contact data, IP address, device and browser information, and data linked to the Shopify account where applicable.
Legal basis: Art. 6 (1) (b) GDPR (performance of contract) and Art. 6 (1) (f) GDPR (legitimate interest in providing efficient sales channels).
Third-country transfer: transfers to third countries (Canada, USA) are based on an EU adequacy decision (Canada) or Standard Contractual Clauses and – where applicable – the EU-US Data Privacy Framework.

15.2 Agentic Storefronts (AI sales channels)

We participate in the Shopify programme "Agentic Storefronts". Through this programme, AI-based applications and platforms can process our product data and – in the event of an actual order placed via a partner – also receive personal customer data.

Currently active partners:

ChatGPT – OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA (for customers in the European Economic Area: OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland).
Microsoft Copilot – Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA (for customers in the European Economic Area: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland).
Shop – Shopify Inc., 151 O'Connor Street, Ottawa, Ontario, K2P 2L8, Canada (for customers in the European Economic Area: Shopify International Ltd., 2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland).

Purpose: discoverability of our products in AI-based search and chat services, product recommendations, search and ranking functions and – if a customer initiates an order via an Agentic Storefronts partner – the initiation, processing and fulfilment of that order, transmission of order status updates, fraud prevention and compliance with legal obligations.

Data processed:

Product information from the Shopify Catalog (titles, descriptions, images, prices, variants, availability, shipping information) and the content of our shop policies.
Only in the event of an order placed via a partner: the personal data required for order processing (name, delivery and billing address, email address, telephone number, order contents, payment metadata, order status). Complete card and payment data continues to be processed exclusively in accordance with section 7.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in providing additional sales and visibility channels, in particular in the growing AI-based discovery market for high-quality Pilates and training equipment). For processing a specific order via a partner, additionally Art. 6 (1) (b) GDPR (performance of contract).

Responsibility structure: in providing the programme, Shopify processes the data on our behalf as a processor pursuant to Art. 28 GDPR. The respective participating partners process the data transmitted to them as independent controllers within the meaning of Art. 4 (7) GDPR or – insofar as purposes and means are determined jointly – as joint controllers pursuant to Art. 26 GDPR.

Third-country transfer:

USA (OpenAI, Microsoft): transfers are based on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), insofar as the respective recipient is certified. Alternatively, EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914 apply in conjunction with the Shopify data processing agreement (https://www.shopify.com/legal/dpa) and the partners' privacy policies.
Canada (Shopify Inc.): transfers are based on the EU adequacy decision for Canada pursuant to Art. 45 GDPR (Decision 2002/2/EC of 20 December 2001).

Further information:

Additional terms for Agentic Storefronts: https://www.shopify.com/legal/terms-agentic-storefronts
OpenAI privacy policy: https://openai.com/policies/privacy-policy
Microsoft privacy statement: https://privacy.microsoft.com
Shopify privacy policy: https://www.shopify.com/legal/privacy

Objection and opt-out: you have the right to object to the processing of your personal data (Art. 21 GDPR). We can deactivate the transmission of your product and order data to individual or all Agentic Storefronts partners; we manage the corresponding settings in the Shopify admin. Please send requests to info@bodyfit-shop.at with the keyword "Agentic Storefronts objection". Note: even after deactivation, data already transmitted to a partner may continue to be stored in accordance with the partner's own retention and deletion periods.

Storage period: with us in accordance with section 6 (order processing) and the tax and commercial retention periods; with the partners in accordance with their respective privacy policies.

15.3 Meta platforms (Facebook, Instagram, Meta Pixel)

Provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland (joint controllership with Meta Platforms Inc., 1601 Willow Road, Menlo Park, CA 94025, USA).
Purpose: displaying our products on Facebook and Instagram (shopping function), reach analysis, conversion tracking, targeted advertising where applicable.
Data processed: IP address, device and browser information, pseudonymous identifiers (e.g. cookies, fingerprint), interactions with our content, order data where applicable.
Legal basis: Art. 6 (1) (a) GDPR (consent via our consent banner). Without your consent, no data is transmitted to Meta beyond the technical data required for provision. You can withdraw your consent at any time via the cookie preferences.
Joint controllership: for processing in connection with Facebook Insights and the Meta Pixel, there is joint controllership between us and Meta pursuant to Art. 26 GDPR. The agreement is available at https://www.facebook.com/legal/controller_addendum.
Third-country transfer: transfers to the USA are based on Standard Contractual Clauses and – where applicable – the EU-US Data Privacy Framework.

15.4 Google platforms (Search, Shopping, Merchant Center, Business Profile)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for customers in the European Economic Area); affiliated recipients: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Purpose: discoverability of our products and locations via Google services (Google Search, Google Shopping, Google Maps, Google Business Profile), free product listings and reach and indexing analysis via Google Search Console.
Data processed: product information, business data of our showrooms (address, opening hours, phone, photos, posts), aggregated search queries and click/impression data (Google Search Console), statistics on profile views, calls and directions (Google Business Profile). Personal web analytics data is only processed after consent via our consent banner and Google Analytics 4 (see section 9).
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in providing additional sales and visibility channels for our showrooms and products). For personal web analytics, additionally Art. 6 (1) (a) GDPR (consent).
Third-country transfer: transfers to the USA are based on Standard Contractual Clauses and – where applicable – the EU-US Data Privacy Framework. Google is certified under the EU-US Data Privacy Framework.

15.5 Microsoft Bing Webmaster Tools

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
Purpose: reach, indexing and performance analysis of our presence in the Bing search engine.
Data processed: exclusively aggregated, not directly personal data on search queries, impressions and clicks.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in analysing our visibility in search engines).
Third-country transfer: transfers to the USA are based on Standard Contractual Clauses and – where applicable – the EU-US Data Privacy Framework.

15.6 Bio Sites link page (Squarespace) and sign-up for news

Provider: Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, D08N12C, Ireland (acting as our processor).
Purpose: our link page bio.site/thevirtuline (linked from our social media profiles) leads to our shop and contains a “Stay up to date” form with which you can sign up for information about new products, showroom dates and offers from The Virtù Line.
Data processed: the details you enter (name, e-mail address, phone number), time of sign-up and technical data when the page is accessed (IP address, browser information). The sign-up data is transferred to our CRM system HubSpot (HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA; acting as our processor under a contract pursuant to Art. 28 GDPR), where we manage it for sending news.
Legal basis: Art. 6 (1) (a) GDPR and § 174 of the Austrian Telecommunications Act 2021 (your consent by submitting the form). You can withdraw your consent at any time with effect for the future, e.g. by e-mail to info@bodyfit-shop.at or via the unsubscribe link in every message.
Storage period: until you withdraw your consent; the data is then deleted unless a statutory retention obligation applies.
Third-country transfer: a transfer to Squarespace, Inc. or HubSpot, Inc. in the USA is possible; in each case it is based on the EU-US Data Privacy Framework or Standard Contractual Clauses.

15.7 Data subject rights

Your data subject rights for the processing described in this section are set out in section 16. Please send requests to info@bodyfit-shop.at.

16 Your rights

You have the right to:

access (Art. 15 GDPR)
rectification (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
object (Art. 21 GDPR)

You can withdraw any consent given at any time with effect for the future. The lawfulness of the processing carried out until withdrawal remains unaffected (Art. 7 (3) GDPR).

Right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

17 Data security

We take technical and organisational measures in accordance with Art. 32 GDPR to protect your data against loss, manipulation and unauthorised access. These include in particular:

Transport encryption: TLS (Transport Layer Security, version 1.2 or higher) for all data transmission — recognisable by the https in the address bar and the padlock symbol in your browser.
Encrypted storage of sensitive data: passwords are only stored as cryptographic hashes. Complete card and payment data is not processed by us, but directly by the PCI DSS certified payment service providers (see section 7).
Access control: access to personal data only by authorised staff, role-based permissions and regular review of access rights.
System maintenance: regular security updates and patches of the software components used within the Shopify platform.
Data backup: automated backups within the Shopify platform infrastructure.
Awareness: training and contractual obligation of our staff to treat personal data confidentially.

Please note that complete security of data transmission over the internet cannot be technically guaranteed. We additionally recommend using secure passwords and keeping your access data carefully confidential.

18 Storage period and deletion

We only store your personal data for as long as is necessary for the respective processing purpose or as required by statutory retention obligations. In detail:

Server log files: a maximum of 14 days, followed by deletion or anonymisation (see section 4).
Order data / contract processing: seven years after complete processing of the order pursuant to Section 132 BAO and Section 212 UGB (tax and commercial retention obligations); followed by deletion.
Shopping cart data for abandoned orders: a maximum of 90 days, unless a contract is concluded (see section 6b).
Recipient data for gift cards for third parties: until the gift card has been sent, followed by deletion (see section 6a).
Contact enquiries: until the enquiry has been fully processed, for a maximum of three years (see section 13).
Customer account data: until the account is deleted by you or at your request, subject to statutory retention obligations (see section 12).
Data from sales channels and third-party platforms: with us in accordance with the periods above; with the respective partners in accordance with their privacy policies (see section 15).
Data of the electronic withdrawal function: a maximum of 90 days in the provider's application, followed by automated deletion (see section 11.1).
Limitation periods: contractual and pre-contractual data three years from the end of the year in which the claim arose (general limitation period, Section 1489 ABGB), unless longer retention obligations apply.

After the respective period has expired, the data is routinely deleted or anonymised, unless longer processing is necessary or required by law.

19 Necessity of providing data

The provision of your personal data is partly required by law (in particular by tax and commercial regulations under the BAO and UGB) or necessary for the contract.

To conclude a purchase contract, we need the mandatory information listed in section 6 (first and last name, delivery and billing address, email address, order contents, payment data). Without this data, the purchase contract cannot be concluded with you and your order cannot be processed.

The provision of further data — for example for a voluntary customer account, a contact enquiry or marketing consents — is voluntary. Not providing it has no effect on the conclusion of the contract, but may mean that we cannot provide you with certain information, offers or service functions.

20 Language versions

This privacy policy is available in German and has been translated into English. In the event of any discrepancy between the language versions, the German version shall prevail.

21 Changes to this privacy policy

We reserve the right to amend this privacy policy if this becomes necessary due to new technologies or changes in the legal situation. The current version is always available on this page.