Privacy policy

⚠️ Placeholder – replace this text with a legally reviewed text before going live (e.g. WKO templates or a generator; ask a lawyer if in doubt).

This English version is provided for convenience only. The German version is the legally binding one for contracts under Austrian law.

[Controller pursuant to the GDPR with contact details]

Data processed

When you place an order, we process your email address, order data and payment information (via Stripe) to perform the contract (Art. 6(1)(b) GDPR).

Fraud prevention (IP address and device fingerprint)

When you start a checkout, we process your IP address and a technical fingerprint of your device/browser. The fingerprint is a SHA-256 hash calculated in your browser from technical characteristics (e.g. graphics/canvas rendering, screen resolution, time zone, language settings, installed fonts, number of processor cores); it does not contain your name or other content. We also process the IP address and this fingerprint when you sign in to your customer account. The purpose is solely to prevent fraud and misuse (e.g. chargeback fraud, repeat orders by blocked buyers): we compare these values with our block list and store them with your order or sign-in record. The legal basis is our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR). The data is not used for advertising, profiling or tracking across other websites and is not shared with third parties for those purposes. Sign-in records are deleted after 90 days; values stored with an order are kept for as long as the order data (statutory retention periods). Values of blocked buyers remain on the block list until the block is lifted. You can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

Processors

Stripe (payments), Supabase (database/hosting), Cloudflare (hosting), possibly Resend (email delivery). [Add details, third-country transfers, retention periods]

Your rights

Access, rectification, erasure, restriction, data portability, objection; complaint to the Austrian Data Protection Authority (dsb.gv.at).