Legal
Privacy policy
Template – have it reviewed before launch. This text is a draft and a convenience translation; the German version is legally binding. Marked placeholders must be replaced with real details and the entire text reviewed by a qualified legal advisor. No guarantee of legal completeness or accuracy is given.
1. Controller
[FIRMENWORTLAUT / NAME DES UNTERNEHMERS], [STRASSE UND HAUSNUMMER], [PLZ] [ORT], Austria
Email: [KONTAKT-E-MAIL]
2. Principles
We process personal data exclusively on the basis of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG), and only to the extent necessary for the respective purpose.
3. Orders
To process your order, we process your name, delivery address, email address, optionally your phone number and order data. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). We retain data relevant for invoicing in accordance with statutory retention obligations (§ 132 BAO, generally 7 years) (Art. 6(1)(c) GDPR).
Disclosure to carriers
For delivery, we pass on your name and delivery address and, where applicable, email/phone to [VERSANDDIENSTLEISTER / CARRIER].
Order emails
Order, shipping and service emails are sent via our email service provider Resend (Resend Inc., USA) on our behalf. Transfers to the USA are based on the EU standard contractual clauses.
4. Payment processing via Stripe
Payments are processed by Stripe Payments Europe, Ltd. (Ireland). You enter payment details exclusively on Stripe's payment page; we do not receive full card details. Legal basis: Art. 6(1)(b) GDPR. More information: stripe.com/at/privacy.
5. Hosting
This website, its database and uploaded product images are hosted by Vercel Inc. (USA) and its infrastructure partners. Technically necessary server log data (e.g. IP address, time, page accessed) is processed. Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR). Transfers to the USA are based on the EU standard contractual clauses (Art. 46(2)(c) GDPR) agreed with Vercel and, where applicable, the EU-US Data Privacy Framework.
6. Local storage and cookies
We store your cart, recently viewed products and your cookie choice in your browser as technically necessary (§ 165(3) TKG 2021). Analytics or marketing services are only loaded after your explicit consent (Art. 6(1)(a) GDPR). You can change your choice at any time via “Cookie settings” in the footer.
Services used only with your consent:
- CARDELUNE analytics (own, first-party): anonymous session ID, pages viewed, device type, country and shop events (product views, cart, checkout) to improve the shop. No IP address is stored. Data is deleted after about 13 months.
7. Newsletter
We do not currently send a newsletter. Sign-up is not possible.
8. Contacting us
If you contact us by email or through the contact form, we process your details (name, email, message and optionally an order number) to handle your enquiry (Art. 6(1)(b) or (f) GDPR). Contact form requests are stored in our customer support system until the enquiry is resolved and any statutory retention periods have expired.
9. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent given. Please contact [KONTAKT-E-MAIL].
If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority (www.dsb.gv.at).
Last updated: 11 November 2026