PRIVACY POLICY

Version: 28.07.2026

PRIVACY POLICY

1 ) Information on the collection of personal data and contact details of the controller within the meaning of the General Data Protection Regulation (GDPR)

STUDIO SOUL COULEUR e.U.

Kärntner Ring 5-7, 1010 Vienna

Email: office@studiosoulcouleur.com

Telephone: +43 664 234 91 72

2) Hosting, shop platform and data collection when visiting our website

We use the services of Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, D08 N12C, Ireland ("Squarespace"), to host and operate this website and the integrated online shop.

When you visit our website for informational purposes only, Squarespace and we process data that your browser automatically transmits to the website server. This may include in particular:

the page or resource accessed,
the date and time of access,
the amount of data transferred,
the source or referrer URL,
the browser and browser version used,
the operating system used,
the IP address of the accessing device, and
technical status, error and security information.

This data is processed for the purpose of providing the website, ensuring its stability and security, detecting technical errors and preventing misuse. The processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the secure, stable and reliable operation of our website.

Squarespace also processes personal data that you provide when using the functions of the website and online shop. This may include, in particular, contact details, customer account data, order and delivery data, payment-related information, messages, form entries and files uploaded for the personalisation of products.

Where processing is necessary to take steps prior to entering into a contract or to perform a contract, including the processing of orders and the provision of shop functions, it is carried out pursuant to Art. 6(1)(b) GDPR.

Where Squarespace services use cookies or comparable technologies that are not technically necessary, the relevant processing takes place only after you have given your consent pursuant to Art. 6(1)(a) GDPR. Further information can be found in the sections on cookies and the Cookie Consent Tool.

We have concluded a data processing agreement with Squarespace. Under this agreement, Squarespace processes personal data for which we determine the purposes and means of processing as a processor acting on our behalf and in accordance with our instructions.

Squarespace may process certain data as an independent controller, in particular where processing is necessary to maintain the security and integrity of its services, to comply with legal obligations or to enforce its contractual terms.

As part of providing its services, Squarespace may use affiliated companies and other service providers located outside the European Economic Area, in particular in the United States. Where personal data is transferred to a third country, the transfer is based, where applicable, on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR.

Personal data processed through Squarespace is stored only for as long as necessary for the respective processing purposes or for compliance with statutory retention obligations. Further information on the processing of personal data by Squarespace can be found in Squarespace's privacy policy.

3) Cookies and comparable technologies

In order to make visiting our website attractive and to enable the use of certain functions, we use so-called cookies and comparable technologies, such as local storage or pixels, on various pages. Cookies are small text files that are stored on your end device. Some of the cookies we use are deleted after the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your end device and enable us or our partner companies to recognise your browser or end device on your next visit (so-called persistent cookies). Persistent cookies are automatically deleted after a predefined period, which may vary depending on the cookie. The respective providers, purposes and storage periods are specified in separate sections below.

When cookies or comparable technologies are used, certain information may be stored on or accessed from your end device. Depending on the technology used, this may include browser and device information, usage data, online identifiers, approximate location data and IP address values.

Some cookies and comparable technologies are technically necessary to enable the transmission of communications or to provide functions expressly requested by you. These include, in particular, technologies required for the operation and security of the website, the shopping cart and checkout process, customer login and the storage of your cookie preferences. The storage of or access to information on your end device for these purposes does not require consent pursuant to Section 165(3) Austrian Telecommunications Act 2021. Where personal data is processed in this context, the processing is carried out pursuant to Art. 6(1)(b) GDPR where it is necessary for the initiation or performance of a contract, or pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the secure, stable and user-friendly operation of our website.

Cookies and comparable technologies that are not technically necessary, in particular those used for analytics, advertising, remarketing or conversion tracking, are used only after you have given your express consent. The legal basis for the storage of or access to information on your end device and the associated processing of personal data is Art. 6(1)(a) GDPR in conjunction with Section 165(3) Austrian Telecommunications Act 2021.

We work with analytics and advertising partners who help us analyse the use of our website and make our online offering more relevant to you. For this purpose, cookies or comparable technologies from partner companies may also be stored on or accessed from your end device. You will be informed separately in the sections below about the providers used, the purposes of processing, the categories of data concerned and the applicable storage periods.

You may decide through the Cookie Consent Tool whether to consent to individual categories of non-essential cookies and comparable technologies. You may withdraw or change your consent at any time with effect for the future via the Cookie Consent Tool available on the website. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Independently of the choices available through the Cookie Consent Tool, you can configure your browser so that you are informed about the setting of cookies and can decide individually whether to accept them, or you can exclude the acceptance of cookies in certain cases or generally. Each browser differs in the way it manages cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings. You can find further information for the respective browsers at the following links:

Internet Explorer / Microsoft Edge: https://support.microsoft.com/help/17442
Firefox: https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop
Chrome: https://support.google.com/chrome/answer/95647
Safari:https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac
Opera: https://help.opera.com/latest/web-preferences/#cookies

Please note that if you block technically necessary cookies, certain functions of our website, particularly customer login, the shopping cart and the checkout process, may be limited or unavailable.

4) Contacting us

4.1 When you contact us (e.g. via contact form or email), personal data is collected. The data collected in the case of a contact form is apparent from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for contacting you and the associated technical administration. The legal basis for processing this data is our legitimate interest in responding to your request pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, an additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted after your request has been finally processed. This is the case if the circumstances indicate that the matter concerned has been conclusively clarified and provided that no statutory retention obligations prevent deletion.

4.2 Our own review reminder

Exclusively on the basis of your express consent pursuant to Art. 6(1)(a) GDPR, we use your email address to send a one-time reminder to submit a review of your order. You may withdraw your consent at any time by sending a message to the controller responsible for data processing.

5) Data processing for contract performance

Contract performance

Pursuant to Art. 6(1)(b) GDPR, personal data is collected and processed if you provide it to us for the performance of a contract. The data collected is apparent from the respective booking form. We store and use the data provided by you for contract performance. After the contract has been fully performed or your customer account has been deleted, your data will be deleted subject to tax and commercial-law retention periods (currently 7 years).

The provision of the personal data required for the conclusion and performance of the contract is contractually necessary. If this data is not provided, this will mean that the contract cannot be concluded or performed.

6) Data processing for order handling

6.1 To the extent necessary for contract performance for delivery and payment purposes, the personal data collected by us is passed on to the commissioned transport company and the commissioned credit institution pursuant to Art. 6(1)(b) GDPR.

For the purpose of handling your order, we also work with the service provider(s) listed below, who support us wholly or partly in performing concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

6.2 We pass on your name and delivery address and, where required for delivery, your email address and telephone number, exclusively for the purpose of delivering goods pursuant to Art. 6(1)(b) GDPR, to Österreichische Post Aktiengesellschaft, Rochusplatz 1, 1030 Vienna, Austria.

6.3 Apple Pay

If you choose the payment method "Apple Pay" provided by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed via the "Apple Pay" function of your end device operating with iOS, watchOS or macOS by charging a payment card stored with "Apple Pay". Apple Pay uses security functions integrated into the hardware and software of your device to protect your transactions. To authorise a payment, you must therefore enter a code previously specified by you and verify it using the "Face ID" or "Touch ID" function of your end device.

For the purpose of payment processing, the information you provide during the order process, together with the information about your order, is transmitted to Apple in encrypted form. Apple then encrypts this data again with a developer-specific key before the data is transmitted to the payment service provider of the payment card stored in Apple Pay for the purpose of carrying out the payment. Encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm successful payment.

If personal data is processed in the transmissions described, processing is carried out exclusively for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR.

Apple retains anonymised transaction data, including the approximate purchase amount, the approximate date and time and information as to whether the transaction was successfully completed. Anonymisation completely excludes any personal reference. Apple uses the anonymised data to improve "Apple Pay" and other Apple products and services.

If you use Apple Pay on the iPhone or Apple Watch to complete a purchase that you made via Safari on the Mac, the Mac and the authorising device communicate via an encrypted channel on Apple's servers. Apple does not process or store any of this information in a format that can identify you personally. You can disable the option to use Apple Pay on your Mac in the settings of your iPhone. Go to "Wallet & Apple Pay" and disable "Allow Payments on Mac".

Further information on data protection with Apple Pay can be found at the following internet address: https://support.apple.com/de-de/HT203027

6.4 Google Pay

If you choose the payment method "Google Pay" provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), payment is processed via the "Google Pay" application on your mobile end device operating with at least Android 4.4 ("KitKat") and equipped with NFC functionality by charging a payment card stored with Google Pay or a payment system verified there (e.g. PayPal). To authorise a payment via Google Pay in an amount exceeding EUR 25.00, your mobile end device must first be unlocked using the verification measure configured in each case (such as facial recognition, password, fingerprint or pattern).

For the purpose of payment processing, the information you provide during the order process, together with the information about your order, is passed on to Google. Google then transmits your payment information stored in Google Pay to the originating website in the form of a one-time transaction number, by means of which a completed payment is verified. This transaction number contains no information about the actual payment data of your payment methods stored with Google Pay, but is created and transmitted as a one-time valid numerical token. In all transactions via Google Pay, Google acts solely as an intermediary for processing the payment transaction. The transaction is carried out exclusively in the relationship between the user and the originating website by charging the payment method stored with Google Pay.

If personal data is processed in the transmissions described, processing is carried out exclusively for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR.

Google reserves the right to collect, store and evaluate certain transaction-specific information for each transaction made via Google Pay. This includes the date, time and amount of the transaction, merchant location and description, a description of the goods or services purchased provided by the merchant, photos you have attached to the transaction, the name and email address of the seller and buyer or of the sender and recipient, the payment method used, your description of the reason for the transaction and, where applicable, the offer associated with the transaction.

According to Google, this processing is carried out exclusively pursuant to Art. 6(1)(f) GDPR on the basis of the legitimate interest in proper accounting, verification of transaction data and optimisation and maintenance of the functionality of the Google Pay service.

Google also reserves the right to combine the processed transaction data with further information collected and stored by Google when other Google services are used.

The terms of use for Google Pay can be found here:

https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de
Further information on data protection with Google Pay can be found at the following internet address:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de

6.5 Squarespace Payments

One or more online payment methods from the following provider are available on this website: Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, D08 N12C, Ireland ("Squarespace").

The technical payment processing for Squarespace Payments is carried out with the involvement of Stripe Payments Europe, Limited, Ireland ("Stripe").

If you select a payment method processed through Squarespace Payments, your payment data provided during the order process, including your name, billing and delivery address, email address, payment method and payment information, currency, transaction number and information about the content of your order, will be transmitted to Squarespace and Stripe to the extent necessary for payment processing. Processing is carried out pursuant to Art. 6(1)(b) GDPR.

Squarespace and Stripe may process certain information under their own responsibility where this is necessary for fraud prevention, security, risk management or compliance with legal obligations.

Data may also be transmitted to affiliated companies and service providers outside the European Economic Area, in particular in the USA. Such transfers are based, where applicable, on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR.

6.6 Stripe

If you select a payment method processed directly by Stripe, payment processing is carried out by Stripe Payments Europe, Limited, Ireland ("Stripe").

For payment processing, the data you provide during the order process, including your name, billing and delivery address, email address, payment details, payment amount, currency, transaction number and information about the content of your order, is transmitted to Stripe. Processing is carried out pursuant to Art. 6(1)(b) GDPR and only to the extent necessary for payment processing.

Stripe may process certain information under its own responsibility where this is necessary for fraud prevention, security, risk management or compliance with legal obligations.

Stripe may transfer personal data to affiliated companies and service providers outside the European Economic Area, in particular in the USA. Such transfers are based, where applicable, on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR.

Further information can be found in Stripe's privacy policy.

6.7 PayPal

If you select PayPal as your payment method, payment processing is carried out by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg ("PayPal").

For payment processing, the data you provide during the order process, including your name, billing and delivery address, email address, telephone number where provided, payment amount, currency, transaction number and information about the content of your order, is transmitted to PayPal. Payment details entered directly on PayPal's website or application are collected by PayPal. Processing is carried out pursuant to Art. 6(1)(b) GDPR.

PayPal may process certain information under its own responsibility where this is necessary for identity and credit checks, fraud prevention, risk management or compliance with legal obligations.

PayPal may transfer personal data to affiliated companies and service providers outside the European Economic Area. Such transfers are based, where applicable, on an adequacy decision, binding corporate rules or the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR.

Further information can be found in PayPal's privacy policy.

6.8 Transmission of image files for order processing

Customers may transmit one or more image files to us by email, messaging function or upload function for the personalisation of products. We collect, store and use the transmitted files exclusively for the production of the personalised product. Processing is carried out pursuant to Art. 6(1)(b) GDPR for the performance of the respective order.

The customer is responsible for ensuring that the transmitted files do not contain any unnecessary sensitive content and that their transmission and processing do not infringe the rights of third parties. Where identifiable third parties are depicted, the customer must obtain their consent pursuant to Art. 6(1)(a) GDPR and provide evidence of such consent upon request. Where minors are depicted, the necessary consent must be obtained from their parent or legal guardian. If the files contain special categories of personal data, their processing additionally requires the explicit consent of the affected person pursuant to Art. 9(2)(a) GDPR.

The transmitted image files are deleted immediately after final completion of the order.

7) Use of your data for direct advertising

7.1 Registration for our email newsletter

If you register for our email newsletter, we will regularly send you information about our offers. The only mandatory information required for sending the newsletter is your email address.

We use Squarespace Email Campaigns, a service provided by Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, D08 N12C, Ireland ("Squarespace"), to send and manage the newsletters described in Sections 7.1 and 7.2.

By registering, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. When you register for the newsletter, we store your IP address as well as the date and time of registration in order to be able to trace any possible misuse of your email address and to demonstrate that consent was given.

For newsletter administration and delivery, Squarespace processes your email address, registration and consent data, delivery status and unsubscribe status. Where opening and click tracking is used, information on the opening of newsletters and links accessed may also be processed. Such tracking is carried out only on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

We have concluded a data processing agreement with Squarespace. Squarespace may use affiliated companies and service providers outside the European Economic Area, in particular in the USA. Such transfers are based, where applicable, on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR.

The data collected when you register for the newsletter is used exclusively for sending and administering the newsletter and documenting your consent. You may unsubscribe at any time via the link provided for this purpose in the newsletter or by sending us a corresponding message.

After unsubscribing, your email address will be removed from the active newsletter mailing list without undue delay. Your email address may subsequently be stored in a suppression list pursuant to Art. 6(1)(f) GDPR in order to ensure that no further newsletters are sent to you. Evidence of consent may be retained for as long as necessary to demonstrate compliance with legal requirements.

7.2 Sending the email newsletter to existing customers

If you have provided us with your email address in connection with the purchase of goods or services, we reserve the right to regularly send you offers for our own similar goods or services by email, provided that you have not objected to such use.

For this purpose, pursuant to Section 174(4) Austrian Telecommunications Act 2021, we do not have to obtain separate consent from you, provided that you were clearly informed of the possibility to object to the use of your email address when it was collected and that you are given a free and easy opportunity to object in every email. We will not send such emails if you have objected to their receipt from the outset, in particular by being entered in the list referred to in Section 7(2) Austrian E-Commerce Act.

In this respect, data processing is carried out on the basis of our legitimate interest in direct advertising pursuant to Art. 6(1)(f) GDPR. You are entitled to object to the use of your email address for the aforementioned advertising purpose at any time with effect for the future, without incurring any costs other than the transmission costs according to the basic rates, by using the unsubscribe link provided in each email or by notifying us. After receipt of your objection, the use of your email address for this purpose will be discontinued without undue delay.

7.3 Advertising by postal mail
On the basis of our legitimate interest in personalized direct advertising, we reserve the right to store your first and last name, your postal address and - insofar as we have received this additional information from you within the scope of the contractual relationship - your title, academic degree, year of birth and your professional, industry or business designation pursuant to Art. 6(1)(f) GDPR and to use it for sending interesting offers and information about our products by postal mail.
You may object to the storage and use of your data for this purpose at any time vis-à-vis us.

8) Web analytics

8.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables analysis of your use of our website.

By default, Google Analytics 4 sets cookies when the website is visited. These are small text elements stored on your end device that collect certain information. This information also includes your IP address, which, however, is shortened by Google by the last digits in order to exclude direct personal identifiability.

The information is transmitted to Google servers and processed there. Transfers to Google LLC, based in the USA, are also possible.

Google uses the information collected on our behalf to evaluate your use of the website, to compile reports on website activity for us and to provide other services associated with website use and internet use. The shortened IP address transmitted by your browser within the scope of Google Analytics is not combined with other Google data. The data collected within the scope of the use of Google Analytics 4 is stored for a period of two months and then deleted.

All processing described above, in particular the setting of cookies on the end device used, takes place only if you have given us your express consent pursuant to Art. 6(1)(a) GDPR.
Without your consent, Google Analytics 4 will not be used during your visit to the site. You may withdraw your consent with effect for the future at any time. To exercise your right of withdrawal, please deactivate this service via the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with Google that ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

Further legal information on Google Analytics 4 can be found at https://policies.google.com/privacy?hl=de&gl=de and at https://policies.google.com/technologies/partner-sites

Demographic characteristics
Google Analytics 4 uses the special "demographic characteristics" function to create statistics that make statements about the age, gender and interests of site visitors.
This is done by analysing advertising and information from third-party providers. This enables target groups to be identified for marketing activities. However, the collected data cannot be assigned to any specific person and is deleted after being stored for a period of two months.

Google Signals
As an extension to Google Analytics 4, Google Signals is used on this website to have cross-device reports created. If you have activated personalised ads and linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics pursuant to Art. 6(1)(a) GDPR, analyse your usage behaviour across devices and create database models, including models for cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop cross-device analysis, you can disable the "Personalised advertising" function in the settings of your Google account. To do so, follow the instructions on this page: https://support.google.com/ads/answer/2662922?hl=de Further information on Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=de

User IDs
As an extension to Google Analytics 4, the "User IDs" function is used on this website. If you have consented to the use of Google Analytics 4 pursuant to Art. 6(1)(a) GDPR, have set up an account on this website and log in with this account, we assign a unique pseudonymous user ID to your account. The user ID does not contain your name, email address or other information that directly identifies you. It is transmitted to Google and enables your activities, including conversions, to be analysed across sessions and devices.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

9) Retargeting / remarketing and conversion tracking

9.1 Google Ads Remarketing

This website uses retargeting technology from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

For this purpose, Google sets a cookie in the browser of your end device that automatically enables interest-based advertising by means of a pseudonymous cookie ID and on the basis of the pages you visit. Further data processing only takes place if you have consented to Google linking your internet and app browsing history to your Google account and using information from your Google account to personalise ads that you view on the web. If, in this case, you are logged into Google while visiting our website, Google uses your data together with Google Analytics data to create and define target group lists for cross-device remarketing. For this purpose, your personal data is temporarily linked by Google with Google Analytics data to form target groups. In the course of using Google Ads Remarketing, personal data may also be transmitted to the servers of Google LLC. in the USA.

All of the processing described above, in particular the setting of cookies for reading information on the end device used, is carried out only if you have given us your express consent to do so pursuant to Art. 6(1)(a) GDPR. Without such consent, retargeting technology will not be used during your visit to the site.

You may withdraw your consent at any time with effect for the future. To exercise your withdrawal, please deactivate this service in the "Cookie Consent Tool" provided on the website.

Details on the processing initiated by Google and on Google's handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites

Further information on Google's privacy policy can be found here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

9.2 Google Ads Conversion Tracking

This website uses the online advertising programme "Google Ads" and, within the scope of Google Ads, conversion tracking provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

We use Google Ads to draw attention to our attractive offers on external websites with the help of advertising material (so-called Google AdWords). In relation to the data of the advertising campaigns, we can determine how successful the individual advertising measures are. Our objective is to display advertising to you that is of interest to you, to make our website more interesting for you and to achieve a fair calculation of the advertising costs incurred.

This website uses Google Ads Conversion Tracking without setting conversion cookies. Instead, information is stored in or accessed from your browser's local storage. Google assigns an individual identifier that enables analysis of the use of the website and the effectiveness of advertising measures.

The identifier is stored when a user clicks on an advertisement placed by Google. If the user subsequently visits certain pages of this website, Google and we can recognise that the user clicked on the advertisement and was redirected to that page. Each Google Ads customer receives a different identifier. Identifiers therefore cannot be used by Google Ads customers to track users across the websites of other Google Ads customers.

The information obtained in this way is used to create conversion statistics. We receive information about the total number of users who clicked on an advertisement and were redirected to a page containing a conversion tracking tag. We do not receive any information that directly identifies individual users.

In the course of using Google Ads Conversion Tracking, personal data may also be transmitted to servers of Google LLC in the USA. Details on the processing initiated by Google Ads Conversion Tracking and on Google's handling of data from websites can be found in Google's privacy information.

All processing described above, including the storage of or access to information in local storage, takes place only if you have given us your express consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) Austrian Telecommunications Act 2021. Without your consent, Google Ads Conversion Tracking will not be used during your visit to the website.

You may withdraw your consent at any time with effect for the future by deactivating this service in the Cookie Consent Tool provided on the website. The specific storage period of the identifier used for conversion tracking is stated in the Cookie Consent Tool.

Google's privacy policy can be viewed here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

10) Online marketing

10.1 Google AdSense

This website uses Google AdSense, a web advertising service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google AdSense uses so-called cookies, i.e. text files that are stored on your computer and that enable analysis of your use of the website. In addition, Google AdSense also uses so-called "web beacons" (small invisible graphics) to collect information, by means of which simple actions such as visitor traffic on the website can be recorded, collected and evaluated. The information generated by the cookie and/or web beacon (including your IP address) about your use of this website is usually transmitted to a Google server and stored there. This may also involve transmission to the servers of Google LLC. in the USA.

Google uses the information obtained in this way to evaluate your usage behaviour with regard to AdSense advertisements. The IP address transmitted by your browser within the scope of Google AdSense is not combined with other Google data. The information collected by Google may be transmitted to third parties if this is required by law and/or insofar as third parties process this data on Google's behalf.
All processing described above, in particular the reading of information on the end device used via cookies and/or web beacons, is carried out only if you have given us your express consent to do so pursuant to Art. 6(1)(a) GDPR. Without such consent, Google AdSense will not be used during your visit to the site.

You may withdraw your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

Further information on Google's privacy policy can be viewed here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

10.2 Use of Instagram Insights

When you visit our Instagram page, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"), processes various personal data about you (e.g. IP address, device information and activities on Instagram). On the basis of this data, Meta creates aggregated statistics ("Insights"), which may provide us, among other things, with the following information:

Number of page views or profile views
Reach of posts and stories
Demographic analyses (e.g. age, gender and region, in each case only in aggregated form)
Information on times at which users are particularly active
Interactions with our page (e.g. likes, comments, shares, profile views and clicks on links)

We use these Insights to:

optimise our content and offers,
address target groups and improve our presence,
analyse the reach and effectiveness of posts and, where applicable, advertising measures.

For the collection and processing of data used to create Instagram Insights, we and Meta are jointly responsible within the meaning of Art. 26 GDPR. Joint responsibility does not mean that we and Meta are equally responsible for all processing operations.

Meta is primarily responsible for collecting and processing data on the Instagram platform and for fulfilling the information, security and data subject rights obligations relating to data held by Meta. We are responsible for our use of the Insights statistics provided to us and for personal data that we process ourselves in connection with our Instagram page. Further information on the allocation of responsibilities can be found in Meta's Page Insights Controller Addendum.

You may exercise your data subject rights against both Meta and us. Since Meta has direct access to the data processed on the Instagram platform, Meta is generally best placed to respond to requests concerning this data.

The legal basis for our processing of the Insights statistics is our legitimate interest in effective external presentation and communication with users and interested persons pursuant to Art. 6(1)(f) GDPR.

Outside the processing operations for which joint responsibility exists, Meta processes personal data independently, in particular for the operation of Instagram, profiling and advertising by Meta or third parties. We have no influence over this processing. In this respect, the information provided by Meta in the Instagram Privacy Policy is authoritative.

We receive from Meta only aggregated statistics that generally do not allow us to directly identify individual users. However, joint responsibility may exist irrespective of whether we have access to the personal data processed by Meta.

The legal basis for our processing of publicly visible interactions, such as comments, likes and shared content, is Art. 6(1)(f) GDPR on the basis of our legitimate interest in communication with users and public relations.

Meta may transfer personal data collected when Instagram is used to third countries, in particular to the United States, and process it there. Where data is transferred to the United States, the transfer is based, where applicable, on the EU-US Data Privacy Framework or on the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR. Further information on international data transfers and the safeguards applied can be found in Meta's Privacy Policy.

11) Google reCAPTCHA

This website uses Google reCAPTCHA, a security service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). We use reCAPTCHA to determine whether entries in our contact forms and shop functions are made by a natural person or by automated programs and to prevent spam, fraud, abuse and other malicious activity.

For this purpose, reCAPTCHA may process your IP address, browser and device information, operating system, referrer URL, date and time of access, interaction and usage data, cookies or similar identifiers and the result of the security analysis. Google processes this data on our behalf only to provide and maintain reCAPTCHA and its security, threat detection and abuse prevention functions.

Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the secure, stable and reliable operation of our website and, in particular, in protecting our contact forms and shop functions against automated access, spam, fraud and abuse.

reCAPTCHA sets the technically necessary cookie "GRECAPTCHA" in order to perform its risk analysis. The storage of or access to information on your end device for this purpose is technically necessary within the meaning of Section 165(3) Austrian Telecommunications Act 2021.

Data may also be processed by Google LLC and other service providers outside the European Economic Area, in particular in the United States. Such transfers are based, where applicable, on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR.

The data processed through reCAPTCHA is stored only for as long as necessary to perform the security analysis, prevent misuse and comply with applicable legal obligations.

12) Cookie Consent Tool

This website uses the Cookie Consent Tool provided by Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, D08 N12C, Ireland ("Squarespace"), to obtain and manage user consent for cookies and comparable technologies requiring consent.

The Cookie Consent Tool is displayed to users when they access the website in the form of an interactive user interface through which consent to individual categories of cookies and services can be granted or refused. Services requiring consent are loaded only if the respective user has given the corresponding consent.

For this purpose, the tool may process your consent status, the categories selected, the date and time of your selection, a preference identifier, browser and device information and, where necessary, your IP address. Technically necessary information is stored on your end device in order to remember and apply your cookie preferences.

The storage of or access to information on your end device for this purpose is technically necessary within the meaning of Section 165(3) Austrian Telecommunications Act 2021. Where personal data is processed, processing is carried out pursuant to Art. 6(1)(c) GDPR for the purpose of complying with our legal obligations and pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management.

Your preferences are stored until you change or withdraw them, delete the relevant browser data or the storage period specified in the Cookie Consent Tool expires. Records required to demonstrate that consent was given or refused may be retained for as long as necessary to comply with legal documentation and accountability obligations.

We have concluded a data processing agreement with Squarespace. In providing the service, Squarespace may use affiliated companies and service providers outside the European Economic Area, in particular in the USA. Such transfers are based, where applicable, on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR.

Further information on the individual services, storage periods and setting options can be found directly in the Cookie Consent Tool on our website.

13) Rights of the data subject

13.1 The applicable data protection law grants you comprehensive data subject rights vis-à-vis the controller with regard to the processing of your personal data, about which we inform you below:

Right of access pursuant to Art. 15 GDPR: In particular, you have the right to obtain information about your personal data processed by us, the purposes of processing, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, complaint to a supervisory authority, the origin of your data if it was not collected from you by us, the existence of automated decision-making including profiling and, where applicable, meaningful information about the logic involved and the significance and intended consequences of such processing for you, as well as your right to be informed of the safeguards pursuant to Art. 46 GDPR where your data is transferred to third countries;
Right to rectification pursuant to Art. 16 GDPR: You have the right to immediate rectification of inaccurate data concerning you and/or completion of incomplete data stored by us;
Right to erasure pursuant to Art. 17 GDPR: You have the right to request erasure of your personal data if the requirements of Art. 17(1) GDPR are met. However, this right does not exist in particular where processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
Right to restriction of processing pursuant to Art. 18 GDPR: You have the right to request restriction of the processing of your personal data for as long as the accuracy of your data contested by you is being verified; if you refuse erasure of your data due to unlawful data processing and instead request restriction of the processing of your data; if you need your data for the establishment, exercise or defence of legal claims after we no longer need this data once the purpose has been achieved; or if you have objected on grounds relating to your particular situation pending verification as to whether our legitimate grounds override yours;
Right to notification pursuant to Art. 19 GDPR: If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.
Right to data portability pursuant to Art. 20 GDPR: You have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format or to request transmission to another controller, insofar as this is technically feasible;
Right to withdraw consent granted pursuant to Art. 7(3) GDPR: You have the right to withdraw consent once given to the processing of data at any time with effect for the future. In the event of withdrawal, we will delete the data concerned without undue delay, unless further processing can be based on a legal basis for processing without consent. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal;
Right to lodge a complaint pursuant to Art. 77 GDPR: If you consider that the processing of personal data concerning you infringes the GDPR, you have - without prejudice to any other administrative or judicial remedy - the right to lodge a complaint with a supervisory authority, in Austria the Austrian Data Protection Authority.

13.2 Right to object

Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then cease processing unless we demonstrate compelling legitimate grounds or require the data for legal claims.
You may object to processing for direct marketing purposes at any time. Following such an objection, your personal data will no longer be processed for direct marketing purposes.

14) Duration of storage of personal data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and - where relevant - additionally by the respective statutory retention period (e.g. retention periods under company and tax law).

When personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, this data is stored until the data subject withdraws their consent.

If statutory retention periods exist for data processed within the scope of legal or similar obligations on the basis of Art. 6(1)(c) GDPR, this data is routinely deleted after expiry of the retention periods, provided that it is no longer required for contract performance or contract initiation and/or we have no continuing legitimate interest in further storage.

When personal data is processed for direct advertising purposes on the basis of Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21(2) GDPR.

Unless otherwise stated in the other information in this policy regarding specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

‍ ‍