Privacy policy

The protection of your personal data is a top priority for us. We process your personal data exclusively in accordance with applicable legal regulations, in particular the General Data Protection Regulation (GDPR) and the Telecommunications Act 2021 (TKG 2021).

In this privacy policy we inform you about which personal data is processed when you use our website and online store, for what purposes this is done and what rights you have.

1. responsible body

Wolfgang Schober & Maria Hopfner
Linzer Street 17
4331 Naarn im Machlande
Austria
Phone: +43 664 5333295
E-Mail: office@schobermost.at
UID: ATU 65045319

2. hosting & server log files

Our website is hosted by Host Europe GmbH, Hansestraße 111, 51149 Cologne, Germany, hosted.

When visiting our website, technical information is automatically processed that is necessary for the secure and reliable operation of the website. This includes, in particular:

• IP address and, if applicable, the hostname of the requesting device
• Date and time of access
• Requested pages and files
• Amount of data transferred
• Browser type and browser version
• Used operating system
• Referrer URL
• Technical status and error messages

The processing takes place on the basis of our legitimate interest in ensuring the safe and functional operation of the website in accordance with Art. 6(1)(f) GDPR.

As far as the hosting provider processes personal data on our behalf, there is an order processing agreement in accordance with Article 28 GDPR.

Server log files are generally stored only for as long as is necessary for the respective security and operational purpose. The specific storage duration depends on the settings and retention policies of the hosting provider.

3. General data collection and processing

When you visit our website, submit an inquiry, or use our online store, we process personal data to the extent necessary for the respective purpose.

This may include the following information:

• First and last name
• Billing and delivery address
• Email address and phone number
• Ordering and contract information
• Payment and transaction information
• Technical information such as IP address and browser data
• Voluntarily submitted messages and other information

The processing takes place depending on the specific purpose, based on Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract performance and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligations) or Art. 6(1)(f) GDPR (legitimate interests).

Personal data will only be disclosed if it is necessary for contract performance, legally required, or possible on another permissible legal basis.

4. Webshop & Order Processing (WooCommerce)

Our online store is powered by WooCommerce operated by an e-commerce software from the Automattic environment.

When you place an order in our online store, we process the data you provide to accept, process, ship, and, if necessary, answer any questions regarding your order.

In particular, the following information is processed:

• Name and contact details
• Billing and delivery address
• Products and quantities ordered
• Order value and shipping costs
• Selected payment and shipping method
• Order status and transaction information
• If applicable, IP address and technical order information

The processing takes place for the purpose of performing the purchase contract in accordance with Art. 6(1)(b) GDPR, as well as for the fulfillment of legal obligations pursuant to Art. 6(1)(c) GDPR.

Certain personal details are required to complete an order. Without the necessary contact, billing, delivery and payment information, an order may not be completed.

WooCommerce also uses technically necessary cookies and comparable technologies to enable the shopping cart, the session, and the ordering process.

The use of these technically necessary technologies is carried out within the framework of the legal exceptions set out in § 165, paragraph 3, of the TKG 2021.

5. Customer accounts & guest orders

In our online shop you have the option to order as a guest or to voluntarily create a customer account.

When creating a customer account, your email address, access data, and, if applicable, your name, billing and delivery address, and your order history are stored in particular.

The customer account allows you to view your orders and manage certain information for future purchases.

The processing takes place to provide the account functions you request in accordance with Art. 6(1)(b) GDPR.

When you place an order as a guest, no permanent customer account will be created for you. The data necessary for order processing will nevertheless be processed and stored in accordance with legal requirements.

You can delete your customer account at any time under office@schobermost.at The statutory retention obligations for already completed orders remain unaffected by this.

6. Payment processing with Stripe

We use secure payment processing systems for the safe processing of online payments. Stripe. The provider of European payment services is in particular Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

When you make a payment via Stripe, the information required for payment processing is transmitted to Stripe or collected directly by Stripe.

This may include, in particular, the following data:

• Name and billing address
• E-mail address
• Payment amount and currency
• Payment and transaction information
• Information about the payment method used
• IP address, device and browser information
• Further information required for fraud prevention

Stripe processes this data to process the payment, to detect and prevent fraud, to comply with legal obligations, and to ensure the security of the payment transaction.

The processing by us takes place for the fulfillment of the contract in accordance with Art. 6(1)(b) GDPR, as well as, if necessary, for the fulfillment of legal obligations pursuant to Art. 6(1)(c) GDPR and for the safeguarding of legitimate interests pursuant to Art. 6(1)(f) GDPR.

Stripe may also process personal data in its own data protection-related responsibility. The respective purposes and legal bases for this processing result from the privacy notices of Stripe.

As part of the payment processing, personal data may also be transmitted to affiliated Stripe companies and other participating payment service providers. In this case, international data transfers may also be possible.

Further information can be found at:
https://stripe.com/at/privacy

7. Billing with Germanized

To support the legal requirements in online commerce, we use the WooCommerce plugin. Germanized.

This supports, among other things, order processing, the creation of invoice documents, and the provision of legally required information in the ordering process.

The order and billing data required for this purpose are processed for contract fulfillment in accordance with Art. 6(1)(b) GDPR as well as to fulfill legal retention obligations pursuant to Art. 6(1)(c) GDPR.

Accounting and bookkeeping documents are generally stored in accordance with the applicable statutory retention periods, in particular the regular seven-year retention period under Austrian tax law. In certain cases, longer retention periods may apply.

8. Shipping and delivery

To deliver your order, we will provide the personal data required for shipping to the shipping or transport service provider commissioned for the respective purpose.

These include in particular:

• Name of the recipient
• Delivery address
• Telephone number and email address, if necessary, insofar as necessary for delivery
• Delivery information necessary for delivery

The data is transmitted to the extent necessary to execute the purchase contract in accordance with Art. 6(1)(b) GDPR.

Depending on the delivery area, shipping method and order, different shipping service providers may be used.

[Here are the actual shipping service providers used in addition.]

The respective shipping service providers may process the data received within the framework of their own data protection responsibilities to carry out the delivery.

9. Newsletter & Email Marketing (MailPoet)

On our website you have the option to sign up for our newsletter. With our newsletter we inform you about news, products, offers and promotions related to Schobermost.

For the management, creation, and sending of our newsletter, we use MailPoet, a newsletter service from Automattic.

Our newsletters are sent via the MailPoet Sending Service. In this case, the personal data necessary for shipping are transmitted to the service provider and processed there.

In the context of the newsletter registration and delivery, the following data may be processed in particular:

• E-mail address
• First and last name, if provided
• Date and time of registration
• IP address when registering, if recorded
• Information about the confirmation of the registration
• Information about unsubscribing
• Technical information regarding the delivery of the newsletters

Registration for our newsletter is based on your voluntary consent in accordance with Art. 6(1)(a) GDPR.

If a double opt-in procedure is used, you will receive an email after you register in which you must confirm your registration. This is intended to ensure that no unauthorized persons sign up using your email address.

When the appropriate analysis functions are enabled, we can use MailPoet to evaluate whether newsletters are opened and whether the included links are clicked. These analyses help us improve our newsletters and adapt the content to the interests of our subscribers.

Personalized analysis of opening and click behavior only takes place if there is a corresponding legal basis for this, in particular a necessary consent.

The processing of the newsletter data takes place on our web server and, insofar as necessary for the delivery, through the systems of the MailPoet Sending Service.

As part of the use of the shipping service, data may also be processed by MailPoet or the associated service providers outside the European Economic Area. For such data transfers, the data protection requirements of Article 44 ff. of the GDPR must be met.

You can revoke your consent at any time with effect for the future. To do this, you can use the unsubscribe link at the end of each newsletter or contact us at office@schobermost.at contact.

After you unsubscribe, your email address will be removed from the active newsletter list. Required evidence of granted or revoked consents can continue to be stored to the extent permitted by law.

Further information about data processing by MailPoet or Automattic can be found at:
https://automattic.com/privacy/

10. Contact form & email contact

If you contact us via our contact form or by email, we will process your details to process your request.

This includes in particular your name, your email address and the content of your message, as well as any other voluntarily submitted information.

The processing takes place in accordance with Art. 6(1)(b) GDPR, provided that your request relates to a contract or pre-contractual measures. In other cases, it is based on our legitimate interest in processing requests pursuant to Art. 6(1)(f) GDPR.

The data will be deleted as soon as they are no longer required for processing and there are no legal retention obligations or other legitimate reasons for further storage.

11. Security & Firewall

To protect our website and our online store, we use technical security measures, including a firewall and other mechanisms to detect and prevent unauthorized access, spam, and cyberattacks.

In particular, IP addresses, access times and security-relevant technical information can be processed.

The processing takes place on the basis of our legitimate interest in the security and functionality of our website in accordance with Art. 6(1)(f) GDPR.

The data is stored only for as long as necessary to detect, investigate and prevent security incidents.

12. Microsoft Clarity and Microsoft Advertising

We use Microsoft Clarity and Microsoft Advertising, Services of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA.

These services help us better understand the use of our website, optimize our content, and measure the effectiveness of our advertising.

In particular, the following data can be processed:

• Visited pages and interactions
• Technical device and browser information
• IP address and approximate location information
• Behavioral metrics, heatmaps, and session recordings
• Information about advertising contacts and conversions

Processing can be carried out using cookies and similar tracking technologies.

The use of these consent-based services is exclusively subject to your consent in accordance with Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021.

You can revoke your consent at any time via the cookie settings on our website, with effect for the future.

As part of the processing, personal data may also be transferred to third countries, in particular the USA. The data protection requirements required for this are to be met by the respective provider.

Further information can be found at:
Privacy policy from Microsoft

13. Meta Pixel (Facebook & Instagram)

Our website uses the Meta Pixel, an analytics and marketing service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

The Meta Pixel allows us to measure the effectiveness of our advertising on Facebook and Instagram and to optimize our advertising campaigns.

In particular, the following information can be processed:

• IP address and technical device information
• Browser information and pages visited
• Date and time of website visits
• Interactions with our website and our webshop
• Products and product information called up
• Shopping cart actions and started order processes
• Completed orders and order values
• Cookie identifiers and other online identifiers

Within the framework of conversion tracking, events such as ViewContent, AddToCart, InitiateCheckout and Purchase are recorded, provided that they are activated in the integration used.

Meta may link the information provided with existing Facebook or Instagram accounts and use it for its own purposes, in particular to personalize advertisements.

The collection and transmission of data via the Meta Pixel takes place exclusively with your express consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021.

The Meta Pixel is only activated via our cookie banner after your consent.

You can revoke your consent at any time via the cookie settings on our website, with effect for the future.

To the extent that we, together with Meta, are responsible for collecting and transmitting certain event data, the corresponding agreements on joint responsibility by Meta apply in addition.

As part of the data processing, personal data may be transferred to the USA. Such transfers may, subject to the prerequisites, be based on the EU-US Data Privacy Framework or other appropriate transfer mechanisms.

Further information can be found at:
Meta privacy policy

14. Google Maps

Our website uses Google Maps by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Maps allows you to view interactive maps and makes it easier for you to find our locations and sales outlets.

When loading a card, your IP address, browser information, and other technical data may be transmitted to Google in particular.

The activation of external card content takes place with your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021.

Further information can be found at:
Google privacy policy

15. YouTube

Videos from the platform can be found on our website YouTube To be included. Provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When an embedded video is activated, your IP address, device and browser information, as well as information about the use of the video, can be transmitted to Google or YouTube, respectively.

If you are logged into your Google account, Google may assign this information to your user account if necessary.

The activation of YouTube content subject to consent is based on your consent pursuant to Art. 6(1)(a) GDPR.

Further information can be found at:
Google privacy policy

16. Agile Store Locator

To display and search our sales locations, we use the plugin Agile Store Locator.

This allows you to search for sales outlets and find suitable locations in your area.

In this case, technical information such as your IP address and the search locations entered by you can be processed.

If the location search accesses external map or geolocation services, data may be transmitted to the respective providers. For consent-based external services, your consent will be obtained beforehand.

The processing takes place based on your consent pursuant to Art. 6(1)(a) GDPR, or our legitimate interest in user-friendly location search pursuant to Art. 6(1)(f) GDPR, depending on the function.

17. Translation with TranslatePress

Our website uses TranslatePress, to provide content in multiple languages.

In this case, technically necessary cookies or similar technologies can be used to store your preferred language setting.

The processing takes place on the basis of our legitimate interest in providing a user-friendly, multilingual website in accordance with Article 6(1)(f) of the GDPR.

As long as the storage is technically necessary, no separate consent is required under § 165, paragraph 3 of the TKG 2021.

18. Cookies & Consent Management (Real Cookie Banner)

Our website uses cookies and similar technologies to provide basic functions, store settings, and – with your consent – to evaluate the use of our website and optimize advertising measures.

In particular, we distinguish between technically necessary, functional, statistical, and marketing-related services.

Technically necessary cookies enable, for example, the shopping cart function, logging in to customer accounts, and storing your cookie settings.

For the management of your consents we use Real Cookie Banner by devowl.io GmbH, Tannet 12, 94539 Grafling, Germany.

The plugin allows you to decide whether to allow the use of cookies and services that require consent. Your decision is stored and documented.

The processing of consent data takes place in order to fulfill our legal obligations under Article 6(1)(c) of the GDPR, as well as to safeguard our legitimate interest in the traceability of consents granted under Article 6(1)(f) of the GDPR, insofar as relevant.

Technically non-essential services, in particular Meta Pixel, Microsoft Clarity and Microsoft Advertising, are only activated after your consent.

You can change your cookie settings at any time via the appropriate function on our website or revoke a given consent with effect for the future.

Further information can be found at:
Privacy policy of devowl.io

19th Processing of orders & Recipients of personal data

To operate our website and online store, we work with external service providers.

The possible recipients of personal data include, in particular:

• Hosting and IT service providers
• Payment service providers and participating financial institutions
• Shipping and transport service providers
• Newsletter and communication service providers, especially MailPoet
• Tax advice and accounting
• Analytical and marketing service providers, insofar as there is an appropriate legal basis
• Authorities, insofar as there is a legal obligation

To the extent that service providers process personal data on our behalf, the necessary agreements are concluded in accordance with Article 28 of the GDPR.

Other recipients, such as payment service providers or shipping companies, may also process data under their own data protection responsibilities.

20th International Data Transfers

When using certain services, in particular those from Meta, Microsoft, Google, Stripe and MailPoet, personal data may be transmitted to recipients outside the European Economic Area.

Such transfers only take place if the data protection requirements applicable to them are met.

As the legal basis for international data transfers, in particular, adequacy decisions of the European Commission pursuant to Article 45 GDPR or appropriate guarantees such as EU standard contractual clauses pursuant to Article 46 GDPR are considered.

For certain certified US companies, the EU-US Data Privacy Framework can constitute a suitable basis for data transfers.

Further information about the respective transmission mechanisms can be found in the privacy policies of the service providers used.

21. Storage duration

We generally store personal data only for as long as is necessary to fulfill the respective purpose or as required by legal retention obligations.

For order, invoice and accounting data, the statutory retention periods under Austrian tax and corporate law apply in particular. These periods are typically seven years, but may in individual cases be longer.

Data from customer accounts is generally processed for as long as the respective account exists, unless a shorter deletion takes place or legal retention obligations preclude it.

Newsletter data is generally processed until your consent is revoked. In addition, required proofs of consent can be stored to the extent permitted by law.

For technical logs, cookies, and data from external analytics and marketing services, the respective retention periods and deletion policies apply based on the purpose.

22. Your rights

Within the framework of the applicable data protection regulations, you have the following rights in particular:

• Right to information pursuant to Art. 15 GDPR
• Right to rectification pursuant to Article 16 GDPR
• Right to deletion pursuant to Art. 17 GDPR
• Right to restriction of processing pursuant to Art. 18 GDPR
• Right to data portability pursuant to Art. 20 GDPR
• Right to object pursuant to Art. 21 GDPR
• Right to revoke a consent pursuant to Art. 7(3) GDPR

You can revoke a given consent at any time with effect for the future. The legality of the processing carried out up to the revocation remains unaffected.

You also have the right not to be subjected to any decision based solely on automated processing that has legal effect on you or similarly significantly affects you, insofar as the requirements of Article 22 of the GDPR are met.

If you would like to exercise one of your data protection rights, you can contact us at any time:

E-Mail: office@schobermost.at

If you believe that the processing of your personal data violates data protection law, you have the right to file a complaint with a competent data protection supervisory authority.

In Austria this is the Austrian Data Protection Authority:
https://www.dsb.gv.at/

23. Changes to this privacy policy

We reserve the right to adapt this privacy policy as necessary, especially if legal requirements, the technologies used, or the processing of personal data on our website change.

The version published on our website applies.