Privacy information

Data Protection Information

1. Information about the collection of personal data and contact details of the data controller
2. Contact
3. Data processing for order processing
4. Rights of the data subject
5. Duration of storage of personal data

––––––––––––––––––––––––––––––––
B. Data Protection Information
––––––––––––––––––––––––––––––––

1) Information about the collection of personal data and contact details of the data controller

1.1 We are pleased that you are visiting us at SHOMUGO and thank you for your interest. In the following, we will inform you about the handling of your personal data that we process at SHOMUGO. Personal data are all data with which you can be personally identified.

1.2 The data controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is Christian Raunjak, austriavital, Burggasse 3/2, 8570 Voitsberg, Austria, Tel .: +436642335927, email: christian@austriavital.at. The data controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

2) Contact

When contacting us (e.g., via contact form or email), personal data is collected, which can be seen from the contact form. These data are stored and used exclusively for the purpose of answering your request or for contacting you and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your request in accordance with Art. 6 (1) (f) GDPR. If your contact is aimed at concluding a contract, an additional legal basis for the processing is Art. 6 (1) (b) GDPR. Your data will be deleted after final processing of your inquiry; this is the case if it can be inferred from the circumstances that the matter in question has been conclusively clarified and provided that there are no statutory retention obligations.

3) Data processing for order processing

3.1 The personal data collected by us will be passed on to the transport company commissioned with the delivery as part of the contract processing, insofar as this is necessary for the delivery of the goods.
If we owe you updates for goods with digital elements or for digital products based on a corresponding contract, we process the contact data you provided when placing the order (name, address, email address) in order to inform you personally about upcoming updates within the legally prescribed period in accordance with Art. 6 (1) (c) GDPR, using a suitable means of communication (e.g., postal or email). Your contact data will be used strictly for the purpose of providing information about updates owed by us and will only be processed to the extent necessary for the respective information.

3.2 If you choose to pay via PayPal, credit card via PayPal, direct debit via PayPal, or, if offered, "purchase on account" or "installment payment" via PayPal, your payment data will be transmitted to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") as part of the payment processing. The disclosure is made in accordance with Art. 6 (1) (b) GDPR and only to the extent necessary for the payment processing.
For payment methods offered by PayPal, such as credit card via PayPal, direct debit via PayPal, or, if offered, "purchase on account" or "installment payment" via PayPal, PayPal reserves the right to carry out a credit check. For this purpose, your payment data may be transferred to credit agencies in accordance with Art. 6 (1) (f) GDPR, based on PayPal's legitimate interest in determining your ability to pay. PayPal uses the result of the credit assessment with regard to the statistical probability of default for the purpose of deciding whether to provide the respective payment method. The credit report may contain probability values (so-called score values). To the extent that score values are included in the credit report, they have their basis in a scientifically recognized mathematical-statistical procedure. The calculation of score values includes, among other things, address data. For further information on data protection, including the credit agencies used, please refer to PayPal's privacy policy: https://www.paypal.com/de/weba...
You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual payment processing.

3.3 If you choose a payment method offered by the payment service provider "Stripe," payment is processed by the payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we pass on the information you provided during the ordering process, along with the information about your order (name, address, account number, bank code, possibly credit card number, invoice amount, currency, and transaction number), in accordance with Art. 6 (1) (b) GDPR. For more information on Stripe's privacy practices, please visit the URL: https://stripe.com/de/privacy#translation.
Stripe reserves the right to perform a credit check based on mathematical-statistical procedures in order to safeguard its legitimate interest in determining the user's ability to pay. Stripe may disclose personal data necessary for a credit check to selected credit agencies upon request by Stripe users. The credit report may contain probability values (so-called score values). To the extent that score values are included in the credit report, they have their basis in a scientifically recognized mathematical-statistical procedure. The calculation of score values includes, among other things, address data. Stripe uses the result of the credit assessment with regard to the statistical probability of default for the purpose of deciding on the user's eligibility for the chosen payment method.
You can object to this processing of your data at any time by sending a message to Stripe or the credit agencies. However, Stripe may still be entitled to process your personal data if this is necessary for the contractual payment processing.

4) Rights of the data subject

4.1 The applicable data protection law grants you comprehensive rights with regard to the processing of your personal data by the data controller (rights of access and intervention), about which we inform you below:

- Right to information according to Art. 15 GDPR: You have the right to obtain information about your personal data processed by us, the purposes of processing, the categories of processed personal data, the recipients or categories of recipients to whom the data has been or will be disclosed, the envisaged storage period or the criteria for determining the storage period, the existence of the right to rectification, erasure, restriction of processing, objection to processing, the right to lodge a complaint with a supervisory authority, the source of your data if it was not collected by us, the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing, and the right to be informed about the safeguards pursuant to Art. 46 GDPR relating to the transfer of data to third countries;

- Right to rectification according to Art. 16 GDPR: You have the right to have your incorrect data corrected and/or incomplete data stored by us completed without undue delay;

- Right to erasure according to Art. 17 GDPR: You have the right to request the erasure of your personal data if the requirements of Art. 17 (1) GDPR are met. However, this right does not apply, in particular, if the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;

- Right to restriction of processing according to Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data contested by you is verified, if you oppose the erasure of your data due to unlawful processing and request the restriction of their use instead, if you need your data for the establishment, exercise, or defense of legal claims after we no longer need this data for the purposes of processing, or if you have objected to processing on grounds relating to your particular situation, as long as it is not yet determined whether our legitimate grounds override yours;

- Right to be informed according to Art. 19 GDPR: If you have exercised your right to rectification, erasure, or restriction of processing against the data controller, the data controller is obliged to communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. The data controller is required to inform you about those recipients if you request it;

- Right to data portability according to Art. 20 GDPR: You have the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format or to request the transmission of that data to another controller, where technically feasible;

- Right to withdraw consent according to Art. 7 (3) GDPR: You have the right to withdraw your consent to the processing of your data at any time with future effect. In the event of withdrawal, we will immediately delete the data concerned unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal;

- Right to lodge a complaint according to Art. 77 GDPR: If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, without prejudice to any other administrative or judicial remedy.

4.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR OVERRIDING LEGITIMATE INTEREST IN THE CONTEXT OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE RELEVANT DATA. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.
IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE RELEVANT DATA FOR DIRECT MARKETING PURPOSES.

5) Duration of storage of personal data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing, and – if applicable – additionally by the respective statutory retention period (e.g., commercial and tax retention periods).
If the processing of personal data is based on your explicit consent pursuant to Art. 6 (1) (a) GDPR, the data will be stored until you revoke your consent.
If there are legal retention periods for data that is processed within the framework of contractual or similar legal obligations based on Art. 6 (1) (b) GDPR, these data will be routinely deleted after expiration of the retention periods, provided they are no longer necessary for the performance of the contract or the initiation of the contract and/or on our part no longer have a legitimate interest in continued storage.
If personal data is processed on the basis of Art. 6 (1) (f) GDPR, the data will be stored until you exercise your right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
If personal data is processed for the purpose of direct marketing on the basis of Art. 6 (1) (f) GDPR, the data will be stored until you exercise your right to object pursuant to Art. 21 (2) GDPR.
Unless otherwise stated in the remaining information in this declaration about specific processing situations, stored personal data will be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.