Introduction and Overview

We have prepared this Privacy Policy (version 07.01.2024-122693978) in order to explain to you, in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable national laws, which personal data (hereinafter referred to as “data”) we, as the controller – and the processors commissioned by us (e.g., providers) – process, will process in the future, and what lawful options you have. The terms used are to be understood as gender-neutral.
In short: We provide comprehensive information about the data we process about you.

Privacy policies often sound very technical and use legal terminology. This Privacy Policy, however, aims to describe the most important aspects as simply and transparently as possible. Where helpful for clarity, technical terms are explained in a reader-friendly way, links to further information are provided, and graphics are used. We inform you in clear and simple language that we process personal data in the course of our business activities only when there is an appropriate legal basis. This is certainly not possible by providing overly brief, unclear, and highly technical legal explanations, as is often standard on the internet regarding data protection. We hope you find the following explanations interesting and informative and perhaps discover information you were not previously aware of.

If you still have questions, we kindly ask you to contact the responsible entity listed below or in the legal notice, follow the available links, and consult further information on third-party websites. Our contact details can of course also be found in the legal notice.

Scope of Application

This Privacy Policy applies to all personal data processed by us within the company and to all personal data processed by companies commissioned by us (processors). Personal data refers to information within the meaning of Article 4(1) GDPR, such as a person’s name, email address, or postal address. The processing of personal data enables us to offer and invoice our services and products, whether online or offline.

The scope of this Privacy Policy includes:

• All online presences (websites, online shops) operated by us
• Social media appearances and email communication
• Mobile apps for smartphones and other devices

In short: This Privacy Policy applies to all areas in which personal data is systematically processed within the company through the aforementioned channels. Should we enter into legal relations with you outside these channels, we will inform you separately if necessary.

Legal Bases

In this Privacy Policy, we provide transparent information about the legal principles and regulations – i.e., the legal bases of the GDPR – that enable us to process personal data.

With regard to EU law, we refer to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. You can, of course, read the GDPR online on EUR-Lex at:
https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32016R0679

We process your data only if at least one of the following conditions applies:

Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be storing the data you entered in a contact form.

Contract (Article 6(1)(b) GDPR): We process your data to fulfill a contract or pre-contractual obligations with you. For example, if we conclude a purchase agreement with you, we require personal information in advance.

Legal obligation (Article 6(1)(c) GDPR): If we are subject to a legal obligation, we process your data. For example, we are legally required to retain invoices for accounting purposes. These usually contain personal data.

Legitimate interests (Article 6(1)(f) GDPR): In cases of legitimate interests that do not override your fundamental rights, we reserve the right to process personal data. For example, we must process certain data to operate our website securely and efficiently. This processing therefore constitutes a legitimate interest.

Other legal bases, such as the performance of tasks carried out in the public interest or the protection of vital interests, generally do not apply in our case. If such a legal basis becomes relevant, it will be indicated in the appropriate section.

In addition to the EU Regulation, national laws also apply:

• In Austria: the Federal Act concerning the Protection of Natural Persons with regard to the Processing of Personal Data (Data Protection Act – DSG).
• In Germany: the Federal Data Protection Act (BDSG).

If further regional or national laws apply, we will inform you in the following sections.

Contact Details of the Controller

If you have any questions regarding data protection or the processing of personal data, please find below the contact details of the responsible person or entity:

Loofahcrafts (Hemeada e.U.)
Baumgasse 50 Top 6-7
1030 Vienna
Austria

Email: info@loofahcrafts.shop

Data Retention Period

As a general rule, we store personal data only for as long as is absolutely necessary to provide our services and products. This means that we delete personal data as soon as the reason for data processing no longer applies.

In some cases, we are legally obligated to retain certain data even after the original purpose has ceased to apply, for example for accounting purposes.

If you wish to request deletion of your data or withdraw your consent to data processing, the data will be deleted as quickly as possible, provided there is no legal obligation to retain it.

We will inform you about the specific duration of the respective data processing further below, where additional details are available.

Your Rights under the GDPR

In accordance with Articles 13 and 14 GDPR, we inform you about the following rights to ensure fair and transparent data processing:

• Right of access (Article 15 GDPR): You have the right to know whether we process your data. If so, you are entitled to receive a copy of the data and information about the purpose of processing, categories of data processed, recipients of the data, storage period, your rights to rectification or erasure, and whether profiling is carried out.

• Right to rectification (Article 16 GDPR): You have the right to have incorrect data corrected.

• Right to erasure (Article 17 GDPR): You have the right to request deletion of your data (“right to be forgotten”).

• Right to restriction of processing (Article 18 GDPR): We may only store your data but not further process it.

• Right to data portability (Article 20 GDPR): Upon request, we provide your data in a commonly used format.

• Right to object (Article 21 GDPR): You may object to processing based on legitimate interest or public interest.

• Right not to be subject to automated decision-making (Article 22 GDPR): Under certain circumstances, you have the right not to be subject to decisions based solely on automated processing (including profiling).

• Right to lodge a complaint (Article 77 GDPR): You may lodge a complaint with a supervisory authority if you believe that data processing violates the GDPR.

In short: You have rights – do not hesitate to contact the responsible entity listed above.

The competent supervisory authority in Austria is:
Austrian Data Protection Authority
Barichgasse 40-42, 1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

Data Transfer to Third Countries

We transfer or process data in countries outside the scope of the GDPR (third countries) only if you consent to such processing or if another legal basis exists.

This particularly applies if processing is legally required or necessary for the performance of a contract. In many cases, your consent is the primary reason for processing data in third countries.

Processing personal data in third countries such as the United States – where many software providers operate and host their servers – may mean that personal data is processed and stored in unexpected ways.

According to the European Court of Justice, an adequate level of protection for data transfers to the United States currently exists only if a U.S. company participating in the EU–US Data Privacy Framework actively processes personal data of EU citizens.

Further information can be found at:
https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en

Where possible, we aim to use server locations within the EU.

Security of Data Processing

To protect personal data, we have implemented both technical and organizational measures. Where possible, we encrypt or pseudonymize personal data to make it as difficult as possible for third parties to draw conclusions about personal information.

Article 25 GDPR refers to “data protection by design and by default,” meaning that security measures are considered both in software (e.g., forms) and hardware (e.g., server room access).

TLS Encryption with HTTPS

We use HTTPS (Hypertext Transfer Protocol Secure) to transmit data securely over the internet.

This means that the entire transmission of all data from your browser to our web server is encrypted and protected – no one can “listen in.”

The use of TLS (Transport Layer Security) ensures the protection of confidential data.

You can recognize the use of this security feature by the small lock symbol in your browser and the use of “https” in our web address.

Communication

Summary

Affected persons: Anyone who communicates with us via phone, email, or online form
Processed data: e.g., phone number, name, email address, entered form data
Purpose: Handling communication with customers and business partners
Storage period: Duration of the business case and statutory requirements
Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contract), Article 6(1)(f) GDPR (legitimate interests)

When you contact us by phone, email, or online form, personal data may be processed.

The data is processed for handling your inquiry and the related business matter. Data is stored only as long as necessary or as required by law.

Telephone

When you call us, call data may be pseudonymized and stored on the respective device and by the telecommunications provider. Data such as name and phone number may also be sent by email afterward and stored for responding to your inquiry. Data is deleted once the matter is concluded and legal requirements permit deletion.

Email

When you communicate with us by email, data may be stored on the respective device and on the email server. Data is deleted once the matter is concluded and legal requirements permit deletion.

Online Forms

When you communicate with us via online forms, data is stored on our web server and may be forwarded to one of our email addresses. Data is deleted once the matter is concluded and legal requirements permit deletion.

Legal Bases

Processing is based on:

• Article 6(1)(a) GDPR (Consent)
• Article 6(1)(b) GDPR (Contract)
• Article 6(1)(f) GDPR (Legitimate Interests)

We aim to handle customer inquiries and business communication professionally and efficiently, which requires the use of certain technical infrastructure such as email programs, servers, and telecommunications providers.