Privacy policy

This English version is provided for convenience. The German version is legally binding.

Version: [Date of publication]

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

[Company name as registered, e.g. Vantok GmbH]

[Street and number, postcode Vienna, Austria]

Email: [info@vantok.at]

2. What data we process

2.1 When you visit the website

When you open the website, our hosting provider processes technically necessary data such as IP address, browser type and time of access in order to deliver the page and protect it against misuse. Legal basis: Art 6 (1) (f) GDPR (legitimate interest in the secure operation of the website).

2.2 In the configurator

Your configuration (category, dimensions, material, colour, features, quantity) contains no information about you as a person. It is sent to our server to calculate the price. An optionally uploaded photo of your room stays in your browser and is not transmitted to us. Legal basis: Art 6 (1) (b) GDPR (pre-contractual measures).

2.3 When you order

For your order we process your name, delivery and billing address, email address, phone number if provided, your configuration and payment information. Ordering and payment are handled by our shop provider Shopify. Legal basis: Art 6 (1) (b) GDPR (performance of contract) and Art 6 (1) (c) GDPR (statutory retention obligations).

2.4 Customer account

You can optionally use a customer account. Sign-in is handled by Shopify. In the account we store your email address, your orders and the configurations you save yourself. Legal basis: Art 6 (1) (b) GDPR. You can delete saved configurations at any time and request deletion of your account by email.

2.5 Contact

If you write to us by email or via the contact form, we process your details (name, email address, message) to answer your enquiry. Legal basis: Art 6 (1) (f) GDPR, or Art 6 (1) (b) GDPR if the enquiry concerns an order.

2.6 Production, delivery and assembly

For production and delivery, we pass on your configuration as well as your name, delivery address and phone number if provided to our production partner and the delivery service. Legal basis: Art 6 (1) (b) GDPR.

3. Recipients and service providers

We use the following service providers:

• Shopify (shop system, checkout, payment processing and customer account): Shopify International Limited, Ireland. Data may also be transferred to Shopify companies in Canada and the USA. [Check and add the legal basis for the transfer.]
• Vercel (website hosting): Vercel Inc., USA. [Check and add the legal basis for the transfer, e.g. EU-US Data Privacy Framework.]
• [Name of production partner, registered office] (production)
• [Name of delivery service, registered office] (delivery)
• [Accounting or tax advisory service provider] (accounting)

With service providers that process data on our behalf, we conclude data processing agreements pursuant to Art 28 GDPR.

4. Cookies

We only use technically necessary cookies: they keep you signed in during sign-in and while you are logged in to your customer account. No consent is required for this (§ 165 (3) TKG 2021). We do not use analytics or marketing cookies.

At the Shopify checkout, Shopify sets its own cookies that are required for checkout and payment. Details can be found in Shopify’s privacy policy.

5. Retention period

We only store personal data for as long as necessary for the respective purpose. We keep order and invoice data for seven years due to the statutory retention obligation (§ 132 BAO).

6. Your rights

You have the right to:

• access (Art 15 GDPR)
• rectification (Art 16 GDPR)
• erasure (Art 17 GDPR)
• restriction of processing (Art 18 GDPR)
• data portability (Art 20 GDPR)
• object (Art 21 GDPR)

To exercise these rights, write to us at [info@vantok.at]. You can also lodge a complaint with the Austrian Data Protection Authority: www.dsb.gv.at

7. Changes

We update this privacy policy when our processes or the legal situation change.