Privacy policy
Privacy Policy
We process the following categories of your personal data:
- Contact data (e.g., name, e-mail address, phone number)
- Contract data (e.g., shipping address, billing address, ordered products, order details)
- Payment data (e.g., preferred payment method, transaction details)
- Technical data (e.g., IP address, browser type, usage data of the online shop)
Legal basis: Consent
You have voluntarily provided us with personal data which we process with your consent for the following purposes:
- Purpose: Sending our e-mail newsletter, providing personalized offers, and direct marketing.
You can withdraw this consent at any time. Withdrawal will result in your data no longer being processed for the above purposes from that time on. To withdraw your consent, please contact us by e-mail at: hello@delilunne.com
Legal basis: Performance of a contract
The data you have provided are required for the performance of a contract or to take steps prior to entering into a contract (e.g., processing an order in our online shop). Without these data, we cannot conclude the contract with you or fulfill your order.
Purpose of data processing: Processing, handling, and shipping orders placed through our Shopify online store.
Legal basis: Legal obligation
We have a legal obligation to process the data we received from you.
Purpose of data processing: Compliance with statutory retention obligations (in particular, pursuant to the Austrian Federal Fiscal Code – BAO and the Commercial Code – UGB, which require invoices and accounting records to be retained for 7 years).
The non-provision of your data means we cannot comply with our legal accounting obligations and therefore cannot conclude a purchase contract with you.
Legal basis: Legitimate interests
We process your personal data based on our legitimate interests or those of a third party.
Purpose of data processing and justification: Ensuring IT security, fraud prevention in the online shop, technical optimization of the website, and conducting basic statistical analysis to improve our store.
Data transfers (Processors)
We use the following processors for this data processing, who act on our behalf:
| Category of Processor | Subject of Processing / Transferred Data |
|---|---|
| Shopify Inc. (E-commerce platform) | Provision of online shop infrastructure, hosting, order management, shopping cart, and customer database. |
| Payment service providers (e.g., Stripe, PayPal, Klarna) | Processing and securing payments (payment data, invoice amounts). |
| Shipping service providers (e.g., Österreichische Post AG, DHL) | Delivery of ordered goods (shipping address, name, e-mail for tracking if applicable). |
The appropriate level of protection derives from an adequacy decision of the European Commission pursuant to Article 45 GDPR (as Shopify Inc. is headquartered in Canada, which is recognized by the EU Commission as a safe third country, and under the EU-US Data Privacy Framework for US-based services).
Retention period
We store your personal data as follows:
- Contract and billing data: For a period of 7 years from the end of the calendar year of the order (pursuant to the legal retention obligation under § 132 BAO in Austria).
- Contact data for direct marketing (Newsletter): Until you withdraw your consent (unsubscribing from the newsletter).
- Technical data (Logfiles/IP addresses): For a maximum period of 30 days to ensure IT security, after which they are automatically deleted or anonymized.
Information on legal remedies
Because we process the data on the basis of our own legitimate interests, you have a right to object to this processing of personal data on grounds relating to your particular situation.
Because we process the data for direct advertising, you can at any time object to this processing for purposes of direct advertising (e.g., by clicking the unsubscribe link in any newsletter).
Basically, you have the right to access, rectification, erasure, restriction, data portability and to object. Contact us about this.
If you believe that the processing of your data contravenes data-protection law or your legal claim to protection of your data has been violated in some other way, you can complain to the supervisory authorities. The Data Protection Authority (Datenschutzbehörde) is responsible for this in Austria.
Contact details
You can reach us at:
Khrystyna Hen
Address: Kaiserstraße 14/12, 1070 Wien, Austria
E-mail: hello@delilunne.com
Supervisory authority for compliance with data protection regulations in Austria:
Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Wien
Phone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at
Website: www.dsb.at