Privacy Policy

1. Controller

Waldart GmbH, Grünstraße 12, 1010 Wien, Austria — office@waldart.co, +43 1 960 960 600.

2. What data we process, why, and on which legal basis

a) Order and contract data (name, delivery address, email, phone, ordered items, payment status, chosen language): processed to conclude and perform the purchase contract, including delivery, invoicing and handling of warranty and withdrawal cases. Legal bases: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (statutory retention duties).

b) Payment data: payments are processed by Stripe Payments Europe, Ltd. (Dublin, Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). We never receive your full card data; we receive confirmation of payment and a transaction reference. Legal basis: Art. 6(1)(b) GDPR.

c) Contact and quote requests: name, email and the content of your message, processed to answer your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR (legitimate interest in customer communication).

d) Server log data (IP address, timestamp, requested URL, user agent): processed for operation, stability and security of the website. Legal basis: Art. 6(1)(f) GDPR. Logs are deleted or anonymized within a short rotation period.

e) Cookies: we use strictly necessary cookies only — see our Cookie Policy. No consent-requiring analytics or marketing cookies are set.

3. Recipients

We share personal data only as needed: payment providers (Stripe, PayPal), delivery carriers (e.g. Österreichische Post, DPD, GLS — name and delivery address), our hosting provider (DigitalOcean, LLC), and our email service provider. These providers process data as processors under Art. 28 GDPR or as independent controllers (payment providers, carriers).

4. Transfers to third countries

Where providers process data outside the EU/EEA (e.g. DigitalOcean, LLC, USA), transfers are based on an adequacy decision (EU–US Data Privacy Framework) and/or standard contractual clauses pursuant to Art. 46 GDPR.

5. Retention

Contract, invoicing and accounting records are retained for seven years pursuant to § 132 Bundesabgabenordnung (BAO) and § 212 UGB. Contact requests are deleted once the matter is concluded, unless a contract follows. Log data is short-lived (see above).

6. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future.

You also have the right to lodge a complaint with the supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb.gv.at.

7. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

8. Data security

The website is served exclusively over TLS-encrypted connections. Access to personal data is restricted to persons who need it for the purposes above.