Privacy policy

(Last updated: October 2025)

We, Glavienne Designs e.U. operate this online shop and the associated website, including all related information, content, functions, products, and services (the “Services”). We take the protection of your personal data very seriously and process it exclusively in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Controller

The controller responsible for the processing of your personal data is:

Glavienne Designs e.U.
Oberlaaer Straße 206/10
1100 Vienna, Austria
E-mail: glaviennedesigns@gmail.com

2. Categories of Personal Data

We may process the following categories of personal data:

Contact details: name, address, phone number, email address
Payment data: payment method, billing and shipping address, bank or credit card details
Account data: username, password, preferences
Order and transaction data: cart, wishlist, purchases, returns
Communication data: content of support requests or messages
Usage and device data: IP address, browser type, device information, log files
Cookies and tracking data (where consent is given)

3. Purposes and Legal Bases of Processing

We process your personal data for the following purposes and based on these legal grounds:

Performance of a contract (Art. 6 (1) (b) GDPR)
- Processing and shipping of orders, returns, customer support
- Management of your customer account
Compliance with legal obligations (Art. 6 (1) (c) GDPR)
- Statutory retention requirements under tax and commercial law (typically 7 years)
Legitimate interests (Art. 6 (1) (f) GDPR)
- Improving and securing our Services
- Fraud prevention and IT security
- Direct marketing of our own similar products (unless you object)
Consent (Art. 6 (1) (a) GDPR)
- Sending newsletters and marketing communications
- Using cookies/tracking for analytics and marketing
- Participation in promotions or surveys

You can withdraw your consent at any time with effect for the future.

4. Data Retention

We retain personal data only as long as necessary for the stated purposes:

Contract and order data: 7 years (due to tax and commercial law obligations)
Communication data: for as long as required to process your inquiry
Marketing data: until consent is withdrawn or you object
Usage and tracking data: according to your consent and cookie storage periods

5. Recipients of Data

We only share your personal data with third parties where this is legally permitted or where you have provided consent. Possible recipients include:

Shopify (hosting, shop operation, payment and logistics support)
Payment service providers and banks
Shipping and logistics providers
IT service providers, hosting providers
Marketing and analytics partners (only with your consent)

We have concluded Data Processing Agreements (Art. 28 GDPR) with all processors.

Note on Shopify:
Our Services are hosted by Shopify (Shopify International Ltd., Ireland). Shopify may also process data outside the EU. In such cases, EU Standard Contractual Clauses are used to ensure an adequate level of protection. More information: https://www.shopify.com/legal/privacy.

6. Cookies and Tracking

Our website uses cookies and similar technologies. These serve the following purposes:

Technically necessary cookies (e.g. cart, login, security)
Statistics and analytics (e.g. Shopify Analytics, Google Analytics – only with consent)
Marketing and personalization (e.g. retargeting, personalized ads – only with consent)

You can manage or withdraw your consent at any time via the cookie banner.

7. Your Rights

Under the GDPR, you have the following rights:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing based on legitimate interests (Art. 21 GDPR)
Right to withdraw consent (Art. 7 (3) GDPR)

To exercise these rights, please contact us at: glaviennedesigns@gmail.com.

You also have the right to lodge a complaint with your local data protection authority. In Austria:
Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna

8. International Data Transfers

If personal data is processed outside the EU/EEA, we ensure an adequate level of protection through appropriate safeguards (e.g. EU Standard Contractual Clauses).

9. Data Security

We implement appropriate technical and organizational measures to protect your data against manipulation, loss, or unauthorized access. However, no transmission over the Internet is ever completely secure.

10. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our Services. The current version is always available on our website.

Contact