Privacy Policy

Controller

The protection of your data is important to us. This policy informs you about which personal data we process and for which purposes – concise, clear and complete.

Hosting and server logs

Our website is hosted by Kinsta Inc. (with infrastructure in the EU) and delivered via the Cloudflare content delivery network. When you access the website, the server processes technically necessary data (IP address, date and time, page accessed, browser type) in log files – the legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). All transmissions are TLS-encrypted throughout.

Cookies and consent

We use three categories of cookies: necessary (basket, login, cookie preference – the shop does not work without these), statistics and marketing. We set statistics and marketing cookies exclusively with your consent (Art. 6(1)(a) GDPR), which you give on your first visit via the cookie banner and which you can withdraw or adjust at any time via the “Cookie settings” link in the footer.

Web analytics (Google Analytics 4)

With your consent, we use Google Analytics 4 (Google Ireland Ltd.) to analyse the use of our website. We have implemented Google Consent Mode v2: without your consent, no analytics cookies are set and no identifiers are transmitted. IP addresses are not stored by Google Analytics 4. A transfer to the USA is possible; it is based on the adequacy decision for the EU-US Data Privacy Framework. You can withdraw your consent at any time via the cookie settings.

With your marketing consent, we additionally activate Google signals (advertising features of Google Analytics): Google links session data with the Google accounts of signed-in users who have consented to personalised advertising and provides us exclusively with aggregated reports derived from this – for example demographic characteristics (age, gender, interests) and cross-device usage. It is not possible for us to draw any conclusions about individual persons. We use this data to evaluate and manage our advertising campaigns (e. g. remarketing via Google Ads). When a purchase is made, we transmit – again only with your marketing consent – your email address in hashed, pseudonymised form to Google Analytics in order to measure conversions in a privacy-friendly way (user-provided data / enhanced conversions). You can view and deactivate this linking in your Google account under “My Activity” and withdraw your consent at any time via the cookie settings in the footer.

Orders, customer account and payment service providers

In order to process your order, we process your order, address and contact data (Art. 6(1)(b) GDPR). Retention obligations under tax and company law (§ 132 BAO – Bundesabgabenordnung, the Austrian Federal Fiscal Code: 7 years) remain unaffected. You can have your customer account deleted at any time in your account settings.

Payments are handled by certified payment service providers: WooPayments/Stripe (cards, Apple Pay, Google Pay), PayPal and Klarna. Your payment data is processed directly by the respective provider and does not reach our servers. For details, please refer to the privacy notices of the provider concerned.

Shipping service providers

For delivery purposes, we transmit your name, your delivery address and – for delivery notifications – your email address to the commissioned shipping service provider (DPD Austria GmbH or GLS Austria GmbH), Art. 6(1)(b) GDPR.

Address autofill and maps (Google Places)

In the order form, we offer address completion via the Google Places API. The service is only loaded once you actively use the address field; your entry is then transmitted to Google. Use of this feature is optional – you can of course also enter your address manually.

Signing in with Google

Optionally, you can register and sign in with your Google account (“Sign in with Google”). In doing so, we receive your name and your email address from Google in order to create your account (Art. 6(1)(b) GDPR). No further Google data is retrieved.

Emails about news and reviews

We send emails about news and benefits, as well as invitations to review products, only with your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time in your account settings under “Communication & benefits” or by sending us a message.

Your rights

• Access to the data we store about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To do so, simply contact us informally at office@flunatec.com. You also have the right to lodge a complaint with the Austrian Data Protection Authority (www.dsb.gv.at).