Privacy policy

Privacy Policy

Last updated: 09.08.2026

  1. Controller

Wimpire e.U.
Merangasse 73/Top 3A
8010 Graz
Austria
E-mail: wimpire.shop@gmail.com

  1. General

We process personal data exclusively within the framework of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act. Below we inform you which data we process, for which purposes, on which legal basis and for how long.

  1. Visiting our website

When you visit our website, technically necessary data is processed, in particular your IP address, the date and time of access, the pages accessed, the browser type and the operating system.

Purpose: provision and security of the website.
Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a secure and functioning online presence.
Storage period: as a rule up to 30 days in the server logs.

  1. Orders and contract processing

When you place an order, we process your name, your billing and delivery address, your e-mail address, where applicable your telephone number, as well as order and payment data.

Purpose: processing of the purchase contract, shipping, invoicing, handling of returns and warranty cases.
Legal basis: Art. 6 (1) (b) GDPR for the performance of the contract and Art. 6 (1) (c) GDPR for tax and commercial retention obligations.
Storage period: documents relevant for invoicing are kept for seven years pursuant to Section 132 of the Austrian Federal Fiscal Code. Other order data is deleted once it is no longer required.

  1. Customer account

If you create a customer account, we process the data you provide as well as your order history.

Purpose: management of your account and simplification of future orders.
Legal basis: Art. 6 (1) (b) GDPR.
Storage period: until the account is deleted.

  1. Contacting us

If you contact us by e-mail, we process the information you provide in order to handle your enquiry.

Legal basis: Art. 6 (1) (b) GDPR for enquiries relating to a contract, otherwise Art. 6 (1) (f) GDPR.
Storage period: until your enquiry has been dealt with, unless retention obligations apply.

  1. Shop platform

Our online shop is operated on the Shopify platform. Shopify International Limited, 2nd Floor 1-2 Victoria Buildings, Haddington Road, Dublin 4, Ireland, processes the data on our behalf as a processor on the basis of an agreement pursuant to Art. 28 GDPR. Data is stored within the European Union. Where a transfer to third countries takes place in individual cases, it is based on the standard contractual clauses of the European Commission.

  1. Payment processing

Payment is processed via Shopify Payments. Depending on the payment method selected, your payment data is transmitted to the respective payment service provider. The methods offered are Shop Pay, credit card (Visa, Mastercard, American Express, Maestro, UnionPay), Apple Pay, Google Pay, PayPal and the local payment methods Bancontact, BLIK, EPS, iDEAL/Wero, Klarna and MobilePay.

If you select PayPal, your data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. If you select Klarna, your data is transmitted to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Both providers are independently responsible for this processing and process the data for purposes including payment processing and fraud prevention.

Purpose: processing of payment and fraud prevention.
Legal basis: Art. 6 (1) (b) GDPR and Art. 6 (1) (f) GDPR with regard to fraud prevention.

We do not store your full credit card details and cannot view them.

  1. Shipping

In order to deliver your order, we transmit your name, your delivery address and, where necessary for delivery, your e-mail address or telephone number to Österreichische Post AG, Rochusplatz 1, 1030 Vienna, and to the partner company engaged by the Austrian Post for delivery in the destination country.

Legal basis: Art. 6 (1) (b) GDPR.

  1. Cookies and consent management

We use technically necessary cookies that are required for the operation of the shop, the shopping cart and the ordering process.
Legal basis: Art. 6 (1) (f) GDPR in conjunction with Section 165 (3) of the Austrian Telecommunications Act 2021.

Cookies and comparable technologies for personalisation, marketing and analytics are only used after your express consent given through our consent banner.
Legal basis: Art. 6 (1) (a) GDPR in conjunction with Section 165 (3) of the Austrian Telecommunications Act 2021.

You can change or withdraw your consent at any time with effect for the future using the Cookie settings link in the footer of our website. The lawfulness of processing carried out before withdrawal remains unaffected.

  1. Meta Pixel

After your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. This allows us to record your interactions with our shop in order to measure the effectiveness of our advertising and to show you interest-based advertising on Meta platforms.

We and Meta are joint controllers for the collection and transmission of this data pursuant to Art. 26 GDPR. Any further processing by Meta is carried out under Meta's sole responsibility. A transfer to the USA may take place and is based on the adequacy decision of the European Commission regarding the EU-US Data Privacy Framework and, additionally, on the standard contractual clauses.

Legal basis: Art. 6 (1) (a) GDPR.

  1. Google Analytics

After your consent, we use Google Analytics 4 of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This allows us to analyse how our website is used in order to improve it. Your IP address is processed in shortened form.

Legal basis: Art. 6 (1) (a) GDPR.

  1. Google Ads and Google Merchant Center

After your consent, we use Google Ads services in order to measure the effectiveness of our advertising and to display interest-based advertising.

Via the Google Merchant Center we transmit our product data to Google. Personal data of our customers is not transferred in this process.

A transfer to the USA may take place and is based on the adequacy decision of the European Commission regarding the EU-US Data Privacy Framework and, additionally, on the standard contractual clauses.

Legal basis: Art. 6 (1) (a) GDPR.

  1. Product reviews

We use the service Judge.me to collect and display product reviews. If you receive a review invitation or submit a review, the data required for this is processed and the review is published together with the name you provide.

Legal basis: Art. 6 (1) (a) GDPR.
Storage period: until withdrawal of consent or deletion of the review.

  1. Promotions and gift function

We use the service BOGOS.io to display promotions and free items in the shopping cart. Usage data relating to your cart is processed for this purpose. Processing only takes place after your consent given through the consent banner.

Legal basis: Art. 6 (1) (a) GDPR.

  1. Newsletter and promotional e-mails

During the ordering process you have the option of consenting to receive promotional e-mails. If you consent, we store your e-mail address together with the time and content of your consent so that we can send you information about our products and offers.

Legal basis: Art. 6 (1) (a) GDPR.
Storage period: until you withdraw your consent. We retain proof of consent beyond this period in order to fulfil our obligations of evidence.

You can withdraw your consent at any time, either using the unsubscribe link in every promotional e-mail or by message to wimpire.shop@gmail.com.

  1. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on a legitimate interest (Art. 21). You may withdraw any consent given at any time with effect for the future.

A message to wimpire.shop@gmail.com is sufficient to exercise your rights.

  1. Right to lodge a complaint

If you consider that the processing of your data infringes the GDPR, you may lodge a complaint with the supervisory authority. In Austria this is

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Vienna
dsb@dsb.gv.at

  1. No automated decision-making

Automated decision-making, including profiling, producing legal effects concerning you does not take place.

  1. Changes

We will adapt this Privacy Policy if our processing activities or the legal framework change. The version published on this page applies.