Privacy Policy

This is a convenience translation. Only the German version of this privacy policy is legally binding.

Controller

Mag. Lukas Kirschbichler Am Weiher 4, 4645 Grünau im Almtal, Austria Email: maplovecc@gmail.com Telephone: 0660/4022786

Data collected

When you place an order

Name, postal address, email address, telephone number (optional), payment data (processed by the payment service provider), IP address, order data and individual design specifications for your product.

When you visit the website

IP address, browser type and version, operating system, referrer URL, pages accessed, date and time of access.

Purpose and legal basis of processing

• Performance of contract: To carry out your order and delivery (Art. 6 Abs. 1 lit. b DSGVO (GDPR))
• Legal obligations: To comply with retention obligations under tax law and commercial law (Art. 6 Abs. 1 lit. c DSGVO)
• Legitimate interests: To improve our website and to prevent fraud (Art. 6 Abs. 1 lit. f DSGVO)
• Consent: For newsletters and marketing, only with your express consent (Art. 6 Abs. 1 lit. a DSGVO)

Recipients of the data

• Payment service providers (e.g. Stripe) for payment processing
• Print-on-demand service provider (Gelato) for production and shipping
• Shipping service providers for delivery
• Hosting providers (Vercel, Cloudflare) for technical operation

We have concluded data processing agreements pursuant to Art. 28 DSGVO (GDPR) with service providers that process personal data on our behalf (processors, e.g. for hosting, database, email delivery and printing). Payment service providers (Stripe) and shipping providers partly process the data required for payment processing or delivery as independent controllers; in that respect their own privacy notices also apply.

Transfer of data to third countries

Some of our service providers are based in the USA. Transfers take place on the basis of standard contractual clauses (Art. 46 Abs. 2 lit. c DSGVO) or the EU-US Data Privacy Framework.

Storage period

• Order data: 7 years (statutory retention obligation under the BAO)
• Customer account data: Until your account is deleted
• Website log data: 14 days
• Newsletter consents: Until withdrawn

Your rights

• Right of access (Art. 15 DSGVO)
• Right to rectification (Art. 16 DSGVO)
• Right to erasure (Art. 17 DSGVO)
• Right to restriction of processing (Art. 18 DSGVO)
• Right to data portability (Art. 20 DSGVO)
• Right to object (Art. 21 DSGVO)
• Right to withdraw consent given (Art. 7 Abs. 3 DSGVO)

To exercise your rights, please contact: maplovecc@gmail.com

Right to lodge a complaint

You have the right to lodge a complaint with the Austrian Data Protection Authority: Österreichische Datenschutzbehörde Barichgasse 40-42, 1030 Wien Email: dsb@dsb.gv.at Website: https://www.dsb.gv.at

Cookies

Our website uses cookies. Technically necessary cookies are set on the basis of Art. 6 Abs. 1 lit. f DSGVO. For analytics and marketing cookies, we obtain your consent in accordance with Art. 6 Abs. 1 lit. a DSGVO.

Security

We use technical and organisational security measures to protect your data against manipulation, loss, destruction or access by unauthorised persons. Our security measures are continuously improved in line with technological developments.

Web analytics with PostHog

This website uses PostHog (PostHog Inc., hosted on EU servers in Frankfurt am Main, Germany) for the anonymised analysis of your usage behaviour. PostHog helps us understand which features are used and where there is a need for optimisation.

Data collected: page views, click events on certain product features (opening the editor, searching for a location, selecting a theme, placing an order), device type, browser, anonymised IP address.

Legal basis: Art. 6 Abs. 1 lit. a DSGVO (consent). You can withdraw this consent at any time via our cookie settings.

Storage period: The data is stored on PostHog servers in the EU for a maximum of 365 days. If you withdraw your consent, your data will be deleted promptly.

Provider: PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. For EU users, all data is processed exclusively on EU servers (Frankfurt). PostHog privacy policy: https://posthog.com/privacy

Retargeting with the Meta Pixel (if active)

If you have consented to the marketing category, we use the Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) to measure the effectiveness of our advertisements on Facebook and Instagram and to show you more relevant ads.

Legal basis: Art. 6 Abs. 1 lit. a DSGVO. Meta privacy policy: https://www.facebook.com/privacy/policy

Sending emails with Resend

For transactional emails (order confirmations, shipping information, password resets) and the optional newsletter, we use the service Resend, Inc. (San Francisco, USA).

Data processed: email address, first name and surname (if provided), order number and order contents.

Legal basis: Art. 6 Abs. 1 lit. b DSGVO (performance of contract) or, as applicable, Art. 6 Abs. 1 lit. a DSGVO (consent, in the case of the newsletter).

Third-country transfer: USA. Resend is certified under the EU-US Data Privacy Framework (DPF); standard contractual clauses are additionally in place.

Storage period: Until you unsubscribe from the newsletter or until the end of the contract, as applicable; plus statutory retention periods (UGB/BAO).

Resend privacy policy: https://resend.com/legal/privacy-policy

Retargeting with the Pinterest Tag (if active)

If you have consented to the marketing category, we use the Pinterest Tag of Pinterest, Inc. (San Francisco, USA) to measure the effectiveness of our Pinterest advertisements.

Data processed: truncated IP address, browser and device information, pages visited, order conversions.

Legal basis: Art. 6 Abs. 1 lit. a DSGVO (consent via the cookie banner).

Third-country transfer: USA. Pinterest is certified under the EU-US Data Privacy Framework.

Withdrawal: At any time via the cookie banner (click on the cookie icon at the bottom left) or via the privacy settings of your Pinterest account.

Pinterest privacy policy: https://policy.pinterest.com/de/privacy-policy

Database hosting with Neon

Our application data (customer accounts, orders, saved designs, newsletter list) is stored in an encrypted PostgreSQL database of Neon, Inc. (San Francisco, USA), operated in data centres within the EU.

Data processed: all account and order data that you actively transmit to us.

Legal basis: Art. 6 Abs. 1 lit. b DSGVO (performance of contract).

Third-country transfer: Neon is certified under the EU-US Data Privacy Framework; a data processing agreement (AVV) pursuant to Art. 28 DSGVO is in place; data processing takes place exclusively in EU data centres.

Neon privacy policy: https://neon.com/privacy-policy