Privacy policy
Petal Damage is operated by Lisa Pfeiffer as an Einzelunternehmen. We take the protection of your personal data seriously.
This Privacy Policy explains how we collect, use, store and otherwise process personal data when you visit our website, contact us, purchase an item from us, interact with us through social-media platforms or otherwise use our services.
1. Controller
The controller responsible for the processing of your personal data is:
Petal Damage
Lisa Pfeiffer – Einzelunternehmen
Rusterstraße 2
7072 Mörbisch am See
Austria
Email: petaldamage@gmail.com
Phone: +43 664 88789833
For the purposes of the General Data Protection Regulation (GDPR), Lisa Pfeiffer is the controller of the personal data processed by Petal Damage.
2. Personal Data We Process
Depending on how you interact with Petal Damage, we may process the following categories of personal data:
- name and contact details;
- email address and telephone number;
- billing and shipping address;
- information relating to orders and purchases;
- information about items purchased, requested, returned or refunded;
- payment-related information and payment status;
- communications with us, including emails, Instagram messages, TikTok messages and other customer enquiries;
- information necessary to process returns, refunds and customer-service requests;
- information provided through Vinted in connection with enquiries or transactions;
- technical information relating to your use of our website, such as IP address, browser type, device information and information about how you interact with the website; and
- information collected through cookies and similar technologies, subject to your cookie preferences and applicable law.
We only process personal data that is reasonably necessary for the relevant purpose.
We generally do not receive or store your full payment-card details when a payment is processed through an external payment provider such as PayPal.
3. How We Collect Personal Data
We may collect personal data:
- directly from you when you contact us, place an order, request information or otherwise communicate with us;
- when you use our Shopify-powered website;
- through Instagram when you contact or interact with our account;
- through TikTok when you contact or interact with our account;
- through Vinted when you communicate with us or purchase an item through the platform;
- through payment providers such as PayPal in connection with payments;
- through shipping and delivery providers when necessary to fulfil an order; and
- automatically through cookies and similar technologies when you use our website, subject to your cookie choices and applicable law.
4. How We Use Your Personal Data
We process personal data for the following purposes.
4.1 Processing and fulfilling orders
We use necessary personal data to process and fulfil purchases, confirm orders, arrange shipping, communicate with you about your order and process returns or refunds.
The legal basis is generally Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or for taking steps at your request before entering into a contract.
4.2 Customer communication
We process information you provide when you contact us by email, Instagram, TikTok, Vinted or another communication channel in order to respond to enquiries, provide product information, discuss potential or existing orders and provide customer support.
Depending on the circumstances, the legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual communication, or Article 6(1)(f) GDPR based on our legitimate interest in communicating with customers and managing our business.
4.3 Payment processing
We process information necessary to confirm and record payments and complete transactions.
For example, Instagram orders may be paid through PayPal. PayPal processes payment-related personal data according to its own privacy policy and terms.
The legal basis for our processing is generally Article 6(1)(b) GDPR and, where applicable, Article 6(1)(c) GDPR for compliance with legal obligations.
4.4 Shipping and delivery
We use your name, delivery address and other necessary contact information to arrange delivery through the relevant shipping provider.
The legal basis is Article 6(1)(b) GDPR.
4.5 Returns, refunds and warranty matters
We process personal data where necessary to handle withdrawals, returns, refunds, complaints, warranty matters and other customer-service requests.
The legal basis is generally Article 6(1)(b) GDPR and, where applicable, Article 6(1)(c) GDPR or Article 6(1)(f) GDPR.
4.6 Legal and accounting obligations
We may process and retain personal data where necessary to comply with legal obligations, including tax, accounting, record-keeping and other statutory requirements.
The legal basis is Article 6(1)(c) GDPR.
4.7 Protection of our rights and prevention of fraud or misuse
Where necessary, we may process personal data to protect our business, prevent fraudulent or abusive activity, establish or defend legal claims and enforce our contractual rights.
The legal basis is Article 6(1)(f) GDPR, based on our legitimate interests in protecting our business and legal rights.
4.8 Marketing
We may use personal data for promotional communications where permitted by applicable law.
Where consent is required, we will only send marketing communications or use marketing technologies after the required consent has been obtained.
Where we rely on consent, the legal basis is Article 6(1)(a) GDPR.
You may withdraw your consent to consent-based marketing at any time.
5. Shopify
Our website is operated using Shopify, a commerce platform provided by Shopify.
Shopify processes personal data on our behalf where necessary to provide the Shopify services we use.
Depending on the Shopify services and settings enabled on our store, Shopify may also process certain information as an independent controller for its own purposes.
This may include information relating to your use of the website, device information, cookies, shopping activity and interactions with Shopify services.
Shopify may transfer personal data outside the European Economic Area where permitted by applicable data-protection law and using appropriate safeguards.
For information about Shopify’s own processing of personal data, please refer to Shopify’s Privacy Policy and Shopify’s Consumer Privacy Policy.
6. Instagram and Meta
We use Instagram to display Petal Damage products and content, communicate with customers and provide information about our business.
If you contact us through Instagram, Meta may process personal data in accordance with its own privacy policy and terms.
Information that you voluntarily send to us through Instagram, such as messages, your name or information relating to an enquiry or purchase, may also be processed by Petal Damage for customer communication, pre-contractual communication, order processing and customer service.
We are not responsible for the independent processing of your personal data by Meta.
For information about processing carried out by Meta, please refer to Meta’s Privacy Policy.
7. TikTok
We use TikTok to share Petal Damage content, promote our products and communicate with users where applicable.
If you contact or interact with us through TikTok, TikTok may process personal data in accordance with its own privacy policy and terms.
Information that you voluntarily send to us through TikTok, such as messages or information relating to an enquiry or purchase, may also be processed by Petal Damage for customer communication, pre-contractual communication, order processing and customer service.
We are not responsible for the independent processing of your personal data by TikTok.
For information about processing carried out by TikTok, please refer to TikTok’s applicable Privacy Policy for users in the European Economic Area.
8. Vinted
We may use Vinted as a marketplace for the sale of certain items.
Where you communicate with us or purchase an item through Vinted, Vinted may process personal data in accordance with its own privacy policy and platform terms.
We may receive and process information necessary to communicate with you, complete the transaction, arrange delivery and handle customer-service matters.
We are not responsible for the independent processing of your personal data by Vinted.
For information about processing carried out by Vinted, please refer to Vinted’s applicable privacy information.
9. PayPal and Other Payment Providers
Depending on the payment method used for an order, payment information may be processed by the relevant payment provider.
For direct orders, we may use PayPal.
Payment providers process personal data according to their own privacy policies and terms.
We generally do not receive or store your full payment-card details ourselves when those details are entered directly with the payment provider.
10. Shipping Providers
To deliver your order, we may provide the relevant shipping provider with information such as:
- your name;
- delivery address; and
- contact information where necessary for delivery.
This processing is necessary to fulfil your order.
11. Cookies and Similar Technologies
Our Shopify-powered website uses cookies and similar technologies.
The cookie-preference tool on our website allows you to choose which optional categories of cookies you allow.
Our cookie settings currently distinguish between the following categories:
11.1 Required Cookies
Required cookies are necessary for the website to function properly.
They may be used for essential functions such as:
- website security;
- shopping-cart functionality;
- checkout functionality;
- maintaining essential website settings; and
- remembering your cookie preferences.
These cookies may remain active even if you choose to decline optional cookies because they are necessary for the operation of the website.
11.2 Personalization Cookies
Personalization cookies and similar technologies may store information about your actions and preferences in order to personalize your experience on the website.
These technologies are used only where permitted by applicable law and, where required, with your consent.
11.3 Analytics Cookies
Analytics cookies and similar technologies help us understand how visitors use our website, for example which pages are visited and how visitors interact with the website.
We may use this information to understand website performance and identify areas for improvement.
Where consent is required, analytics technologies are only activated after you have provided the required consent.
11.4 Marketing Cookies
Marketing cookies, pixels and similar technologies may be used by Shopify and, where applicable, our marketing or advertising partners.
They may be used to measure advertising effectiveness, understand interactions with our website and provide or personalise advertising on other websites or platforms.
Where consent is required, marketing technologies are only activated after you have provided the required consent.
11.5 Managing Your Cookie Preferences
When you visit our website, you may use the cookie and privacy preferences tool to:
- accept all optional cookies;
- decline optional cookies; or
- save your individual choices.
You can change your choices later through the “Cookie preferences” option available in the website’s policies or footer area.
The exact cookies, pixels and similar technologies used on our website may change depending on the Shopify features, apps, integrations and services currently enabled.
Where required by law, non-essential cookies and similar technologies will not be activated before the necessary consent has been obtained.
12. Third-Party Websites and Links
Our website, Instagram account, TikTok account or other communications may contain links to third-party websites or platforms.
Those third parties process personal data under their own privacy policies and terms.
We are not responsible for the independent data-processing practices of third-party websites or platforms.
13. International Data Transfers
Some of the service providers we use may process personal data outside the European Economic Area.
This may include Shopify, social-media platforms, payment providers and other technology or service providers.
Where personal data is transferred outside the European Economic Area, we rely on an applicable legal transfer mechanism and appropriate safeguards where required by law, such as an adequacy decision or appropriate contractual safeguards.
The relevant third-party provider’s privacy policy may contain further information about its international data transfers.
14. How Long We Keep Personal Data
We retain personal data only for as long as necessary for the relevant purpose and in accordance with applicable legal requirements.
In particular:
- order and transaction information may be retained for the duration of applicable contractual and statutory limitation periods;
- accounting and tax records are retained for as long as required by Austrian law;
- customer communications may be retained for as long as reasonably necessary to handle the enquiry, order, return, complaint or potential legal claim;
- information processed on the basis of consent is generally retained until consent is withdrawn, unless another legal basis permits or requires continued retention; and
- cookie and tracking information is retained according to the relevant technology, your consent choices and applicable retention periods.
When personal data is no longer required and there is no legal reason to retain it, it will be deleted or anonymised where appropriate.
15. Your Rights Under the GDPR
Subject to the applicable legal requirements and limitations, you have the following rights:
Right of Access
You may request information about the personal data we process about you and request a copy of that data.
Right to Rectification
You may request correction of inaccurate or incomplete personal data.
Right to Erasure
You may request deletion of your personal data where the legal requirements for erasure are met.
Right to Restriction
You may request restriction of processing in certain circumstances.
Right to Data Portability
Where applicable, you may request to receive personal data that you have provided to us in a structured, commonly used and machine-readable format.
Right to Object
Where processing is based on our legitimate interests, you may object to such processing where the applicable legal requirements are met.
You may also object to processing for direct marketing purposes.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw your consent at any time.
Withdrawal of consent does not affect the lawfulness of processing that took place before you withdrew your consent.
To exercise your rights, please contact us using the contact details in Section 19.
We may request appropriate information to verify your identity where reasonably necessary to protect your personal data.
16. Right to Lodge a Complaint
If you believe that the processing of your personal data violates applicable data-protection law, you have the right to lodge a complaint with a competent supervisory authority.
For Petal Damage, the relevant Austrian supervisory authority is:
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
Phone: +43 1 52 152-0
The Austrian Data Protection Authority is responsible for receiving complaints concerning alleged violations of data-protection law.
17. Data Protection Officer
Petal Damage has not appointed a separate Data Protection Officer.
18. Data Security
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or misuse.
However, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure.
19. Contact
If you have questions about this Privacy Policy, want to exercise your data-protection rights or have another privacy-related request, please contact:
Petal Damage
Lisa Pfeiffer – Einzelunternehmen
Rusterstraße 2
7072 Mörbisch am See
Austria
Email: petaldamage@gmail.com
Phone: +43 664 88789833
20. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our business, the services and technologies we use or applicable legal requirements.
The current version will be published on this website with the corresponding “Last updated” date.