Privacy Notice — DRAFT
Effective date: 2026-06-24
This notice explains how personal data is processed when you use this webshop. It is drafted to provide a minimal GDPR and cookie transparency baseline for a necessary-cookies-only setup.
1. Controller
The controller under Art. 4(7) GDPR is:
[Company legal name]
[Street, postal code, city, country]
Email: [privacy contact email]
This section must be completed with exact legal entity details before production use.
2. Purposes, Data Categories, and Legal Bases
- Account creation, login, and account management (name, email, password hash, account settings): Art. 6(1)(b) GDPR.
- Order processing, payment handling, shipping and fulfillment (order, billing, shipping and contact data): Art. 6(1)(b) GDPR.
- Legal record keeping (for example tax and accounting retention): Art. 6(1)(c) GDPR.
- IT security and fraud prevention (server logs, security events): Art. 6(1)(f) GDPR (legitimate interest in secure operations).
3. Recipients and Processors
Personal data may be shared with processors and service providers only as needed to operate the webshop (for example hosting, shop backend, payment processing, shipping, and email delivery). Processing is carried out under applicable data processing agreements where required.
4. International Data Transfers
If personal data is transferred outside the EU/EEA, transfers are based on an adequacy decision or appropriate safeguards under Art. 44 et seq. GDPR (for example Standard Contractual Clauses).
5. Retention Periods
Data is stored only as long as necessary for the stated purposes and statutory retention obligations. If no longer required, data is deleted or anonymized.
6. Your Rights under GDPR
You have the right to access, rectification, erasure, restriction, data portability, and objection, subject to legal conditions. You also have the right to lodge a complaint with a supervisory authority.
7. Cookies (Necessary Cookies Only)
This webshop uses only technically necessary cookies required for core shop functionality and secure session handling. No analytics, marketing, or profiling cookies are intentionally set in this minimal configuration.
| Cookie | Purpose | Duration | Legal Basis |
|---|---|---|---|
| vendure_remix_session | Maintains secure session state for login, cart, checkout, and order processing. | Session or as configured by platform authentication behavior. | Art. 6(1)(b) GDPR, and where applicable Art. 6(1)(f) GDPR for secure operation. |
| vendure_preprod_preview | Enables access to pre-production preview mode. | Up to 30 days (pre-production stage only). | Art. 6(1)(f) GDPR (service security and restricted preview access). |
If optional cookies (analytics/marketing) are introduced in the future, they will only be activated after prior consent where legally required.
8. Contact and Complaints
For privacy requests, contact: [privacy contact email].
In Austria, you may also complain to: Austrian Data Protection Authority (Datenschutzbehoerde), Barichgasse 40-42, 1030 Vienna, Austria.