Privacy policy

This English version is provided for your convenience. In case of any discrepancy, the German version shall prevail.

Hollyshirt GmbH
Version: January 2025

1. Controller

Hollyshirt GmbH
Liechtensteinstraße 23/Top VII
1090 Vienna, Austria
Email: office@hollyshirt.at
Website: www.hollyshirt.net

We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act (TKG 2021).

2. Processing of personal data

We process the data you provide to us when ordering, making an enquiry or using the website, in particular:

• Name
• Address
• Email address
• Phone number
• Payment information
• Order data
• Technical data (e.g. IP address, browser, device)

This data is processed only for the specified purposes.

3. Orders & contract processing

To process orders, we process personal data for:

• Order and delivery
• Payment processing
• Customer service
• Invoicing
• Compliance with statutory retention obligations

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
In accordance with statutory requirements (in particular the Austrian Commercial Code, UGB), data is generally retained for up to 7 years.

4. Payment service providers

Depending on the payment method chosen, we pass the necessary data on to payment service providers, e.g.:

• PayPal
• Klarna
• Credit card providers
• Payment service providers of our shop system

Data is passed on exclusively for payment processing.
Legal basis: Art. 6(1)(b) GDPR.

5. Shipping service providers

To deliver your order, your name and address are transmitted to the respective shipping partners, e.g.:

• Austrian Post (Österreichische Post)
• DHL
• DPD
• GLS
• other carriers depending on your choice

Legal basis: Art. 6(1)(b) GDPR.

6. Newsletter

6.1 Newsletter subscription (double opt-in)

If you subscribe to our newsletter, we process:

• Email address
• optional: name

Legal basis: Art. 6(1)(a) GDPR (consent).
You can withdraw your consent at any time using the unsubscribe link in the newsletter.

6.2 Newsletter to existing customers (§ 107 (3) TKG)

If you have already ordered from us, we may offer you our own similar products by email (existing customer advertising).
You can object to this use at any time.

Legal bases:

• Art. 6(1)(f) GDPR (legitimate interest)
• § 107 (3) TKG (exception for existing customers)

7. Contact & enquiries

If you contact us via contact form, email or phone, we process the data you provide in order to handle your enquiry.

Legal bases:

• Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract)
• Art. 6(1)(f) GDPR (legitimate interest in handling enquiries)

8. Server log files

When you visit our website, the hosting provider automatically stores the following data:

• IP address
• Date and time of access
• Pages visited
• Browser type and version
• Operating system used

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring technical operation and system security).
The data is generally stored for a maximum of 30 days.

9. Web analytics (Google Analytics 4)

We use Google Analytics 4, a web analytics service of Google LLC, to analyse the use of our website.
Google Analytics uses cookies that are only set with your consent.

Data processed may include:

• shortened IP address (IP anonymisation)
• pages visited and interactions
• time spent on the site
• device and browser information

Google processes some data in the USA. We use standard contractual clauses (SCCs) pursuant to Art. 46 GDPR to ensure an adequate level of data protection.

Legal basis: Art. 6(1)(a) GDPR (consent via cookie banner).
You can withdraw your consent at any time via the cookie banner.

10. Cookies & similar technologies

Our website uses cookies and similar technologies (e.g. pixels, tags, local storage) to provide functions and improve the user experience.

10.1 Types of cookies

(a) Necessary cookies

These cookies are strictly necessary for the operation of the website and the shop, e.g. for:

• Shopping cart functions
• Login and account management
• Security (e.g. CSRF protection)
• Storing cookie settings

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning online shop).

(b) Preference cookies

These cookies improve usability and store, for example, language settings or form contents.
They are only set with your consent.

Legal basis: Art. 6(1)(a) GDPR.

(c) Analytics cookies

Analytics or statistics cookies allow us to better understand user behaviour in order to optimise our offering (e.g. via Google Analytics 4).

Legal basis: Art. 6(1)(a) GDPR.

(d) Marketing cookies

Marketing or tracking cookies are used to show you relevant advertising (e.g. via Facebook Pixel, Google Ads remarketing).

Legal basis: Art. 6(1)(a) GDPR.

10.2 Cookie banner and consent

When you first visit our website, a cookie banner appears. There you can:

• accept all cookies,
• allow only necessary cookies, or
• make an individual selection.

You can change your selection and withdraw your consent at any time via the “Cookie settings” link (e.g. in the footer).

10.3 Storage period

Session cookies are deleted when you close your browser; persistent cookies remain on your device until their expiry date or until you delete them manually.

10.4 Data transfer to third countries

If cookies transfer data to companies in third countries (e.g. the USA), this is done on the basis of your consent and using appropriate safeguards (e.g. standard contractual clauses pursuant to Art. 46 GDPR).

11. Social media plugins

Our website may contain links or plugins to social networks (e.g. Facebook, Instagram, TikTok, YouTube).
When you click on such links or buttons, a connection to the servers of the respective provider may be established and data (e.g. IP address, page visited) may be transmitted.

Where technically possible, we use a so-called two-click solution so that data is only transmitted after you actively interact with the plugin.

12. Embedded content from third parties

If content from third-party providers (e.g. embedded videos, maps, fonts) is displayed on our website, the respective provider may receive your IP address and other technical data.

Such content is generally only embedded if you have consented via the cookie banner (Art. 6(1)(a) GDPR) or to safeguard our legitimate interest in an attractive presentation of our online offering (Art. 6(1)(f) GDPR).

13. SSL/TLS encryption

Our website uses SSL/TLS encryption to protect the transmission of confidential content (e.g. orders or contact requests). You can recognise an encrypted connection by “https://” in your browser’s address bar.

14. Storage period

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations. The data is then deleted or anonymised.

15. Your rights as a data subject

You have the right at any time to:

• access the personal data we process about you (Art. 15 GDPR)
• rectification of inaccurate or incomplete data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR), unless statutory retention obligations prevent this
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, you can contact us at:
Email: office@hollyshirt.at

16. Disclosure to third parties

Personal data is only passed on to third parties:

• to perform the contract (e.g. payment and shipping service providers),
• to IT and hosting service providers,
• if we are legally obliged to do so, or
• within the scope of data processing agreements pursuant to Art. 28 GDPR.

Data is not passed on for third parties’ own advertising purposes without your express consent.

17. Changes to this privacy policy

We reserve the right to amend this privacy policy if technical or legal conditions change. The current version published on our website applies.

18. Information on data processing for users in Switzerland (revFADP)

Our privacy policy also applies to users from Switzerland. We process personal data of persons resident in Switzerland in accordance with the revised Swiss Federal Act on Data Protection (revFADP).

If we process or transfer data to countries outside Switzerland (e.g. to service providers in the EU or to providers such as Google or Meta in the USA), this is done:

• on the basis of an adequacy decision by the Federal Council, or
• on the basis of standard contractual clauses or other appropriate safeguards, or
• because it is necessary to perform a contract or to carry out pre-contractual measures (e.g. shipping, payment service providers).

Data subjects from Switzerland have rights comparable to those of data subjects in the EU, in particular the right of access, rectification, erasure, restriction of processing, data portability and objection. To exercise these rights, you can also contact us at office@hollyshirt.at.