Privacy Policy

This privacy policy explains which personal data we process when you visit the IronPunky online shop, place an order, write to us or sign up for our newsletter, and which rights you have.

Who is responsible

The controller under the General Data Protection Regulation (GDPR) is IronPunky. The full name, address and contact details are in our Imprint.

Visiting the shop

Our shop runs on Shopify. When you visit it, technical data such as your IP address, browser type, the pages you open and the time of your visit is processed so that the shop can be shown to you and kept secure. The legal basis is our legitimate interest in running a secure online shop (Art. 6(1)(f) GDPR).

Cookies

We use cookies that are needed for the shop to work, for example for the cart and the checkout. Any cookies for statistics or marketing are only set if you agree to them in the cookie banner (Art. 6(1)(a) GDPR). You can change your choice at any time.

Orders

When you place an order we process your name, delivery and billing address, email address, phone number if given, the items ordered and the payment status. We need this data to fulfil the contract (Art. 6(1)(b) GDPR). Payments are handled by Shopify and its payment partners. We do not receive your full card details. To deliver your order we pass your name and delivery address to the shipping company we use, and your email address where needed for tracking updates.

Customer account

If you create a customer account, we store your details so you can see your orders and check out faster. You can ask us to delete your account at any time.

Contact form and email

When you write to us, we process your name, email address, phone number if given and your message, so that we can answer you (Art. 6(1)(b) or (f) GDPR). We do not use these details for anything else.

Newsletter

If you sign up for our workshop letter, we use your email address to send it to you, based on your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time with the link in every email.

Service providers and transfers outside the EU

We work with service providers who process data on our behalf, mainly Shopify International Limited (Ireland) as our shop platform, payment providers and shipping companies. Some of these providers may process data outside the European Union, for example in the United States. In that case the transfer is based on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on standard contractual clauses.

How long we keep data

We keep personal data only as long as it is needed for the purpose for which it was collected. Order and invoice data is kept for seven years, as required by Austrian tax law. Newsletter data is deleted when you unsubscribe.

Your rights

You have the right to access, correct and delete your data, to restrict its processing, to data portability and to object to processing. Where processing is based on your consent, you can withdraw it at any time with effect for the future. To use these rights, write to us through the contact form.

You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

Changes

We update this privacy policy when our shop or the law changes. The current version is always on this page.