DATA PRIVACY POLICY

The controller responsible for data processing is:

Pintu Design GmbH
Margaretenstraße 112
1050 Vienna
Austria
Email: hello@pintu-design.com
Phone: +43 676 8338 0300

Thank you for your interest in our online shop. Protecting your privacy and personal data is very important to us. The following information explains how we process personal data when you use our website, place an order or contact us.

1. ACCESS DATA AND HOSTING

You can generally visit our website without actively providing personal information.

When you access our website, the web server may automatically collect access data. This may include your IP address, date and time of access, requested file or page, amount of data transferred, browser and device information and your internet service provider.

This information is processed in particular to ensure the secure and uninterrupted operation of our website and to improve our services.

Processing is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR.

Our website and online shop are operated using Shopify. Personal data may therefore be processed by Shopify in connection with the provision and use of our online shop.

2. DATA PROCESSING FOR CONTRACT PERFORMANCE AND CONTACT

2.1 CONTRACT PERFORMANCE

We collect personal data that you voluntarily provide when placing an order.

The data collected can be seen in the relevant input forms and may include, in particular, your name, billing and shipping address, email address, telephone number and order and payment information.

We use this information to process your order and perform our contract with you, as well as to handle warranty, return, refund and other contract-related requests.

Processing is carried out pursuant to Art. 6(1)(b) GDPR.

Where statutory retention obligations apply, the relevant data will be retained in accordance with applicable law and subsequently deleted or restricted from further processing.

2.2 CONTACTING US

If you contact us by email, contact form or other means, we process the personal data you provide in order to respond to your inquiry.

Where your inquiry relates to a contract or pre-contractual measures, processing is carried out pursuant to Art. 6(1)(b) GDPR. In other cases, processing may be based on our legitimate interests pursuant to Art. 6(1)(f) GDPR.

Once your inquiry has been fully processed, your data will be deleted unless statutory retention requirements or another legal basis require or permit further storage.

3. DATA PROCESSING FOR SHIPPING

For the performance of our contract pursuant to Art. 6(1)(b) GDPR, we provide the shipping service provider responsible for your delivery with the personal data necessary to deliver your order.

For the shipment of our orders, we use DHL and, depending on the delivery destination, shipping method and availability, other shipping service providers where applicable.

This may include your name, shipping address and, where necessary for delivery, your contact details.

Where we provide your email address or telephone number to a shipping provider for delivery notifications or coordination and consent is required, this will be done on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future.

4. DATA PROCESSING FOR PAYMENTS

We work with payment service providers, financial institutions and technical service providers to process payments.

Depending on the payment method you select, the information required to process your payment will be provided to the relevant payment service provider.

Depending on availability, these may include credit card providers, PayPal, Apple Pay, Klarna, Shop Pay and other payment methods offered at checkout.

Processing is carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR.

In some cases, payment providers collect the necessary information directly. Their respective privacy policies also apply in these cases.

Where information is processed for fraud prevention or to ensure secure payment processing, processing may be based on our legitimate interests pursuant to Art. 6(1)(f) GDPR.

5. EMAIL MARKETING AND NEWSLETTERS

If you subscribe to our newsletter, we use your email address and any other information you voluntarily provide to send you information about PINTU, new products, collections, offers, events and other news.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR.

We may use specialized email and marketing service providers to send and analyze our marketing emails.

You may withdraw your consent at any time with effect for the future, in particular by using the unsubscribe link provided at the end of our marketing emails.

After unsubscribing, your email address will be removed from the relevant mailing list unless another legal basis permits or requires further storage.

6. COOKIES AND OTHER TECHNOLOGIES

We use cookies and similar technologies on our website.

Some of these technologies are necessary for our website and essential functions such as the shopping cart, checkout, security and language settings to operate correctly.

In addition, with your consent, cookies and similar technologies may be used for analytics, personalization and marketing purposes.

Where consent is required, processing is based on Art. 6(1)(a) GDPR.

Necessary technologies may be used on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR or other applicable legal grounds.

You can change or withdraw your consent at any time with effect for the future using the cookie or privacy settings available on our website.

7. WEB ANALYTICS AND ONLINE MARKETING

Where you have given your consent, we may use technologies to analyze how our website is used and to optimize our advertising.

This may involve processing information about pages visited, products, interactions, orders, device and browser information, IP addresses and cookie or similar identifiers.

Where consent is required, processing is based on Art. 6(1)(a) GDPR.

8. META / FACEBOOK AND INSTAGRAM

Where you have given your consent, technologies provided by Meta Platforms Ireland Limited may be used on our website, in particular to analyze website usage, measure advertising campaigns and display relevant advertising on Facebook and Instagram.

Information processed may include your IP address, device and browser information and information about your use of our website and certain events such as page views, product views or purchases.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR.

In connection with the use of Meta services, personal data may also be transferred to companies within the Meta group in the United States.

For transfers to appropriately certified U.S. companies, the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework may provide the legal basis. Where this framework does not apply, other safeguards permitted by law, including the European Commission's Standard Contractual Clauses, may be used.

9. SOCIAL MEDIA

PINTU maintains online presences on social networks, in particular Facebook and Instagram.

When you visit our profiles on these platforms or interact with our content, personal data may be processed by the relevant platform operator.

For certain processing activities relating to our social media presences, PINTU and the relevant platform operator may act as joint controllers.

Further information regarding the processing of personal data by the respective platforms can be found in their privacy policies.

10. INTERNATIONAL DATA TRANSFERS

When using certain service providers, personal data may be processed in or transferred to countries outside the European Economic Area.

Where the European Commission has adopted an adequacy decision for the relevant third country, transfers may be based on that decision.

Otherwise, personal data will only be transferred where the requirements of Articles 44 et seq. GDPR are met, for example on the basis of appropriate safeguards such as the European Commission's Standard Contractual Clauses.

11. DATA RETENTION

We generally retain personal data only for as long as necessary for the respective processing purposes.

In addition, statutory retention obligations, in particular tax and corporate law requirements, may require us to retain certain data for longer periods.

Once the applicable retention periods have expired, the data will be deleted or anonymized unless another legal basis permits or requires further processing.

12. YOUR RIGHTS

Subject to the applicable statutory requirements, you have in particular the following rights:

Right of access pursuant to Art. 15 GDPR
Right to rectification pursuant to Art. 16 GDPR
Right to erasure pursuant to Art. 17 GDPR
Right to restriction of processing pursuant to Art. 18 GDPR
Right to data portability pursuant to Art. 20 GDPR
Right to object pursuant to Art. 21 GDPR
Right to withdraw consent at any time with effect for the future
Right to lodge a complaint with a competent data protection supervisory authority pursuant to Art. 77 GDPR

13. RIGHT TO OBJECT

Where we process personal data on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right, subject to the requirements of Art. 21 GDPR, to object to such processing on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you may object to the processing of your personal data for such purposes at any time.

14. CONTACT

If you have any questions regarding the collection, processing or use of your personal data or wish to exercise your data protection rights, please contact us: