Privacy Policy
Privacy Policy
1. Controller
The controller responsible for the processing of personal data on this website is:
Amalphis PS GmbH
Donau-City-Straße 3, Office 1
1220 Vienna
Austria
E-Mail: info@amalphis.at
Phone: +43 660 959 2045
Company registration number: FN 648384 g
Commercial court: Commercial Court of Vienna
VAT ID: ATU82121623
2. General information on data processing
We process personal data exclusively within the framework of the General Data Protection Regulation ("GDPR"), the Austrian Data Protection Act ("DSG"), and the Telecommunications Act 2021 ("TKG 2021").
Personal data is any information that relates to an identified or identifiable natural person. This includes, in particular, name, address, email address, telephone number, order and payment data, IP address, and information about the use of our website.
Processing is based, in particular, on the following legal foundations:
- Art. 6(1)(a) GDPR: Consent;
- Art. 6(1)(b) GDPR: Contract performance and pre-contractual measures;
- Art. 6(1)(c) GDPR: Fulfilment of legal obligations;
- Art. 6(1)(f) GDPR: Safeguarding our legitimate interests or the legitimate interests of third parties.
To the extent that processing is based on your consent, you may revoke this consent at any time with effect for the future. The legality of the processing carried out until the revocation remains unaffected.
3. Hosting and Shopify shop platform
Our online shop is operated via the Shopify platform. The provider for merchants in the European Economic Area is generally:
Shopify International Limited
Attn: Data Protection Officer
c/o Intertrust Ireland
2nd Floor, 1–2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
Shopify processes data required for the operation of the online shop, the display of the website, the shopping cart function, checkout, payment processing, fraud prevention, and order processing.
In this context, the following data may be processed in particular:
- IP address as well as device and browser information;
- pages visited, date, and time of access;
- shopping cart and order data;
- name, email address, telephone number;
- billing and delivery address;
- payment status and information on the chosen payment method;
- cookie and consent settings.
Processing is carried out to provide the shop, to execute orders, and to ensure security based on Art. 6(1)(b), (c), and (f) GDPR.
Shopify may transfer data to affiliated companies and sub-processors in Canada, the USA, or other countries. According to its own information, Shopify uses appropriate safeguards for this purpose, in particular approved Binding Corporate Rules and, where necessary, standard contractual clauses of the European Commission.
Further information:
https://www.shopify.com/legal/privacy
https://www.shopify.com/legal/cookies
4. Server log data
When accessing our website, technically necessary information is processed. This may include the IP address, browser type, operating system, referrer URL, page accessed, access time, and amount of data transferred.
Processing is carried out for the technical provision of the website, error analysis, protection against attacks, and to ensure system security based on Art. 6(1)(f) GDPR.
Log data is stored only for as long as is necessary for the aforementioned purposes or to fulfil legal obligations.
5. Orders and customer account
When you place an order or create a customer account, we process the data you provide for the processing and performance of the contract.
This includes in particular:
- name and contact details;
- billing and delivery address;
- products ordered and order value;
- payment and transaction status;
- shipping and return information;
- communication in connection with the order.
The legal basis is Art. 6(1)(b) GDPR. Documents relevant to tax and corporate law are stored in accordance with statutory retention obligations, generally for seven years.
6. Payment processing
For payment processing, the required data is transmitted to the selected payment service provider. Depending on your selection, Shopify Payments, PayPal, Klarna, Apple Pay, Google Pay, or the participating credit card companies may process data.
In principle, we do not receive complete credit card details. Payment data is processed directly by the respective payment service provider.
Processing is carried out for the performance of the contract according to Art. 6(1)(b) GDPR as well as for fraud prevention and secure payment processing according to Art. 6(1)(f) GDPR.
For further processing, the privacy policy of the selected payment service provider applies additionally.
7. Shipping and delivery
To deliver your order, we transmit the required data, in particular name, delivery address, telephone number or email address, as well as shipment information, to the shipping service provider used.
Depending on the delivery location and availability, we use DHL, DPD, and the Austrian Post, among others.
The legal basis is Art. 6(1)(b) GDPR. Data is only transmitted to the extent necessary for shipping, delivery, and shipment tracking.
8. Contacting us and B2B inquiries
If you contact us via email, telephone, contact form, or B2B form, we process your information to handle the inquiry.
In this context, name, company, email address, telephone number, and the content of your message may be processed in particular.
For contract-related or pre-contractual inquiries, the legal basis is Art. 6(1)(b) GDPR. For general inquiries, processing is based on our legitimate interest in responding to customer and business inquiries in accordance with Art. 6(1)(f) GDPR.
The data will be deleted as soon as the inquiry has been finally processed and there are no statutory retention or documentation obligations to the contrary.
9. Newsletter and Klaviyo
If you subscribe to our newsletter, we process your email address and, if applicable, your name, language, purchase history, and information about whether newsletters were delivered, opened, or clicked.
We use Klaviyo for the distribution and analysis of our newsletters. The provider is Klaviyo, Inc., USA.
Registration is carried out only on the basis of your consent according to Art. 6(1)(a) GDPR. Where a double opt-in procedure is used, we store the registration and confirmation in order to be able to provide evidence of the consent.
You can unsubscribe from the newsletter at any time via the unsubscribe link in each message or by sending an email to info@amalphis.at.
Klaviyo may process data in the USA. Where necessary, the transfer is based on appropriate safeguards, in particular the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.
Further information:
https://www.klaviyo.com/legal/privacy
10. Cookies and consent management
Our website uses cookies and similar technologies. Cookies are small files or pieces of information that can be stored on or read from your device.
We distinguish in particular between:
- technically necessary cookies;
- functional cookies;
- analysis cookies;
- marketing and advertising cookies.
Technically necessary cookies are used to provide the shop, shopping cart, checkout, security settings, language and country selection, and the storage of your privacy settings. Processing is based on Art. 6(1)(b) or (f) GDPR as well as § 165(3) TKG 2021.
Analysis and marketing technologies are generally only activated for visitors from the European Economic Area and other regions requiring consent after you have given your consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021.
You can change or revoke your consent at any time via the "Cookie Settings" button provided on the website.
11. Google Analytics 4
We use Google Analytics 4 ("GA4"), a web analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further processing may be carried out by Google LLC in the USA.
The GA4 measurement ID G-WQP2M50YKW is used on our website.
Google Analytics helps us understand how visitors use our website and our shop. The following data may be processed in particular:
- IP address and approximate geographic region;
- browser, device, and operating system information;
- pages visited and referrer URL;
- date, time, and duration of the visit;
- interactions with products and shop features;
- search queries within the shop;
- shopping cart, checkout, and purchase events;
- order value, currency, transaction ID, and purchased products;
- cookie and device identifiers;
- consent status.
We use Google Analytics exclusively based on your consent according to Art. 6(1)(a) GDPR and § 165(3) TKG 2021.
The data collected by Google Analytics is stored according to the retention settings configured in our GA4 account. We regularly review these settings and limit the storage period to what is necessary for analysis and documentation purposes. Aggregated statistics that no longer allow for the identification of individual persons may be stored for longer.
Further information:
https://policies.google.com/privacy
https://support.google.com/analytics/topic/2919631
12. Google Ads and conversion tracking
We use Google Ads and Google Ads conversion tracking from Google Ireland Limited. The Google Ads identifier AW-17826296460 is used on our website.
If you arrive at our website via a Google ad and have consented to the use of marketing technologies, Google and we can recognize whether certain actions were performed after the ad contact or ad click.
These include in particular:
- visiting a product page;
- adding a product to the shopping cart;
- starting checkout;
- entering shipping or payment information;
- completing a purchase.
In this process, information such as the Google Click Identifier, cookie or device ID, page visited, time, transaction ID, order value, currency, and purchased products may be processed.
We use this information to measure the effectiveness of our advertising, attribute orders to ads, evaluate campaigns, and optimize our advertising budget.
As far as activated and covered by your consent, data can also be used for audience building, remarketing, and personalized advertising.
The legal basis is your consent according to Art. 6(1)(a) GDPR and § 165(3) TKG 2021.
13. Enhanced conversions with Google Ads
To improve measurement accuracy, we may use the "Enhanced Conversions" function from Google Ads.
After a purchase, data you have provided yourself, such as email address, telephone number, name, or address, can be technically normalized, encrypted using the one-way SHA-256 hash method, and transmitted to Google along with information about the conversion event.
Google compares these hash values with the hashed data of logged-in Google accounts to determine whether an order can be attributed to a previous ad contact or ad click. This is intended to improve the measurement of conversions.
The hash values are pseudonymized, not fully anonymized data. A transmission therefore only occurs if you have previously consented to the corresponding analysis and marketing processing.
Processing includes in particular:
- hashed email address;
- if applicable, hashed telephone number;
- if applicable, hashed parts of name and address;
- transaction ID;
- purchase time;
- order value and currency;
- information about the conversion event.
The legal basis is Art. 6(1)(a) GDPR. You can revoke your consent at any time via the cookie settings.
The function serves exclusively for conversion measurement and campaign optimization. Google processes the transmitted data in accordance with the applicable Google Ads Data Processing Terms.
Further information:
https://support.google.com/google-ads/answer/15712870
https://business.safety.google/adsdatatransfers/
14. Google Consent Mode
We use Google Consent Mode to transmit your choices made in the cookie banner to the integrated Google services.
In this process, consent signals for analysis, ad storage, personalized advertising, and the processing of user-provided data are transmitted. Google tags and the Google pixels integrated via Shopify must take this choice into account.
Without your consent, data from our shop may not be used for personalized advertising. You can change or revoke your granted consent at any time via the cookie settings.
15. Google Merchant Center and Google & YouTube
We use the Google & YouTube sales channel from Shopify to synchronize product information with Google Merchant Center and other Google services.
In this process, product names, descriptions, images, prices, availability, brands, product identifiers, shipping information, and links to product pages are transmitted to Google.
If you interact with a product entry or a Shopping ad, Google may process information about this interaction. Insofar as this data is connected with analysis or marketing information from our shop, this only occurs within the scope of your consent and the described Google services.
16. Pinterest
We use services from Pinterest, in particular the Pinterest sales channel and, if applicable, the Pinterest Tag. The provider for users in the European Economic Area is Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland.
After your consent, information about page views, product interactions, shopping cart actions, orders, as well as cookie and device identifiers can be transmitted to Pinterest. Processing serves the purpose of measuring Pinterest campaigns, creating audiences, and—if permitted—displaying personalized advertising.
The legal basis is Art. 6(1)(a) GDPR and § 165(3) TKG 2021.
Further information:
https://policy.pinterest.com/de/privacy-policy
17. Product reviews with Judge.me
We use Judge.me for the display and management of product reviews. The provider is Judge.me Ltd.
Judge.me can process data such as name, email address, order and product information, review content, IP address, and technical usage data. Processing is carried out to obtain, verify, and display authentic product reviews.
If we send a review request after a purchase, this is done on the basis of your consent or—to the extent legally permitted—our legitimate interest in quality control and the presentation of authentic customer reviews.
Published reviews may be publicly visible with the name you provided or a display name you have chosen.
Further information:
18. International data transfers
Some of our service providers process data outside the European Economic Area, in particular in Canada and the USA.
Such a transfer only takes place if the legal requirements are met. The following, in particular, may serve as a basis:
- an adequacy decision by the European Commission;
- a valid certification under the EU-U.S. Data Privacy Framework;
- standard contractual clauses of the European Commission;
- approved Binding Corporate Rules;
- other legally recognized safeguards.
Despite these measures, in the case of processing outside the European Economic Area, it cannot be ruled out in every case that authorities in the relevant country may access data within the framework of the laws applicable there.
19. Recipients of personal data
Personal data may be transferred to the following categories of recipients, to the extent necessary for the respective purpose:
- hosting and e-commerce service providers;
- payment service providers and banks;
- shipping and logistics companies;
- IT, security, and support service providers;
- analytics, marketing, and advertising service providers;
- newsletter and communication service providers;
- review platforms;
- tax advisors, legal counsel, and auditors;
- authorities and courts, insofar as a legal obligation exists.
Where necessary, we enter into data processing agreements with processors in accordance with Art. 28 GDPR.
20. Storage period
We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations.
In particular, the following criteria apply:
- Order and billing data: generally seven years due to tax and commercial law obligations;
- Customer account: until the account is deleted, subject to legal obligations;
- Contact inquiries: until final processing and the expiry of any proof or limitation periods;
- Newsletter data: until withdrawal of consent;
- Proof of consent: as long as necessary to demonstrate compliance with legal obligations;
- Analytics and marketing data: in accordance with consent and the settings of the respective service.
After the expiry of the respective periods, the data will be deleted or anonymized, provided there are no legal or legitimate reasons for further storage.
21. Your rights
In accordance with the GDPR, you have the following rights in particular:
- Right of access pursuant to Art. 15 GDPR;
- Right to rectification pursuant to Art. 16 GDPR;
- Right to erasure pursuant to Art. 17 GDPR;
- Right to restriction of processing pursuant to Art. 18 GDPR;
- Right to data portability pursuant to Art. 20 GDPR;
- Right to object pursuant to Art. 21 GDPR;
- Right to withdraw consent pursuant to Art. 7 para. 3 GDPR;
- Right to lodge a complaint with a data protection supervisory authority.
To exercise your rights, you can contact us at info@amalphis.at. We may require appropriate proof of your identity to prevent unauthorized information or changes.
You also have the right to lodge a complaint with the Austrian Data Protection Authority:
Austrian Data Protection Authority
https://www.dsb.gv.at
E-mail: dsb@dsb.gv.at
22. Objection to direct marketing
If personal data is processed for direct marketing, you have the right to object to this processing at any time. This also applies to profiling related to such direct marketing.
After your objection, your personal data will no longer be used for these purposes.
23. Automated decision-making
In principle, we do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
Google, Pinterest, and other advertising platforms may use automated procedures to select, deliver, and optimize advertisements. This selection of advertisements generally does not produce any legal or similarly significant effect on you.
24. Data security
We implement appropriate technical and organizational security measures to protect personal data from loss, misuse, unauthorized access, alteration, or disclosure.
Data transmission between your browser and our website is generally encrypted via HTTPS/TLS.
25. Changes to this privacy policy
We may change this privacy policy if our data processing, the services used, or legal requirements change.
The current version is available on our website.
As of: July 2026