Data protection

Status: June 2026

1. Controller according to GDPR

The controller for the processing of personal data in this online shop is:

Relles GmbH
Technoparkstraße 3
4820 Bad Ischl, Austria
Company Register Number: FN 665027g (Wels Regional Court)
VAT ID (AT): ATU82691927
VAT ID (DE): DE458971090

Contact: office@relles.at

A data protection officer is not required to be appointed according to Art. 37 GDPR. For all questions regarding data protection, please contact the above-mentioned contact details directly.

2. General Information on Data Processing

We process your personal data exclusively within the framework of the legal provisions of the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and the German Federal Data Protection Act (BDSG). This Privacy Policy describes what data we collect from you when you visit and use our online shop at relles.at, for what purposes we use it, and what rights you have.

Personal data is any information relating to an identified or identifiable natural person — such as name, address, email address, or order history.

3. Hosting via Shopify

Our online shop is operated on the platform of Shopify International Limited, 2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). When accessing the shop, technically necessary data (e.g., IP address, browser type, referrer, time of access) are processed to provide the shop and ensure security. The legal basis is Art. 6 Para. 1 lit. f GDPR (legitimate interest in a stable, secure shop). A data processing agreement according to Art. 28 GDPR exists with Shopify. Further information: shopify.com/legal/privacy.

4. Data Processing in the Context of Orders

4.1 What data we process

When you place an order in our online shop, we process the following data:

  • Name and address (delivery and billing address)
  • Email address and, if applicable, phone number
  • Order data (items, quantity, price, order number)
  • Payment data (see section 5)
  • If applicable, communication regarding complaints, revocations, and returns

4.2 Purposes of Processing

  • Processing of the purchase contract (shipping, invoicing, payment processing)
  • Communication with you in connection with your order
  • Processing of returns, revocations, and warranty claims
  • Fulfillment of tax and commercial law retention obligations

4.3 Legal Bases

  • Art. 6 Para. 1 lit. b GDPR — fulfillment of the purchase contract
  • Art. 6 Para. 1 lit. c GDPR — fulfillment of legal obligations (especially tax and commercial law retention obligations according to § 132 BAO / § 147 AO, ten years)
  • Art. 6 Para. 1 lit. f GDPR — legitimate interests (e.g., assertion and defense of legal claims)

5. Payment Processing

Depending on the chosen payment method, your payment data will be transmitted to the following service providers:

  • Credit Card / Apple Pay / Google Pay / SEPA: Shopify Payments (Shopify International Limited, Ireland)
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg
  • Klarna (Sofort, Invoice, Installment Purchase): Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden

Bank and credit card data are processed exclusively by the respective payment service providers; we ourselves do not receive or store this data. Legal basis: Art. 6 Para. 1 lit. b GDPR.

6. Shipping and Logistics

The goods are shipped via our fulfillment partner Wolffstore GmbH from a warehouse in Germany. Wolffstore GmbH receives your delivery and contact details for the purpose of picking and shipping. Furthermore, your shipping and contact details are transmitted to the commissioned parcel and freight service providers (in particular FedEx, DHL, DPD, GLS, Hermes, or the respective freight forwarder used). Legal basis: Art. 6 Para. 1 lit. b GDPR.

7. Tax Consulting and Accounting

To fulfill tax obligations, we transmit certain order data (invoices, sales) to our tax consulting office and – where legally required – to tax authorities in Austria and Germany.

8. Cookies and similar technologies

Our shop uses technically necessary cookies to enable the shopping cart, login, and ordering process (legal basis: Art. 6 Para. 1 lit. f GDPR). Optionally, with your consent (Art. 6 Para. 1 lit. a GDPR), we also use analysis cookies that help us to evaluate user behavior anonymously and improve the shop. You can adjust or revoke your consent at any time via the cookie banner.

9. Transfer to Third Countries

Your personal data is generally not transferred to countries outside the European Economic Area (EEA). Insofar as our service providers (e.g., Shopify, sub-service providers) process personal data outside the EEA, this is done exclusively on the basis of an adequacy decision by the EU Commission or by means of appropriate safeguards within the meaning of Art. 44 et seq. GDPR (in particular EU standard contractual clauses).

10. Storage Duration

We store your personal data only for as long as this is necessary for the respective processing purpose or as required by statutory retention obligations.

  • Invoice and business documents: 10 years (§ 132 BAO / § 147 Para. 1 AO)
  • Communication and support histories: up to 3 years from the end of the business transaction (statutory limitation periods)
  • Customer account data: until you delete your account

11. Your Rights as a Data Subject

According to the GDPR, you as a data subject have the following rights:

  • Right to information (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Right to withdraw given consent (Art. 7 Para. 3 GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, a simple email to office@relles.at is sufficient.

12. Right to Object (Art. 21 GDPR)

Insofar as we process your data on the basis of legitimate interests pursuant to Art. 6 Para. 1 lit. f GDPR, you have the right to object to the processing at any time for reasons arising from your particular situation. After an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests and rights, or the processing serves the establishment, exercise, or defense of legal claims.

13. Competent Supervisory Authorities

Should you believe that the processing of your data violates data protection regulations, you can lodge a complaint with a data protection supervisory authority.

Responsible for our company headquarters:
Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna, Austria
Email: dsb@dsb.gv.at | Web: www.dsb.gv.at

Alternatively for German customers:
The Federal Commissioner for Data Protection and Freedom of Information (BfDI)
Graurheindorfer Straße 153, 53117 Bonn, Germany
Web: www.bfdi.bund.de

14. Automated Decision-Making / Profiling

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR, based exclusively on automated processing, does not take place by us.

15. Amendments to this Privacy Policy

We reserve the right to adapt this Privacy Policy if this becomes necessary due to legal changes or changes in our data processing. The current version can always be found in our online shop.