Privacy Policy / Datenschutzerklärung

Overview

This Privacy Policy explains how Marie Hartig, trading as Marie's Painted Worlds, collects and uses personal data through the website and online shop.

The current website setup uses Netlify for website hosting and Stripe for payment processing.

At the date of this policy, the website is not intended to use Google Analytics, Meta/Facebook Pixel, newsletter marketing platforms or comparable advertising/analytics tracking tools.

If additional tools are introduced later, this Privacy Policy and any required cookie-consent mechanism must be reviewed and updated before those tools are activated.

1. Data Controller

The controller responsible for the processing of personal data through this website and online shop is:

If you have questions about the processing of your personal data or wish to exercise your data-protection rights, please contact us using the details above.

2. What Personal Data We Process

We process personal data only to the extent necessary for operating the website, communicating with visitors and customers, processing orders, taking payments, arranging delivery, meeting legal obligations and protecting the security of the website and our business.

This may include:

• Contact data, such as name, email address, telephone number and postal address.
• Order and transaction data, such as products ordered, order number, delivery details, invoice details, payment status and correspondence concerning an order.
• Payment-related data processed through Stripe. Marie's Painted Worlds does not need to receive or store full card details in order to process a Stripe payment.
• Communication data contained in emails, contact enquiries, complaints or customer-service correspondence.
• Technical data generated when the website is accessed, such as IP address, date and time of access, requested page or file, browser/device information, referral information and technical/security logs, to the extent generated by the hosting infrastructure.
• Information necessary to comply with accounting, tax, consumer-law and other legal obligations.

3. Purposes and Legal Bases

We process personal data under the General Data Protection Regulation (GDPR) on one or more of the following legal bases, depending on the circumstances:

• Article 6(1)(b) GDPR – where processing is necessary to take steps at your request before entering into a contract or to perform a contract, for example processing an order, payment, delivery or return.
• Article 6(1)(c) GDPR – where processing is necessary to comply with a legal obligation, including accounting, tax and consumer-law obligations.
• Article 6(1)(f) GDPR – where processing is necessary for our legitimate interests, for example operating and securing the website, preventing misuse, handling ordinary business correspondence and establishing or defending legal claims, provided those interests are not overridden by your rights.
• Article 6(1)(a) GDPR – consent, where consent is specifically requested for an optional activity.

At present, this website is not intended to use optional marketing or analytics tracking that requires consent.

4. Website Hosting – Netlify

The website is hosted and delivered using services provided by Netlify.

In the course of providing hosting, content-delivery, security and technical infrastructure services, Netlify may process technical data such as IP addresses, request information, browser/device information and server or security logs.

Such processing is used to make the website available, maintain its security and performance, diagnose technical problems and protect against misuse.

Where Netlify processes personal data on our behalf as a service provider or processor, that processing is governed by the contractual data-protection arrangements applicable to the Netlify service.

Netlify may use infrastructure and service providers in countries outside the European Economic Area. Where personal data is transferred internationally, the applicable safeguards required by data-protection law must be used.

5. Payments – Stripe

Payments in the online shop are processed through Stripe.

When you choose to make a payment, information necessary for the payment transaction is transmitted to Stripe. Depending on the payment method and transaction, this may include your name, billing details, email address, payment-method information, transaction amount, currency, IP/device information and information used for fraud prevention and regulatory compliance.

Stripe may act as a data processor on behalf of Marie's Painted Worlds for certain processing activities and may also act as an independent data controller for activities for which Stripe determines the purposes and means of processing, for example certain payment, fraud-prevention, security and legal-compliance functions.

Stripe may process data through entities and service providers located outside the European Economic Area.

For further information, please refer to Stripe's own privacy information.

6. Orders, Delivery and Customer Service

When you place an order, we process the information necessary to accept and fulfil it.

This normally includes your name, delivery and billing details, email address, telephone number where provided, the products ordered, price and payment status.

Where necessary to deliver your order, relevant data may be provided to postal, courier or fulfilment service providers.

Only information reasonably necessary for carrying out the delivery should be shared.

If you contact us about an order, return, withdrawal, complaint or other enquiry, we process your correspondence in order to respond and, where relevant, perform the contract, comply with legal obligations or establish and protect legal rights.

7. Email and Contact Enquiries

If you contact us by email or another contact method provided on the website, we process the personal data contained in your message in order to respond to your enquiry.

Where an enquiry relates to a potential or existing purchase, the legal basis is generally Article 6(1)(b) GDPR.

For general business correspondence, processing may be based on our legitimate interest under Article 6(1)(f) GDPR in responding to communications and operating the business.

8. Cookies and Similar Technologies

The current website is intended to operate without optional advertising or analytics tracking such as Google Analytics or Meta/Facebook Pixel.

Technically necessary cookies or similar technologies may nevertheless be used where required for core website, security, checkout, payment or session functionality.

Such technologies are used only to the extent permitted without consent or, where consent is legally required, only after the appropriate consent has been obtained.

If optional analytics, advertising, social-media tracking, newsletter tracking or comparable technologies are introduced in the future, the website's cookie-consent setup and this Privacy Policy must be updated before those technologies are activated.

9. Recipients of Personal Data

Personal data may be disclosed only where necessary and legally permitted, including to:

• Netlify and relevant technical infrastructure providers for hosting and operation of the website.
• Stripe and associated payment-service providers for processing payments, payment security, fraud prevention and related functions.
• Postal, courier or delivery providers where necessary to deliver an order.
• Professional advisers such as accountants, tax advisers or legal advisers where necessary.
• Public authorities, courts or other bodies where disclosure is required by law.

10. International Data Transfers

Some service providers used for hosting, payments or technical infrastructure may process personal data in countries outside the European Economic Area.

Where such transfers occur, we rely on a legally permitted transfer mechanism as applicable, such as an adequacy decision, the EU-U.S. Data Privacy Framework where available and applicable, or European Commission Standard Contractual Clauses together with any supplementary measures required by law.

11. Storage and Retention

We keep personal data only for as long as necessary for the purpose for which it was collected and for any additional period required by law or reasonably necessary for the establishment, exercise or defence of legal claims.

Austrian tax and accounting rules generally require relevant books, records, invoices and business documents to be retained for seven years, with longer periods applying in certain specific cases.

Order and invoice information may therefore need to be retained for the applicable statutory period even if a customer asks for deletion.

Ordinary enquiries that do not lead to a transaction are kept only for as long as reasonably necessary to deal with the enquiry and any related follow-up, unless longer retention is justified or required.

12. Your GDPR Rights

Subject to the conditions and limitations in applicable data-protection law, you may have the right to:

• request access to personal data concerning you;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data where there is no legal basis or obligation requiring continued storage;
• request restriction of processing in certain circumstances;
• object to processing based on legitimate interests in certain circumstances;
• receive certain personal data in a structured, commonly used and machine-readable format and request data portability where the legal requirements are met;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, contact: info@mariespaintedworlds.com

We may need to verify your identity before acting on a request.

13. Right to Complain

If you believe that your personal data is being processed unlawfully, you have the right to lodge a complaint with a competent data-protection supervisory authority.

In Austria, the supervisory authority is the:

14. Data Security

We take appropriate technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

No internet transmission or storage system can, however, be guaranteed to be completely secure.

15. No Automated Marketing Profiling by Marie's Painted Worlds

At the date of this policy, Marie's Painted Worlds does not intend to use the website to carry out automated marketing profiling or behavioural advertising based on website tracking.

Payment providers such as Stripe may use automated systems for fraud prevention, payment security and regulatory purposes in accordance with their own legal obligations and privacy information.

16. Changes to this Privacy Policy

We may update this Privacy Policy when the website, online shop, service providers or applicable law change.

The current version will be published on the website together with its revision date.