Privacy policy
Protecting your personal data is important to us. Below we inform you about the processing of personal data when you use this online store in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and the Austrian Telecommunications Act (TKG 2021).
1. Controller
Julian Handl, Adrian-Hoven-Straße 10, 2752 Wöllersdorf, Austria, email: servus@riccava.com, phone: +43 670 505 80 45.
2. General Information and Legal Bases
We process personal data only to the extent necessary. Depending on the case, the legal bases are: performance of a contract and pre-contractual measures (GDPR Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interest (Art. 6(1)(f)), and your consent (Art. 6(1)(a)). You may revoke any consent you have given at any time with effect for the future.
3. Hosting and Store Platform (Shopify)
This store is operated and hosted via Shopify (Shopify International Ltd., Victoria Buildings, 2 Haddington Road, Dublin 4, Ireland; parent company Shopify Inc., Ottawa, Canada). Shopify processes on our behalf all data required to operate the store, including automatically collected server log files (IP address, date and time, pages accessed, referrer, browser, and user agent) as well as cart, order, and customer account data. Legal basis: GDPR Art. 6(1)(f) (secure, stable operation) or Art. 6(1)(b) for orders. Shopify may also process data in Canada and the USA; for Canada there is an adequacy decision of the EU Commission, and otherwise the EU Standard Contractual Clauses apply.
4. Page Builder and Theme Extensions (GemPages)
For the design of individual pages we use the Shopify app GemPages (GemCommerce Co., Ltd., Vietnam). When such pages are accessed, scripts and content from GemPages are loaded; for technical reasons, your IP address is transmitted to the provider in the process. No usage profiles are created. Legal basis: GDPR Art. 6(1)(f) (proper display of the website). A data processing agreement is in place.
5. CDN, DNS, and Email Delivery (Cloudflare)
For the secure, high-performance delivery of the website we use Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, USA) as a content delivery network, for DNS name resolution, and for the email routing of our domain. In doing so, Cloudflare processes technically necessary connection data (including IP address) to deliver content, to defend against attacks (e.g., DDoS), and to deliver emails. Legal basis: GDPR Art. 6(1)(f) (security and availability). A data processing agreement is in place; Cloudflare is certified under the EU-US Data Privacy Framework.
6. Email Communication (Google Workspace)
Our business email communication (e.g., servus@riccava.com) runs through Google Workspace (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). When you send us an email or receive an email from us, your email address, the content of the message, and the usual connection data are processed on Google servers. Legal basis: GDPR Art. 6(1)(b) or Art. 6(1)(f) (handling your inquiry, reliable communication). A data processing agreement is in place; Google is certified under the EU-US Data Privacy Framework.
7. Cookies and Consent Management
We use technically necessary cookies (e.g., cart, session, security, language selection) on the basis of GDPR Art. 6(1)(f) and Section 165(3) of the Austrian Telecommunications Act (TKG 2021). Non-essential cookies and technologies (analytics, marketing) are only set with your consent (GDPR Art. 6(1)(a)) via our consent banner (Shopify Privacy and Compliance Banner). You can change or revoke your selection at any time with effect for the future, for example via the "Your Privacy Settings" page in the footer.
8. Order Processing and Customer Account
When you place an order, we process your name, shipping and billing address, email address, phone number where applicable, and order and payment data for the performance of the contract (GDPR Art. 6(1)(b)). If you create a customer account, we store the data entered there until the account is deleted. Statutory retention obligations (under tax and commercial law, generally 7 years) remain unaffected (GDPR Art. 6(1)(c)).
We send transactional emails (order and shipping confirmations, invoices, notices about your order) via Shopify and Klaviyo on the basis of GDPR Art. 6(1)(b).
9. Subscriptions (Shopify Subscriptions)
If you take out a subscription, we manage it through the Shopify Subscriptions app (Shopify International Ltd.). For this purpose we store your subscription data (product, interval, next delivery date) and a payment method token held with Shopify Payments in order to trigger recurring orders. Legal basis: GDPR Art. 6(1)(b). You can cancel the subscription at any time through your customer account or by email; after that, the subscription data is deleted unless retention obligations apply.
10. Payment Service Providers
Depending on the payment method you choose, we use Shopify Payments (Shopify Payments Europe Ltd., Ireland, technically processed via Stripe Payments Europe Ltd., Ireland), including credit card, Shop Pay, Apple Pay, and Google Pay, as well as, where available, PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) and Klarna (Klarna Bank AB, Sweden). The data required for payment (name, payment details, billing address, order amount) is transmitted directly to the respective provider, which processes it under its own responsibility in accordance with its privacy policy, including for fraud prevention. Legal basis: GDPR Art. 6(1)(b).
11. Shipping (Austrian Post)
For delivery, we pass on your name, shipping address and, where required for delivery or delivery notifications, your email address and phone number to Österreichische Post AG (Austrian Post, Rochusplatz 1, 1030 Vienna) and, where applicable, its delivery partners in Germany (GDPR Art. 6(1)(b)). We create shipping labels through the Austrian Post online label center.
12. Contact (Email, Contact Form, WhatsApp)
When you contact us by email or through our contact and inquiry forms (for example for businesses), we process your information to handle your inquiry (GDPR Art. 6(1)(b) or Art. 6(1)(f)). Form entries are transmitted via Shopify. The data is deleted as soon as it is no longer required and no retention obligations apply.
If you message us via WhatsApp, we use WhatsApp Business (WhatsApp Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland). We process your phone number, your profile name, and the content of your messages in order to respond to your inquiry (GDPR Art. 6(1)(b) or Art. 6(1)(f)). WhatsApp also processes this data under its own responsibility in accordance with its privacy policy; data may be transferred to the USA in the process. Use is voluntary, and you can also reach us by email. On our website, WhatsApp is only linked: you are redirected to WhatsApp only when you click the link.
13. Email Marketing, Pop-up, and Waitlist (Klaviyo)
For email marketing, newsletters, product and offer information, our waitlist, and sign-up forms and pop-ups on the website, we use Klaviyo (Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA). We process your email address, your name where applicable, and usage and interaction data (e.g., opens, clicks, products viewed, cart) to send, personalize, and measure the performance of our mailings. Sign-up uses a double opt-in procedure; the time and confirmation are logged.
The legal basis is your consent (GDPR Art. 6(1)(a), Section 174 of the Austrian Telecommunications Act (TKG 2021)). You can revoke your consent to receive these emails at any time via the unsubscribe link in every email or by sending a message to servus@riccava.com.
We only send reminders about an incomplete order process (cart or checkout reminders) if you entered your email address at checkout and agreed to receive marketing emails.
Klaviyo sets cookies and similar technologies on our website to assign visits and actions (e.g., products viewed) to a profile; this only happens after you have given your consent via the consent banner. Klaviyo is certified under the EU-US Data Privacy Framework; in addition, the EU Standard Contractual Clauses apply. A data processing agreement is in place.
14. Product Reviews (Klaviyo Reviews)
After an order, we may ask you by email to review the products you purchased (Klaviyo Reviews, provider as described in Section 13). The legal basis is our legitimate interest in customer feedback and quality assurance (GDPR Art. 6(1)(f)) or your consent. If you submit a review, we store the review, the star rating, your first name or the name you provided, and the time of submission. Reviews may be published on our website with your first name; you can object to publication at any time and request deletion. You can unsubscribe from review requests at any time.
15. Web Analytics (Microsoft Clarity and Google Analytics 4)
We use Microsoft Clarity (Microsoft Ireland Operations Ltd., One Microsoft Place, Dublin 18, Ireland; Microsoft Corporation, USA) to analyze user behavior (including clicks, mouse movements, scrolling behavior, heatmaps, and pseudonymized session recordings) in order to improve our website. Entries in form fields are masked by default.
We also use Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, USA) for the statistical evaluation of website usage (e.g., page views, time on site, visitor origin, conversions). IP addresses are not stored by Google Analytics 4; Google may transfer the data to the USA and is certified under the EU-US Data Privacy Framework. Data from Google Analytics may be linked with Google Ads to measure the performance of advertising campaigns.
Both services use cookies or similar technologies. Processing takes place exclusively on the basis of your consent (GDPR Art. 6(1)(a)), which you can revoke at any time via the consent banner. Data processing agreements are in place with both providers.
16. Meta Pixel and Conversions API (Facebook, Instagram)
To measure, optimize, and deliver our advertising on Facebook and Instagram according to your interests, we use technologies from Meta (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland): the Meta Pixel (in the browser) and the Conversions API (server-side via Shopify). Information about your visit and your actions on our website (e.g., page views, product views, cart, purchases) is collected and transmitted to Meta, as well as, for better matching and in pseudonymized, hashed form, details such as email address, name, or IP address. The purpose is to measure reach and performance, to build audiences (including remarketing), and to optimize our ads. The legal basis is your consent (GDPR Art. 6(1)(a)), which you can revoke at any time. With regard to collection and transmission, we and Meta are joint controllers (GDPR Art. 26); further processing takes place under Meta's sole responsibility. Data may be transferred to the USA (Meta Platforms, Inc.) in the process, based on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
17. Social Media Profiles and Embedded Links
We maintain profiles on Instagram and other platforms and link to them on our website. When you click such a link, you leave our website; the privacy policy of the respective provider applies. Content from social networks is not automatically embedded on our website.
18. Recipients and Processors
We only pass on personal data to carefully selected service providers that support us in operating the store: Shopify (hosting, store, checkout, subscriptions, consent banner), GemCommerce (GemPages), Cloudflare, Google (Workspace, Analytics), Klaviyo (email, pop-up, reviews), Microsoft (Clarity), Meta (advertising), payment service providers, and Austrian Post. Processors are contractually obligated to process data in compliance with the GDPR. Beyond that, we only disclose data if we are legally required to do so.
19. Data Transfers to Third Countries
Some of the services mentioned process data outside the EU or the EEA, in particular in the USA and Canada. Transfers are based on adequacy decisions of the EU Commission (EU-US Data Privacy Framework, where the provider is certified; Canada) and, in addition, on the EU Standard Contractual Clauses to ensure an adequate level of data protection.
20. Retention Period
We store personal data only as long as necessary for the respective purposes or as required by statutory retention periods (order and invoice data generally 7 years under Section 132 of the Austrian Federal Fiscal Code (BAO)). We store newsletter data until you revoke your consent, and analytics and marketing data in accordance with the retention periods of the respective providers (generally 2 to 14 months). After that, the data is deleted.
21. Data Security
Data is transmitted in encrypted form via SSL/TLS (recognizable by the https:// in the address bar). We take appropriate technical and organizational measures to protect your data.
22. Your Rights
You have the right of access (GDPR Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You may revoke any consent you have given at any time without affecting the lawfulness of processing carried out up to that point. To exercise your rights, simply send a message to servus@riccava.com.
23. Objection to Direct Marketing
You may object at any time, without giving any reason, to the processing of your data for direct marketing purposes, for example via the unsubscribe link in every email or by sending a message to servus@riccava.com.
24. Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority, in Austria the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40 to 42, 1030 Vienna, dsb.gv.at.
25. Changes to This Privacy Policy
We update this privacy policy when our data processing or the legal situation changes. The version published here at the time applies.
Last updated: October 29, 2026