Privacy Policy

As of: August 20, 2026

The protection of your personal data is important to us. Below we provide information regarding which personal data we process when you visit our online shop at www.schafhocker.com, place an order with us, contact us, or utilize our other offers.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Schafhocker.com is an online shop of
DokuPit GmbH
Schulstrasse 14a
A-3300 Amstetten
Susi Schönherr
Tel.: +43 676 979 56 53
Austria

For questions regarding data protection or to exercise your rights, please contact us using the contact details provided above.

2. Legal Bases

We process personal data only insofar as a legal basis exists for doing so. Depending on the processing operation, we rely in particular on:

  • Art. 6(1)(a) GDPR – your consent, in particular for optional cookies as well as analysis and marketing technologies;
  • Art. 6(1)(b) GDPR – the initiation, implementation, and processing of a contract as well as pre-contractual measures;
  • Art. 6(1)(c) GDPR – the fulfillment of legal obligations, in particular retention and documentation obligations under tax and corporate law;
  • Art. 6(1)(f) GDPR – our legitimate interests, in particular in the secure, economical, and user-friendly provision of our online shop, the prevention of fraud and abuse, as well as the establishment, exercise, or defense of legal claims.

Insofar as consent is required for storing information on your terminal device or accessing information in your terminal device, we obtain this via our cookie banner.

3. Visiting our Online Shop

Technical Provision and Log Data

When you access our online shop, technically necessary data is processed, which your browser transmits to our shop or its technical service providers. This includes, in particular, the IP address, date and time of access, page or file accessed, amount of data transferred, referrer URL, browser type and version, operating system, and, if applicable, error messages.

The processing is necessary to deliver the online shop, ensure its stability and security, analyze technical errors, and ward off attacks or misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our online shop.

Shopify

Our online shop is operated via the e-commerce platform Shopify. Shopify processes data required for hosting, shop functions, shopping cart, checkout, order management, security functions, and technical communication.

Depending on your interaction, IP address, device and browser data, cookie information, shopping cart and order data, customer account and contact data may be processed in particular. Recipients may be companies of the Shopify Group as well as subcontractors employed by Shopify.

Processing takes place for the performance of the contract pursuant to Art. 6(1)(b) GDPR, to safeguard our legitimate interests in a secure and efficient shop operation pursuant to Art. 6(1)(f) GDPR and – in the case of optional technologies – on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

Further information on data processing by Shopify can be found at: https://www.shopify.com/legal/privacy

Shopify Network Intelligence / Enhanced Services: This function is not activated in our shop.

4. Order, Contract, Shipping and Customer Service

Orders and Customer Account

If you order from us or create a customer account, we process the data you provide to us in the context of the order or registration. This includes, in particular, first and last name, billing and delivery address, e-mail address, telephone number, ordered goods, order number, payment status, shipping status, messages, and, if applicable, voluntary information.

We use this data to process orders, allocate payments, ship goods, inform you about your order, process warranty or complaint cases, prevent fraud, and provide customer service.

The legal basis is Art. 6(1)(b) GDPR. Insofar as the processing serves the fulfillment of legal retention, documentation, or reporting obligations, the legal basis is Art. 6(1)(c) GDPR.

The provision of the data required for the order is necessary to conclude and perform a contract with us. Without this data, we cannot process or deliver your order.

Shipping and Worldwide Delivery

To deliver your order, we transmit the required data – usually name, delivery address, if applicable e-mail address and telephone number, as well as shipment and order data – to the respective commissioned shipping service provider. Our shipping partners may include, in particular, Österreichische Post AG, DPD, as well as their local delivery or cooperation partners depending on the destination country.

For deliveries to countries outside the European Economic Area (EEA), the data required for shipping, customs clearance, import, or delivery may be transmitted to shipping partners, customs authorities, customs agents, import service providers, or other competent bodies in the destination country. This takes place, as far as necessary, for the performance of the purchase and delivery contract pursuant to Art. 6(1)(b) GDPR, for the fulfillment of legal obligations pursuant to Art. 6(1)(c) GDPR, or to safeguard our legitimate interests in proper worldwide delivery pursuant to Art. 6(1)(f) GDPR.

Please note that the level of data protection in individual third countries may not correspond to the level within the EEA. In the absence of an adequacy decision by the European Commission, we take – as far as legally required and within our sphere of influence – appropriate protective measures, in particular the conclusion of EU Standard Contractual Clauses. Insofar as a transmission is exceptionally required directly for the performance of your contract and no other suitable guarantee exists, it may be based on Art. 49(1)(b) GDPR.

Invoicing and Accounting

We process order, invoice, payment, and tax-related data for invoicing, accounting, fulfillment of legal documentation and retention obligations, as well as for the defense or enforcement of legal claims.

Recipients may be tax advisors, accounting service providers, banks, payment service providers, and competent authorities, as far as necessary. The legal basis is Art. 6(1)(b) and (c) GDPR and, where applicable, Art. 6(1)(f) GDPR.

5. Payment Processing

For payment processing, we use the payment methods offered in the checkout. Depending on the country and availability, these may include, in particular, credit and debit card payments (Visa, Mastercard, American Express, Maestro, and UnionPay) as well as Bancontact, EPS, iDEAL/Wero, Klarna, MobilePay, and TWINT.

The specific payment data is processed directly by the payment service you have selected. We generally only receive the information we need for the confirmation, processing, and allocation of your payment, such as payment status, transaction ID, and, if applicable, chargeback or fraud information. We do not process full card or access data for the payment methods used.

Payment processing is carried out via Shopify Payments and/or the respective payment service you have chosen. The respective provider processes your data under its own responsibility under data protection law or as a service provider, depending on the payment method and specific transaction processing. Information on the respective responsible payment service will be displayed to you in the checkout.

The legal basis is Art. 6(1)(b) GDPR. Insofar as an audit is required to prevent fraud or abuse, this is done on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR.

6. Contacting us and hCaptcha

If you contact us by e-mail, telephone, contact form, or in any other way, we process the information you provide, including contact details, content of the inquiry, and, if applicable, associated communication data. The processing serves to handle your request, answer your inquiry, and, if applicable, initiate or perform a contract.

The legal basis for contract-related inquiries is Art. 6(1)(b) GDPR; for other inquiries, it is Art. 6(1)(f) GDPR. Our legitimate interest lies in the efficient processing of customer and interested party inquiries.

To protect our contact form from automated entries, spam, and misuse, we use hCaptcha from Intuition Machines, Inc., USA. When accessing or using the protected form, technical data such as IP address, device and browser information, referrer information, timestamps, and interaction data may be processed and transmitted to hCaptcha.

Processing takes place on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR to protect our online shop and our communication channels from abusive automated use. Insofar as consent is required in individual cases for the use of technologies that are not technically necessary, processing takes place only after your consent pursuant to Art. 6(1)(a) GDPR. Data transfer to the USA cannot be ruled out. Further information can be found at: https://www.hcaptcha.com/privacy

7. Product Reviews with Judge.me

We use the Judge.me app for product reviews. When you place an order with us, we may – as far as legally permissible – send you an invitation to submit a product review. In this process, the name, e-mail address, purchased products, order information, review submitted, star rating, images, and the time of the review may be processed in particular.

When you publish a review, the information you provide voluntarily, in particular your name or display name, the review text, the star rating, and voluntarily uploaded images, may be publicly visible in the online shop.

The legal basis for sending a review request is our legitimate interest pursuant to Art. 6(1)(f) GDPR in obtaining feedback and improving our offer, as far as this is permissible under applicable competition law requirements. Insofar as consent is required, we obtain it beforehand. The legal basis for the publication of your voluntarily submitted review is Art. 6(1)(a) GDPR or your voluntary publication. You can object to a review request at any time.

Further information on Judge.me can be found at: https://judge.me/help/en/articles/8364277-gdpr-compliance

8. Affiliate Program with GoAffPro

We operate an affiliate program via GoAffPro. Affiliate partners receive an individual discount code and/or affiliate link. If a discount code or link is used, GoAffPro processes data to allocate the referral and calculate the partner commission.

In this process, affiliate ID, discount code used, click and time information, order number, order value, referred products, status of the order, and technically required cookie information may be processed in particular. Your full payment data, address, e-mail address, or other contact details not required for the commission are not transmitted to affiliate partners.

Affiliate partners only receive the data required for the allocation and settlement of their referral, in particular the information that an order was placed via their code or link, the order number or a pseudonymized reference, the commission-relevant order value, and the commission status. The specific data release depends on the configuration of our affiliate program.

We process this data to allocate referrals, settle commissions, manage the affiliate program, and prevent misuse. The legal basis for technically necessary allocations is Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper processing and prevention of abuse of the affiliate program. Insofar as GoAffPro uses non-essential cookies or comparable technologies, this only takes place with your consent pursuant to Art. 6(1)(a) GDPR.

9. Analysis and Marketing

We use analysis and marketing technologies only if you have given us your consent to do so via our cookie banner. The legal basis is Art. 6(1)(a) GDPR. You can withdraw or change your consent at any time with effect for the future via the cookie settings.

Google Analytics

We use Google Analytics, a web analysis service from Google. Google Analytics helps us to understand how visitors use our online shop, for example which pages are accessed, how long a visit lasts, through which source a visit occurs, and which interactions take place.

In this process, online identifiers, cookie IDs, IP address, device and browser information, approximate location data, pages accessed, interactions, and timestamps may be processed in particular. We use Google Analytics only after your consent. A transfer of data to Google companies outside the EEA, in particular to the USA, cannot be ruled out.

Further information can be found at: https://policies.google.com/privacy

Pinterest

We use the Pinterest Tag. This serves to measure the success of Pinterest campaigns, capture conversion events, create target groups, and display interest-based advertising on Pinterest or other websites.

In this process, cookie or similar identifiers, IP address, device and browser information, pages accessed, product and shopping cart events, order or conversion events, and timestamps may be processed in particular. Pinterest can link this data to your Pinterest account if you are logged in there.

We activate the Pinterest Tag exclusively after your consent via the cookie category "Marketing". The legal basis is Art. 6(1)(a) GDPR. You can withdraw this consent at any time via the cookie settings. Data transfers to Pinterest companies outside the EEA cannot be ruled out.

Further information can be found at: https://policy.pinterest.com/en/privacy-policy

Shopify Marketing and Personalization

Insofar as you activate the category "Personalization" or "Marketing" in the cookie settings, Shopify and, if applicable, other partners used by us may use technologies to personalize content, measure marketing measures, and display interest-based advertising to you. This may include the processing of online identifiers, cookie information, device usage data, shopping cart and purchase events, and interaction data.

You can withdraw your consent at any time via the cookie settings. Information on data processing by Shopify can be found at: https://www.shopify.com/legal/privacy

10. Cookies and Comparable Technologies

We use cookies and comparable technologies, such as pixels, tags, local storage, or comparable identifiers. Cookies are small text files that can be stored on your terminal device. Some technologies are technically necessary for our online shop to function. Others serve personalization, analysis, or advertising purposes.

Technically Necessary Technologies

We require technically necessary cookies and comparable technologies in particular for the shopping cart, checkout, security functions, fraud prevention, cookie settings, language and session settings, and the technical provision of the shop. We use these technologies on the basis of Art. 6(1)(f) GDPR and, as far as applicable, the relevant telecommunications law exemption for technically necessary access. Our legitimate interest lies in the secure and functional provision of our online shop.

Optional Technologies

We use personalization, analysis, and marketing technologies only after your active consent. You can change or withdraw your selection at any time with effect for the future via the "Cookie Settings" link in the footer of our online shop.

The individual categories and any services used are explained to you in the cookie banner or in its settings view. Refusal of optional technologies has no influence on the basic usability of our online shop.

11. Recipients and Data Transfers to Third Countries

We only pass on personal data if this is necessary for the purposes mentioned, we are legally obliged to do so, you have consented, or a legitimate interest exists. Recipients may include, in particular:

  • Shopify and companies affiliated with Shopify as well as technical subcontractors;
  • Payment service providers and banks;
  • Shipping service providers, delivery partners, customs authorities, and import service providers;
  • IT, hosting, security, and communication service providers;
  • Judge.me, GoAffPro, Google, and Pinterest, insofar as their use takes place according to this privacy policy;
  • Affiliate partners to the extent described in Section 8, limited to commission settlement;
  • Tax advisors, accounting service providers, authorities, courts, and legal advisors, as far as necessary.

Some recipients may be located outside the EEA or process data there. Insofar as no adequacy decision by the European Commission exists for the respective recipient country, we use – as far as required – appropriate guarantees pursuant to Art. 44 et seq. GDPR, in particular EU Standard Contractual Clauses, or base the transfer on a legally provided exemption. You can request information from us about the respectively relevant guarantees.

12. Storage Period

We store personal data only as long as is necessary for the respective purpose. Subsequently, we delete or anonymize the data, unless we are legally obliged to retain it for a longer period or require the data for the establishment, exercise, or defense of legal claims.

  • We generally retain contract, order, payment, and invoice data for seven years within the framework of legal tax and corporate law retention obligations.
  • Data from customer inquiries is deleted as soon as the inquiry has been finally processed and no legal obligations or legal claims stand in the way.
  • Data processed on the basis of consent is stored until the consent is withdrawn or until the purpose of processing no longer applies.
  • We store cookie and similar consent information as far as necessary to document and manage your selection.

In individual cases, longer storage may be necessary, for example in the case of ongoing warranty, limitation period, or legal disputes.

13. Your Rights

You have the following rights within the framework of the legal requirements:

  • Access: You can request information about the personal data processed by us.
  • Rectification: You can request the rectification of incorrect or the completion of incomplete data.
  • Erasure: You can request the erasure of your data under the legal conditions.
  • Restriction: You can request the restriction of processing under the legal conditions.
  • Data Portability: You can request the transfer of the data you have provided to us and which we process automatically on the basis of consent or for the performance of a contract in a structured, commonly used, and machine-readable format.
  • Withdrawal: You can withdraw a given consent at any time with effect for the future. The lawfulness of the processing until the withdrawal remains unaffected by this.
  • Objection: You can object at any time to processing based on Art. 6(1)(e) or (f) GDPR for reasons arising from your particular situation. If data is processed for direct marketing, you can object to this processing at any time without giving reasons.

To exercise your rights, a message to office@schafhocker.com is sufficient.

14. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is in particular the:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria
E-mail: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

You can also contact the data protection supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement.

15. Automated Decisions

We do not make any decisions based exclusively on automated processing – including profiling – which produce legal effects concerning you or similarly significantly affect you.

However, insofar as you consent to analysis, marketing, or personalization technologies, these technologies may be used to evaluate usage behavior, form target groups, or display interest-based advertising. This does not constitute an exclusively automated decision with the consequences mentioned in Art. 22 GDPR.

16. Data Security

We take technical and organizational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. Our online shop uses TLS/SSL encryption for the transmission of data.

17. Changes to this Privacy Policy

We may adapt this privacy policy if legal requirements, our online shop, or the services used by us change. The version published on this website at any given time with the status mentioned above applies.