Politica sulla riservatezza

As of: August 20, 2026

The protection of your personal data is important to us. Below we inform you about which personal data we process when you visit our online shop at www.schafhocker.com, order from us, contact us, or use our other offers.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Schafhocker.com is an online shop of
DokuPit GmbH
Schulstrasse 14a
A-3300 Amstetten
Susi Schönherr
Tel.: +43 676 979 56 53
Austria

For questions regarding data protection or the exercise of your rights, please contact us using the contact details provided above.

2. Legal Bases

We process personal data only insofar as there is a legal basis for doing so. Depending on the processing, we rely in particular on:

• Art. 6(1)(a) GDPR – your consent, in particular for optional cookies as well as analysis and marketing technologies;
• Art. 6(1)(b) GDPR – the initiation, performance, and execution of a contract as well as pre-contractual measures;
• Art. 6(1)(c) GDPR – the fulfillment of legal obligations, in particular tax and corporate law retention and documentation requirements;
• Art. 6(1)(f) GDPR – our legitimate interests, in particular in the secure, economical, and user-friendly provision of our online shop, the prevention of fraud and abuse, and the establishment, exercise, or defense of legal claims.

Insofar as consent is required for the storage of information on your terminal device or access to information in your terminal device, we obtain this via our cookie banner.

3. Visiting our Online Shop

Technical Provision and Log Data

When you access our online shop, technically necessary data is processed, which your browser transmits to our shop or its technical service providers. This includes, in particular, the IP address, date and time of access, page or file accessed, amount of data transferred, referrer URL, browser type and version, operating system, and, if applicable, error messages.

Processing is necessary to deliver the online shop, to ensure its stability and security, to analyze technical errors, and to prevent attacks or abuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our online shop.

Shopify

Our online shop is operated via the e-commerce platform Shopify. Shopify processes data required for hosting, shop functions, shopping cart, checkout, order management, security functions, and technical communication.

Depending on your interaction, in particular, IP address, device and browser data, cookie information, shopping cart and order data, customer account and contact data may be processed. Recipients may be companies of the Shopify group and subcontractors employed by Shopify.

The processing takes place for the performance of the contract pursuant to Art. 6(1)(b) GDPR, to safeguard our legitimate interests in a secure and efficient shop operation pursuant to Art. 6(1)(f) GDPR and – in the case of optional technologies – on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

Further information on data processing by Shopify can be found at: https://www.shopify.com/legal/privacy

Shopify Network Intelligence / Enhanced Services: This function is not activated in our shop.

4. Ordering, Contract, Shipping, and Customer Service

Orders and Customer Account

When you order from us or create a customer account, we process the data you provide to us as part of the order or registration. This includes, in particular, first and last name, billing and shipping address, email address, telephone number, ordered goods, order number, payment status, shipping status, messages, and, if applicable, voluntary information.

We use this data to process orders, assign payments, ship goods, inform you about your order, process warranty or complaint cases, prevent fraud, and provide customer service.

The legal basis is Art. 6(1)(b) GDPR. Insofar as the processing serves the fulfillment of legal retention, documentation, or reporting obligations, the legal basis is Art. 6(1)(c) GDPR.

The provision of the data required for the order is necessary to conclude and perform a contract with us. Without this data, we cannot process or deliver your order.

Shipping and Worldwide Delivery

For the delivery of your order, we transmit the required data – usually name, shipping address, if applicable, email address and telephone number as well as shipment and order data – to the respective shipping service provider commissioned. Our shipping partners may include, in particular, Österreichische Post AG, DPD, and, depending on the destination country, their local delivery or cooperation partners.

For deliveries to countries outside the European Economic Area (EEA), the data required for shipping, customs clearance, import, or delivery may be transmitted to shipping partners, customs authorities, customs agents, import service providers, or other competent bodies in the destination country. This takes place, as far as necessary, for the performance of the purchase and delivery contract pursuant to Art. 6(1)(b) GDPR, for the fulfillment of legal obligations pursuant to Art. 6(1)(c) GDPR, or to safeguard our legitimate interests in proper worldwide delivery pursuant to Art. 6(1)(f) GDPR.

Please note that the level of data protection in individual third countries may not correspond to the level within the EEA. In the absence of an adequacy decision by the European Commission, we take appropriate protective measures – as far as legally required and within our sphere of influence – in particular the conclusion of EU Standard Contractual Clauses. Insofar as a transfer is exceptionally necessary for the direct performance of your contract and no other suitable guarantee exists, it may be based on Art. 49(1)(b) GDPR.

Invoicing and Accounting

We process order, invoice, payment, and tax-relevant data for invoicing, accounting, fulfillment of legal documentation and retention obligations, and for the defense or enforcement of legal claims.

Recipients may be tax consultants, accounting service providers, banks, payment service providers, and competent authorities, as far as necessary. The legal basis is Art. 6(1)(b) and (c) GDPR and, where relevant, Art. 6(1)(f) GDPR.

5. Payment Processing

For payment processing, we use the payment methods offered in the checkout. Depending on the country and availability, these may include, in particular, credit and debit card payments (Visa, Mastercard, American Express, Maestro, and UnionPay) as well as Bancontact, EPS, iDEAL/Wero, Klarna, MobilePay, and TWINT.

The specific payment data is processed directly by the payment service you have selected. As a rule, we only receive the information we need for the confirmation, processing, and assignment of your payment, such as payment status, transaction identifier and, if applicable, chargeback or fraud information. We do not process full card or access data of the payment methods used.

Payment processing takes place via Shopify Payments and/or the respective payment service chosen by you. The respective provider processes your data under its own responsibility under data protection law or as a service provider, depending on the payment method and specific transaction processing. Information on the respective payment service responsible will be displayed to you in the checkout.

The legal basis is Art. 6(1)(b) GDPR. Insofar as a check is required to prevent fraud or abuse, this takes place on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR.

6. Contacting Us and hCaptcha

If you contact us by email, telephone, contact form, or in any other way, we process the information you provide, including contact details, content of the inquiry, and, if applicable, associated communication data. The processing serves the purpose of handling your request, answering your inquiry, and, if applicable, the initiation or performance of a contract.

The legal basis for contract-related inquiries is Art. 6(1)(b) GDPR, for other inquiries Art. 6(1)(f) GDPR. Our legitimate interest lies in the efficient processing of customer and interested party inquiries.

To protect our contact form from automated entries, spam, and abuse, we use hCaptcha from Intuition Machines, Inc., USA. When accessing or using the protected form, technical data such as IP address, device and browser information, referrer information, timestamps, and interaction data may be processed and transmitted to hCaptcha.

Processing takes place on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR to protect our online shop and our communication channels from abusive automated use. Insofar as consent is required in individual cases for the use of technologies that are not technically necessary, processing takes place only after your consent pursuant to Art. 6(1)(a) GDPR. A transfer of data to the USA cannot be ruled out. Further information can be found at: https://www.hcaptcha.com/privacy

7. Product Reviews with Judge.me

We use the Judge.me app for product reviews. If you place an order with us, we may – as far as legally permissible – send you an invitation to submit a product review. In doing so, in particular, name, email address, products purchased, order information, review submitted, star rating, images, and the time of the review may be processed.

If you publish a review, the information you provide voluntarily, in particular your name or display name, the review text, the star rating, and voluntarily uploaded images, may be publicly visible in the online shop.

The legal basis for sending a review request is our legitimate interest pursuant to Art. 6(1)(f) GDPR in obtaining feedback and improving our offer, as far as this is permissible according to the applicable competition law requirements. Insofar as consent is required, we obtain this in advance. The legal basis for the publication of your voluntarily submitted review is Art. 6(1)(a) GDPR or your voluntary publication. You can object to a review request at any time.

Further information on Judge.me can be found at: https://judge.me/help/en/articles/8364277-gdpr-compliance

8. Affiliate Program with GoAffPro

We operate an affiliate program via GoAffPro. Affiliate partners receive an individual discount code and/or affiliate link. If a discount code or link is used, GoAffPro processes data for the assignment of the recommendation and for the calculation of the partner commission.

In this context, in particular, affiliate ID, discount code used, click and time information, order number, order value, referred products, status of the order, and technically necessary cookie information may be processed. Your full payment data, address, email address, or other contact data not required for the commission will not be transmitted to affiliate partners.

Affiliate partners receive only the data required for the assignment and billing of their referral, in particular the information that an order was placed via their code or link, the order number or a pseudonymized reference, the commission-relevant order value, and the commission status. The specific data sharing depends on the configuration of our affiliate program.

We process this data to assign recommendations, settle commissions, manage the affiliate program, and prevent abuse. The legal basis for technically necessary assignments is Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper execution and prevention of abuse of the affiliate program. Insofar as GoAffPro uses non-necessary cookies or comparable technologies, this only takes place with your consent pursuant to Art. 6(1)(a) GDPR.

9. Analysis and Marketing

We use analysis and marketing technologies exclusively if you have given us your consent to do so via our cookie banner. The legal basis is Art. 6(1)(a) GDPR. You can revoke or change your consent at any time with effect for the future via the cookie settings.

Google Analytics

We use Google Analytics, a web analysis service from Google. Google Analytics helps us understand how visitors use our online shop, for example, which pages are accessed, how long a visit lasts, through which source a visit occurs, and which interactions take place.

In this context, in particular, online identifiers, cookie IDs, IP address, device and browser information, approximate location data, accessed pages, interactions, and timestamps may be processed. We use Google Analytics only after your consent. A transfer of data to Google companies outside the EEA, in particular to the USA, cannot be ruled out.

Further information can be found at: https://policies.google.com/privacy

Pinterest

We use the Pinterest Tag. This serves to measure the success of Pinterest campaigns, to record conversion events, to create target groups, and to display interest-based advertising on Pinterest or on other websites.

In this context, in particular, cookie or similar identifiers, IP address, device and browser information, accessed pages, product and shopping cart events, order or conversion events, and timestamps may be processed. Pinterest may link this data to your Pinterest account if you are logged in there.

We activate the Pinterest Tag exclusively after your consent via the cookie category "Marketing". The legal basis is Art. 6(1)(a) GDPR. You can revoke this consent at any time via the cookie settings. Data transfers to Pinterest companies outside the EEA cannot be ruled out.

Further information can be found at: https://policy.pinterest.com/de/privacy-policy

Shopify Marketing and Personalization

Insofar as you activate the category "Personalization" or "Marketing" in the cookie setting, Shopify and, if applicable, other partners used by us may use technologies to personalize content, measure marketing measures, and show you interest-based advertising. This may include the processing of online identifiers, cookie information, device usage data, shopping cart and purchase events, and interaction data.

You can revoke your consent at any time via the cookie settings. Information on data processing by Shopify can be found at: https://www.shopify.com/legal/privacy

10. Cookies and Comparable Technologies

We use cookies and comparable technologies, such as pixels, tags, local storage, or comparable identifiers. Cookies are small text files that can be stored on your terminal device. Some technologies are technically necessary for our online shop to function. Others serve personalization, analysis, or advertising.

Technically Necessary Technologies

We need technically necessary cookies and comparable technologies in particular for the shopping cart, checkout, security functions, fraud prevention, cookie settings, language and session settings, and the technical provision of the shop. We use these technologies on the basis of Art. 6(1)(f) GDPR and, where applicable, the relevant telecommunications law exemption for technically necessary access. Our legitimate interest lies in the secure and functional provision of our online shop.

Optional Technologies

We use personalization, analysis, and marketing technologies only after your active consent. You can change or revoke your selection at any time with effect for the future via the "Cookie Settings" link in the footer of our online shop.

The individual categories and any services used are explained to you in the cookie banner or in its settings view. The rejection of optional technologies has no influence on the basic usability of our online shop.

11. Recipients and Data Transfers to Third Countries

We only pass on personal data if this is necessary for the purposes mentioned, we are legally obliged to do so, you have consented, or there is a legitimate interest. Recipients may include, in particular:

• Shopify and Shopify-affiliated companies as well as technical subcontractors;
• Payment service providers and banks;
• Shipping service providers, delivery partners, customs authorities, and import service providers;
• IT, hosting, security, and communication service providers;
• Judge.me, GoAffPro, Google, and Pinterest, insofar as their use takes place according to this privacy policy;
• Affiliate partners to the extent described in Section 8, limited to commission settlement;
• Tax consultants, accounting service providers, authorities, courts, and legal advisors, as far as necessary.

Some recipients may be located outside the EEA or process data there. If there is no adequacy decision by the European Commission for the respective recipient country, we use – as far as necessary – suitable guarantees pursuant to Art. 44 et seq. GDPR, in particular EU Standard Contractual Clauses, or base the transfer on a legally provided exception. You can request information from us about the respectively applicable guarantees.

12. Storage Duration

We store personal data only as long as this is necessary for the respective purpose. Subsequently, we delete or anonymize the data, unless we are legally obliged to a longer retention or require the data for the establishment, exercise, or defense of legal claims.

• We generally store contract, order, payment, and invoice data for seven years within the framework of statutory tax and corporate law retention obligations.
• We delete data from customer inquiries as soon as the inquiry has been finally processed and no legal obligations or legal claims stand in the way.
• We store data processed on the basis of consent until the consent is revoked or until the purpose of processing ceases to exist.
• We store cookie and similar consent information as far as necessary to document and manage your selection.

In individual cases, longer storage may be required, for example in the case of ongoing warranty, limitation, or legal disputes.

13. Your Rights

You have the following rights under the legal requirements:

• Access: You can request information about the personal data processed by us.
• Rectification: You can request the rectification of incorrect or the completion of incomplete data.
• Erasure: You can request the erasure of your data under the legal requirements.
• Restriction: You can request the restriction of processing under the legal requirements.
• Data Portability: You can request the transfer of the data you have provided to us and which we process automatically on the basis of consent or for the performance of a contract in a structured, commonly used, and machine-readable format.
• Withdrawal: You can withdraw a given consent at any time with effect for the future. The lawfulness of the processing until the withdrawal remains unaffected.
• Objection: You can object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR. If data is processed for direct marketing, you can object to this processing at any time without giving reasons.

To exercise your rights, a message to office@schafhocker.com is sufficient.

14. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is in particular the:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

You can also contact the data protection supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement.

15. Automated Decisions

We do not make decisions based solely on automated processing – including profiling – which produce legal effects concerning you or similarly significantly affect you.

Insofar as you consent to analysis, marketing, or personalization technologies, these technologies may however be used to evaluate usage behavior, to create target groups, or to display interest-based advertising. This does not constitute an exclusively automated decision with the consequences mentioned in Art. 22 GDPR.

16. Data Security

We take technical and organizational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. Our online shop uses TLS/SSL encryption for the transmission of data.

17. Changes to this Privacy Policy

We may adapt this privacy policy if legal requirements, our online shop, or the services used by us change. The version published on this website at the time, with the status mentioned above, shall apply.