Privacy Policy

Last updated: June 2025

We take the protection of your personal data very seriously. This Privacy Policy explains what data we collect,
how we use it, and what rights you have in connection with your data. Our processing of personal data complies
with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and other applicable
data protection regulations.

1. Controller (Verantwortlicher)

The controller responsible for data processing on this website is:

Deko-Ballons e.U.
Hofmannstahlgasse 12/2/2
1030 Wien, Österreich
Email: office@ballonia.at
Phone: +43 667 7782261
Website: https://ballonia.at
UID: ATU83182556

2. Types of Data Processed (Arten der verarbeiteten Daten)

Depending on how you interact with our website, we may process the following categories of personal data:

• Contact data: Name, email address, phone number
• Order data: Billing address, delivery address, order details, payment information
• Usage data: IP address, browser type, operating system, pages visited, date and time of access
• Communication data: Messages submitted via the contact form or email correspondence
• Cookie data: Session cookies, preference cookies, analytics cookies (where applicable)

3. Purposes of Processing (Zweck der Verarbeitung)

We process your personal data for the following purposes:

• To operate and display our website correctly
• To process and fulfill orders placed through our online shop
• To respond to inquiries submitted via the contact form or email
• To manage customer accounts and order history
• To fulfill legal obligations (e.g., invoicing, tax records)
• To improve the functionality and security of our website
• To send order confirmations and transactional communications

4. Legal Bases (Rechtsgrundlagen — Art. 6 DSGVO)

The processing of your personal data is based on the following legal grounds under Article 6 of the GDPR:

• Art. 6(1)(b) GDPR – Contract performance:
  Processing is necessary to fulfill a contract with you or to take pre-contractual steps at your request
  (e.g., processing orders, managing customer accounts).
• Art. 6(1)(c) GDPR – Legal obligation:
  Processing is necessary to comply with a legal obligation, such as tax and accounting requirements.
• Art. 6(1)(f) GDPR – Legitimate interests:
  Processing is based on our legitimate interests, such as ensuring the technical security and functionality
  of the website, preventing fraud, and improving our services — provided these interests are not overridden
  by your rights and freedoms.
• Art. 6(1)(a) GDPR – Consent:
  Where we rely on your consent (e.g., for optional cookies or newsletter subscriptions), we will request
  your explicit consent. You may withdraw this consent at any time with future effect.

5. Cookies and Tracking (Cookies und Tracking)

Our website uses cookies — small text files stored on your device by your browser. Cookies help us provide
a functional, user-friendly experience.

We use the following types of cookies:

• Technically necessary cookies: These are essential for the operation of the website
  and the online shop (e.g., shopping cart, session management). These cookies are set on the basis of
  Art. 6(1)(f) GDPR and do not require your consent.
• Preference cookies: These store your settings (e.g., language or currency preferences).
• Analytics/statistical cookies: Where we use analytics tools, these are only activated
  with your explicit consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time through
  your browser settings or our cookie consent banner.

You can configure your browser to block or delete cookies at any time. Please note that disabling certain
cookies may affect the functionality of the website or online shop.

6. Contact Form (Kontaktformular)

If you submit a message via our contact form or contact us by email, the data you provide (such as your
name, email address, and message content) will be stored and processed solely for the purpose of handling
your inquiry and any follow-up correspondence.

The legal basis for this processing is Art. 6(1)(b) GDPR (pre-contractual measures or contract performance)
and/or Art. 6(1)(f) GDPR (our legitimate interest in responding to inquiries).

We will not share this data with third parties without your consent. Data submitted through the contact form
will be deleted once the purpose of the communication has been fulfilled and no legal retention obligations apply.

7. Online Shop / WooCommerce (Online-Shop)

Our online shop is powered by WooCommerce, a plugin for WordPress. When you place an order, we collect and
process the following data:

• First and last name
• Billing and delivery address
• Email address and phone number
• Payment information (processed via third-party payment providers)
• Order details and purchase history

This data is processed on the basis of Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR
(legal obligation, e.g., invoicing and tax requirements under Austrian law).

Order data is retained for the duration required by Austrian commercial and tax law — typically seven (7) years
as stipulated by the Bundesabgabenordnung (BAO) and the Unternehmensgesetzbuch (UGB).

Payment transactions are handled by external payment providers. We do not store full payment card details.
Please refer to the privacy policies of the respective payment service providers for further information.

8. Hosting and Servers (Hosting und Server)

Our website is hosted by an external hosting provider. In order to deliver the website to your browser,
technical data is automatically transmitted and temporarily stored in server log files. This includes:

• IP address of the requesting device
• Date and time of the request
• Name and URL of the requested file
• Website from which access is made (referrer URL)
• Browser type, version, and operating system
• HTTP status code and volume of data transferred

This data is processed on the basis of Art. 6(1)(f) GDPR — our legitimate interest in ensuring the
stable and secure operation of the website. Log data is typically deleted after 7 to 30 days unless
it is needed for longer periods to investigate security incidents.

If our hosting provider acts as a data processor on our behalf, a data processing agreement (DPA)
has been or will be concluded in accordance with Art. 28 GDPR.

9. SSL Encryption (SSL-Verschlüsselung)

This website uses SSL (Secure Sockets Layer) encryption to ensure the security of data transmitted
between your browser and our server. You can identify an encrypted connection by the padlock icon
in your browser’s address bar and the https:// prefix in the URL.

When SSL encryption is active, any data you transmit to us — including personal data, payment information,
and messages — cannot be read by third parties during transmission.

10. Your Rights as a Data Subject (Betroffenenrechte)

Under the GDPR and the Austrian Data Protection Act (DSG), you have the following rights with respect
to your personal data:

• Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether
  we process personal data about you and, if so, to receive a copy of that data along with detailed information
  about the processing.
• Right to rectification (Art. 16 GDPR): You have the right to request the correction of
  inaccurate personal data or the completion of incomplete data without undue delay.
• Right to erasure (Art. 17 GDPR): You have the right to request the deletion of your
  personal data where it is no longer necessary for the purposes for which it was collected, where you
  withdraw your consent, or where the processing is unlawful — subject to any legal retention obligations.
• Right to restriction of processing (Art. 18 GDPR): You may request that we restrict
  the processing of your data under certain circumstances, for example while the accuracy of the data
  is being verified.
• Right to data portability (Art. 20 GDPR): Where processing is based on your consent
  or on a contract, you have the right to receive your personal data in a structured, commonly used,
  and machine-readable format.
• Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on your consent,
  you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out
  prior to the withdrawal.

To exercise any of these rights, please contact us at:
office@ballonia.at

11. Right to Object (Widerspruchsrecht — Art. 21 DSGVO)

Where we process your personal data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have
the right to object to this processing at any time for reasons arising from your particular situation.

If you object, we will cease processing your data unless we can demonstrate compelling legitimate grounds
for the processing that override your interests, rights, and freedoms, or the processing serves the
establishment, exercise, or defense of legal claims.

Please send your objection to: office@ballonia.at

12. Right to Lodge a Complaint (Beschwerderecht)

If you believe that the processing of your personal data violates the GDPR or the Austrian Data Protection
Act, you have the right to lodge a complaint with the competent supervisory authority:

Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Wien, Österreich
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at

We would, however, appreciate the opportunity to address your concerns directly before you contact the
supervisory authority. Please feel free to reach out to us first.

13. Data Retention

We retain personal data only for as long as is necessary to fulfill the purposes outlined in this Privacy
Policy, or as required by applicable law. In particular:

• Order and invoice data is retained for a minimum of seven (7) years in accordance
  with Austrian tax and commercial law (BAO, UGB).
• Contact form data is deleted once the inquiry has been fully resolved and no further
  legal basis for retention exists.
• Server log data is typically deleted after 7 to 30 days.

14. No Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR that would produce
legal effects or similarly significantly affect you.

15. Amendments to this Privacy Policy (Aktualität)

We reserve the right to update this Privacy Policy from time to time to reflect changes in legal requirements,
our services, or our data processing practices. The current version is always available on our website at
https://ballonia.at.

We recommend that you review this policy periodically. Significant changes will be communicated to you
directly where required by law.

Last updated: June 2025