The controller responsible for processing your personal data is:

Saint Savoy Dancewear e.U.
Proprietor: Rani-Patricia Dirnhofer
Schübelauer Gartenhaus
Zahnradbahnstrasse 17
1190 Vienna, Austria
Telephone: +43 676 604 00 10
Email: office@saintsavoy.com

You can contact us using these details for privacy enquiries or to exercise your rights.

When you access our website, technical connection data is processed to deliver the requested content and help keep the website secure. This includes, in particular, your IP address, the time of access, the requested URL and technical information about your browser and device. Server logs may also contain response codes and the page you visited previously.

The legal basis is Article 6(1)(f) of the General Data Protection Regulation (GDPR). Our legitimate interest is to operate our website reliably and securely and to detect and resolve errors and attacks.

Data transmitted between your browser and our website is encrypted using HTTPS/TLS. Authorised individuals and appointed technical service providers are given only the access necessary for operation, maintenance and troubleshooting.

If you contact us by email or via a contact form, we process your contact details, the contents of your message and any documents you provide in order to respond to your enquiry. For enquiries relating to orders, returns or the exercise of your right of withdrawal, we also process the information needed to identify and handle the relevant transaction, such as your order number.

Where an enquiry concerns a contract or steps taken before entering into a contract, the legal basis is Article 6(1)(b) GDPR. We handle other enquiries on the basis of our legitimate interest in communicating with prospective customers and business contacts under Article 6(1)(f) GDPR.

Messages are processed through our email infrastructure. Necessary correspondence is linked to the relevant matter. We delete enquiries that are no longer needed unless retention obligations or the protection of legal claims require us to retain them.

When you place an order, we process, in particular, your name, billing and delivery addresses, email address, telephone number where provided, and information about the products ordered, prices, payments and order status. We need this data to process orders, arrange delivery, provide customer service and issue refunds. Mandatory information is marked in the relevant form. We cannot carry out a transaction without the information required for it.

If you create a customer account, we process your login details and the information stored in your account to manage your account and orders. The legal basis for this processing is Article 6(1)(b) GDPR.

Our gift vouchers are provided digitally for you to print yourself. To create, deliver and redeem them, we process order details, the voucher value, voucher code and redemption status, together with any personalisation details you enter where such fields are available.

We process the records required for accounting and tax obligations on the basis of Article 6(1)(c) GDPR. Further processing under Article 6(1)(f) GDPR may be necessary to assess, establish, exercise or defend legal claims.

To process your payment, we process the selected payment method, payment amount, transaction references and payment status. Depending on the payment method selected, the payment service providers involved receive the identification, contact, billing, order and payment data needed to process the transaction. Payment services may also process technical data to help secure the payment process.

Data is transferred to carry out your chosen payment on the basis of Article 6(1)(b) GDPR. Article 6(1)(c) GDPR applies where we fulfil statutory record-keeping obligations. Payment service providers may act as independent controllers when fulfilling their own legal obligations, preventing fraud and, where applicable, carrying out credit checks.

WooPayments

We use WooPayments to process the payment methods offered through it at checkout. Companies within the Automattic/Woo group and Stripe are involved in payment processing. Information about their processing is available in Automattic’s Privacy Policy and Stripe’s Privacy Policy.

PayPal

If you pay using PayPal, PayPal processes the information required for the payment. For the Austrian market, the entities involved include PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Details of processing, recipients and international transfers are available in the PayPal Privacy Statement.

We ship our goods with Österreichische Post AG (Austrian Post). We provide Austrian Post with the recipient and address information required for delivery. The legal basis is Article 6(1)(b) GDPR.

We send you the tracking number by email as part of our order communications. Processing by Austrian Post is also governed by its privacy information, which can be accessed through the Austrian Post website.

Our website uses cookies and comparable storage mechanisms. These support functions such as the shopping basket, login and language selection. Session identifiers and the settings required for each function are processed for these purposes.

Technologies that are strictly necessary for a service you have expressly requested may be used without additional consent. Depending on the purpose, the associated processing of personal data is carried out to perform a contract under Article 6(1)(b) GDPR or to provide our website securely under Article 6(1)(f) GDPR.

Optional services require a separate choice. Subscribing to a newsletter, placing an order or accepting our terms and conditions does not replace consent to optional tracking. Where processing is based on your consent, Article 6(1)(a) GDPR provides the legal basis; the legal requirements for storing or accessing information on your device also apply.

You can also delete or block cookies through your browser. Blocking necessary cookies may limit functions such as the shopping basket or login.

We send newsletters about our products and offers using Sender, a service provided by UAB Sender.lt. This involves processing your email address and, where applicable, other information you provide when subscribing. Sender processes the recipient data supplied for sending newsletters as a service provider.

When you voluntarily subscribe to our newsletter, your consent under Article 6(1)(a) GDPR is the basis for sending it. You may withdraw this consent at any time with effect for the future, for example by using the unsubscribe link in the newsletter or by contacting us. Withdrawal does not affect the lawfulness of newsletters sent before you withdrew your consent.

Unsubscribing from the newsletter does not affect communications required for your orders. Order confirmations and other messages necessary to perform the contract are sent independently of the newsletter.

Further information is available in Sender’s Privacy Policy and its information on data processing.

The embedded newsletter form is provided through Sender. When it loads, connection data such as your IP address and technical browser information may be transmitted to the servers involved. The integration also includes requests for visit tracking and font files provided by Google. Technical connection data may therefore also be transmitted to Google. Further information is available in Google’s Privacy Policy.

We use Pinterest to display our products on its platform. Transferring product information to the Pinterest catalogue is distinct from collecting personal data relating to visits and purchases.

The Pinterest integration also includes functions for measuring website visits and purchases. Page views, product interactions and order events may be linked to technical information such as IP addresses, browser information and identifiers and transmitted to Pinterest. This may take place both through your browser and directly from our server via the Conversions API. Enhanced matching may involve processing contact details in hashed form. These hash values are not automatically anonymous.

This measurement helps us understand the impact of our Pinterest activities. Article 6(1)(a) GDPR is the relevant legal basis for consent-based measurement. Consent must cover both browser-side and server-side transfers and must be capable of being withdrawn with effect for the future.

An embedded Save function allows content to be saved on Pinterest. Technical connection data may already be transmitted to Pinterest when this external function loads; when you use it, data may be associated with your Pinterest account.

For individuals in the European Economic Area, Pinterest identifies Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland, and Pinterest, Inc., 651 Brannan Street, San Francisco, CA 94107, USA, as joint controllers under its privacy policy. Further details are provided in Pinterest’s Privacy Policy.

We use Adobe Fonts (formerly Typekit) to display typefaces. Retrieving the font files establishes a connection to Adobe’s infrastructure. In particular, Adobe receives the IP address required to deliver the files, along with information about the embedded font project and the website requesting the fonts.

According to Adobe, no cookies are set solely for font delivery, and the IP address received for this purpose is not stored. A connection to Adobe nevertheless takes place. Further details are provided in the Adobe Fonts privacy information.

If you submit a product review, we process your review, the name you provide, your email address and the time of submission. Following manual approval, the review text, star rating, display name and date are published. Your email address is not published as part of the review. Reviews are not restricted to verified purchasers.

We rely on your consent under Article 6(1)(a) GDPR for the voluntary publication of your review. You may withdraw this consent with effect for the future by contacting us. For moderation and protection against unlawful or abusive submissions, we also process technical information, particularly your IP address, on the basis of Article 6(1)(f) GDPR.

We use Akismet by Automattic for automated spam detection. The review text, name, email address, IP address and technical information such as browser identifiers and the referring page may be transmitted to this service. Our legitimate interest under Article 6(1)(f) GDPR is to protect against spam and abuse. Information about the service is available in Automattic’s Privacy Notice for website visitors.

We use Wordfence by Defiant, Inc., USA, to protect our shop against unauthorised access and malicious requests. This involves processing, in particular, IP addresses, requested URLs, timestamps, technical browser information and security-related information about login attempts.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to protect our systems and the data processed within them. The traffic logging planned for the relaunched website is limited to security-related events. This Live Traffic log is configured with limits of 30 days and 2,000 entries; these limits do not automatically apply to all Wordfence data.

Connections to Wordfence’s infrastructure are used to provide security functions. An additional check of administrator passwords against known data breaches sends a short hash prefix to the service; the password entered is not transmitted in plain text. Further information is available in Wordfence’s Privacy Policy.

We create backups so that we can restore the shop and its data in the event of technical problems or data loss. Backups may contain order and contact data in particular. The legal basis is our legitimate interest in operational security under Article 6(1)(f) GDPR.

As a general rule, we retain personal data only for as long as it is needed for the relevant purpose. Statutory retention obligations and the necessary protection of legal claims may justify longer retention. This applies in particular to invoices and other business records subject to retention requirements; it does not mean that all shop data is retained for the same period.

Depending on the activity, the service providers described in this policy receive the data needed to perform their tasks. These include hosting and email providers, payment and shipping providers, technical support providers, and the newsletter, security and platform services we use. Where service providers process data on our behalf, the required data processing agreements govern that processing.

International services may involve processing outside the European Economic Area. In addition to the legal basis for processing, such transfers must meet the requirements of Articles 44 et seq. GDPR. These may include applicable adequacy decisions or appropriate safeguards, such as EU Standard Contractual Clauses. Consent to a website service does not automatically replace the need to assess these requirements.

Our website contains links to our Facebook and Instagram profiles. An ordinary link does not, in itself, constitute an embedded social media function. Following a link takes you away from our website; on the destination website, the relevant platform provider processes data under its own privacy terms.

Subject to the applicable legal requirements, you have the right to access your personal data, have inaccurate data corrected, request erasure or restriction of processing, and exercise your right to data portability.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object at any time to the processing of your data for direct marketing without having to provide such grounds; this also applies to related profiling.

Withdrawal of consent: You may withdraw consent you have given at any time with effect for the future. This does not affect the lawfulness of processing carried out before you withdrew your consent.

To exercise your rights, please contact office@saintsavoy.com. Where necessary to verify that your request relates to your data, we will ask for appropriate information to confirm your identity.

You also have the right to lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, place of work or the place of the alleged infringement. In Austria, this is the Austrian Data Protection Authority.