Privacy policy

Privacy Policy

GeMa SHOP – Handelsagentur Gerald Rehak

Last updated: 8 October 2026

1. Controller

The controller responsible for processing personal data on this website is:
Handelsagentur Gerald Rehak
Ferdinand Raunegger Straße 10
9063 Maria Saal
Austria
Phone: +43 664 1545307
Email: info@stockgehen.at
Website: https://www.stockgehen.at

We take the protection of your personal data seriously. This policy explains which personal data we process when you visit our online shop, place orders or communicate with us, why we process it and what rights you have.

2. Legal bases for processing

We process personal data under the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and relevant provisions of the Telecommunications Act (TKG 2021). Depending on the processing, we rely on:

Article 6(1)(a) GDPR: consent, for example for optional cookies, certain analytics and marketing activities and newsletters.
Article 6(1)(b): performance of a contract or pre-contractual steps, particularly orders, payments and deliveries.
Article 6(1)(c): legal obligations, particularly tax and business record-retention requirements.
Article 6(1)(f): legitimate interests, particularly shop security, fraud prevention, handling enquiries and asserting or defending legal claims, unless overridden by the interests or rights of the individuals concerned.

Where processing relies on consent, you can withdraw it at any time with effect for the future.

3. Personal data we process

Depending on how you use our shop, we may process:

Contact and address data: name, billing and delivery address, email and telephone number.
Order and contract data: ordered products, order number and time, invoice information, shipping status, returns and cancellations.
Payment data: selected method, payment status, transaction identifiers and other information needed to process payments.
Customer account data: contact details, order history and account settings.
Communication data: enquiries, messages and other correspondence.
Technical data: IP address, browser and device information, access times and technical usage data.
Consent data: accepted or declined cookie and marketing consent, including times and technical evidence where applicable.

Data may come directly from you, be collected automatically during website use or come from service providers involved. We process personal data only as necessary for the respective purpose or where an appropriate legal basis exists.

4. Online shop operation by Shopify

Our shop uses the Shopify e-commerce platform. Shopify provides technical infrastructure for displaying the shop, basket and checkout functions, customer accounts, orders and other shop functions. Technical access data, customer information, order data and transaction information may be processed by Shopify. Where Shopify acts on our behalf, processing is based particularly on Article 6(1)(b) and (f) GDPR. Shopify may also act as a controller for certain services of its own. The European Union is selected as our hosting region. This does not mean that all processing takes place exclusively in the EU. Further information: Shopify privacy information.

5. Shopify Network Intelligence

Shopify Network Intelligence is enabled in our shop. Information about shop interactions may be processed together with data from other Shopify services to improve certain Shopify functions, including personalisation, product recommendations, analytics and advertising. Shopify may act as an independent controller for certain processing in these additional services. Where processing or relevant technologies require consent, this must be obtained in advance. Information about Shopify’s processing and exercising your rights: https://privacy.shopify.com/de.

6. Orders and contract performance

When you order, we process personal data to handle the order and fulfil the purchase contract, particularly:

Recording and confirming the order
Payment processing
Invoicing
Shipping and delivery
Returns and withdrawals
Customer service and communication

The legal basis is Article 6(1)(b) GDPR. Statutory retention also relies on Article 6(1)(c).

7. Payment processing

We use Shopify Payments and PayPal. Depending on availability and selection, Shopify Payments supports card payments, EPS, Klarna, MobilePay and Google Pay. Information needed for the chosen payment is sent to the relevant payment provider or payment and card companies. This may include names, billing details, amounts, transaction information and technical data needed for fraud prevention. Payment processing generally relies on Article 6(1)(b) GDPR. Legal obligations and necessary fraud-prevention measures may provide further legal bases. Additional provider privacy terms may apply. Further information:

Full payment card information is processed through the designated payment systems.

8. Shipping and delivery

We share data necessary to fulfil and deliver your order with the appointed shipping or transport provider. This may include recipient name, delivery address and telephone or email details where required for delivery. As we may use different providers, the specific recipient depends on the shipment. The legal basis is Article 6(1)(b) GDPR.

9. Invoicing

Alongside Shopify, we use F: PDF Invoice to create and manage invoices. Data needed for invoicing may be processed, particularly name, address, order number, products, prices and tax information. Processing is based on contract performance under Article 6(1)(b) GDPR and statutory invoicing and retention duties under Article 6(1)(c).

10. Cookies and similar technologies

We use cookies and similar technologies to provide our shop and its functions, distinguishing between technically necessary and optional technologies.

Technically necessary technologies

These support the basket, order processing, shop security and required functions. Where no consent is required, their use follows the relevant statutory provisions. Associated personal-data processing relies particularly on Article 6(1)(b) or (f) GDPR, depending on purpose.

Optional technologies

With your consent, additional technologies may be used for:

Saving personal preferences
Analysing website use
Measuring shop performance
Personalised advertising and marketing

Where required, these technologies are used only with consent. You can accept, reject or individually select optional cookies through our banner. Consent may be withdrawn or changed at any time for the future through our website’s cookie settings. Processing requiring consent relies on Article 6(1)(a) GDPR.

11. Google Analytics 4

We use Google Analytics 4, a Google web analytics service, to analyse shop use. It may process page views, product views, interactions, orders, device and browser information and technical identifiers. Our measurement ID is G-32X0SH6M67. Analysis helps us understand shop use and improve our offering and usability. Where legally required, processing relies on consent under Article 6(1)(a) GDPR. You can withdraw consent for the future through our cookie settings. Further information: Google privacy policy.

12. Google & YouTube and conversion measurement

Our shop uses Shopify’s Google & YouTube integration to connect Google Analytics 4 and Google Merchant Center. A Google web pixel and server pixel are enabled in Shopify for analytics and conversion measurement. Depending on the function, technical identifiers, usage and event data and order information may be processed. Shopify’s cookie banner manages consent preferences. The integration supports consent signals through Google Consent Mode. Depending on technical configuration, limited signals may also be transmitted without analytics or advertising cookies. Where required, processing relies on consent under Article 6(1)(a) GDPR. Further information: Google privacy policy.

13. Google Merchant Center

We use Google Merchant Center to synchronise product and shipping information with Google and display products in Google services. Product descriptions, prices, availability and shipping information may be transmitted. Any personal data is processed under applicable statutory provisions. Further information: Google privacy policy.

14. Email marketing and newsletters

If you subscribe to marketing emails, we process your email address and any other voluntarily supplied data to send product information, news and offers. Subscription requires an active choice; the checkbox is not preselected. New subscribers use double opt-in, with a confirmation message to verify subscription. Processing generally relies on consent under Article 6(1)(a) GDPR. Other statutory permissions for electronic direct marketing may also apply where relevant. You can withdraw consent at any time through the unsubscribe link or by contacting info@stockgehen.at. This does not affect the lawfulness of processing before withdrawal.

15. Shop remarketing and product reminders

Shopify-related functions may send abandoned-basket reminders, back-in-stock notifications and price-change information. Messages may refer to previously viewed products or other interactions. Where consent is required for electronic advertising or underlying processing, these functions are used only with an appropriate legal basis. Shopify or the Shop app may also act as a controller for their own services. Further information: https://privacy.shopify.com/de.

16. Customer accounts and return requests

Shopify customer accounts let customers view orders and submit available return and cancellation requests. Identity and contact data, order information and return or cancellation details may be processed. Processing generally relies on contract performance under Article 6(1)(b) GDPR.

17. Customer communication

When you contact us by email, telephone or other available channels, we process your information to handle your enquiry. This includes name, contact details, message content and order information where applicable. The legal basis is Article 6(1)(b) or (f) GDPR, depending on the context. Correspondence is stored only as long as needed to handle the matter, comply with legal duties or protect legitimate interests.

18. Other Shopify applications

We also use Shopify Translate & Adapt and Shopify Flow to operate and manage the shop. They support translation management and automation of internal workflows. Personal data processed depends on the functions and automations actually configured. We also use a Shopify connection to ChatGPT for administration and support. Information from Shopify may be processed within expressly initiated workflows insofar as necessary for the task and technically authorised.

19. Recipients of personal data

Where necessary for the purpose, personal data may be shared with:

Shopify and technical service providers involved
Payment providers and networks
Shipping and transport companies
Invoicing providers
Analytics, marketing and communication providers
Tax advisers and bookkeeping services where needed
Authorities and courts where legally required

Data is shared only with an appropriate legal basis.

20. International data transfers

Using Shopify, Google and other providers may involve processing outside the European Economic Area. Transfers to third countries must meet Articles 44 et seq. GDPR, particularly through European Commission adequacy decisions or appropriate safeguards such as standard contractual clauses.

21. Retention and deletion

We generally retain personal data only as long as necessary for its purpose or required by law. In particular:

Accounting and tax documents: generally seven years under Austrian tax retention rules; longer periods may apply in special circumstances.
Order and contract data: as needed for contract performance, statutory retention and asserting or defending legal claims.
Newsletter data: until consent is withdrawn or subscription cancelled. Required evidence of consent or withdrawal may be retained longer where legally permitted.
Enquiries: as long as needed for handling and any legal claims.
Cookie and usage data: according to purpose, technologies and applicable legal requirements.

After the purpose ends and relevant retention periods expire, personal data is deleted or anonymised unless another basis permits further storage.

22. Data security

We implement appropriate technical and organisational measures against unauthorised access, loss, alteration or unlawful disclosure. Our shop uses encrypted connections for data transmission. Complete protection against all risks of electronic transmission cannot be guaranteed.

23. Your rights

Subject to statutory conditions, you have rights to:

Access under Article 15 GDPR
Rectification under Article 16
Erasure under Article 17
Restriction under Article 18
Data portability under Article 20
Object to certain processing under Article 21
Withdraw consent for the future under Article 7(3)

To exercise your rights, contact info@stockgehen.at. To prevent unauthorised disclosure, we may request identity verification within legal limits.

24. Complaints to a supervisory authority

If you believe processing violates data protection law, you may lodge a complaint with a competent supervisory authority. In Austria, this is particularly:
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria
Website: https://www.dsb.gv.at

You may also contact another competent supervisory authority where statutory conditions are met.

25. Children’s privacy

Our shop is not specifically directed at children. We do not knowingly process children’s personal data for purposes lacking required consent from their legal representatives. If a child’s data has been unlawfully sent to us, please contact info@stockgehen.at.

26. External links

Our website may link to external websites. Their operators’ respective privacy policies apply to processing on those sites.

27. Changes to this policy

We may update this policy when legal requirements, technical functions, providers or processing activities change. The current version is published on our website.

28. Contact

For privacy questions or to exercise your rights, contact:
GeMa SHOP – Handelsagentur Gerald Rehak
Ferdinand Raunegger Straße 10
9063 Maria Saal
Austria
Phone: +43 664 1545307
Email: info@stockgehen.at