Privacy Policy

This English version is provided as a courtesy translation. The German version („Datenschutzerklärung“) is the legally binding version.

We process your personal data exclusively on the basis of the applicable legal provisions (GDPR, Austrian Data Protection Act, TKG 2021). This policy explains what data we process when you visit this website and place an order in our shop, for what purposes, and on what legal basis.

1. Controller

Simon Marcel Schlieber Bienengasse 5, Top 6, 1060 Vienna, Austria Phone: +43 (0) 720 347 381 Email: mail@simon-simons.com

2. Principles

This website uses no advertising, cross-site advertising or social-media trackers. With your prior consent, it uses Google Analytics 4 to measure use of the website and the shop. Google Analytics remains completely blocked until you select Accept analytics. Rejecting analytics does not restrict the shop. Our emails contain no open or click tracking.

The following information, necessary for operating the shop or recording your consent choice, is stored locally in your browser (local storage or session storage, § 165 para 3 TKG 2021 — no consent required):

If you accept analytics, Google Analytics additionally creates the first-party cookies described in the cookie and browser-storage notice. No names, addresses or payment data are stored in the shop’s own browser entries.

3. Hosting and technical infrastructure (Cloudflare)

This website is operated on Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; for the EEA: Cloudflare Germany GmbH). Cloudflare provides delivery of the website, the database for order and subscriber data, queues for order processing, and routing of incoming email.

When you access the website, Cloudflare processes technical connection data (in particular IP address, date and time of access, page requested, browser and device information) to the extent necessary to deliver the content and defend against attacks. We ourselves do not store your IP address in plain text; for abuse prevention (rate limiting), IP addresses are processed only briefly and exclusively in cryptographically hashed form.

Legal bases: Art 6(1)(b) GDPR (provision of the shop), Art 6(1)(f) GDPR (legitimate interest in secure, stable operation).

A data processing agreement is in place with Cloudflare. Transfers to the USA cannot be excluded; they take place on the basis of Cloudflare’s certification under the EU-U.S. Data Privacy Framework and, additionally, the EU Commission’s Standard Contractual Clauses. More information: www.cloudflare.com/privacypolicy

4. Optional website and ecommerce analytics (Google Analytics 4)

With your consent, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA), under measurement ID G-W601RG38PN.

The purpose is to understand, in aggregate, how consenting visitors find and use the website and where the shop can be improved. The events include page visits, campaign source information, viewing a work, adding or removing it from the bag, viewing the bag, starting checkout, and a purchase after the shop has confirmed the paid order. For a confirmed purchase, Google receives a transaction reference, product identifiers and titles, quantity, price, discount, shipping amount and currency. Google does not receive the customer’s name, email address, postal address, telephone number, payment details, confirmation tokens or the complete order-status URL.

Google Analytics uses pseudonymous browser and session identifiers in the cookies _ga and _ga_*. Before data is sent, the shop removes all URL parameters other than standard utm_* campaign parameters. Google Signals, advertising storage, advertising user data and advertising personalisation are disabled. Google states that IP addresses of users in the EU are used only for coarse location derivation and are discarded before the measurement data is logged.

The Google tag and analytics cookies remain blocked until you accept analytics. The legal basis is your consent under Article 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021. You can change or withdraw that consent at any time through Cookie settings in the website footer. Withdrawal stops future analytics collection and causes the storefront to delete the Google Analytics cookies accessible to it. The lawfulness of processing before withdrawal remains unaffected.

Google acts as our processor for the analytics service. Transfers to the United States may occur on the basis of Google LLC’s certification under the EU-U.S. Data Privacy Framework and, additionally, the EU Commission’s Standard Contractual Clauses. The Google Analytics property is to use the shortest operationally suitable event-data retention and no longer than 14 months.

More information: policies.google.com/privacy, business.safety.google/adsprocessorterms

5. Orders in the shop

When you place an order, we process the following data:

• name, email address, phone number
• billing and shipping address (shipping within Austria only)
• ordered works, edition number, prices, discounts applied
• payment status and payment method (but not your payment details themselves, see section 5)
• order and contract documents including the order confirmation sent to you

Purposes: conclusion and performance of the contract, allocation of the edition number, production and shipping, invoicing, handling of warranty and withdrawal cases.

Legal bases: Art 6(1)(b) GDPR (contract), Art 6(1)(c) GDPR (statutory retention obligations, in particular § 132 of the Austrian Federal Fiscal Code, BAO), Art 6(1)(f) GDPR (abuse and fraud prevention, documentation).

Providing this data is necessary to conclude the contract; without it, an order is not possible. No customer account is created.

6. Payment processing (Stripe)

Payment is handled by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland; parent company: Stripe, Inc., USA). For payment you are redirected to a checkout page operated by Stripe. You enter your payment details (e.g. card number) directly with Stripe; they are never transmitted to us or stored by us. From Stripe we receive only the payment status, the payment method, and the billing and shipping details you confirmed during checkout.

Stripe processes your data in part as an independent controller, in particular for fraud prevention and to comply with its own legal obligations. Stripe uses automated fraud detection procedures. We do not make any decision based solely on automated processing that produces legal effects within the meaning of Art 22 GDPR.

Legal bases: Art 6(1)(b) GDPR (payment processing), Art 6(1)(f) GDPR (fraud prevention).

Transfers to the USA take place on the basis of Stripe’s certification under the EU-U.S. Data Privacy Framework and, additionally, Standard Contractual Clauses. More information: stripe.com/at/privacy

7. Invoicing and accounting (sevdesk)

For issuing invoices and credit notes and for accounting we use sevdesk (sevdesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany). We transmit the data required for invoicing (name, billing address, email address, phone number, ordered works, amounts).

Legal bases: Art 6(1)(b) GDPR (contract), Art 6(1)(c) GDPR (tax and fiscal obligations).

A data processing agreement is in place with sevdesk. Processing takes place within the EU. More information: sevdesk.de/datenschutz

8. Transactional email (Brevo)

For sending transactional emails (subscription confirmation, order confirmation, invoice, dispatch notification, refund confirmation) we use Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany; part of the Brevo group, Paris, France). The data processed are your email address, name, message content and technical delivery events (e.g. delivery, bounces).

We do not use open or click tracking in our emails and do not synchronize contact lists with Brevo.

Legal bases: Art 6(1)(b) GDPR (contract performance), Art 6(1)(f) GDPR (reliable delivery, bounce handling).

A data processing agreement is in place with Brevo. Processing takes place within the EU. More information: www.brevo.com/legal/privacypolicy

9. Newsletter

You can subscribe to our newsletter with your email address. Subscription uses a double opt-in procedure: you first receive a confirmation email with a link valid for 48 hours. Your address is added to the list only after confirmation. We log the subscription and confirmation (timestamps) in order to be able to prove consent. Newly confirmed subscribers receive a one-time welcome discount code; its conditions are set out in the Terms and Conditions.

Legal bases: Art 6(1)(a) GDPR (consent) in conjunction with § 174 TKG 2021.

You can unsubscribe at any time with immediate effect via the unsubscribe link included in every email we send. After unsubscribing you will receive no further newsletters; the lawfulness of processing prior to withdrawal remains unaffected. Delivery is handled via Brevo (see section 8).

10. Contact and support mailbox

If you contact us by email (e.g. questions, warranty, withdrawal), your details are processed to handle your request. Incoming email to our domain is forwarded via Cloudflare Email Routing (see section 3) to our mailbox at Proton (Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland) and stored there. An EU Commission adequacy decision exists for Switzerland.

Legal bases: Art 6(1)(b) GDPR (contract-related requests), Art 6(1)(f) GDPR (answering other enquiries).

11. Shipping

To deliver your order we transmit your name, shipping address and — where required for delivery — your phone number or email address to the commissioned carrier: Österreichische Post AG.

Legal basis: Art 6(1)(b) GDPR (contract performance).

12. Web fonts (Adobe Fonts)

For a consistent typographic presentation this website uses Adobe Fonts (Adobe Systems Software Ireland Ltd., 4-6 Riverwalk, Citywest Business Campus, Dublin, Ireland; parent company: Adobe Inc., USA). When a page is loaded, your browser retrieves the required fonts directly from Adobe servers. In doing so, your IP address and technical browser information are transmitted to Adobe. According to Adobe, no cookies are set for the provision of the fonts.

Legal basis: Art 6(1)(f) GDPR (legitimate interest in consistent, license-compliant typography; self-hosting these fonts is not permitted under the license).

Transfers to the USA take place on the basis of Adobe’s certification under the EU-U.S. Data Privacy Framework and, additionally, Standard Contractual Clauses. More information: www.adobe.com/privacy/policies/adobe-fonts.html

13. Recipients and third-country transfers — overview

Beyond this, we disclose personal data only where legally required (e.g. to tax authorities) or where necessary to enforce legal claims.

14. Retention periods

• Order, contract and invoice data: 7 years from the end of the calendar year (§ 132 BAO); longer only where required for pending proceedings or the limitation of claims.
• Google Analytics event and user data: only for consenting visitors and no longer than 14 months in the property’s event-data retention; aggregated reports may remain available for longer.
• Newsletter data: until consent is withdrawn; thereafter the address is processed only to ensure exclusion from future mailings.
• Unconfirmed newsletter sign-ups: the confirmation link expires after 48 hours.
• Support correspondence: until the matter is resolved, at most within statutory limitation periods.
• Technical security and log data: short-term, as required for operation and abuse prevention.

15. Your rights

You have the rights of access (Art 15 GDPR), rectification (Art 16), erasure (Art 17), restriction of processing (Art 18), data portability (Art 20) and objection (Art 21). You may withdraw any consent at any time with effect for the future (Art 7(3) GDPR).

To exercise your rights, an informal message is sufficient: mail@simon-simons.com

If you believe that the processing of your data violates data protection law, you may lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at

16. No automated decision-making

We do not make decisions based solely on automated processing within the meaning of Art 22 GDPR. For fraud prevention in payment processing, our payment provider Stripe uses automated screening (see section 5); flagged transactions are reviewed manually on our side.

17. Changes to this privacy policy

We will update this privacy policy when the legal situation or our processing activities change. The version published on this website applies; the version number and effective date appear at the top of this document.