This Privacy Policy provides information about the processing of personal data in the Goldener Papagei Shopify webshop.
1 Controller
GPARG4 GmbH, Argentinierstraße 4–6/Lokal, 1040 Vienna, Austria
Email: hello@goldenerpapagei.at
2 Principles and Legal Bases
We process personal data only for defined purposes and only to the extent necessary for that purpose. Legal bases include, in particular, Art. 6 para. 1 lit. b GDPR for the performance of a contract and pre-contractual measures, Art. 6 para. 1 lit. c GDPR for legal obligations, Art. 6 para. 1 lit. f GDPR for legitimate interests in a secure, economical, and customer-friendly webshop, and Art. 6 para. 1 lit. a GDPR for voluntarily given consent. Additionally, the Austrian Data Protection Act and, in particular, §§ 165 and 174 TKG 2021 apply.
3 Technical Operation with Shopify
The webshop is operated via Shopify. The contractual partner for merchants in the European Economic Area is generally Shopify International Limited, Ireland. Data processed includes, in particular, IP address, device and browser information, access times, shop and account data, shopping cart, order and security data. The processing is necessary for the operation, presentation, checkout, fraud prevention, and security of the webshop. Legal bases are Art. 6 para. 1 lit. b, c, and f GDPR. Our legitimate interest lies in stable and secure operation, misuse prevention, and the enforcement or defense of claims. Shopify processes data within an international company and service provider structure. Transfers are carried out, in particular, on the basis of adequacy decisions, binding corporate rules, or standard contractual clauses. Information about the safeguards can be viewed at www.shopify.com/legal/dpa or requested from us.
4 Orders, Customer Account, and Support
When placing orders and setting up or using a customer account, we process, in particular, name, billing and delivery address, email address, telephone number, ordered products, prices, discounts, order, delivery, and payment status, customer communication, and technical order data. The data is necessary for the conclusion and execution of the contract. An order or delivery is not possible without the information marked as mandatory fields. Voluntary information can be omitted at any time. Legal bases are Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. c GDPR for tax, corporate, and consumer law obligations.
5 Payments and Fraud Prevention
Payment processing is handled via Shopify Payments and the payment service providers selected in the checkout. This involves the processing of, in particular, name, billing data, amount, currency, transaction ID, payment status, technical data, and necessary risk information. Complete card or account data is generally processed directly by the payment service provider; we usually only receive shortened payment data and status information. Legal bases are Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. f GDPR for fraud and misuse prevention. Automated risk warnings can trigger a manual review. We do not make any solely automated decision with legal or comparably significant effect ourselves, unless explicitly communicated otherwise in individual cases.
6 Shipping and Fulfillment
For shipping processing, we transmit the required order and address data to Sendcloud B.V., Netherlands, and to the respective shipping service provider used, in particular DPD or Österreichische Post (Austrian Post). Processed data includes, in particular, name, delivery address, email address, telephone number, order number, shipping product, weight, package status, and tracking data. The legal basis is Art. 6 para. 1 lit. b GDPR. Providing a telephone number is only necessary if it is required for the selected shipping method or delivery communication.
7 Accounting and Invoices
For accounting, invoicing, and tax documentation, we use sevdesk from sevDesk GmbH. Processed data includes, in particular, master, order, invoice, payment, and receipt data. Legal bases are Art. 6 para. 1 lit. b and c GDPR.
8 Newsletter with Klaviyo
If you subscribe to our newsletter, we process your email address and voluntarily provided profile data, as well as the time, IP address, and proof of registration and confirmation. We use Klaviyo for double opt-in, sending, and the welcome email. The confirmation message does not yet contain advertising; only after confirmed registration can the welcome email contain a one-time discount. If you have consented, delivery, opens, clicks, purchases, and derived interests may also be processed to evaluate and adapt content. Legal bases are Art. 6 para. 1 lit. a GDPR and § 174 TKG 2021. Consent is voluntary, not a prerequisite for a purchase, and can be revoked at any time via the unsubscribe link or by email to hello@goldenerpapagei.at. Klaviyo also processes data in the USA and is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. Further information is available at www.klaviyo.com/legal/privacy-faqs.
9 Loyalty Program with Marsello
If the loyalty program is activated and used by you, we use Marsello Limited, New Zealand. This may involve the processing of, in particular, name, contact details, customer account, purchases, points, rewards, redemptions, and interactions. The legal basis is Art. 6 para. 1 lit. b GDPR for the implementation of the loyalty program and, where necessary, Art. 6 para. 1 lit. a GDPR. Marketing via Marsello only takes place after separate authorization. Participation is voluntary. Participation in the loyalty program is not possible without the data required for it, but a purchase remains possible. In the case of transfers to New Zealand or to other recipients outside the EEA, the respective required safeguards are used.
10 Coffee Subscriptions with Seal Subscriptions
For recurring coffee deliveries, we use Seal Subscriptions. Processed data includes, in particular, customer and contact data, product selection, delivery interval, delivery address, price, discount, payment status, next billing, changes, pauses, and cancellation. The legal basis is Art. 6 para. 1 lit. b GDPR. Without this data, the subscription cannot be set up and carried out.
11 Contacting Us
If you contact us by email, telephone, contact form, or via a shop function, we process the communicated contact, content, and process data to handle the request. The legal basis is Art. 6 para. 1 lit. b GDPR in case of contractual reference and otherwise Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in efficient customer communication and the documentation of business processes.
12 Cookies and Consent Management
Technically necessary cookies and similar technologies are used insofar as they are required for the shopping cart, checkout, language settings, security, payment processing, and basic functions. Legal bases are Art. 6 para. 1 lit. b and f GDPR and § 165 para. 3 TKG 2021. Non-essential analysis or marketing technologies are only used after your active consent. A refusal has no effect on the basic possibility of purchasing. Your selection can be changed at any time via the cookie settings with effect for the future. The current detailed overview of the cookies used, providers, and durations is provided in the consent banner.
13 Google Analytics 4
If you consent, we use Google Analytics 4 from Google Ireland Limited for the statistical evaluation of webshop usage. This may involve the processing of event, usage, device, approximate location, and online identifier data and their merging with a pseudonymous identifier. Google Analytics is only activated after your consent. The legal basis is Art. 6 para. 1 lit. a GDPR in conjunction with § 165 para. 3 TKG 2021. The retention period for event and user-related data is limited to 14 months. Google may also process data in the USA; transfers are carried out, in particular, on the basis of the EU-US Data Privacy Framework and, where necessary, standard contractual clauses. Google Signals and personalized advertising features are not activated at the start.
14 Storage Duration
We regularly store order, contract, invoice, and accounting data for seven years from the end of the respective financial year and beyond, to the extent necessary for open proceedings, warranty, liability, or the enforcement and defense of claims. Customer accounts are stored until the account is deleted; legally required records remain unaffected. Contact inquiries without a contractual reference are generally deleted no later than three years after completion. Newsletter data is stored until revocation; proof of consent can subsequently be kept until the expiry of possible claim or prosecution periods. Loyalty and subscription data are stored for the duration of participation or the contract and thereafter only within the framework of legal obligations or required limitation periods. Security and log data are only kept for as long as necessary for security, error analysis, and misuse prevention. Google Analytics data is deleted according to the configuration mentioned above.
15 Recipients and International Transfers
Recipients are only those bodies that require data for the stated purposes, in particular Shopify, payment service providers, Sendcloud and carriers, sevdesk, Klaviyo, Seal Subscriptions, and—after activation—Marsello, as well as IT and consulting service providers and legally authorized authorities. The necessary agreements are concluded with processors. For transfers outside the EEA, we use, where necessary, adequacy decisions, the EU-US Data Privacy Framework, binding corporate rules, or standard contractual clauses including supplementary protective measures. A copy of the respective applicable safeguard can be requested at hello@goldenerpapagei.at; sensitive business and security information may be redacted.
16 Your Rights
In accordance with the legal requirements, you have the right to information, rectification, erasure, restriction of processing, data portability, and objection. Given consents can be revoked at any time with effect for the future; the lawfulness of the processing carried out until then remains unaffected. You can object to processing based on legitimate interests for reasons arising from your particular situation. You can object to direct marketing at any time without giving a reason. To exercise your rights, please contact hello@goldenerpapagei.at.
You also have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
17 Changes
We update this Privacy Policy when the legal situation, shop configuration, or services used change. The version published in the shop is authoritative. As of: September 4, 2026.