Privacy Policy (EU/GDPR)

This Privacy Policy applies to customers ordering from the European Union / EEA and describes how we process personal data in accordance with the GDPR and the Austrian Telecommunications Act (TKG). For US orders, see our US-focused Privacy Policy handled by our US operating partner.

1. Data Controller

LUXONARIA GmbH
Lustkandlgasse 3/1/1-2a
1090 Vienna, Austria
Email: [email protected]

2. General Information on Data Processing

We only process personal data where a legal basis under Art. 6 GDPR exists: consent, contract performance, legal obligation, or legitimate interest.

3. Data Collected on This Website

When you browse this site, our hosting provider automatically collects technical data (IP address, browser type, date/time of access, referring page) for security and stability purposes.

4. Contact

When you contact us by email or contact form, the data you provide (name, email, message) is stored to process your inquiry.

5. Orders

When you place an order shipping to an EU/EEA address, we collect the data necessary to process it: name, address, email, phone, and order details. This data is shared with the payment provider and shipping carrier as required to fulfil the order.

6. Payment Providers

Depending on the payment method chosen at checkout, your payment data is transmitted to the relevant payment provider (e.g. Mollie, PayPal, Stripe) which processes it under its own privacy policy.

7. Cookies

This website uses cookies. Non-essential cookies are only set with your consent via the cookie banner. See our Cookie Policy for details.

8. Google Analytics

Where enabled and consented to, we use Google Analytics to understand website usage. IP addresses are anonymised where technically possible.

9. Hosting

This website is hosted on servers operated on our behalf; a data processing agreement is in place with our hosting provider as required under Art. 28 GDPR.

10. Your Rights

Under the GDPR you have the right to access, rectify, erase, or restrict processing of your data, the right to data portability, and the right to object to processing. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde).

11. Data Protection Contact

For any data protection queries, contact [email protected].

12. Changes

We may update this policy to reflect legal or operational changes. The current version always applies.

Draft prepared for legal review. Please confirm accuracy with counsel before relying on this notice.

If you tick the newsletter box when you order, we send you an email with a confirmation link (double opt-in). You only receive our newsletter with offers and new arrivals after you have confirmed. The legal basis is your consent (Art. 6(1)(a) GDPR).

For this we store your email address, your name and your country and, as proof, the time of sign-up and confirmation and the IP address at sign-up. We manage this data in our own system (FluentCRM on our server); emails are sent via Brevo (Sendinblue SAS, Paris, France) as our processor.

You can withdraw your consent at any time – with the unsubscribe link in every email or by writing to [email protected]. After that we no longer use your email address for the newsletter.