We are committed to safeguarding the privacy and confidentiality of personal data for users of our store. We will only utilize your personal data to deliver services and products effectively, implementing protections against any breaches and misuse.

To deliver our services, we collect, process, manage, and store the following personal data:

• Full name
• Shipping address
• Billing address (if applicable)
• Name and details of the legal entity (if applicable)
• VAT number (if applicable)
• Email address
• Username (if you choose to create a customer account)
• Securely stored password
• Contact telephone number (if applicable)
• Country of residence
• Order history
• Additional information that users may voluntarily add to their profile

We process this data for the following purposes:

• Creating and managing customer accounts
• Processing and fulfilling orders
• Handling payments and payment-related processes
• Shipping products and managing deliveries
• Providing customer support
• Communicating with customers regarding orders and services
• Fulfilling legal and regulatory obligations

Our website uses cookies and similar technologies to ensure the proper operation of the online store, enable shopping cart functionality, maintain user sessions, and improve website security. Essential cookies that are required for the operation of the website may be used without prior consent. Where we use non-essential cookies, such as analytics cookies, these will only be activated after obtaining your consent where required by applicable law. We may process technical information such as IP address, browser information, device information, and access logs for security purposes and to ensure the reliable operation of our website.

We process personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR). Personal data is handled confidentially and protected through appropriate technical and organizational measures to prevent unauthorized access, loss, misuse, or disclosure.

We may share personal data with trusted third-party service providers where necessary to provide our services, process orders, complete payments, deliver products, maintain website security, or comply with legal obligations. These third parties may include payment providers, shipping providers, hosting providers, and other service providers required for the operation of our online store. Promotional communications, such as newsletters or marketing emails, will only be sent where required consent has been provided or where otherwise permitted by applicable law. All employees and service providers who have access to personal data are required to maintain confidentiality and handle such information in accordance with applicable data protection requirements.

Employees, contractors, and service providers who have access to personal data are instructed regarding their responsibilities under applicable data protection laws and are required to maintain confidentiality. The commitment to these privacy principles remains indefinitely, even after termination of employment. Users may request deletion of their account and personal data by contacting us. Certain information may need to be retained where required by law, particularly accounting and tax obligations.

The controller responsible for processing personal data on this website is:

Boxstitch e.U.
Liebenauer Hauptstraße 263
8041 Graz
Austria
[email protected]

We process personal data only where permitted under applicable data protection laws, including the General Data Protection Regulation (GDPR).

Personal data may be processed for the following purposes:

• Performance of a contract (Art. 6(1)(b) GDPR), including processing and fulfilling orders, customer communication, shipping, and account management.
• Compliance with legal obligations (Art. 6(1)(c) GDPR), including accounting and tax record retention requirements.
• Legitimate interests (Art. 6(1)(f) GDPR), including website security, fraud prevention, operation of the online store, and responding to customer inquiries.
• Consent (Art. 6(1)(a) GDPR), where required for optional cookies, newsletters, or similar services.

To protect our website from spam, abuse, and automated attacks, we use Cloudflare Turnstile, a service provided by Cloudflare, Inc. Turnstile may process technical information such as IP address, browser information, user-agent data, TLS fingerprint, and other signals required to distinguish human visitors from automated systems.

This processing is based on our legitimate interest in maintaining the security, integrity, and functionality of our website pursuant to Art. 6(1)(f) GDPR. For additional information regarding Cloudflare's handling of personal data, please refer to Cloudflare's Privacy Policy and Turnstile Privacy Addendum.

Under the GDPR, users have the right to:

• Access their personal data.
• Request correction of inaccurate personal data.
• Request deletion of personal data where legally permissible.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Receive a copy of their data in a portable format where applicable.
• Withdraw consent at any time where processing is based on consent.

Users also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde) if they believe their personal data is being processed unlawfully.

Personal data will be retained only for as long as necessary to fulfill the purposes described in this Privacy Policy or to comply with legal obligations. Order and invoice data may be retained for the period required by Austrian tax and accounting laws. Customer accounts may be retained until deleted by the user or upon request, unless legal retention obligations apply.

To operate our online store and provide our services, we use third-party service providers that may process personal data on our behalf or independently.

These may include:

• WooCommerce / WordPress for managing our online store, customer accounts, and orders.
• Payment providers such as PayPal and Stripe for processing payments and fraud prevention.
• Shipping providers for delivery of purchased products.
• Hosting providers for operating our website and storing necessary data.
• Google Analytics for analyzing website usage and improving our services.
• Cloudflare Turnstile for website security and bot protection.

Each provider processes personal data according to their own privacy policies and applicable data protection requirements.

For processing payments, we use external payment service providers, including PayPal and Stripe.

When selecting a payment method, certain personal data required for payment processing may be transferred to the respective payment provider. This may include name, billing information, payment details, transaction information, and technical data required for fraud prevention. Payment providers process personal data independently according to their own privacy policies.

We reserve the right to update this Privacy Policy where necessary to reflect changes in our services, legal requirements, or data processing practices. The latest version will always be available on our website.

For questions regarding this Privacy Policy or the processing of your personal data, please contact:

Boxstitch e.U.
Liebenauer Hauptstraße 263
8041 Graz
Austria
[email protected]