Privacy Policy
Table of contents
Information on data protection
1) Information on the collection of personal data and contact details of the person responsible.
2) Contacting
3) Data processing for order processing
4) Web analytics services
5) Rights of the data subject
6) Duration of the storage of personal data
7) Reference to the Shopify Privacy Policy
1) Information on the collection of personal data and contact details of the person responsible.
1.1 We are pleased that you are visiting our Online-Shop Times & Treasure (www.timesandtreasure.com) and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website. Personal data is any data with which you can be personally identified.
1.2 The data controller within the meaning of the General Data Protection Regulation (GDPR) is Times & Treasure e.U., Franzensgasse 11/1, 1050 Vienna, Austria, e-mail: support@timesandtreasure.com. The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
2) Contacting
In the context of contacting us (e.g. via contact form or e-mail), personal data are collected, which these are, you can see from the contact form. This data is stored and used exclusively for the purpose of responding to your request or for contacting you and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your request pursuant to Art. 6 (1) lit. f GDPR. If your contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 (1) lit. b GDPR. Your data will be deleted after final processing of your request, this is the case if it can be inferred from the circumstances that the matter concerned has been conclusively clarified and provided that there are no legal storage obligations to the contrary.
3) Data processing for order processing
3.1 Insofar as necessary for the processing of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 Para. 1 lit. b GDPR.
If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we will process the contact data (name, address, e-mail address) provided by you when placing the order in order to inform you personally about upcoming updates within the legally stipulated period of time within the scope of our legal information obligations pursuant to Art. 6 (1) lit. c GDPR by suitable means of communication (e.g. by mail or e-mail). Your contact data will be used strictly for the purpose of informing you about updates owed by us and will only be processed by us for this purpose to the extent necessary for the respective information.
In order to process your order, we also work together with service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.
3.2 When using the payment method Shopify Payment, the payment is processed via Shopify International Limited, 2nd Floor Victoria Buildings 1-2 Haddington Road, Dublin 4, D04 XN32, Irland, unless the payment is made in the currencies US dollars or Canadian dollars. In this case, payment processing is carried out via Shopify Payments (USA) 251 Little Falls Drive, Wilmington, Delaware 19808. The transfer takes place in accordance with Art. 6 para. 1 lit. b GDPR and only insofar as this is necessary for the payment processing.
For more information on data protection, please see Shopify's privacy policy: https://www.shopify.com/legal/privacy
4) Web analytics services
Google (Universal) Analytics
Google (Universal) Analytics is used for Shopify, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google (Universal) Analytics uses so-called "cookies", which are text files that are stored on your terminal device and enable an analysis of your use of the online presence. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States.
Google (Universal) Analytics is used exclusively with the extension "_anonymizeIp()", which ensures anonymization of the IP address by shortening it and excludes direct personal reference. Through the extension, your IP address is shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google LLC.server in the USA and shortened there. On our behalf, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity for us. In this context, the IP address transmitted by your browser as part of Google (Universal) Analytics will not be merged with other Google data.
Google Analytics also enables the creation of statistics with statements about the age, gender and interests of site visitors on the basis of an evaluation of interest-based advertising and with the inclusion of third-party information via a special function, the so-called "demographic characteristics". This allows the definition and differentiation of user groups of the website for the purpose of targeting marketing measures. However, data records collected via the "demographic characteristics" cannot be assigned to a specific person.
Details on the processing triggered by Google Analytics and Google's handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites
All processing described above, in particular the setting of Google Analytics cookies for the reading of information on the end device used, will only be carried out if you have given us your express consent to do so in accordance with Art. 6 (1) a GDPR. Without this consent, Google Analytics will not be used during your visit to the site.
You can revoke your given consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the "Cookie Consent Tool" provided on the website. We have concluded an order processing agreement with Google for the use of Google Analytics, which obliges Google to protect the data of our site visitors and not to pass it on to third parties.
For the transfer of data from the EU to the USA, Google refers to so-called standard data protection clauses of the European Commission, which are intended to ensure compliance with the European level of data protection in the USA.
Further information on Google (Universal) Analytics can be found here: https://policies.google.com/privacy?hl=de&gl=de
Meta Pixel and Retargeting
We use meta pixels to collect data on your website interactions, such as pages visited, products viewed, name, e-mail address, billing address, shipping address, phone number, credit card or bank account information, date of birth or other presistent identifiers that can be used to identify you for traffic analysis and to enhance user experience. Retargeting technologies deliver personalized content or ads across third-party sites based on your interactions with our site, improving your overall online experience. Third-party service providers assist in meta pixel and retargeting activities. They are bound by confidentiality agreements and use data solely for specified services. Our website may use third-party platforms for retargeting; refer to their privacy policies for data handling practices.
Meta pixel and retargeting activities require your explicit consent (Art. 6 (1) a GDPR). Manage your consent preferences through our "Cookie Consent Tool". You have the option to opt-out of meta pixel and retargeting activities. Adjust your browser settings or use third-party tools for cookie management. Note that opting out may affect personalized content and ad delivery. You can revoke consent at any time. Use opt-out options or contact us at support@timesandtreasure.com.
We implement reasonable security measures to protect meta pixel and retargeting data from unauthorized access, disclosure, alteration, or destruction.
5) Rights of the data subject
5.1 The applicable data protection law grants you comprehensive data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, which we inform you about below:
Right to information pursuant to Art. 15 GDPR: You have in particular the right to information about your personal data processed by us, the processing purposes, the categories of personal data processed, the recipients or categories of recipients to whom your data have been or will be disclosed, the planned storage period or criteria for determining the storage period. the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, complaint to a supervisory authority, the origin of your data if it has not been collected from you by us, the existence of automated decision-making, including profiling, and, if applicable, meaningful information about the logic involved and the scope and intended effects of such processing that concern you, as well as your right to be informed about what guarantees exist in accordance with Art. 46 GDPR when your data is transferred to third countries;
Right to rectification pursuant to Art. 16 GDPR: You have a right to the immediate rectification of any incorrect data relating to you and/or completion of any incomplete data stored by us;
Right to erasure pursuant to Art. 17 GDPR: You have the right to request the erasure of your personal data if the requirements of Art. 17 (1) GDPR are met. However, this right does not exist in particular if the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defense of legal claims;
Right to restriction of processing pursuant to Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data, which you dispute, is being verified, if you refuse the deletion of your data due to unlawful data processing and instead request the restriction of the processing of your data, if you require your data for the assertion, exercise or defense of legal claims after we no longer need this data after the purpose has been achieved, or if you have lodged an objection for reasons relating to your particular situation as long as it has not yet been determined whether our legitimate grounds prevail;
Right to information pursuant to Art. 19 GDPR: If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients.
Right to data portability pursuant to Art. 20 GDPR: You have the right to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request that it be transferred to another controller, insofar as this is technically feasible;
Right to revoke consent given in accordance with Art. 7 (3) GDPR: You have the right to revoke consent to the processing of data once given at any time with effect for the future. In the event of revocation, we will immediately delete the data concerned, unless further processing can be based on a legal basis for processing without consent. The revocation of consent shall not affect the lawfulness of the processing carried out on the basis of the consent until the revocation;
Right to lodge a complaint pursuant to Art. 77 GDPR: If you consider that the processing of personal data concerning you infringes the GDPR, you have - without prejudice to any other administrative or judicial remedy - the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, workplace or the place of the alleged infringement.
5.2 RIGHT OF OBJECTION
IF WE PROCESS YOUR PERSONAL DATA IN THE CONTEXT OF A BALANCING OF INTERESTS ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE AT ANY TIME ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING IS FOR THE PURPOSE OF ASSERTING, EXERCISING OR DEFENDING LEGAL CLAIMS.
IF WE PROCESS YOUR PERSONAL DATA FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.
6) Duration of the storage of personal data
The duration of the storage of personal data is determined on the basis of the respective legal basis, the purpose of processing and - if relevant - additionally on the basis of the respective statutory retention period (e.g. retention periods under commercial and tax law).
When processing personal data on the basis of explicit consent pursuant to Art. 6 (1) a GDPR, the data concerned will be stored until you revoke your consent.
If there are statutory retention periods for data that is processed within the scope of legal or quasi-legal obligations on the basis of Art. 6 Para. 1 lit. b GDPR, this data will be routinely deleted after expiry of the retention periods, insofar as it is no longer required for the fulfillment or initiation of a contract and/or we do not have a legitimate interest in continuing to store it.
When processing personal data on the basis of Art. 6(1)(f) GDPR, this data will be stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
When processing personal data for the purpose of direct marketing based on Art. 6 (1) lit. f GDPR, this data will be stored until you exercise your right to object according to Art. 21 (2) GDPR.
Unless otherwise stated in the other information in this statement about specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.
7) Reference to the Shopify's Privacy Policy
The Shopify platform is responsible for all further data processing that goes beyond the data processing described above. For more information about Shopify's data protection, please see Shopify's privacy policy: https://www.shopify.com/legal/privacy