Privacy policy

Privacy

Last updated: 5 October 2026

Controller: Máté Kovács – Gilded Bruises
8.-Mai-Strasse 28/20
9020 Klagenfurt am Wörthersee, Austria
gildedbruises@gmail.com
+43 676 4535799

Orders and contact

We process your contact, address, order and payment information to handle orders, delivery, payment, returns and contract-related enquiries (Article 6(1)(b) GDPR). Required details are identified during ordering; without them we cannot process the order. Tax record retention is based on Article 6(1)(c) GDPR. Other enquiries, shop security and the defence or enforcement of claims are handled on the basis of our legitimate interest in secure business operations (Article 6(1)(f) GDPR).

Recipients, where necessary for their task, include our shop provider Shopify, your selected payment provider, shipping providers, email providers and, where applicable, accounting and legal advisers and competent authorities. We use Gmail for email communication. Payment providers receive the information needed for payment at checkout; shipping providers receive the details needed for delivery.

Shopify and technical data

This shop operates through Shopify. IP addresses, device and browser information, visits, orders and technical logs are processed to provide the shop, process payments and prevent abuse. Depending on the service, Shopify processes data as a processor or for its own purposes explained in its privacy notices. Further information and contact details: Shopify consumer privacy policy.

Cookies and analytics

Necessary cookies and similar storage functions support features such as the cart, language and consent management. Optional analytics and marketing functions are activated only with your consent (Article 6(1)(a) GDPR; section 165(3) Austrian Telecommunications Act 2021). You can change or withdraw your choices at any time through “Cookie settings” in the footer. Withdrawal takes effect for the future.

With your analytics consent, we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We collect pseudonymous device/cookie identifiers, page and product views, size selections, cart and checkout actions, order values, visit sources and country information to measure shop use and product interest by country. Our analytics function does not send names, email addresses or full delivery addresses. According to Google, Google Analytics 4 does not store IP addresses. Further information: Google privacy policy.

Optional email signup

If you sign up for shipping notifications, we store your email address, selected country and consent evidence with Shopify to notify you within the scope of your signup (Article 6(1)(a) GDPR). Signup does not reserve goods or promise expansion to other delivery countries. You can withdraw consent at any time using an unsubscribe link or by emailing us. No such notification is sent without signup.

International transfers and retention

Shopify and Google may process data outside the European Economic Area, particularly in Canada and the United States. Transfers rely on applicable adequacy decisions or appropriate safeguards, particularly EU Standard Contractual Clauses. Information about these safeguards is available in the linked privacy notices or on request from us.

We retain data only as long as necessary for its purpose. Tax-relevant business records are generally retained for seven years, or longer during ongoing proceedings. Enquiries are deleted after resolution unless retention duties or necessary evidence preservation apply. Optional signup data is used until consent is withdrawn or the notification purpose ends; necessary consent records may be retained longer to defend legal claims. Analytics identifiers and event data are deleted or aggregated according to their technical lifespan and configured retention period. You may send us a deletion request.

Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation, and to direct marketing at any time. Consent may be withdrawn at any time for the future. Contact us using the email address above. You may complain to the Austrian Data Protection Authority or another competent data protection supervisory authority.

Online withdrawal form

We use CC EU Widerruf Button by CC Consulting GmbH, Emil-Figge-Straße 91, 44227 Dortmund, Germany, to receive and document withdrawals and send receipt emails. The service processes your name, email address, order reference, affected items, declaration and receipt timestamp, along with necessary technical and order data. The provider processes withdrawal data on our behalf under a data-processing agreement and states that it hosts this service in the EU. Processing is necessary to handle your contract and meet our legal obligations (Article 6(1)(b) and (c) GDPR). Withdrawal records are retained for applicable legal record-keeping and claims periods. Further information: provider privacy notice.