Privacy Policy

This privacy policy explains which personal data (“data”) we process on this website and in our online shop, for what purpose and on what legal basis (General Data Protection Regulation, GDPR).

Hosting and server logs

This website is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary connection data such as IP address, time, requested page and browser identifier in order to deliver the website and protect it against attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses also apply.

Based on your IP address, Cloudflare also determines the country you are visiting from. We only use this to show prices appropriately (incl. or excl. VAT) and to suggest the country at checkout; it is not stored.

Orders in the online shop

When you place an order, we process the details from the order form: name, email address, optionally phone number, delivery/billing address, ordered items, payment method and invoice amount. We use this data solely to process your order – invoicing, shipping, communication about the order and warranty. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) and our statutory retention obligations (Art. 6(1)(c) GDPR).

We keep order and invoice data for seven years in accordance with § 132 of the Austrian Federal Fiscal Code (BAO) and delete it afterwards. Incomplete online payment attempts are deleted automatically after 24 hours.

For shipping, we pass your name and delivery address to the respective carrier (e.g. Austrian Post) to the extent necessary for delivery.

Payment processing via Stripe

If you choose “Card, PayPal & more”, you are redirected to Stripe’s payment page (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your payment details directly with Stripe; we do not receive any card or account data, only confirmation of whether the payment succeeded. We send Stripe your email address, the order number and the order items. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). Stripe may also transfer data to the USA; Stripe is certified under the EU-US Data Privacy Framework. Details: stripe.com/privacy.

If you pay in advance by bank transfer, you transfer the amount directly to our bank account. We generate the QR code for the transfer using the goQR.me service (Foundata GmbH, Germany); only our account details, the amount and the order number are transmitted – no data about you.

Abuse protection (Cloudflare Turnstile)

To protect the order form against automated spam orders, we use Cloudflare Turnstile (Cloudflare, Inc., see above). When you open the checkout, Turnstile uses technical characteristics of your browser (e.g. IP address, browser properties) to check whether the request comes from a human – usually without you having to click anything. No cookies are set for advertising or tracking purposes. The legal basis is our legitimate interest in protecting the shop against abuse (Art. 6(1)(f) GDPR). Details: cloudflare.com/privacypolicy.

Sending emails

We send order confirmations, invoices, payment and shipping notifications via Resend (Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA). For this, your email address and the content of the respective email are transmitted to Resend. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). The transfer to the USA is based on EU Standard Contractual Clauses.

Contact by email or phone

If you contact us by email or phone, we process your details to answer your inquiry (Art. 6(1)(b) or (f) GDPR). We delete this data as soon as it is no longer needed, unless statutory retention obligations apply.

Cookies, local storage and analytics

We do not use tracking cookies or any analytics or advertising tools. For the shop to work, your browser stores your shopping cart locally (local storage) and, during an online payment, temporarily your form entries (session storage), so you don’t have to re-enter anything if you cancel the payment. This data does not leave your browser until you submit an order. The legal basis is § 165(3) of the Austrian Telecommunications Act 2021 (strictly necessary).

Fonts are loaded directly from our own server; there is no connection to Google or any other font provider.

External links

Links to our social media profiles (Facebook, Instagram) lead to external platforms. The respective provider’s privacy policy applies as soon as you visit those pages.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on our legitimate interest (Art. 15–21 GDPR). Simply contact info@asp-puch.de. Statutory retention obligations (e.g. for invoices) may prevent immediate erasure.

Right to lodge a complaint

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).

Changes to this privacy policy

We update this privacy policy when our website, our shop or the legal requirements change.

Last updated: 26 Sept 2026