top of page

Privacy Policy of the Shop: Lucy's dogstuff

  1. Summary

We, the shop operators, do not sell your data!

We handle your data with great care and only collect and use it to process the purchase you have made.

  1. Introduction

This privacy policy explicitly refers to the collection, use, storage, and transfer of data that we, as operators of the aforementioned shop, control. We explicitly point out that in order to fully inform you about the use of your data in connection with a purchase from our shop, it is necessary to also read the privacy policies of the payment service provider and the shipping service provider.

  1. Definitions

To explain the terms used here, we refer to Article 4 of the GDPR. Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more specific factors that express the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

  1. Contact Information of the Data Controller

You can contact the responsible person for data collection at the following address:

Enayat Gholami
Breuninggasse 4
1230 Vienna, Austria
+43 69010337745
gholami96.e@gmail.com

You can also contact us directly through our shop and its messaging function.

  1. Minors

To agree to this privacy policy, a minimum age of 16 is required. If you are under this age, prior consent to this policy from your legal guardians is absolutely necessary. Retrospective consent is not possible.

  1. Legal Basis

The interference with your rights to the protection of your personal data requires a legal basis, which we disclose here.

We collect, use, store, and forward data based on Article 6(1)(b) GDPR, as the processing of your data is necessary for the fulfillment of a contract or for carrying out a pre-contractual measure initiated at your request, of which you are or will be a party. Additionally, we process your data according to Article 6(1)(c) GDPR, as we are subject to legal obligations whose fulfillment requires the processing of your data (e.g., storing invoices).

Thus, the processing of your data does not require your consent (Article 6(1)(a) GDPR).

  1. Purpose, Type, and Scope of Data Collection and Use

We would like to inform you about the purpose, type, and scope of the data collection and use.

7.1 Principle of Purpose Limitation

The purpose of data processing is to enable the legally secure and successful processing of purchase contracts concluded via our shop for all parties and to comply with the legal requirements to which we, as the responsible party, are subject.

7.2 Principle of Data Minimization and Storage Limitation

If your data is no longer needed to achieve the purposes of collection, we will delete it. To ensure a uniform standard and to transparently explain when your data will be deleted, we conduct regular checks on the appropriateness of data storage.

Deletion criteria are thus the complete processing of the contract and the expiration of legal retention periods.

The relevant retention period for data such as name, address, and payment information is usually the mandatory ten-year retention period for invoices according to § 14b para. 1 sentence 1 UStG, which begins at the end of the calendar year in which the invoice was issued.

Data such as text messages and potentially received image files will generally be deleted after the two-year statute of limitations for warranty claims expires, according to § 438 para. 1 no. 3 BGB, after which the contract processing is usually considered completed. This period starts upon delivery of the goods.

7.3 Principle of Pseudonymization

We anonymize or pseudonymize the collected data if this does not contradict the purpose of data processing. For example, we use customer and order numbers.

7.4 Type and Scope of Data Processing in Detail

The type and scope of data collection and use are limited to what is absolutely necessary to achieve the purpose. Only personal data that is relevant is processed. This includes your first and last name, your address(es), payment details, and text messages.

We use your data to process your online purchases, orders, cancellations, and to communicate shipping status or to answer your inquiries. We also use your data for processing payments, complaints, warranty claims, and identity verification.

The data we process also depends on the product class you choose. For a physical product, the focus is on collecting data about your name and address. We also use your email address to pass it to the shipping service provider for tracking purposes. We will then contact you and provide the tracking ID (tracking number). The shipping service provider also receives your address data from us.

7.5 Processing of Your Data by Third Parties – Processors

Recipients of your data are, on the one hand, us, the responsible party for data collection. On the other hand, we engage third parties to fulfill our tasks, who, to the necessary extent, may also become recipients of your data, insofar as this is necessary for the purpose. These third parties can include:

  • The shipping service provider tasked with fulfillment:

Enayat Gholami, Breuninggasse 4, 1230 Vienna, Austria

Your data will only be shared to the extent necessary for fulfilling the contract.

For a comprehensive assessment of your data usage, please also refer to the relevant payment, shipping, and communication service providers.

  1. Product Reviews

By submitting a product review through our shop, you consent in accordance with Article 6(1) sentence 1(a) GDPR that this review may be publicly displayed permanently. Therefore, it is unlikely that it will ever be deleted and may also be published by us on other websites.

  1. Your Rights

We also want to inform you that you have the right to request free information about the status of your data with us at any time. For this case, we maintain a record of the processing of your data. You will receive the data in a structured, commonly used, and machine-readable format.

You also have the right to request the correction or deletion of your data in accordance with Article 17 GDPR, if one of the following reasons applies:

  • The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.

  • You withdraw your consent on which the processing was based in accordance with Article 6(1)(a) or Article 9(2)(a), and there is no other legal basis for processing.

  • You object to the processing in accordance with Article 21(1) GDPR, and there are no overriding legitimate grounds for processing, or you object to the processing under Article 21(2) GDPR.

  • The personal data have been processed unlawfully.

  • Deletion of personal data is necessary to fulfill a legal obligation under Union or Member State law to which the controller is subject.

  • The personal data were collected in relation to offered information society services under Article 8(1) GDPR.

If we have made the personal data public and are required to delete them as stated above, we will take appropriate measures, including technical measures, to inform data controllers (including third parties) who process the personal data that a data subject has requested the deletion of all links to such personal data or copies or replications of such personal data.

If the processing of your data required your consent (Article 6(1)(a) GDPR), you can withdraw it at any time, informally, and without stating a reason. Additionally, you have the right to lodge a complaint with supervisory authorities if you have concerns about your data security. However, we hope you will contact us first if you have any questions.

  1. Transparency Requirement

If we ever plan to change the purpose of data processing, we will inform you in advance.

  1. Handling Data Breaches and Impact Assessments

We work extremely carefully and reliably. However, should your data be unlawfully accessed by third parties, we will inform you and the relevant supervisory authority without delay, provided that there is no absolute risk to the violation of your rights and freedoms.

​

bottom of page