Privacy policy

The protection of your personal data is an important concern for us. We process your data exclusively on the basis of the statutory provisions (GDPR, TKG 2021/TDDDG, DSG). In this privacy policy we inform you about the essential aspects of data processing within our online shop.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Gössl Gwand GmbH
Plainbachstrasse 4, 5101 Bergheim, Austria
Managing Director: MMag. Maximilian Gössl
E-mail: kundenservice@goessl.com
Telephone: +43 662 46966

A data protection officer has not been appointed. If you have questions about data protection, you can reach us at any time using the contact details given above, in particular by e-mail to kundenservice@goessl.com.

2. General information on data processing

We process personal data only to the extent necessary to provide a functioning website as well as our content and services. As a rule, processing takes place only with your consent or where the processing is permitted by statutory provisions.

The following in particular may serve as legal bases for the processing: your consent (Art 6(1)(a) GDPR), the performance of a contract or pre-contractual measures (Art 6(1)(b) GDPR), compliance with legal obligations (Art 6(1)(c) GDPR) and the safeguarding of our legitimate interests (Art 6(1)(f) GDPR).

3. Provision of the website and server log files

Each time our website is accessed, our hosting service provider automatically collects information transmitted by your browser. This includes: IP address, date and time of access, page accessed, volume of data transferred, browser type and browser version, operating system and the previously visited page (referrer).

This data is stored in server log files and serves the technical provision, the security and the stability of the website. The processing takes place on the basis of our legitimate interest in secure and trouble-free operation (Art 6(1)(f) GDPR).

4. Cookies and consent

Our website uses cookies and comparable technologies. Cookies are small text files that are stored on your device. Technically necessary cookies are required for the operation of the website and the basket; their processing is based on our legitimate interest (Art 6(1)(f) GDPR) and on § 165(3) TKG 2021.

Cookies and services that are not technically necessary – in particular for web analytics – are set exclusively following your express consent via our cookie consent banner (Art 6(1)(a) GDPR, § 165(3) TKG 2021/TDDDG). No such processing takes place before consent is given. You can withdraw or adjust your consent at any time with effect for the future via the cookie banner.

5. Order processing and customer account

In connection with an order we process the data required for the performance of the contract, in particular form of address, first and last name, billing and delivery address, e-mail address, telephone number as well as order and payment data. The processing takes place for the performance of the purchase contract and for the implementation of pre-contractual measures (Art 6(1)(b) GDPR).

You can create a customer account with us. The data provided is stored in order to allow you to manage your orders and address details. You can have a customer account deleted at any time. Statutory retention obligations remain unaffected by this.

6. Hosting and shop system

Our online shop is operated and hosted by Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, Ireland. Shopify processes the data arising in the shop on our behalf, in particular for the provision of the website, for order processing and for the handling and securing of payments.

The legal basis is the performance of the contract (Art 6(1)(b) GDPR) as well as our legitimate interest in secure operation and in the prevention of fraud (Art 6(1)(f) GDPR).

7. Payment processing

Payments are processed via Shopify Payments (Shopify International Limited, address as above). Depending on the payment method chosen, the data required for the payment is processed and transmitted to the respective payment service provider. The payment data may be checked in order to prevent fraud.

The legal basis is the performance of the contract (Art 6(1)(b) GDPR) as well as our legitimate interest in fraud prevention (Art 6(1)(f) GDPR).

8. Web analytics with Google Analytics

We use Google Analytics 4 (property ID G-R5M3DY734J), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics serves the statistical evaluation of the use of our website. IP anonymisation is activated, so that your IP address is processed in shortened form.

Google Analytics is loaded exclusively following your express consent via our cookie consent banner. No collection takes place before consent is given. The legal basis is your consent (Art 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021/TDDDG). You can withdraw your consent at any time with effect for the future via the cookie banner.

A transfer of data to the USA cannot be ruled out. Such a transfer takes place on the basis of the EU standard contractual clauses and Google's certification under the EU-US Data Privacy Framework.

9. Newsletter

If you sign up for our newsletter, we use the double opt-in procedure: after your registration you receive an e-mail in which you confirm your registration. In this way we ensure that the registration actually originates from you. You can unsubscribe from the newsletter at any time, for example via the unsubscribe link in every newsletter e-mail. The legal basis is your consent (Art 6(1)(a) GDPR).

For sending our newsletter and for transactional e-mails we currently use the following service providers:

  • Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA – dispatch of our newsletter. Data is transferred to the USA on the basis of certification under the EU-US Data Privacy Framework.
  • Sendinblue GmbH (Brevo), Koepenicker Strasse 126, 10179 Berlin, Germany – dispatch of transactional e-mails (such as order and shipping confirmations) as well as newsletter e-mails in the double opt-in procedure.

Transactional e-mails that serve the processing of your order are sent by us on the basis of the performance of the contract (Art 6(1)(b) GDPR).

10. Shipping and returns

In order to deliver your order we pass on your name and your delivery address to our shipping service provider DPD Austria (DPD Direct Parcel Distribution Austria GmbH). DPD uses this data for delivery and parcel tracking. The legal basis is the performance of the contract (Art 6(1)(b) GDPR).

For handling returns we use the returns portal of Reever, operated by HERMONT RTU, Inc. Sucursal en España. The data required to process your return is processed in this connection. The legal basis is the performance of the contract (Art 6(1)(b) GDPR).

11. Content delivery network and security

For the secure and fast delivery of our website we use services of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA). Cloudflare provides a content delivery network and protects our website against harmful data traffic and against overload attacks. The legal basis is our legitimate interest in secure and efficient operation (Art 6(1)(f) GDPR).

12. Merchandise management

In order to process your order we process your order data in our internal merchandise management system (Intex). This service provider acts for us as a processor and processes the data exclusively in accordance with our instructions. The legal basis is the performance of the contract (Art 6(1)(b) GDPR).

13. Recipients and processors

To provide our services we use carefully selected service providers who act for us as processors. Data processing agreements pursuant to Art 28 GDPR are in place with these service providers. In detail these are:

  • Shopify International Limited, Dublin, Ireland – hosting, shop system and payment processing
  • Google Ireland Limited, Dublin, Ireland – web analytics (only following consent)
  • Klaviyo, Inc., Boston, USA – newsletter dispatch
  • Sendinblue GmbH (Brevo), Berlin, Germany – transactional e-mails and newsletter dispatch
  • DPD Direct Parcel Distribution Austria GmbH – parcel delivery
  • HERMONT RTU, Inc. Sucursal en España (Reever) – returns processing
  • Cloudflare, Inc., USA – content delivery network and security
  • Intex – merchandise management

Your data is not transferred to recipients beyond the purposes stated.

14. Storage period

We process and store your personal data only for as long as is necessary to achieve the respective processing purpose. Data arising in connection with an order is stored by us for the duration of the performance of the contract.

In addition, we are subject to statutory retention obligations. In particular, under the Federal Fiscal Code (BAO) we are obliged to retain invoice-related documents for seven years. After these periods have expired, the data concerned is deleted, unless it is still required for other permissible purposes.

15. Your rights as a data subject

With regard to the personal data processed by us, you have the following rights:

  • Right of access to the processed data (Art 15 GDPR)
  • Right to rectification of incorrect data (Art 16 GDPR)
  • Right to erasure (Art 17 GDPR)
  • Right to restriction of processing (Art 18 GDPR)
  • Right to data portability (Art 20 GDPR)
  • Right to object to the processing (Art 21 GDPR)
  • Right to withdraw a consent given, with effect for the future (Art 7(3) GDPR)

To exercise your rights, a message to the controller's contact details given above is sufficient.

16. Right to lodge a complaint

If you are of the opinion that the processing of your data infringes data protection law, you have the right to lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority:

Austrian Data Protection Authority
Barichgasse 40-42, 1030 Wien
Web: www.dsb.gv.at

17. SSL and TLS encryption

For security reasons and to protect the transmission of confidential content, our website uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser begins with "https://". As long as the encryption is active, the data you transmit to us cannot be read by third parties.

Version of this privacy policy: May 2026. As our offering develops further or due to changed legal requirements, it may become necessary to adapt this privacy policy. You will find the respective current version on this page.