Privacy policy

1. Data Controller

The data controller responsible for data processing on this website is Pataaka GmbH Untersbergstraße 104, 5084 Großgmain Austria Email: we.care@pataaka.at Commercial register number: 614474 p, Commercial Court Salzburg Regional Court  VAT ID : AT14 2040 4000 4340 7790

If you have any questions about data protection, please contact us at any time using the email address above.

2. General Information on Data Processing

We process our users' personal data only where this is necessary to provide a functioning website and our content and services. Personal data is processed regularly only with the user's consent or on the basis of a legal permission (in particular Art. 6(1)(a), (b) and (f) GDPR).

3. Provision of the Website and Creation of Server Log Files

You can visit our website without providing any personal information. Each time our website is accessed, our system automatically collects data and information from the accessing computer's system (server log files), including:

  • IP address
  • Date and time of the request
  • File requested
  • Amount of data transferred
  • Browser and operating system used

This data is used to ensure a smooth connection, comfortable use of the website, and to evaluate system security and stability. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. The data is deleted as soon as it is no longer required for these purposes, at the latest after [number] days.

Hosting / Shop Platform

Our online shop is operated via the Shopify platform (provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland, and/or Shopify Inc., 151 O'Connor Street, Ottawa, ON, Canada). Shopify processes, among other things, server log files on our behalf and enables the operation of the shop. Further information is available in Shopify's privacy policy: https://www.shopify.com/legal/privacy

4. Cookies

Our website uses cookies. Cookies are small text files stored on your device. Some cookies are technically necessary for the shop to function (e.g. shopping cart, login); others are used for analytics or advertising purposes and are only set with your consent.

On your first visit to our website, you will be asked for your consent via a cookie banner (Shopify's built-in cookie banner). You can withdraw your consent at any time with effect for the future, e.g. via the cookie settings on our website or through your browser settings.

5. Order Processing and Customer Accounts

To process your order (Art. 6(1)(b) GDPR), we collect the data necessary for the order, including your name, delivery address, billing address, email address, and, where applicable, phone number. This data is processed and stored to fulfil the purchase contract and to comply with statutory (in particular tax and commercial) retention obligations.

If you create a customer account, the data you provide is stored permanently until you delete your account.

Shipping

To deliver your order, we share your data (name, delivery address, and, where applicable, phone number/email for shipping notifications) with the shipping provider engaged for delivery, e.g. [Austrian Post / other shipping partners depending on destination country].

6. Payment Providers

Depending on the payment method chosen, we share the data necessary for payment processing with the relevant payment provider. The privacy policy of the respective provider applies in addition to this policy. Payment methods currently available in our shop: Shopify Payments / Credit Card / PayPal / Klarna, Shop.

7. Newsletter

If you sign up for our newsletter, we use your email address and, where applicable, your name, to send you regular information about Pataaka, new collections, and offers. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in any email or by contacting us.

For newsletter delivery, we use Klaviyo 

Klaviyo (Klaviyo Inc., 225 Franklin St, Boston, MA, USA): https://www.klaviyo.com/legal/privacy

Sign-up uses a double opt-in process; we also store the time of sign-up and your IP address as proof of consent.

8. Web Analytics with Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies or similar technologies that enable an analysis of how our website is used (e.g. pages visited, time spent, visitor origin). The information generated is generally transmitted to and processed on a Google server.

This processing only takes place if you have consented via our cookie banner (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future. Further information on how Google Analytics handles user data can be found in Google's privacy policy: https://policies.google.com/privacy

9. Contacting Us

If you contact us by email, contact form, or social media, your details will be stored by us to process your inquiry and for any follow-up questions. The legal basis is Art. 6(1)(b) or (f) GDPR. The data is deleted as soon as it is no longer required for processing, at the latest after [number] years.

10. Disclosure of Data to Third Parties

Your personal data is only transferred to third parties within the scope of the purposes described above (e.g. shipping, payment processing, hosting, newsletter delivery, web analytics) and to processors with whom we have data processing agreements under Art. 28 GDPR. Transfers to countries outside the EU/EEA (e.g. the USA) only take place where appropriate safeguards are in place (e.g. EU Standard Contractual Clauses).

11. Your Rights

As a data subject, you have the following rights:

  • Right of access to the data we hold about you (Art. 15 GDPR)
  • Right to rectification of inaccurate data (Art. 16 GDPR)
  • Right to erasure of your data stored with us (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to the processing of your data (Art. 21 GDPR)
  • Right to withdraw any consent given, with effect for the future

To exercise these rights, please contact us at any time (see contact details under Section 1).

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, https://www.dsb.gv.at

12. Retention Period

Unless a more specific retention period is stated in this policy, your personal data will be deleted once it is no longer required for the purpose for which it was collected and no statutory retention obligations (e.g. under Austrian commercial and tax law, generally 7 years) apply.

13. Changes to This Privacy Policy

We reserve the right to amend this privacy policy to ensure it always complies with current legal requirements, or to reflect changes to our services. Your renewed visit to our website will then be subject to the new privacy policy.

Last updated: September 2026