PRIVACY POLICY

Effective date: 21 March 2026

1. Data Controller

The controller responsible for data processing on this website is:

CWC Handels GmbH
Franz Josef Platz 9
4810 Gmunden
Austria

Additional business location:
Schulstr. 3
4580 Windischgarsten
Austria

E-mail: office@c-w-c.store
Phone: +43 1 225635474

2. Contact for Data Protection Inquiries

If you have any questions regarding the processing of your personal data or wish to exercise your rights, you may contact us using the above contact details or directly via e-mail at: office@c-w-c.store.

3. Scope and Purpose of Data Processing

We process personal data only to the extent necessary to provide a functional website, our online shop, and our services. In particular, data is processed for handling inquiries, processing orders including payment, shipping and customer support, and for complying with legal obligations.

In particular, we process the following categories of data:

- Master data: name, billing and shipping address
- Contact data: e-mail address, optional telephone number
- Payment data: transaction information, selected payment method
- Communication data: contents of e-mails or contact requests
- Technical data: IP address, browser information, device information, and interaction data relating to the shop

Guest checkout is available.

4. Legal Bases for Processing

Your data is processed on the basis of the following legal grounds:

- Art. 6(1)(b) GDPR: performance of a contract and pre-contractual measures
- Art. 6(1)(c) GDPR: compliance with legal obligations, in particular tax and fiscal obligations
- Art. 6(1)(f) GDPR: legitimate interests, in particular ensuring operational security, preventing misuse, and optimizing the shop
- Art. 6(1)(a) GDPR: consent, where required for certain analytics or marketing services

5. Contact Form and Communication

If you contact us by e-mail or via the contact form, we process the information you provide in order to handle your inquiry and any follow-up correspondence.

6. Customer Account and Checkout

You may create a customer account in order to facilitate future purchases. Orders may also be placed without creating an account.

During checkout, we process the data required for shipping, payment, and contract fulfillment. The fields currently displayed include, in particular, country/region, first name, last name, address, optional additional details, postal code, city, and an optional telephone number.

7. Payment Processing

For payment processing, we use external payment service providers. These include, in particular:

- Shopify Payments
- PayPal

Depending on the selected payment method and technical availability, Shop Pay, Apple Pay, Google Pay, Klarna, credit card payments, or EPS bank transfer may also be offered. The data required for payment processing is transmitted to the respective payment service providers involved.

8. Shipping, Fulfillment and Recipients

For the performance of the contract, we disclose personal data only to the extent necessary to the following recipients or categories of recipients:

- Shopify as the technical shop platform
- Shopify Payments and PayPal for payment processing
- our own operating locations in Gmunden and Windischgarsten for internal processing, warehousing, and order handling
- Weship, Frikusweg 10, 8141 Premstätten, Austria, for fulfillment and other logistics-related services
- Microsoft 365 / Outlook / Exchange / OneDrive for communication, document management, and internal administration
- external tax advisors and accounting service providers

9. Shopify, Cookies and Privacy Settings

Our website uses the Shopify e-commerce platform. Shopify provides tools for privacy settings, cookie banners, data-sharing opt-out pages, regional consent settings, and Shopify Network Intelligence. According to the current configuration, a cookie banner and a data-sharing opt-out page are activated; Shopify Network Intelligence is also enabled.

We use technically necessary cookies for the operation of the shop. Analytics and marketing-related technologies are used only on the basis of your consent where legally required.

Where Shopify Network Intelligence is enabled, additional transparency requirements may apply. In this context, information about your rights in relation to Shopify can be found in the Shopify Privacy Portal. You may review, change, or withdraw your consent at any time via the “Cookie Settings” link or the privacy settings made available on our website.

10. Customer Events and Analytics Services

To optimize our offering, we currently use the following customer events and app pixels in particular:

- Google & YouTube
- Pinterest

Where legally required, these services are activated only after you have given your explicit consent via the cookie banner.

11. Social Media and External Content

Our website contains visible links to the following external platforms:

- Instagram
- Facebook
- TikTok
- YouTube
- LinkedIn
- X
- Pinterest

These are implemented as simple external links. Data is generally transferred to the respective platform only when you actively click on such a link.

Our website also contains an embedded YouTube video. When accessing embedded content, data may be transmitted to Google and/or YouTube.

12. Retention Periods

We retain personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations.

Accounting records, invoices, and other tax-relevant documents are generally retained for seven years. Contract-related and billing-related data may be retained for longer where necessary for the establishment, exercise, or defense of legal claims.

13. Transfers to Third Countries

In the context of using Shopify, Microsoft, Google/YouTube, Pinterest, or other service providers, the transfer of personal data to countries outside the European Economic Area, in particular the United States, cannot be excluded.

Such transfers take place on the basis of the applicable legal mechanisms, in particular adequacy decisions or standard contractual clauses, where required.

14. Your Rights

Under the GDPR, you are entitled in particular to the following rights:

- right of access
- right to rectification
- right to erasure
- right to restriction of processing
- right to data portability
- right to object to processing
- right to withdraw any consent given, with effect for the future

15. Right to Lodge a Complaint with the Supervisory Authority

If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with the competent supervisory authority:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Austria
E-mail: dsb@dsb.gv.at