Privacy Policy

This privacy policy informs you about which personal data we process when you visit dierupps.at, place orders in our online shop, or make enquiries, what we use it for, and what rights you have. We use terms such as "personal data", "processing", or "controller" in the sense of Art. 4 of the General Data Protection Regulation (GDPR).

Last updated: 3 November 2026

1 Controller

Gerald Rupp GmbH
Am Anger 18
2465 Höflein
Austria

Commercial register number: FN 124453w
Managing Director: Gerald Rupp
Phone: +43 2162 63130
E-mail: office@dierupps.at

For questions regarding data protection and to exercise your rights, you can reach us at this address. We have not appointed a data protection officer, as there is no legal requirement to do so.

2 Overview

Types of data processed

• Master and contact data (e.g. name, address, e-mail address, telephone number)
• Contract and order data (e.g. ordered products, prices, delivery and billing address, order history)
• Payment data (e.g. selected payment method, payment status); card and bank account details are processed by our payment service providers, not by us
• Content data (e.g. text entered in enquiries and forms)
• Usage and device data (e.g. visited pages, clicks, timestamp, browser, operating system, IP address)

Data Subjects

Website visitors, customers, prospective customers, business clients, and newsletter subscribers.

Purposes

• Provision of the website and its functions, security
• Processing of orders, payments, deliveries, withdrawals, and warranty claims
• Handling of enquiries (contact, business client enquiries, newsletter)
• Audience measurement and analysis of the online shop (only with consent)
• Advertising and performance measurement of advertisements (only with consent)
• Fulfilment of legal obligations, in particular tax and commercial retention requirements

3 Legal Bases

We process personal data on the following legal bases:

• Consent (Art. 6( 1)(a) GDPR): for statistical and marketing services, embedded videos and the newsletter. For storing information on your device and accessing it (e.g. cookies) where this is not strictly necessary, we also obtain your consent pursuant to Section 165( 3) of the Austrian Telecommunications Act 2021 (TKG 2021).
• Contract and pre-contractual measures (Art. 6( 1)(b) GDPR): for orders, customer accounts, payments, deliveries and enquiries regarding quotes.
• Legal obligation (Art. 6( 1)(c) GDPR): e.g. for the retention of accounting records.
• Legitimate interests (Art. 6( 1)(f) GDPR): for the secure and stable operation of the website, protection against abuse and responding to general enquiries.

We use strictly necessary cookies without requiring consent (Section 165( 3) TKG 2021).

4 Hosting and server log files

Our website is hosted by Raidboxes GmbH, Münster (Germany). The host processes the data on our behalf (Art. 28 GDPR). Backup copies of the website, which may contain personal data, are stored with the host.

Each time the website is accessed, the server stores access data (server log files): IP address, date and time, accessed address, volume of data transmitted, status code, referrer (previously visited page), browser and operating system. This is necessary for the delivery of the website, troubleshooting and defending against attacks (Art. 6( 1)(f) GDPR). The log files are archived daily and automatically deleted after eight days at the latest, unless they are required to investigate a security incident.

5 Cookies and consent

On your first visit, a banner asks you which categories you consent to. Without your consent, we do not load any statistical or marketing services and no embedded videos.

• Necessary: Shopping basket, checkout (including fraud prevention by our payment service provider Stripe), customer account and saving your preferences. These cookies are always active.
• Statistics: Google Analytics 4, Google Tag Manager and tracking the origin of orders in the shop.
• Marketing: Google Ads, Meta Pixel and Google Tag Manager.
• External media: Videos from YouTube.

We save your selection for 12 months in the cookie "rupp_consent". You can change or revoke it at any time using the "Manage consent" button at the bottom of each page; the revocation applies to the future. Which specific cookies are set, how long they remain stored and where they originate from can be found in the cookie notice.

We use Google Consent Mode: Google services receive the status of your consent. Google Analytics is only loaded once consent has been given for "Statistics", while Google Ads and the Meta Pixel are only loaded once consent has been given for "Marketing". Google Tag Manager is loaded as soon as you have consented to either of the two categories (Section 11).

6 Online shop, ordering and customer account

To process your order, we process the information from the order form (name, billing and delivery address, email address, telephone number, ordered products, payment and dispatch method, your comments) as well as the confirmation of the legal minimum age for alcoholic beverages. The legal basis is the performance of the contract (Art. 6( 1)(b) GDPR); age verification additionally serves to comply with youth protection regulations (Art. 6( 1)(c) GDPR). We require the details marked as mandatory fields in order to conclude and fulfil the contract; without them, we cannot accept the order. Further details are voluntary. You are under no statutory obligation to provide us with data.

With each order, our shop system also stores the IP address and browser identification in order to detect abuse and payment fraud (Art. 6( 1)(f) GDPR).

For delivery, we pass on your name, delivery address and, if applicable, telephone number to the commissioned transport company, unless we deliver the goods ourselves. For payment, we forward the necessary data to the payment service provider (Section 7).

Customer account

You can place an order without a customer account. If you create an account, we store your login details, addresses and orders so that you can view them later and order more quickly. You can have your account deleted at any time (e-mail to office@dierupps.at); order data that we are required to retain will remain stored until the end of the statutory retention period.

Order origin

If you have consented to the "Statistics" category, our shop system (WooCommerce) uses cookies ("sbjs_") to store the origin of your visit (e.g. search engine, advert or linking website, campaign parameters, device type, number of pages visited) and attaches this data to your order when placed. The data remains with us and serves to evaluate our marketing activities (Art. 6( 1)(a) GDPR).

Shop search in other languages

If you search in the English, Slovak or Hungarian version of the shop, we translate a new search term into German once via Google’s Gemini interface so that the search can find matching products. Only the search term is transmitted, without your IP address or any other personal details. We store the search term and the result so that the same term does not need to be transmitted again (Art. 6 para. 1 lit. f GDPR; legitimate interest in a functioning search). Please do not enter any personal data into the search field.

Retention period

We retain order and invoice data for seven years (Section 132 of the Austrian Federal Fiscal Code, Section 212 of the Austrian Commercial Code), and beyond that only for as long as warranty or other claims can be asserted.

7 Payment service providers

We process payments in the online shop via Stripe Payments Europe, Limited, Dublin (Ireland). Available options include credit and debit card, eps bank transfer, Klarna, and Link. Stripe receives the data required for the payment (e.g. name, email address, billing address, amount, order number, payment details) and checks payments for fraud. You enter your card and account details directly with Stripe; we do not receive them. For this purpose, the checkout loads a script from Stripe's servers; for fraud prevention, Stripe sets the cookies "__stripe_mid" and "__stripe_sid" there. Stripe may also transfer data to Stripe, Inc. in the USA (section 15). Stripe's privacy policy: stripe.com/at/privacy.

If you choose Klarna, your data will be passed on to Klarna Bank AB (publ), Stockholm (Sweden). Klarna may carry out an identity and credit check for payments on invoice or in instalments and is responsible for this itself. Klarna's privacy policy: klarna.com/at/datenschutz.

With Link, you can save your payment details with Stripe to pay faster in the future. This storage only takes place at your request and under the responsibility of Stripe.

The legal basis is the performance of the contract (Art. 6( 1)(b) GDPR); fraud screening is based on our legitimate interest and that of the payment service provider (Art. 6( 1)(f) GDPR).

8 Contact, enquiries and forms

When you contact us by email, telephone or via a form, we process your details in order to handle your enquiry (Art. 6( 1)(b) GDPR for enquiries regarding orders and quotes, otherwise Art. 6( 1)(f) GDPR).

• Enquiry for business customers: We store the requested products, your company and contact details, your message, the timestamp, and the IP address (to protect against misuse) together with the enquiry, and send a confirmation by email to you and to us.
• Online withdrawal: We store the order number, name, email address, the items being withdrawn, and the timestamp of the withdrawal, and send you an acknowledgement of receipt.
• Newsletter registration: see section 9.

We require the details marked as mandatory fields in order to process your enquiry. We protect our forms against spam without using third-party services. To limit excessive requests within a short period, we do not store the IP address itself, but a non-reversible checksum (hash) generated with a secret key. It expires one hour after the last request and is deleted automatically afterwards.

We delete form submissions as soon as the enquiry has been dealt with and there is no obligation to retain records; we review this regularly.

9 Newsletter

If you subscribe to our newsletter, we use your email address and, if provided, your name to send you information about products, news, and special offers. The legal basis is your consent (Art. 6( 1)(a) GDPR, Section 174 TKG 2021). As proof, we store the time of subscription, the page, and the wording of the consent.

You can unsubscribe from the newsletter at any time, e.g. by emailing office@dierupps.at. We will then remove your address from the mailing list; we retain proof of your previous consent for as long as claims can be asserted against us arising from it (Art. 6( 1)(f) GDPR).

10 Email dispatch

We send order confirmations, invoices, and replies to enquiries via the email server of ALL-INKL.COM – Neue Medien Münnich, Friedersdorf (Germany), acting on our behalf (Art. 28 GDPR).

11 Google Analytics 4 and Google Tag Manager

If you have consented to the "Statistics" category, we use Google Analytics 4 from Google Ireland Limited, Dublin (Ireland). Google Analytics sets cookies (e.g. "_ga") and records how visitors use the website: pages visited, time spent on the site, referrer, device, browser, approximate location, as well as events such as viewing products and product lists, adding items to or removing them from the basket, starting the checkout process, orders (order number, products, amounts, voucher code, payment and delivery method, whether it is a first-time order), search terms used in the shop search, clicks on telephone, email, WhatsApp and directions links, subscribing to the newsletter, submitting a business customer enquiry (without its content), customer account registration and login, and playing embedded videos. We receive evaluations from this to improve what we offer. IP addresses are not stored by Google Analytics 4. The data is retained for a maximum of 14 months.

We only permit Google Signals (cross-device analysis and demographics such as age and interests for users with a Google account) and data sharing for personalised advertising if you have additionally consented to the "Marketing" category.

The Google Tag Manager (also Google Ireland Limited) is a tool for managing website tags. It is only loaded after your consent to "Statistics" or "Marketing"; in doing so, Google receives your IP address. We currently do not integrate any other services via Google Tag Manager. Should this change, these services will respect your consent, and we will update this privacy policy.

The legal basis is your consent (Art. 6( 1)(a) GDPR). Google may also transfer data to the USA (section 15). Google's privacy policy: policies.google.com/privacy.

12 Google Ads, conversion tracking and remarketing

If you have consented to the “Marketing” category, we use Google Ads from Google Ireland Limited, Dublin (Ireland). We use this to measure whether a visit or an order is attributable to one of our adverts (conversion tracking), and we can display relevant adverts to people who have shown interest in our products on other websites and on Google (remarketing, including with the products viewed). For this purpose, Google sets cookies (e.g. “_gcl_au”) and receives details about the pages visited, products and product lists viewed, products added to the shopping basket (product numbers, quantities, prices), and orders (order number, value, products, whether it is a first-time order). If we also measure enquiries as a conversion, Google additionally receives the information that a newsletter subscription or business customer enquiry was submitted, along with its value (without content).

Enhanced conversions: When you place an order, we additionally transmit your email address, phone number, first and last name, as well as city, postcode, and country to Google. Email address, phone number, and name are hashed (SHA-256) on our server beforehand, i.e. converted into an irreversible string of characters. Google matches these values with Google accounts in order to attribute orders more accurately to adverts.

For adverts featuring our products, we also transmit product data (name, price, availability, images) to Google Merchant Center; these do not contain any personal data.

The legal basis is your consent (Art. 6( 1)(a) GDPR). Google may also transfer data to the USA (Section 15). You can also manage personalised advertising at myadcenter.google.com.

13 Meta Pixel

If you have consented to the “Marketing” category, we use the Meta Pixel from Meta Platforms Ireland Limited, Dublin (Ireland). We use this to measure the effectiveness of our adverts on Facebook and Instagram and can show relevant adverts to people who have visited our website. Meta sets cookies (e.g. “_fbp”, “_fbc”) and receives details about visited pages, viewed products and categories, the shopping basket, the initiation of the checkout process, orders (order number, value, products), search terms, clicks on phone, email, WhatsApp, and directions links, as well as newsletter subscriptions, business customer enquiries, and registrations (without their content).

Advanced matching: At checkout and when an order is placed, we transmit your email address, phone number, first and last name, city, postcode, country, and, in the case of a customer account, a pseudonymous customer ID. These details are hashed (SHA-256) prior to transmission: at checkout by the Meta Pixel in your browser, and upon placing an order on our server. Meta matches them with Meta accounts in order to evaluate adverts more accurately.

We are jointly responsible with Meta for the collection and transmission of data to Meta (Art. 26 GDPR); the agreement regarding this can be found at facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing. The legal basis is your consent (Art. 6( 1)(a) GDPR). Meta may also transfer data to the USA (Section 15). Meta's privacy policy: facebook.com/privacy/policy.

14 Videos, maps, and social networks

YouTube: We embed videos via Google Ireland Limited's "youtube-nocookie.com" mode. They are only loaded once you have consented to the "External Media" category or started the individual video. Google then receives your IP address and playback information; YouTube may set cookies (Art. 6( 1)(a) GDPR).

Google Maps and social networks: We only link to Google Maps (route planning), Instagram, Facebook, and YouTube via external links. You only open the provider's website when you click on a link, and their privacy policies apply. If you have consented to “Statistics” or “Marketing”, we record the click on a directions link as an event (Sections 11 and 13).

Our presence on social networks: If you write to us on Instagram, Facebook or YouTube or comment on posts, we process your details in order to respond (Art. 6( 1)(f) GDPR). We are jointly responsible with Meta for statistics relating to our Facebook and Instagram pages (Page Insights Addendum).

Fonts and images: Fonts and images are hosted on our own server; no data is transmitted to services such as Google Fonts or Gravatar for this purpose. We only load third-party scripts at checkout (Stripe, Section 7) and following your consent (Google, Meta, YouTube).

15 Transfers to third countries

Some providers (Google, Meta, Stripe) may transfer data to the USA. These companies are certified under the EU-US Data Privacy Framework; the European Commission's adequacy decision of 10 July 2023 applies to them (Art. 45 GDPR). Where necessary, the European Commission's standard contractual clauses have additionally been agreed (Art. 46 GDPR). The list of certified companies can be found at dataprivacyframework.gov.

16 Security

We transmit all data in encrypted form (HTTPS) and implement technical and organisational measures pursuant to Art. 32 GDPR. To protect against password guessing, we only store the IP address as a checksum (hash) for a maximum of 15 minutes in the event of failed login attempts; after several failed attempts, logins from this address are briefly blocked (Art. 6( 1)(f) GDPR).

17 Retention period

We only store personal data for as long as necessary for the respective purpose or as required by statutory retention periods. The periods for individual processing activities are set out in the sections above. Accounting records are subject to a statutory retention period of seven years (Section 132 BAO, Section 212 UGB). Once these periods have expired, we delete the data or anonymise it.

18 Your rights

Under the GDPR, you have the right to

• access your stored data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR); you can object to direct marketing at any time,
• withdrawal of granted consent with effect for the future (Art. 7 para. 3 GDPR), for cookies via "Manage consent", otherwise by email.

To do so, please contact office@dierupps.at.

If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with the supervisory authority. In Austria, this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

We do not make exclusively automated decisions within the meaning of Art. 22 GDPR. Any credit assessment for payments via Klarna is carried out by Klarna under its own responsibility (Section 7).

19 Changes

We update this privacy policy whenever our data processing practices or legal requirements change. The version published here applies in each case.