Privacy policy
Privacy Policy
Town Town Online Store – Lederleitner GmbH
Last updated: October 2026
1. Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) for the “Town Town” online store is:
Lederleitner GmbH
Feldgasse 5
3451 Michelhausen
Austria
Data protection contact: Anna Lederleitner
Email: office@town-town.store
No Data Protection Officer has been appointed, as there is no legal obligation to do so.
2. General Information on the Processing of Personal Data
Protecting your personal data is important to us. We process personal data exclusively in accordance with applicable legal provisions, in particular the GDPR, the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).
Personal data means any information relating to an identified or identifiable natural person. This includes, for example, your name, address, email address, telephone number, IP address, order and payment information, as well as information about your use of our online store.
We only process personal data where there is a legal basis for doing so.
Depending on the processing activity, the legal basis is, in particular, your consent (Article 6(1)(a) GDPR), the performance of a contract or steps taken prior to entering into a contract (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c) GDPR), or our legitimate interests (Article 6(1)(f) GDPR).
3. Hosting and Shopify E-Commerce Platform
Our online store is operated using the Shopify e-commerce platform. The provider for customers in the European Economic Area is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”).
Shopify processes personal data generated when you visit our store, use its functions, create a customer account, place orders, make payments or otherwise interact with the store.
This includes, in particular:
- IP address, device information and browser information
- Information about your use of and interactions with the store
- Name and contact details
- Billing and delivery addresses
- Order and payment information or payment references
- Customer account information
- Cookie and tracking data, subject to your consent
Shopify processes this data as our data processor (Article 28 GDPR) for the technical provision, security, administration and operation of our online store, including order processing.
The European Union has been selected as the data hosting location. Shopify may transfer data to affiliated companies, in particular Shopify Inc. in Canada, as well as to service providers in the United States (see Section 26).
The legal basis is Article 6(1)(b) GDPR insofar as processing is necessary to fulfil your order, and otherwise Article 6(1)(f) GDPR. Our legitimate interest lies in ensuring the secure, stable and efficient operation of our online store.
Further information about Shopify's processing of personal data is available at:
https://www.shopify.com/legal/privacy
Shopify Privacy Portal:
4. Shopify Network Intelligence and Enhanced Services
Shopify Network Intelligence is enabled for our store.
This allows Shopify to process data relating to interactions with our store together with other Shopify data in order to provide Enhanced Services.
These services are primarily intended to offer a more personalised shopping experience, display more relevant advertising and provide insights into how users interact with online stores and advertisements.
For these purposes, Shopify processes the data under its own responsibility as an independent data controller.
Where non-essential cookies or comparable technologies are used, processing takes place only after you have given your consent via our cookie banner (Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021).
You may withdraw your consent at any time through the cookie settings.
You can exercise your data protection rights in relation to Shopify, including your rights to object and opt out, through the Shopify Privacy Portal:
5. Accessing the Online Store and Server Log Data
When you access our online store, technically necessary data is processed.
This includes, in particular, your IP address, the date and time of access, pages or resources accessed, referrer URL, browser type and version, operating system, device information and language settings.
This processing is necessary to make our online store technically available and to ensure its stability, security and functionality.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of our online store.
6. Orders and Contract Fulfilment
When you place an order through our online store, we process the data necessary to initiate, perform and fulfil the purchase contract.
This includes, in particular:
- Name
- Billing and delivery addresses
- Email address
- Telephone number, where provided or required for order fulfilment
- Products ordered, quantities and order value
- Delivery and shipping information
- Payment method and payment status
- Any other information required to fulfil the contract
The legal basis is Article 6(1)(b) GDPR.
Where we are required to retain data under tax, corporate or commercial law, the processing is additionally based on Article 6(1)(c) GDPR.
7. Customer Accounts and Guest Checkout
You can place orders in our online store either as a guest or by creating a customer account.
If you create a customer account, we process the information you provide to enable you to manage your contact details and orders and to make using our store more convenient.
The legal basis is Article 6(1)(b) GDPR.
You may request the deletion of your customer account at any time by emailing office@town-town.store.
Data that we are legally required to retain will be restricted from further processing until the applicable retention periods have expired and will then be deleted.
8. Payment Processing
We use the payment services offered during checkout to process payments.
Credit card payments, particularly Visa and Mastercard, as well as Apple Pay, are processed through Shopify Payments.
In Europe, Shopify Payments is provided by Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, as the payment service provider.
For payments made using Apple Pay, Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, is also involved.
Depending on the payment method selected, the data required to process the payment is transmitted to the respective payment service provider and the card networks involved.
This includes, in particular, your name, billing address, email address, order amount, currency, payment status and the payment information required for the transaction.
Full payment card details are processed exclusively by the payment service provider and are not stored by us.
The legal basis for processing required to complete payments is Article 6(1)(b) GDPR.
For fraud prevention purposes, payment data may also be processed on the basis of our legitimate interests or those of the payment service provider in preventing payment defaults and misuse (Article 6(1)(f) GDPR).
Where payment service providers process data to comply with their own legal obligations, such as anti-money laundering requirements, or for their own purposes, they do so under their own responsibility as independent data controllers.
Their respective privacy policies also apply.
Stripe Privacy Policy:
https://stripe.com/ie/privacy
Apple Privacy Policy:
https://www.apple.com/ie/legal/privacy/
9. Shipping with Austrian Post
To deliver your order, we transfer the data required for shipping to our delivery service provider, Österreichische Post AG, Rochusplatz 1, 1030 Vienna, Austria.
This includes your name and delivery address and, where necessary for delivery, your telephone number.
The legal basis is Article 6(1)(b) GDPR.
We also share your email address with Österreichische Post AG so that you can receive delivery status updates and coordinate delivery arrangements.
The legal basis is our legitimate interest in ensuring smooth and efficient delivery (Article 6(1)(f) GDPR).
You may object to the transfer of your email address at any time by emailing office@town-town.store.
10. Inventory Management, Accounting and Tax Advisory Services
To process orders and fulfil our operational and legal obligations, we also process personal data in our administrative systems, in particular our ETRON inventory management system.
Where necessary, order data, invoice data, payment information and accounting-related master data are transferred to our accounting department and tax advisers.
Our tax advisers process this data as independent data controllers who are subject to professional confidentiality obligations.
The legal bases are Article 6(1)(b) GDPR for contract fulfilment and Article 6(1)(c) GDPR for statutory retention and documentation obligations.
11. Contact via Forms, Email and Telephone
If you contact us using our contact form, by email or by telephone, we process the information you provide in order to respond to your enquiry.
This includes, in particular, your name, email address, telephone number, message content and, where applicable, order or customer information.
If your enquiry relates to a contract or pre-contractual measures, the legal basis is Article 6(1)(b) GDPR.
For other enquiries, processing is based on our legitimate interest in efficiently handling enquiries from customers and prospective customers in accordance with Article 6(1)(f) GDPR.
We do not currently offer live chat or WhatsApp as contact channels.
12. Newsletter via Mailchimp
If you subscribe to our newsletter, we process your email address and any additional information you voluntarily provide in order to send you information about products, offers, promotions and news.
The legal basis is your consent under Article 6(1)(a) GDPR in conjunction with Section 174 TKG 2021.
To ensure that the subscription request genuinely originates from the owner of the email address, we use a double opt-in procedure.
After subscribing, you will receive an email asking you to confirm your subscription.
We record the subscription and confirmation, including the time and IP address, in order to demonstrate that valid consent was given (Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR).
We use Mailchimp, a service provided by The Rocket Science Group LLC d/b/a Mailchimp, 405 N Angier Ave. NE, Atlanta, GA 30308, USA, a company of Intuit Inc., as our data processor for sending newsletters.
The data is processed in the United States (see Section 26).
With your consent, we analyse whether and when a newsletter is opened and which links are clicked.
For this purpose, our newsletters contain tracking pixels and personalised links.
This analysis helps us improve our newsletters and forms part of your consent to receive them.
You may withdraw your consent at any time with effect for the future, particularly by using the unsubscribe link included in every newsletter or by emailing office@town-town.store.
After unsubscribing, your data will be deleted from the newsletter distribution list. Your email address may be retained on a suppression list to ensure that you do not receive any further newsletters.
13. Cookies and Consent Management
Our online store uses cookies and similar technologies.
Some of these are technically necessary to provide the store and its essential functions, such as the shopping basket, checkout, login and security features.
Other technologies are used for analytics, personalisation and advertising.
For non-essential cookies and comparable technologies, we obtain your consent through Shopify's cookie banner before activating them (Section 165(3) TKG 2021 and Article 6(1)(a) GDPR).
These technologies will not be loaded without your consent.
You may change your preferences or withdraw your consent at any time using the “Cookie Settings” link in the footer of our store.
We use technically necessary cookies without obtaining consent (Section 165(3) TKG 2021).
The legal basis for the associated processing of personal data is Article 6(1)(b) GDPR where necessary for placing and fulfilling an order, and otherwise our legitimate interest in providing a functional and secure online store (Article 6(1)(f) GDPR).
14. Google Analytics 4
With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to analyse the use of our online store and improve our services.
In particular, the following data is processed:
- Information about pages visited
- User interactions
- Device and browser information
- Referrer information
- Technical usage data
- Approximate location information
IP addresses are not stored by Google Analytics 4.
The legal basis is your consent under Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.
You may withdraw your consent at any time with effect for the future through the cookie settings.
Event data is stored for a maximum of 14 months.
Data may be transferred to Google LLC in the United States (see Section 26).
Further information:
https://policies.google.com/privacy
15. Google Tag Manager
We use Google Tag Manager provided by Google Ireland Limited.
Google Tag Manager is used for the technical management and deployment of analytics and marketing tags. It does not itself set cookies or analyse usage data.
However, when Google Tag Manager is loaded, your IP address is transmitted to Google, and Google may also process this data in the United States.
The services managed through Google Tag Manager are only activated in accordance with your preferences selected in the cookie banner.
The legal basis for using Google Tag Manager is our legitimate interest in the simple and consent-compliant management of integrated services (Article 6(1)(f) GDPR).
16. Google Ads and Conversion Tracking
With your consent, we use Google Ads, including conversion tracking, provided by Google Ireland Limited, to display advertisements and measure the effectiveness of our advertising activities.
This allows us to determine whether users perform certain actions in our store, such as making a purchase, after viewing or clicking on an advertisement.
The legal basis is Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.
You may withdraw your consent at any time through the cookie settings.
Data may be transferred to Google LLC in the United States (see Section 26).
17. Meta Pixel (Facebook and Instagram)
With your consent, we use Meta Pixel and the Conversions API provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), to measure and optimise our advertising activities on Facebook and Instagram.
Information about visits, product views, shopping basket activities, orders and other interactions is processed and may be linked to your Facebook or Instagram account.
This processing is used to measure campaign performance, attribute conversions and create or target relevant audiences.
The legal basis is Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.
We and Meta are joint controllers for the collection and transmission of data to Meta (Article 26 GDPR).
The essential terms of the relevant agreement are available at:
https://www.facebook.com/legal/controller_addendum
Meta is solely responsible for any subsequent processing of the data.
You may also exercise your data protection rights directly with Meta.
Further information:
https://www.facebook.com/privacy/policy
Data may be transferred to Meta Platforms Inc. in the United States (see Section 26).
18. Pinterest
With your consent, we use the Pinterest Tag provided by Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.
It is used for campaign analysis, conversion measurement and interest-based advertising on Pinterest.
The legal basis is Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.
Data may be transferred to Pinterest Inc. in the United States (see Section 26).
Further information:
https://policy.pinterest.com/en/privacy-policy
19. TikTok
With your consent, we use the TikTok Pixel provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
It is used to measure reach and conversions, create target audiences and optimise our advertising campaigns on TikTok.
The legal basis is Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.
TikTok may also process data outside the European Economic Area, including in countries for which the European Commission has not issued an adequacy decision (see Section 26).
Further information:
https://www.tiktok.com/legal/privacy-policy-eea
20. Google Maps
We embed maps provided by Google Maps, a service of Google Ireland Limited, on certain pages of our online store.
When a map is loaded, your IP address and technical device and connection data, in particular, are transmitted to Google.
The map is only loaded once you have given your consent.
The legal basis is Article 6(1)(a) GDPR.
Data may be transferred to Google LLC in the United States (see Section 26).
21. Instagram Feed
Posts from our Instagram profile are embedded in our online store.
When this content is loaded, your IP address and technical device and connection data, in particular, are transmitted to Meta.
The content is only loaded once you have given your consent.
The legal basis is Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.
For further information about Meta, please refer to Section 17.
22. Fonts
We use the following fonts to display our online store:
- Nunito
- Quattrocento Sans
- Instrument Sans
- Inter
The font files are provided via Shopify or our own store domain and are not loaded from Google Fonts servers.
No data is transferred to Google in connection with the loading of these fonts.
For information about data processing by Shopify, please refer to Section 3.
23. hCaptcha for Protection Against Misuse
To protect our forms against automated submissions, spam and misuse, Shopify uses hCaptcha, a service provided by Intuition Machines, Inc., USA.
In particular, IP addresses, browser and device information, as well as technical usage and interaction data, are processed to determine whether a submission is made by a human.
The legal basis is our legitimate interest in preventing abusive access and protecting our forms (Article 6(1)(f) GDPR).
Data may be processed in the United States (see Section 26).
Further information:
https://www.hcaptcha.com/privacy
24. Additional Shopify Features
Within the Shopify ecosystem, we also use the following sales channels and features:
- Shop
- Search & Discovery
- Shopify Flow
- Point of Sale
Product, search, order, customer and interaction data is processed where necessary for the respective function.
Depending on the purpose, the legal bases are the performance of a contract (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c) GDPR) and our legitimate interest in efficient store administration (Article 6(1)(f) GDPR).
We only use non-essential analytics, personalisation or advertising features with your consent (Article 6(1)(a) GDPR).
If you use the Shop app or Shop Pay, Shopify processes your data for these services under its own responsibility as a data controller.
We also use administrative apps within the Shopify administration area for internal inventory and product data management.
These apps do not transfer our customers' data to third parties.
25. Recipients and Data Processors
We only transfer personal data where this is necessary for the purposes described in this Privacy Policy or where an appropriate legal basis exists.
Recipients include, in particular:
- Shopify and service providers affiliated with Shopify
- Payment service providers and card networks (Stripe, Apple, Visa, Mastercard)
- Österreichische Post AG as our shipping service provider
- ETRON and our inventory management and administrative systems
- Accounting and tax advisory services
- Mailchimp for sending newsletters
- Google, Meta, Pinterest and TikTok as analytics and advertising service providers, where you have given your consent
- IT, hosting, security and technical service providers, where necessary for the operation of our store
Service providers that process personal data on our behalf are contractually bound in accordance with Article 28 GDPR.
Where recipients process data for their own purposes and under their own responsibility, their respective privacy policies also apply.
26. Transfers to Third Countries
Some of the providers we use, or their subcontractors, process personal data outside the European Economic Area (EEA), particularly in Canada and the United States.
The European Commission has adopted an adequacy decision for Canada.
For the United States, an adequacy decision applies to companies certified under the EU-U.S. Data Privacy Framework (Article 45 GDPR).
Where a recipient is not certified or data is transferred to other third countries, the transfer is based on the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR), supplemented by additional safeguards where necessary.
You may request a copy of the Standard Contractual Clauses by emailing office@town-town.store.
27. Data Retention Periods
We retain personal data only for as long as necessary for the respective purpose or where statutory retention obligations apply.
The following retention periods apply:
- Order, invoice, payment and accounting data: Seven years from the end of the calendar year (Section 132 BAO and Section 212 UGB), or longer where legal proceedings are ongoing.
- Other contractual data: Until the expiry of the applicable warranty period or the limitation period for potential claims (generally three years).
- Customer accounts: Until the account is deleted, subject to statutory retention obligations.
- Contact enquiries: Until the enquiry has been fully resolved, unless retention obligations apply.
- Newsletter data: Until you unsubscribe. Records demonstrating consent are retained for the period during which potential claims may arise.
- Analytics and marketing data: Until consent is withdrawn or in accordance with the retention periods of the respective services (see Sections 13 to 21).
- Technical log and security data: Only for as long as necessary for operation, troubleshooting and the prevention of misuse.
28. Requirement to Provide Data
Providing certain personal data is necessary to conclude and fulfil a purchase contract.
Without the required order, delivery and payment information, we cannot process an order.
Providing information for newsletters, marketing or optional additional features is voluntary.
29. Automated Decision-Making and Profiling
With your consent, user profiles or audience classifications may be created as part of our analytics and advertising services.
We do not carry out any solely automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.
30. Your Data Protection Rights
Subject to the applicable legal requirements, you have the following rights:
- Right of access (Article 15 GDPR)
- Right to rectification (Article 16 GDPR)
- Right to erasure (Article 17 GDPR)
- Right to restriction of processing (Article 18 GDPR)
- Right to data portability (Article 20 GDPR)
- Right to object (Article 21 GDPR; see Section 31)
- Right to withdraw consent at any time with effect for the future (Article 7(3) GDPR)
- Right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR; see Section 32)
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
To exercise your rights, simply send an email to:
31. Right to Object
Where we process your data on the basis of legitimate interests (Article 6(1)(f) GDPR), you have the right to object to such processing at any time on grounds relating to your particular situation.
Where your data is processed for direct marketing purposes, you may object to such processing at any time without giving reasons.
This also applies to profiling related to direct marketing.
Following an objection, we will no longer process your data for these purposes.
32. Right to Lodge a Complaint
If you believe that the processing of your personal data violates data protection law, you may lodge a complaint with a data protection supervisory authority.
In Austria, the competent authority is:
Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at
33. Data Security
We implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, unlawful disclosure, alteration and destruction.
Our online store uses SSL/TLS encryption, which you can recognise by the padlock symbol in your browser's address bar.
These measures are regularly reviewed and adapted in accordance with the current state of technology and the risks associated with processing.
34. Changes to This Privacy Policy
We update this Privacy Policy whenever our data processing activities, the services we use, legal requirements or the technical configuration of our online store change.
The version published in our online store at the relevant time shall apply.