Last updated: 8 July 2026

Controller responsible for data processing:

Lisa Eleni KG
Weyringergasse 27A
1040 Vienna
Austria
Email: info@lisa-eleni.com

Thank you for your interest in our online shop lisa-eleni.com. Protecting your personal data is important to us. This privacy policy explains which data we process, for what purposes and on which legal bases, and describes your rights.

1. General information, legal bases and retention periods

We process personal data in accordance with the General Data Protection Regulation (GDPR), Austrian data-protection law and, where cookies and similar technologies are concerned, the relevant provisions of the Austrian Telecommunications Act 2021 (TKG 2021), in particular section 165(3) TKG 2021.

Depending on the processing activity, we rely in particular on Article 6(1)(b) GDPR for performance of a contract or pre-contractual measures, Article 6(1)(c) GDPR for legal obligations, Article 6(1)(f) GDPR for legitimate interests and Article 6(1)(a) GDPR where you have given consent.

We retain personal data only for as long as necessary for the relevant purposes. Data may be retained for longer where statutory retention obligations apply, where legal claims must be established, exercised or defended, or where you have consented to longer processing.

2. Access data, hosting and Shopify

2.1 Access data

When you visit our online shop, technically necessary access data may be processed. This includes in particular your IP address, date and time of access, pages or files requested, data volume transferred, browser and device information, referrer URL and technical status information.

This processing is necessary for secure and stable operation, error analysis, prevention of misuse and correct presentation of our shop. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and functional operation of the online shop.

2.2 Shopify as the shop platform

Our online shop is operated using Shopify’s technical platform. The providers include Shopify International Limited, Ireland, and other Shopify group companies. Shopify processes personal data where necessary for operation, presentation, security, checkout, order fulfilment, fraud prevention, payment processing, customer-account functions, analytics and other shop functions.

This may include order, contact, delivery, billing, payment, device, browser, usage, security and technical log data. Depending on the purpose, processing is based on Article 6(1)(b), (c) and (f) GDPR and, where required, your consent under Article 6(1)(a) GDPR.

Further information is available in Shopify’s privacy policy: https://www.shopify.com/legal/privacy.

2.3 Shop Pay and shop functions

If you use Shop Pay, Shop customer-account functions or similar convenience and checkout functions provided by Shopify, Shopify may process data directly for recognition, authentication, payment processing, fraud prevention, accelerated checkout and administration of stored delivery or payment information. The terms and privacy notices of Shopify or Shop Pay also apply to these functions.

3. Orders, customer accounts, contact, withdrawal and returns

3.1 Orders and contract performance

When you order from our online shop, we process the data required to accept, process and fulfil the order. This includes in particular your name, email, billing and delivery addresses, order data, payment information, shipping information and order-related communications.

Processing is necessary for contract performance under Article 6(1)(b) GDPR. Where tax, company or commercial-law retention obligations apply, processing is also based on Article 6(1)(c) GDPR.

3.2 Customer account

If you create or use a customer account, we process the necessary data, including contact details, login or authentication information, order history and details stored in the account. Processing is necessary to provide and administer the account and facilitate use of the online shop.

The legal basis is Article 6(1)(b) GDPR or, where the account is created voluntarily on the basis of consent, Article 6(1)(a) GDPR. You may request deletion of your account at any time using the designated function or by contacting us, unless statutory retention obligations prevent deletion.

3.3 Contact and customer service

If you contact us by email, contact form or another channel, we process the information you provide to handle your request. This may include your name, email, order number, message, photographs, attachments and other information you submit.

The legal basis is Article 6(1)(b) GDPR where your request relates to an order or pre-contractual measures. Otherwise, processing is based on Article 6(1)(f) GDPR and our legitimate interest in properly handling your request.

3.4 Withdrawal, returns, complaints and warranty claims

If you exercise a right of withdrawal, register a return, request a refund, submit a complaint or assert warranty rights, we process the data required for this purpose. This includes in particular your name, email, order number, affected items, return and tracking information, payment and refund information and, where applicable, photographs or descriptions of damaged or defective items.

Processing is necessary to administer the withdrawal, return, refund, complaint or statutory warranty claim under Article 6(1)(b) and (c) GDPR. Where data is processed to document, assess or defend claims, processing is also based on Article 6(1)(f) GDPR.

We use Klaviyo as a processor for the electronic withdrawal form and its automatic acknowledgement. The data processed includes, in particular, your name, email address, order number, affected items, voluntary information about item condition, your message, language, market or country code, and the time of submission. This processing is used solely to handle and acknowledge the withdrawal on the basis of Article 6(1)(b) and (c) GDPR. We use these form data for marketing only where separate consent has been given.

4. Shipping

For performance of the contract, we disclose the data required for delivery to the appointed carrier. This includes in particular your name, delivery address and, where applicable, email, telephone number, shipment and tracking data.

Depending on the destination and shipping method, we work in particular with Austrian Post, DHL, FedEx or comparable carriers. The carrier selected may depend on the destination, shipping method, availability and logistics.

Processing is based on Article 6(1)(b) GDPR. Where consent is required to disclose your email or telephone number for delivery announcements, coordination or tracking messages, processing is based on Article 6(1)(a) GDPR. You may withdraw consent at any time with future effect.

5. Payment processing

5.1 General information

The payment methods displayed at checkout are available. Depending on the selected method, payment, order, billing, contact and transaction data is disclosed to payment providers, banks, technical service providers or wallet providers where necessary to process payment.

The legal basis is Article 6(1)(b) GDPR. Processing for fraud prevention, risk analysis, prevention of payment defaults or optimisation of payment processes is based on Article 6(1)(f) GDPR and our legitimate interest in secure and efficient payment processing.

5.2 Shopify Payments and Shopify payment functions

Where Shopify Payments or another Shopify payment function is used, the necessary data is processed through Shopify or payment providers associated with Shopify. This may include payment, billing, transaction, device and security information.

Further information is available in Shopify’s privacy policy: https://www.shopify.com/legal/privacy.

5.3 PayPal

When paying through PayPal, personal data may be disclosed to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. PayPal may also process data as an independent controller, including for payment processing, fraud prevention, identity checks and compliance with legal obligations. PayPal’s privacy notices also apply.

5.4 Klarna, Sofort, instalments and credit checks

If you use Klarna, Sofort or an instalment option, the data required for the selected method may be disclosed to Klarna Bank AB (publ), Sweden, or another provider displayed at checkout. Depending on the payment method, an identity or credit check may be performed. Details are provided at checkout and in the relevant provider’s privacy notice.

5.5 Mollie, Apple Pay, Google Pay, Shop Pay, EPS and other methods

Where Mollie, Apple Pay, Google Pay, Shop Pay, EPS or another method is available and selected, the data required for payment processing is disclosed to the relevant provider and participating banks, card issuers or technical payment providers. Their own privacy notices also apply.

6. Newsletter, email marketing and reviews

6.1 Newsletter and email marketing through Klaviyo

If you subscribe to our newsletter or consent to email marketing, we process the required data, in particular your email and, where applicable, your name, to send newsletters, offers, product information and other marketing messages. The legal basis is your consent under Article 6(1)(a) GDPR.

We use Klaviyo for newsletters and email marketing. The provider is Klaviyo, Inc., USA, together with affiliated companies and subprocessors. Klaviyo processes data on our behalf and may use its own technical systems, servers and service providers. Data processed may include your email, subscription data, consent status, opening and click behaviour, interactions with our shop, order information and technical information, where necessary for delivery, segmentation, analysis and optimisation.

You may unsubscribe at any time using the unsubscribe link in the relevant email or by contacting us. After unsubscribing, we no longer use your email for newsletters unless another legal basis permits continued processing.

Further information is available in Klaviyo’s privacy notice: https://www.klaviyo.com/legal/privacy/privacy-notice.

6.2 Newsletter tracking

Where you have consented, we analyse the performance of newsletters and marketing messages. This may include opens, clicks, deliverability, unsubscribes, device information, time of interaction and, where applicable, attribution to orders or shop interactions.

Processing is based on your consent under Article 6(1)(a) GDPR and is used to improve our communications, offers and content. You may withdraw consent at any time with future effect.

6.3 Review requests and reviews through Judge.me

We use Judge.me to display, manage and request product and shop reviews. Where you have consented, or where otherwise permitted by law, we may ask you to submit a review after purchase.

Data processed may include your name, email, order and product data and review content. Where required, review requests are based on your consent under Article 6(1)(a) GDPR. Processing of published reviews and operation of the review system are also based on our legitimate interest in customer feedback, quality assurance and transparent product presentation under Article 6(1)(f) GDPR.

Further information is available in Judge.me’s privacy policy: https://judge.me/privacy.

7. Cookies, consent management and tracking technologies

7.1 General information about cookies and similar technologies

Our online shop uses cookies and similar technologies. Some are technically necessary for the shop, including the shopping cart, checkout, language, currency, security, customer accounts and basic shop functions. These necessary technologies are processed under Article 6(1)(b) or (f) GDPR and, where strictly necessary, do not require consent under section 165(3) TKG 2021.

Technologies that are not strictly necessary, including analytics, marketing, personalisation or external services, are used only where you consent through our consent-management tool. The legal basis is Article 6(1)(a) GDPR in conjunction with section 165(3) TKG 2021. You may withdraw or change your choice at any time with future effect through the cookie settings.

7.2 Consent management with Pandectes

We use Pandectes / GDPR Cookie Consent to obtain, administer and document cookie and tracking consent. The provider is Pandectes, Estonia. Pandectes helps us record consent, display cookie categories and implement your choices technically.

Data processed may include your consent choices, date and time, a consent ID, browser and device information, country or region and technical information used to display and administer the banner. Processing is necessary to comply with legal record-keeping obligations under Article 6(1)(c) GDPR and is also based on our legitimate interest in legally compliant documentation under Article 6(1)(f) GDPR.

Further information is available at: https://pandectes.io/privacy-policy/.

7.3 Shopify Analytics and shop functions

Shopify may use its own cookies and similar technologies for the shopping cart, checkout, security, localisation, customer accounts, fraud prevention and shop analytics. Where these technologies are not strictly necessary, they are controlled through consent management depending on your choice.

7.4 Klaviyo onsite and marketing technologies

Where you have consented, Klaviyo may use cookies or similar technologies to record interactions with our online shop, newsletter subscriptions, clicks from emails and other marketing interactions. This is used to analyse and personalise our email communications and marketing activities. The legal basis is Article 6(1)(a) GDPR.

7.5 Pinterest marketing technologies

Where you have consented, Pinterest marketing technologies may be used to measure the effectiveness of Pinterest marketing, build audiences and enable interest-based advertising. Data processed may include cookie or device identifiers, usage data, technical information and interactions with our online shop. The provider is Pinterest Europe Ltd., Ireland. The legal basis is Article 6(1)(a) GDPR.

Further information is available in Pinterest’s privacy policy: https://policy.pinterest.com/en/privacy-policy.

8. Transfers to third countries

Some service providers or their subprocessors may process personal data outside the European Union or European Economic Area, in particular in the USA.

Where the European Commission has adopted an adequacy decision for the relevant country, transfers are based on that decision. For certified US organisations, the EU-US Data Privacy Framework adequacy decision may apply. Where there is no adequacy decision or a provider is not covered by an applicable adequacy instrument, we rely where necessary on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, supplementary safeguards, or explicit consent under Article 49(1)(a) GDPR.

Despite such safeguards, transfers to third countries may in individual cases involve a risk that authorities can access data and that data-subject rights cannot be enforced to the same extent as within the EU or EEA.

9. Social media

9.1 Social-media links

Our website links to our profiles on social networks. These are generally simple HTML links. Merely visiting our website does not establish a connection to the relevant social network’s servers. When you click such a link, you leave our website and the relevant provider’s privacy policy applies.

9.2 Our online profiles

We maintain profiles on Instagram, TikTok and Pinterest. When you visit our profiles or interact with content, the relevant platforms may process personal data such as usage data, profile information, interactions, device information and, where applicable, cookies or similar technologies.

The relevant platform operators are generally responsible for processing on their platforms. Where we use statistical reports or messaging functions, joint controllership or independent controllership by the platform operator may apply. Further information is available from:

• Instagram / Meta: https://privacycenter.instagram.com/policy/
• TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/en
• Pinterest: https://policy.pinterest.com/en/privacy-policy

10. External links and third-party websites

Our online shop may contain links to external websites, payment services, carriers, social-media platforms or other third parties. If you click such links or use external services, the relevant provider’s privacy information and terms apply.

11. Your rights

Subject to the statutory requirements, you have the following rights as a data subject:

• access to personal data processed by us under Article 15 GDPR,
• rectification of inaccurate or completion of incomplete data under Article 16 GDPR,
• erasure of personal data under Article 17 GDPR,
• restriction of processing under Article 18 GDPR,
• data portability under Article 20 GDPR,
• objection to processing based on Article 6(1)(e) or (f) GDPR under Article 21 GDPR,
• withdrawal of consent with future effect under Article 7(3) GDPR, and
• lodging a complaint with a data-protection supervisory authority under Article 77 GDPR.

In Austria, the competent authority is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, https://www.dsb.gv.at.

Right to object Where we process personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, you may object at any time with future effect on grounds relating to your particular situation. Where processing is for direct-marketing purposes, you may object at any time. We will then cease processing your personal data for direct marketing.

12. Contact

For questions about personal-data processing or requests for access, rectification, erasure, restriction, withdrawal of consent or objection, please contact:

Lisa Eleni KG
Weyringergasse 27A
1040 Vienna
Austria
Email: info@lisa-eleni.com