Privacy Policy

Protecting your personal data is important to us. We process your data exclusively on the basis of legal provisions, in particular the General Data Protection Regulation (GDPR) and the Telecommunications Act 2021 (TKG 2021). Here, we inform you about which data we process on goelles.at, for what purpose, and on what basis.

Controller

Gölles GmbH
Stang 52, 8333 Riegersburg, Austria
Phone +43 3153 7555
obst@goelles.at

Shop System and Hosting

Our online shop runs on Shopify, a service provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes on our behalf all data generated when visiting the website, in the shopping cart, and at checkout, including IP address, browser and device information, pages visited, and time of access. This processing is required for the operation of the shop (Art. 6(1)(b) and (f) GDPR).

Shopify may transmit data to Shopify Inc. in Canada; there is an adequacy decision from the European Commission for Canada. Shopify bases transfers to the USA on the EU-U.S. Data Privacy Framework and standard contractual clauses. Further information is available at shopify.com/legal/privacy.

Order and Contract Processing

To process your order, we process your name, delivery and billing address, e-mail address, telephone number, order contents, and payment information. Without this information, we cannot conclude the contract (Art. 6(1)(b) GDPR).

After completing the order, we retain this data for the duration of the seven-year statutory tax retention obligation. We also store your name, address, purchased goods, and date of purchase until the expiry of any potential product liability claims, which is ten years (Art. 6(1)(c) GDPR).

Order data is transferred to our ERP system, Sage 100.

Customer Account

If you create a customer account, we store your details so that you can view your orders and complete future orders more quickly. You can have your account deleted at any time, provided there are no statutory retention obligations to the contrary (Art. 6(1)(b) GDPR).

Payment Processing

For payment, we share the necessary payment data with the payment service provider of your choice (Art. 6(1)(b) GDPR). Depending on the payment method, these are:

Shopify Payments for credit and debit cards as well as Apple Pay
PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden
Unzer GmbH, Vangerowstraße 18, 69115 Heidelberg, Germany

The payment service providers partly process your data under their own responsibility, and their privacy policies also apply.

Shipping

For delivery, we share your name, delivery address, and, if necessary for delivery, your e-mail address and telephone number with the respective shipping company, currently DPD Austria and Österreichische Post AG (Art. 6(1)(b) GDPR).

Withdrawal via our website

We provide an online withdrawal function for declaring a withdrawal. It is operated via the Shopify app Revoq by the provider BuschBytes. We process your name, e-mail address, order number, and the content of your declaration in order to process the withdrawal (Art. 6(1)(c) GDPR).

Contacting us

If you reach out to us via e-mail, telephone, or contact form, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR). We delete them as soon as the request has been resolved and there are no retention obligations.

If you subscribe to our newsletter, we process your e-mail address on the basis of your consent (Art. 6(1)(a) GDPR). After registration, you will receive an e-mail asking you to confirm your subscription (double opt-in). You can unsubscribe at any time via the link at the end of every newsletter or by sending a message to obst@goelles.at.

For the newsletter dispatch, we use Intuit Mailchimp, operated by The Rocket Science Group LLC d/b/a Mailchimp, 405 N Angier Ave NE, Atlanta, GA 30308, USA. Mailchimp evaluates for us whether a newsletter was opened and which links were clicked. Mailchimp is certified via Intuit under the EU-U.S. Data Privacy Framework, and standard contractual clauses have also been agreed. A data processing agreement is in place with Mailchimp.

E-mail marketing to customers

If we have received your e-mail address in connection with a purchase, we will occasionally send you information about similar products from our range (§ 174(4) TKG 2021). You can object to this at any time free of charge via the link in every e-mail or by sending a message to obst@goelles.at.

Reviews via Trusted Shops

A widget from Trusted Shops SE, Subbelrather Straße 15c, 50823 Cologne, Germany, is integrated into our website. It displays reviews and our trustmark.

Cookies and Consent

We use technically necessary cookies to ensure the shopping cart, checkout, and your consent settings function. We only use all other cookies and similar technologies if you have consented via our cookie banner (§ 165(3) TKG 2021 in conjunction with Art. 6(1)(a) GDPR). You can change or revoke your consent at any time via the cookie settings.

Server-Side Tagging and Google Tag Manager

We integrate our measurement and marketing services via Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It is delivered via our own domain sst.goelles.at and does not set any cookies itself.

Measurement data is not sent directly from your browser to the respective providers, but first to our server container at sst.goelles.at. It is operated by Stape, Sepapaja tn 6, 15551 Tallinn, Estonia, and is located in the EU. Only after you have given your consent does this server forward the data to Google and Meta. A data processing agreement is in place with Stape.

Google Analytics 4

Following your consent, we use Google Analytics 4 from Google Ireland Limited to understand how our website is used. This involves processing, in particular, pages visited, duration of stay, origin of the visit, device and browser information, and purchases. For purchases, the order value and products are transmitted, but not the name, e-mail address, or address. Google Analytics 4 does not store IP addresses.

Cookies: _ga and _ga_9XD3781536, two years each. Without consent, no data is transmitted to Google. Google may transmit data to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. A data processing agreement is in place with Google.

Google Ads

We use Google Ads from Google Ireland Limited. We use this to measure whether visitors make a purchase with us after clicking on one of our ads, and to show ads for our products later to people who have already visited us.

Following your consent, data processed includes, in particular, click ID and cookie ID, IP address, time of click and purchase, pages and products visited, shopping cart, as well as type and value of the order. We only receive aggregated statistics. Google may link the data with its own data, for example if you are logged into your Google account.

For an order, we additionally transmit your e-mail address and telephone number in hashed form (SHA-256), not in plain text. This remains personal data. Google matches these values with logged-in Google accounts to be able to assign purchases more accurately to the respective ad.

From pages visited, products, shopping cart, and purchases, we create target groups to which we show ads in Google services such as Search, YouTube, and Gmail as well as in the Google Display Network.

Cookies: You can additionally deactivate personalized advertising at myadcenter.google.com. Google may transmit data to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework.

Meta Pixel and Conversions API

Following your consent, we use the Meta Pixel and the Meta Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We use this to measure page views, product views, shopping cart, checkout, and purchases, and to build target groups for advertising on Facebook and Instagram.

The data is transmitted both via your browser and via our server container. Duplicate reports are merged using a common identifier. For an order, we additionally transmit your e-mail address and telephone number in hashed form, not in plain text. This remains personal data.

Cookies: _fbp, 90 days, and _fbc, 90 days, only after clicking on a Meta ad.

We are jointly responsible with Meta for the collection and transmission of data to Meta (Art. 26 GDPR). The details are regulated by the Meta Controller Addendum. Meta is solely responsible for further processing at Meta. Meta may transmit data to Meta Platforms, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework. Further information is available at facebook.com/privacy/policy.

Your Rights

You have the right to access your stored data, to rectification, erasure, and restriction of processing, to data portability, and the right to object to processing. You can revoke your given consent at any time with effect for the future; the lawfulness of the processing carried out until then remains unaffected. To do so, please contact obst@goelles.at.

Right to lodge a complaint

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority:

Austrian Data Protection Authority
Barichgasse 40-42, 1030 Vienna
Phone +43 1 52 152-0
dsb@dsb.gv.at

Last updated

10/10/2026