Privacy Policy
Status: September 15, 2026
1. Controller
BACTO GesbR
Partners: Alexander Seitz, Thomas Cytryn
Josef-Pohler-Weg 5, 6600 Reutte, Austria
Email: info@bacto-clothing.com
Phone: +43 676 7860882
No Data Protection Officer has been appointed; the requirements of Art. 37 GDPR are not met in our case.
2. Principle
We process your data exclusively to process and ship your order as well as to comply with legal retention requirements.
Your order data is not used for advertising purposes. We do not sell data or share it for marketing purposes. Only information necessary for delivery, payment, and accounting is passed on.
3. Which data we process and why
3.1 Order and contract processing
Data: First and last name, delivery and billing address, email address, telephone number (if provided), items ordered, order value, payment method, payment status.
Purpose: Conclusion and fulfillment of the purchase contract, shipping, invoicing, handling inquiries.
Legal basis: Art. 6 (1) (b) GDPR (contract fulfillment).
Storage period: 7 years from the end of the calendar year in which the order was placed — § 132 BAO and § 212 UGB.
3.2 Payment processing
Data: Payment data, depending on the method chosen. We never see credit card numbers; they are processed exclusively by the payment service provider.
Providers:
- Shopify Payments and Shop Pay — Shopify International Limited, Dublin, Ireland. Card payments via Visa, Mastercard, American Express, Maestro, and UnionPay are processed through these.
- PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg
- Apple Pay — Apple Distribution International Ltd., Ireland
- Google Pay — Google Ireland Limited, Ireland
The payment service providers process the payment data as independent controllers according to their own privacy policies. We only receive information from them as to whether the payment was successful.
Legal basis: Art. 6 (1) (b) GDPR.
3.3 Shipping
Data: Name, delivery address, email address or telephone number for shipment tracking.
Recipient: DPD Austria GmbH.
Legal basis: Art. 6 (1) (b) GDPR. Transmission is necessary for delivery — without an address, we cannot deliver.
DPD processes this data as an independent controller and not on our behalf: the transport company determines the delivery process itself and is subject to its own legal obligations. Therefore, their own privacy policy applies to processing by DPD.
3.4 Returns and cancellations
Data: Name, order number, email address, items concerned, date of receipt of goods.
Purpose: Processing of cancellations, returns, and refunds.
Legal basis: Art. 6 (1) (b) GDPR and Art. 6 (1) (c) GDPR for the fulfillment of obligations under the FAGG.
Storage period: 7 years, together with the order data.
3.5 Accounting
Data: Invoice data.
Recipient: sevdesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany.
Legal basis: Art. 6 (1) (c) GDPR (tax law obligations).
3.6 Website operation
If you visit our pages without providing any further data, the server automatically collects the information that your browser transmits. The following is recorded in the server log:
- the origin address (the page from which you came to us)
- name and address of the page accessed
- date and time of access
- time zone difference to Greenwich Mean Time
- your IP address
- type, language, and version of your browser
- the operating system of your device
- amount of data transferred
- HTTP status code, i.e., whether access was successful
Purpose: Delivery of the page, stability and security, defense against abuse.
Storage period: The logs are maintained by Shopify as the platform operator and are automatically deleted after a short time. We have no influence on the exact duration; we do not evaluate the logs and do not merge them with other data.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is the secure and trouble-free operation of the shop.
Fonts are delivered from our own server. There is no connection to Google Fonts or other external providers when loading the page.
3.7 Contacting us
Data: Name, email address, message content.
Legal basis: Art. 6 (1) (b) GDPR for inquiries regarding an order, otherwise Art. 6 (1) (f) GDPR.
Storage period: Until resolution, thereafter according to legal deadlines.
3.8 Reach measurement and advertising
Our shop is connected to the sales channels of Meta (Facebook, Instagram) and TikTok. If you allow marketing cookies, data regarding your visit — such as pages visited, products viewed, and purchases made — may be transmitted to these providers. They serve to measure advertising success and to display advertisements.
No such transmission takes place without your consent. Until you consent, these services are blocked.
Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time via the "Cookie Settings" link in the footer — with effect for the future and without any disadvantages. The legality of processing carried out until that point remains unaffected.
Joint responsibility: We are jointly responsible with Meta or TikTok for the collection and transmission of data (Art. 26 GDPR). Further processing by these providers takes place under their sole responsibility. You can assert your data subject rights both with us and directly with the providers.
Third country: Both providers are based in Ireland but also process data in the USA. This is based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Details on individual cookies can be found in the Cookie Policy.
3.9 Newsletter
We do not currently send a newsletter.
⚠ As soon as a newsletter starts, this section must be supplemented: double opt-in, logging of registration, cancellation at any time, service provider used, legal basis Art. 6 (1) (a) GDPR.
4. Shop platform
Our shop runs on Shopify. The provider for customers in the EEA is Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland, with Shopify Inc., 151 O'Connor Street, Ottawa, Canada. Shopify processes the data on our behalf based on a data processing agreement in accordance with Art. 28 GDPR.
There is an adequacy decision from the European Commission for Canada. As far as data is transmitted to the USA, this is based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
5. Overview of recipients
| Recipient | Purpose | Headquarters | Role |
|---|---|---|---|
| Shopify International Ltd. | Shop platform, hosting | Ireland / Canada | Data processor |
| Shopify Payments / Shop Pay, PayPal, Apple, Google | Payment processing | Ireland / Luxembourg | Independent controllers |
| DPD Austria GmbH | Delivery | Austria | Independent controller |
| sevdesk GmbH | Accounting | Germany | Data processor |
| Meta Platforms Ireland Ltd. | Advertising, only with consent | Ireland / USA | Joint controllers |
| TikTok Technology Ltd. | Advertising, only with consent | Ireland / USA | Joint controllers |
Contracts in accordance with Art. 28 GDPR exist with all data processors.
Other applications we use do not access personal customer data or process it exclusively within the Shopify platform; they are therefore not listed separately.
6. Your rights
You have the right to:
- Information about the data stored about you (Art. 15 GDPR)
- Rectification of incorrect data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR), provided no retention obligation prevents this
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent granted, at any time and with effect for the future (Art. 7 (3) GDPR)
For this purpose, please contact info@bacto-clothing.com informally.
7. Right to lodge a complaint
If you believe that the processing of your data violates the GDPR, you can lodge a complaint with the supervisory authority:
Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
dsb.gv.at
8. Necessity of provision
Providing your name, address, and email address is required for the conclusion of a contract. Without this data, we cannot accept and deliver the order. All other information is voluntary.
9. Automated decision-making
Automated decision-making, including profiling according to Art. 22 GDPR, does not take place.