Privacy policy

Last updated: 20 October 2026

1. Controller

BALISAUR e.U.
Lisa Maria Baur
Arsenal 5/5/4, 1030 Vienna, Austria
Email: hi@balisaur.at

This privacy policy explains how we process your personal data when you visit balisaur.at, place an order or subscribe to our newsletter, in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

2. Visiting the website

When you visit our shop, technically necessary data is processed automatically (IP address, browser type, device information, date and time of access, pages visited). This is necessary to display the website securely and reliably (Art. 6(1)(f) GDPR, legitimate interest in a functioning and secure shop).

3. Cookies

We use cookies that are strictly necessary for the shop to work, such as for the shopping cart and checkout (Art. 6(1)(f) GDPR and § 165(3) TKG 2021). Cookies and similar technologies for analytics and marketing (see sections 7 and 8) are only set if you consent via the cookie banner (Art. 6(1)(a) GDPR). You can withdraw or change your consent at any time via the cookie settings in the footer of our website.

4. Orders

When you place an order, we process your name, billing and shipping address, email address, phone number (if provided), order details and payment information in order to perform the contract (Art. 6(1)(b) GDPR). We pass on only the data required for each purpose:

  • Shop platform: Our shop runs on Shopify. Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, Ireland, processes data on our behalf. Data may also be transferred to Shopify Inc. in Canada (adequacy decision of the EU Commission) and to other countries, based on EU Standard Contractual Clauses. More information: shopify.com/legal/privacy
  • Payment: Payments are processed by the payment provider you choose at checkout (e.g. Shopify Payments / Stripe, PayPal). These providers process your payment data under their own privacy policies.
  • Shipping: To deliver your order we pass your name, shipping address and, where needed for delivery notifications, your email address or phone number to the shipping company (e.g. Österreichische Post AG).

5. Contact by email

If you contact us by email, we process your message and contact details to answer your enquiry (Art. 6(1)(b) or (f) GDPR). Our emails are hosted by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace).

6. Newsletter

If you subscribe to our newsletter, we use your email address to send you news about new pieces, restocks and the stories behind them, based on your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email or by writing to us. The newsletter is sent via Shopify.

7. Meta Pixel and Conversions API (Facebook & Instagram)

With your consent (Art. 6(1)(a) GDPR), we use the Meta Pixel and the Meta Conversions API of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), integrated via the Shopify “Facebook & Instagram” app. This allows us to measure the effectiveness of our ads on Facebook and Instagram and to show our ads to people who have visited our shop or who are similar to them. For this purpose, information about your visit and your interactions in our shop (for example pages viewed, products added to the cart, purchases), your IP address and device information, and, if you place an order, hashed (encrypted) contact data such as your email address or phone number are transmitted to Meta.

For the collection and transmission of this data we and Meta are joint controllers (Art. 26 GDPR); the further processing is carried out by Meta under its own responsibility. Data may be transferred to Meta Platforms, Inc. in the USA; Meta is certified under the EU-U.S. Data Privacy Framework. More information: facebook.com/privacy/policy. You can withdraw your consent at any time via the cookie settings.

8. Google Analytics

With your consent (Art. 6(1)(a) GDPR), we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies to analyse how visitors use our website, for example which pages are visited, how long and from which device and region. This helps us improve our shop. IP addresses are not stored in Google Analytics 4. The data is stored for a maximum of 14 months.

Data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. More information: policies.google.com/privacy. You can withdraw your consent at any time via the cookie settings.

9. Instagram link

Our website also contains a simple link to our Instagram profile. No data is transferred to Meta through this link until you click it. After that, Meta’s privacy policy applies.

10. Storage period

We store your data only as long as necessary for the purposes above. Order and invoice data are kept for seven years in line with Austrian retention obligations (§ 132 BAO). Newsletter data is deleted when you unsubscribe.

11. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent with effect for the future. Please contact us at hi@balisaur.at.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

12. Changes

We may update this privacy policy when our shop or the law changes. The current version is always available on this page.