Privacy policy

This policy describes which personal data arise when you visit craftalux.at and when you use our Telegram app tg.craftalux.at, what we use them for, who receives them and what rights you have. It names only what actually happens in this shop.

Controller

CraftaLux — Dimitri Korenev
Grabmayrgasse 2, Stiege 1, Tür 17, 1210 Wien, Österreich
E-mail: shop@craftalux.at
Telephone: +43 660 5752835

The controller for both services — the craftalux.at website and the tg.craftalux.at Telegram app — is the provider named above; full details in the legal notice. We are not required to appoint a data protection officer under Art. 37 GDPR; please address all matters to the contact details above.

Our principles

  • We process only the data needed to run the shop, to fulfil your order and to answer your enquiries.
  • You can browse the catalogue without telling us your name.
  • Analytics services are loaded only once you have agreed — not before.
  • We do not pass on data for advertising purposes and we do not sell data.
  • No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Visiting the website (server log files)

So that a page can be displayed, your browser transmits technical information to our web server: IP address, date and time, the address requested and the status code, the previously visited page (referrer), browser type and operating system, and the volume of data transferred.

The purpose is delivery of the pages, technical stability and defence against attacks and automated misuse. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in a secure and functioning shop. Log files are deleted automatically after no more than 14 days and are not combined with other sources.

Cookies and local storage

Necessary cookies keep your language choice, your basket and your login; analytics cookies are set only after your consent. In addition, the shop keeps the draft of the checkout and the items you viewed most recently in your browser’s local storage.

Names, purposes and lifetimes of all cookies, and how to withdraw consent, are set out in full in the cookie policy.

Audience measurement

To understand which pages are read and where visitors get stuck, we use Yandex Metrica on the website — only if you have agreed in the cookie banner. It records the pages opened and the time spent, the referring page, device type, browser and screen size, the approximate location derived from the IP address, and the terms you type into the search. Session recording (“Webvisor”) is switched off.

The provider is YANDEX, LLC, ul. Lva Tolstogo 16, 119021 Moscow. The legal basis is Art. 6(1)(a) GDPR (consent); on the transfer see “Transfers to third countries”. No audience measurement takes place in the Telegram app.

Customer account

You may create a customer account but need not do so — ordering as a guest is possible. In the account we store your e-mail address, your name, your password only as a hash, and your orders and saved addresses.

The legal basis is Art. 6(1)(b) GDPR. You can have your account deleted at any time; completed orders remain stored for as long as tax retention obligations require.

Orders and performance of the contract

For an order we process your name, e-mail address, delivery address, on request your telephone number for delivery, the items ordered, the amount and the payment status.

The legal basis is Art. 6(1)(b) GDPR — without these data we can neither deliver nor invoice. Invoices and vouchers are retained for seven years, as required by Section 132 of the Austrian Federal Fiscal Code.

Payment

Payments are handled by Stripe (Stripe Payments Europe Limited, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your card or account details directly with Stripe; they do not reach us. We receive the payment status, the amount and a reference for the transaction.

The legal basis is Art. 6(1)(b) GDPR. Stripe is itself responsible for its own processing, for instance for fraud prevention; the provider’s privacy notice applies.

Shipping

For shipping we pass your name, the delivery address and — where needed for notifications — e-mail address and telephone number to our shipping service provider Sendcloud (Sendcloud B.V., Stadhuisplein 10, 5611 EM Eindhoven, Netherlands) and to the carrier performing the delivery. If you choose a service point, its identifier is processed as well.

The legal basis is Art. 6(1)(b) GDPR. If you collect the goods in Vienna, this disclosure does not occur.

E-mails

Order confirmations, shipping notices and password reset messages are sent via our own mail server. We process your e-mail address and the content of the respective message. The language of the e-mail follows the language of your order.

The legal basis is Art. 6(1)(b) GDPR. We do not send promotional e-mails without separate consent.

Contact and support enquiries

If you write to us through the form, by e-mail or from the Telegram app, we process your name, e-mail address, subject and message and — to prevent mass submissions — your IP address and the time of sending.

Yandex SmartCaptcha checks the submission of the form against automated sending; technical information about your device and your IP address are transmitted to the provider. The legal basis is Art. 6(1)(f) GDPR — without this protection the form would be unusable within a short time.

Your message is delivered to our mailbox and stored there and in our communication archive so that we can follow the history of an enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns an order, otherwise Art. 6(1)(f) GDPR. We delete correspondence once it is settled and no retention obligation stands in the way.

Telegram app (tg.craftalux.at)

If you open our shop inside Telegram, Telegram passes us verified information about your Telegram account at start-up: the Telegram identifier, first and last name, the username if you have one, the app language and the time of opening. We use it to link your basket and your orders to your account and to answer support enquiries. We do not receive your telephone number from Telegram.

Favourites, recent search terms, the basket identifier and your language choice remain in your device’s storage; without an order they do not leave it.

The legal basis is Art. 6(1)(b) GDPR. Telegram itself is responsible for the messenger (Telegram FZ-LLC, Dubai, United Arab Emirates) — we have no influence over its processing and Telegram’s privacy policy applies. Ordering, payment, shipping and e-mails work in the app exactly as described above.

Search, images and fonts

The search runs entirely on our own server; search terms are not passed to anyone and enter the audience measurement only if you have agreed to it.

Product images and media files are delivered from an object store; your device’s IP address is transmitted to its operator (see “Transfers to third countries”). Fonts and icons are served from our own servers; no connection to Google Fonts or comparable services takes place.

Recipients

Only the persons entrusted with the shop and the correspondence have access to data, together with the following service providers acting for us on our instructions under Art. 28 GDPR:

  • hosting and technical infrastructure of shop and app
  • object store for product images and media files
  • payment processing (Stripe)
  • shipping service provider and carriers
  • e-mail delivery via our mail server
  • audience measurement — only where consent has been given
  • spam protection of the contact form

Beyond that we pass on data only where we are legally obliged to do so or where an authority or a court lawfully requires it.

Transfers to third countries

The server on which the shop and the Telegram app run, the database holding your orders, the object store for the product images, and the audience measurement and spam protection are currently operated in the Russian Federation. We say so explicitly here so that you know it before you order.

There is no adequacy decision of the European Commission for the Russian Federation under Art. 45 GDPR. In 2022 the European Data Protection Board stated that transfers there require an instrument under Chapter V of the GDPR and a risk assessment. We therefore do not claim a guarantee here that we cannot give: the transfer takes place, and we are ending it by the relocation described below.

You should know what that means: the level of protection there does not correspond to the European one, access by state authorities to data held by telecommunications and hosting providers cannot be ruled out, and enforcing your rights against bodies in that country may be considerably more difficult.

We are therefore moving the server, the database and the image store to the European Union. Until the move is complete we transmit only in encrypted form (TLS), limit processing to what is necessary for operation and for your order, and load the audience measurement only after your consent. As soon as the move has taken place we will change this page and name the new location here.

If you use the Telegram app, Telegram processes your use of the messenger in the United Arab Emirates; there is no adequacy decision for that country either, and we have no influence over that processing. Using the app is voluntary — the same goods can be ordered in the web shop.

Retention periods at a glance

  • Server log files: no more than 14 days.
  • Cookie choice: 12 months or until you change it.
  • Basket: 30 days; login: 7 days.
  • Orders, invoices and vouchers: seven years (Section 132 of the Federal Fiscal Code).
  • Customer account: until you have it deleted.
  • Correspondence: until the matter is settled, at most as long as statutory retention obligations exist.

Security

Shop and app are reachable over HTTPS throughout; transmission between your device and our server is encrypted. Passwords are stored only as a hash, access to the administration areas is restricted to a few people and protected by passwords, and forms are secured against automated misuse. However, nobody who transmits data over the internet can promise absolute protection.

Your rights

You have the following rights vis-à-vis us:

  • access to whether and which data we process about you (Art. 15 GDPR)
  • rectification of inaccurate or incomplete data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • objection to processing based on a legitimate interest (Art. 21 GDPR)
  • withdrawal of a consent given, with effect for the future (Art. 7(3) GDPR)

For all of these an informal message to shop@craftalux.at is enough. We reply without undue delay, at the latest within one month. So as not to disclose data to unauthorised persons, in case of doubt we must satisfy ourselves that the request really comes from you.

If you consider that we process your data unlawfully, you may lodge a complaint with the supervisory authority at any time (Art. 77 GDPR). In Austria this is the Austrian Data Protection Authority, Barichgasse 40—42, 1030 Vienna, dsb@dsb.gv.at. Such a complaint is open to you regardless of whether you have contacted us first.

Changes to this policy

We adapt this policy whenever the processing in the shop or the app changes — for instance because a service provider is added or dropped. If the set of cookies changes, we ask for your consent again. Version of: 5 September 2026.