Privacy policy

This is an English translation for your convenience. In case of doubt, the German version applies.

Last updated: 17 October 2026

Here you can find out which data we process when you visit our shop, order from us or subscribe to our newsletter, why we do this and what rights you have.

1. Who is responsible?

Maximilian Albert Obauer (ALBERT)
Markt 40, Tür 1, 5450 Werfen, Austria
Email: hello@helloalbert.shop
Phone: +43 660 5455635

We are not required to appoint a data protection officer. If you have questions about data protection, simply write to us at the email address above.

2. Visiting the shop

Our shop runs on Shopify. When you visit it, technically necessary data is processed, such as your IP address, date and time, pages visited, browser and device. We need this so the shop works, is secure and stays protected against misuse. The legal basis is our legitimate interest in a secure, working shop (Art. 6(1)(f) GDPR).

3. Cookies

We set technically necessary cookies, for example for the shopping cart, the checkout or your cookie choice, without consent (§ 165(3) Austrian Telecommunications Act 2021, Art. 6(1)(f) GDPR).

We only set all other cookies and similar technologies, for example for statistics or marketing, if you agree in the cookie banner (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future by changing your cookie settings or deleting the cookies in your browser.

4. Statistics and marketing (only with your consent)

If you agree in the cookie banner, we use the following services. Without your consent, they are not loaded. The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) Austrian Telecommunications Act 2021), which you can withdraw at any time in the cookie settings.

Google Analytics
This shows us how visitors use our shop, for example which pages are viewed, where visitors come from and which products are bought. Cookies are set and usage data such as a shortened IP address, device, browser, pages visited and purchases is processed. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use Google Consent Mode, so Google Analytics respects your choice in the cookie banner.

Meta Pixel and Conversions API (Facebook and Instagram)
This lets us measure whether our ads on Facebook and Instagram work and show ads to people who have visited our shop. Usage data such as pages visited, products added to the cart and purchases, as well as technical identifiers, is sent to Meta. Certain data such as your email address or phone number is encrypted (hashed) beforehand. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. We are jointly responsible with Meta for the collection and transfer (Art. 26 GDPR). Further processing by Meta is Meta's own responsibility, see Meta's privacy policy.

5. Our Instagram profile and Instagram Shopping

We have a profile on Instagram and also show our products there. When you visit our profile or interact with us, Meta processes your data under its own terms. We are jointly responsible with Meta for the statistics Meta provides to us about our profile (Instagram Insights) (Art. 26 GDPR). If you tap a product on Instagram, you'll be taken to our shop to buy it. The legal basis is our legitimate interest in showing our products on Instagram as well (Art. 6(1)(f) GDPR). If you send us messages there, we'll reply to you via Instagram.

6. Spotify podcast player

On our podcast page, you can listen to our podcast directly through an embedded Spotify player. The player only loads when you click “Load podcast”. Only then is data such as your IP address, device and browser information sent to Spotify, and Spotify may set cookies. The provider is Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, § 165(3) Austrian Telecommunications Act 2021). Spotify's privacy policy applies to any further processing.

The links to Instagram, LinkedIn and Spotify in the footer are plain links. Data is only transferred when you click them and open the respective platform.

7. Orders and customer account

When you order, we process your name, billing and delivery address, email address, phone number if provided, the products ordered and payment information. We need this data to process your order, send you the goods and keep you updated on the status of your order (Art. 6(1)(b) GDPR).

A customer account is optional. You can also order as a guest. If you create an account, we store your data so you can view your orders, until you delete the account or ask us to.

8. Payment

Payment is handled by the payment provider you choose at checkout, for example Shopify Payments, Shop Pay, Apple Pay, Google Pay or PayPal. For this, we pass the necessary order and payment data on to the respective provider (Art. 6(1)(b) GDPR). We do not see full card details. The provider's own privacy policy also applies to their processing.

9. Shipping

We ship all orders ourselves from Werfen. To create shipping labels, we use the shipping platform Senddrop. For this and for delivery, we pass on your name, delivery address and, if needed for delivery notifications, your email address or phone number to Senddrop and the respective parcel service (Art. 6(1)(b) GDPR).

10. Newsletter

If you sign up for our newsletter, we use your email address to send you news, offers and discount codes. The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 Austrian Telecommunications Act 2021).

We use the double opt-in process: after signing up, you'll receive an email in which you confirm your subscription. Only then are you signed up. We store the time of sign-up and confirmation as proof.

The newsletter is sent via Shopify Email. We analyse whether an email was opened and which links were clicked so we can improve the newsletter.

You can unsubscribe at any time via the link in every email or by sending us a message. We will then remove your address from the mailing list.

11. Contact

If you write to us by email, phone or contact form, we process your details to answer your request (Art. 6(1)(b) GDPR for questions about an order, otherwise Art. 6(1)(f) GDPR).

12. Product reviews

We use the Judge.me app for product reviews. If you write a review, your name or initials, your review and any photos are published in the shop. Your email address is not published. The legal basis is the consent you give by submitting the review (Art. 6(1)(a) GDPR). You can ask us to delete your review at any time.

If you agreed to receive emails from us at checkout, we'll send you an email via Judge.me a few days after delivery asking you to review the products you bought. For this, we pass on your name, email address and the products ordered to Judge.me. The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 Austrian Telecommunications Act 2021). You can withdraw it at any time via the unsubscribe link in the email or by sending us a message.

13. Who receives your data?

We only pass on your data where this is necessary for the purposes described:

  • Shopify (running the shop, checkout, payment processing via Shopify Payments, newsletter via Shopify Email). In the EU, our contractual partner is Shopify International Limited, Dublin, Ireland.
  • payment providers you choose at checkout
  • Senddrop and the respective parcel service
  • Judge.me (product reviews)
  • Google (Google Analytics) and Meta (Meta Pixel, Conversions API, Instagram), only with your consent
  • Spotify, only if you load the podcast player
  • our tax advisers and authorities, where we are legally required to

Where required, we have data processing agreements with our service providers under Art. 28 GDPR.

14. Transfers to countries outside the EU

Some service providers, including Shopify, Google and Meta, also process data outside the EU, for example in Canada or the USA. For Canada, there is an adequacy decision by the European Commission. For the USA, transfers are based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

15. How long do we keep your data?

  • Order and invoice data: 7 years, because tax law requires us to (§ 132 Austrian Federal Fiscal Code, BAO)
  • Customer account: until you delete it
  • Newsletter: until you unsubscribe. We keep proof of your consent afterwards for as long as we need it to defend against claims.
  • Contact requests: until the request has been dealt with, unless statutory periods require otherwise
  • Technical logs: only as long as necessary for security and operation
  • Google Analytics: usage data is automatically deleted after 14 months
  • Cookies: depending on the cookie, until the end of the session or up to 2 years, unless you delete them earlier

16. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability. You can object to processing based on our legitimate interest and withdraw consent at any time with effect for the future. To do so, write to us at hello@helloalbert.shop.

If you believe we are not processing your data correctly, you can lodge a complaint with the Austrian Data Protection Authority:
Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria
Email: dsb@dsb.gv.at, web: www.dsb.gv.at

17. Do you have to give us data?

To place an order, we need the data marked as required at checkout. Without it, we cannot deliver. Everything else is voluntary. There is no automated decision-making or profiling that legally affects you.

18. Changes

If our shop or the legal requirements change, we will update this privacy policy. The version published here always applies.