As of October 2026

Information provided in accordance with applicable statutory disclosure requirements.



Protecting your personal data is important to us. This Privacy Policy explains what personal data we process in connection with our website and online shop, for what purposes, and what rights you have under the General Data Protection Regulation (GDPR).

Personal data is information relating to an identified or identifiable natural person. This includes, for example, your name, address, email address, telephone number or IP address.

1 - Data Controller

The data controller responsible for processing personal data is:

FINSTERECK KG
Liebenstein 22
4252 Liebenau
Austria

Authorised representative: Alexander Hackl

Telephone: +43 664 426 21 11
Email: info@finstereck.com

Commercial Register Court: Linz Regional Court
Commercial Register Number: FN 685404 y
VAT ID: ATU83619979

Data protection contact: Alexander Hackl

2 - Data Collection When Visiting Our Website

You can generally visit our website without providing any personal information yourself.

However, certain technical data is processed automatically when you access the website. This processing is necessary to make the website available, operate it securely and display it correctly.

We also process personal data when you provide it to us, for example by contacting us, using a customer account or placing an order in our online shop.

3 - Cookies and Local Storage

We use cookies on our website.

Cookies are small data files stored by a website in your browser or on your device. For example, they may be necessary to maintain settings, sessions, logins or a shopping cart while you use the website.

In particular, we distinguish between technically necessary cookies and cookies used for other purposes, such as analytics or marketing.

Strictly Necessary Cookies

We use strictly necessary cookies and similar technologies where required to provide the website and its essential features.

These may include features for login, shopping cart, session management and storing your privacy preferences.

Under Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), prior consent is not required for strictly necessary technologies.

Analytics and Marketing Cookies

Analytics, marketing or other non-essential cookies are only used with your consent.

In this case, the legal basis for processing personal data is:

Art. 6(1)(a) GDPR – Consent

You can change or withdraw your consent at any time, with effect for the future, through the cookie settings.

Rejecting non-essential cookies does not affect your ability to use our website generally.

Further information about the cookies actually used, their purpose and storage period is available in the cookie banner or cookie settings.

Local Storage

Our website also uses local storage features, which can store information locally in your browser.

Depending on the feature, this data may remain stored even after you close your browser.

You can restrict or clear local storage features through your browser settings. This may affect certain website features.

4 - Hosting

When hosting our website, we process data necessary to operate and make the website available.

This processing is primarily carried out to ensure the technical functionality and security of our website.

Where a hosting provider processes personal data on our behalf, this is done under an agreement pursuant to Art. 28 GDPR.

Unless a more specific legal basis applies, the legal basis for processing for which we are responsible is:

Art. 6(1)(f) GDPR – our legitimate interest in maintaining a secure and functional website

5 - Server Log Files

When you access our website, technically necessary access data may be automatically processed in so-called server log files.

This may include, in particular:

• Page accessed
• Browser type and version
• Operating system
• Referrer URL
• Date and time of access
• Amount of data transferred
• Hostname or IP address of the accessing device

This data is processed to make the website available, analyse errors, and ensure the security and stability of our website.

Legal basis: Art. 6(1)(f) GDPR

Log data is generally stored only for as long as necessary for these purposes. If longer storage is required to investigate a security incident, the data concerned may be retained until the incident has been resolved.

6 - Contacting Us

If you contact us by email, telephone or through a contact form, we process the information you provide to handle and respond to your enquiry.

For enquiries relating to entering into or performing a contract, we process your data on the following legal basis:

Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures

Where processing is not directly related to a contract, it may be based on our legitimate interest in handling your enquiry:

Art. 6(1)(f) GDPR

We delete the data as soon as it is no longer needed to handle your enquiry, unless statutory retention or documentation obligations apply.

7 - Orders and Online Shop

When you place an order through our online shop, we process the data needed to fulfil and process your order.

This may include, in particular:

• Name
• Billing address
• Delivery address
• Email address
• Telephone number, if provided or required
• Order details
• Payment information
• Delivery information

We process this data to perform the purchase contract, issue invoices, process payments, deliver orders and handle returns, warranty claims and service requests.

Legal basis: Art. 6(1)(b) GDPR – performance of a contract

Where commercial, tax or other statutory retention obligations apply, further storage is based on:

Art. 6(1)(c) GDPR – legal obligation

You must provide the data needed to process the contract. Without this data, we cannot process your order or fulfil the contract.

8 - Payment Processing

The following payment methods are currently available in our online shop:

• Visa
• Mastercard
• PayPal
• Prepayment / bank transfer

When you select a payment method, the data required to process the payment is processed or transferred to the payment service provider responsible for the selected method, to the extent necessary to complete the payment.

Legal basis: Art. 6(1)(b) GDPR – performance of a contract

If you pay in advance, the payment is processed using the bank account details we provide.

Any further processing of personal data by an independently acting payment service provider is governed by that provider's privacy policy.

9 - Shipping and Delivery

To fulfil an order, we provide the delivery service handling the shipment with the information needed to deliver it.

This includes, in particular:

• Name
• Delivery address
• Any other contact details required for delivery

We share this information only to the extent necessary to process and deliver your order.

Legal basis: Art. 6(1)(b) GDPR – performance of a contract

10 - Sharing Personal Data

We share personal data with third parties only where there is a legal basis for doing so.

We may share data, in particular, where this is necessary to fulfil a contract, where we have a legal obligation to do so, where you have expressly consented, or where processing is necessary and legally permitted to protect our legitimate interests.

We do not share data for other purposes that are incompatible with the original purpose of processing without an appropriate legal basis.

11 - Data Processors

We may use external service providers for certain technical or organisational services, and they may process personal data on our behalf.

Where a provider acts as a data processor, processing is carried out under an agreement pursuant to:

Art. 28 GDPR

Data processors may process personal data only in accordance with our instructions and within the scope of the agreed services.

12 - Transfers to Third Countries

When using certain service providers, personal data may be processed outside the European Union or the European Economic Area.

Transfers to a third country take place only in accordance with the requirements of Arts. 44 to 49 GDPR.

This may include, in particular, an adequacy decision by the European Commission or appropriate safeguards, such as standard contractual clauses approved by the European Commission.

For certified companies in the United States, data may be transferred on the basis of the adequacy decision for the EU-US Data Privacy Framework.

13 - Data Retention

We store personal data only for as long as necessary for the relevant purpose of processing.

Statutory retention, documentation, warranty or limitation periods may require us to retain data for longer.

Once the relevant purpose has ended and any applicable statutory retention periods have expired, the personal data concerned will be deleted or anonymised.

Where a specific retention period applies to a processing activity or cookie, it will be stated for that activity or in the cookie settings.

14 - Legal Bases

Depending on the processing activity, the processing of personal data may be based, in particular, on the following legal bases:

Art. 6(1)(a) GDPR
Consent

Art. 6(1)(b) GDPR
Performance of a contract or taking steps before entering into a contract

Art. 6(1)(c) GDPR
Compliance with a legal obligation

Art. 6(1)(f) GDPR
Pursuit of legitimate interests, provided these are not overridden by the interests or fundamental rights and freedoms of the data subject.

The applicable legal bases are specified for the relevant processing activities.

15 - Your Rights

Subject to the statutory requirements, you have the following rights in particular:

Right of access – Art. 15 GDPR

You can ask whether we process personal data about you and, if so, what data we process.

Right to rectification – Art. 16 GDPR

You can ask us to correct inaccurate personal data and complete incomplete personal data.

Right to erasure – Art. 17 GDPR

You can ask us to erase your personal data where the statutory requirements are met.

Right to restriction of processing – Art. 18 GDPR

You can ask us to restrict processing where the statutory requirements are met.

Right to data portability – Art. 20 GDPR

Where the statutory requirements are met, you can receive the data you have provided in a structured, commonly used and machine-readable format, or ask us to transfer it to another controller.

Right to object – Art. 21 GDPR

Where processing is based on Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation.

You may object at any time to the processing of personal data for direct marketing purposes.

Withdrawal of consent – Art. 7(3) GDPR

You can withdraw your consent at any time, with effect for the future.

This does not affect the lawfulness of processing carried out before the withdrawal.

16 - Exercising Your Rights

To exercise your data protection rights or ask questions about how we process your personal data, you can contact us:

FINSTERECK KG
Liebenstein 22
4252 Liebenau
Austria

Email: info@finstereck.com
Telephone: +43 664 426 21 11

If we have reasonable doubts about the identity of a person making a request, we may ask for additional information where necessary to prevent the unauthorised disclosure of personal data.

17 - Right to Lodge a Complaint

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

For Austria:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria

Telephone: +43 1 52 152-0
Email: dsb@dsb.gv.at

18 - Changes to This Privacy Policy

We update this Privacy Policy if the procedures, technical services or legal requirements applicable to our website change.

The version published on this website at any given time applies.

As of October 2026