Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Das Merch. FlexCo, Peter-Behrens-Platz 6/4, 4020 Linz, Austria
Email: hello@dasmerch.com, phone: +43 677 62983125
Data protection officer
PROLIANCE GmbH / datenschutzexperte.de, Leopoldstrasse 21, 80802 Munich, Germany
Email: datenschutzbeauftragter@datenschutzexperte.de
General information and legal bases
We process personal data only within the limits of applicable law. The legal bases are in particular the performance of a contract (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c) GDPR), our legitimate interests (Art. 6(1)(f) GDPR) and, where required, your consent (Art. 6(1)(a) GDPR).
Shop system and hosting
Our online shop runs on and is hosted via the Shopify platform. The provider is Shopify International Ltd., Dublin, Ireland (for users in the EEA), part of the Shopify group with locations also in Canada and the USA. When you access and use the shop, technically necessary data (e.g. IP address, date and time of access, pages viewed, browser type) are processed to provide the website securely and reliably. A data-processing agreement is in place with Shopify. Any transfer to third countries takes place on the basis of the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
Order processing
To process your order we use the data you provide (name, delivery and billing address, email address, phone number where applicable, order and payment data). The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Where tax and commercial retention obligations apply, we store the relevant data for the legally prescribed period (Art. 6(1)(c) GDPR).
Payment processing
Payments are handled by Shopify Payments (Shopify International Ltd., Dublin, Ireland). We accept Visa, Mastercard and American Express as well as the wallets Shop Pay (Shopify), Apple Pay (Apple Distribution International Ltd., Ireland) and Google Pay (Google Ireland Ltd.). The data required for payment – card or wallet details, amount, billing address – are transmitted to the respective provider, which processes them on its own responsibility under its privacy policy; we never see full card details. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).
Shipping
To deliver your order we pass your name, delivery address and – for tracking – your email address or phone number to the carrier that delivers the parcel from our production in Portugal. Which carrier that is depends on the destination country and on the shipment. We work with the following carriers:
- FedEx (FedEx Express International B.V., Amsterdam, Netherlands, and its national subsidiaries)
- UPS (United Parcel Service Europe SRL, Avenue Ariane 5, 1200 Brussels, Belgium, and its national subsidiaries)
- Austrian Post (Österreichische Post AG, Rochusplatz 1, 1030 Vienna, Austria)
- GLS (General Logistics Systems B.V., Amsterdam, Netherlands, and its national subsidiaries)
The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Where the carriers deliver on our behalf they act as processors; for their own purposes – such as tracking in their own portals – they are controllers in their own right and their privacy policies apply.
Cookies and consent
We use cookies and comparable technologies. Technically necessary cookies (e.g. for the cart, the session and your language setting) are required to operate the shop; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR) or performance of the contract (Art. 6(1)(b) GDPR).
All non-essential cookies – in particular for statistics and marketing – are set exclusively with your consent (§ 165(3) Austrian Telecommunications Act 2021 in conjunction with Art. 6(1)(a) GDPR). You give that consent via our consent banner. Your choice is stored using Shopify’s customer privacy feature and is evaluated by our website before any of the services below is called: as long as you have not agreed, those services are neither loaded nor addressed and set no cookies. You can change your choice at any time via the banner and withdraw your consent with effect for the future.
Web analytics with Google Analytics 4
If you consent to the “analytics” category, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The data processed includes a truncated IP address, device and browser information, the pages you view and the referring source, as well as shopping events (product viewed, set added to cart, checkout started) together with item name, variant, price, quantity and currency. We do not transmit names, email addresses or postal addresses.
We use Google Consent Mode: before you consent, no analytics cookies are set and no events are sent. The legal basis is your consent (Art. 6(1)(a) GDPR). A transfer to the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework, supplemented by the EU Standard Contractual Clauses. For details see policies.google.com/privacy.
Meta pixel (Facebook and Instagram)
If you consent to the “marketing” category, we use the Meta pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. We use it to measure the performance of our ads on Facebook and Instagram and to show you advertising there that matches your interests (retargeting).
The pixel reports to Meta that you have opened a page of our shop, viewed a product, added a set to the cart or started checkout. The data transmitted includes the product or variant identifier, product name, quantity, price, cart value and currency, as well as your IP address, browser and device information and Meta’s cookie identifier (including _fbp). If your browser is signed in to Facebook or Instagram, Meta can link these events to your account there.
We and Meta are joint controllers (Art. 26 GDPR) for the collection of the data on our website and its transmission to Meta; Meta is solely responsible for the subsequent processing. The legal basis is exclusively your consent (Art. 6(1)(a) GDPR) – without consent the pixel is not loaded. A transfer to the USA is possible; Meta is certified under the EU-US Data Privacy Framework, supplemented by the EU Standard Contractual Clauses. For details see facebook.com/privacy/policy.
Enquiries, returns and customer accounts
If you contact us by email or phone – for example with a sizing question, a withdrawal or a return request – we process the data you provide (name, contact details, order number, content of your enquiry) in order to deal with your request. The legal basis is performance or preparation of the contract (Art. 6(1)(b) GDPR) and otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). If you create a customer account in the shop, we store the data held there until the account is deleted. We delete correspondence as soon as it is no longer needed and no retention obligation applies.
Retention periods
We store personal data only for as long as is necessary for the purposes described. Order and invoice data are subject to commercial and tax retention obligations (in Austria generally seven years). Analytics and marketing data are deleted once the respective cookie lifetime expires, and at the latest when you withdraw your consent.
Your rights
Subject to the statutory conditions, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and a right to object (Art. 21). You may withdraw any consent given at any time. To exercise these rights, please use the contact details above.
Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority. The competent authority in Austria is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.