Privacy policy
Note on legal validity: Only the German version of this document is legally binding. This English translation is provided for convenience and better understanding only and has no legal effect. Read the legally binding German version here.
Privacy Policy
This privacy policy describes how we collect, use and disclose your personal data when you visit our website or make a purchase through it. Last updated: August 23, 2026.
1. Controller
MINTU OG, Handwerkstraße 8, 9500 Villach, Austria
Company register number FN 656794z, Landesgericht Klagenfurt
Email: office@mintu.shop, telephone +43 650 740 9358
Partners authorized to represent the company: Mag. Sandra Frank, DI Dr. Thomas Kampitsch
We are not obliged under Art. 37 GDPR to appoint a data protection officer. If you have questions about data protection, please contact office@mintu.shop.
2. What data we process
Device and usage data: web browser, IP address, time zone, cookie information, pages and products viewed, referring website and search terms, interactions with the website.
Order data: name, billing and delivery address, payment data, email address, telephone number, order history.
Account data: login credentials, profile details, points balance and credit in the loyalty program, saved wish lists, settings for push notifications.
Communication data: your enquiries via contact form, chat, product request or retailer application.
Location data: only within the summit promotion and only if you actively grant access. See section 16.
3. Legal bases
Performance of a contract and pre-contractual measures under Art. 6(1)(b) GDPR, for example to process your order.
Consent under Art. 6(1)(a) GDPR, for example for the newsletter and non-essential cookies.
Legitimate interest under Art. 6(1)(f) GDPR, for example for fraud prevention, IT security and improvement of our offering.
Legal obligation under Art. 6(1)(c) GDPR, for example retention obligations under tax and commercial law.
4. Recipients
We only disclose your data where this is necessary for the performance of the contract, where you have consented, or where we are legally obliged to do so. Recipients and processors are:
Shopify Inc. for the operation of the online shop and the checkout
Shopify Payments and the other payment services offered in the checkout (credit card, Apple Pay, Google Pay, PayPal, Klarna, EPS)
Shipping service providers for the delivery of your order
Supabase for our own application database, server location European Union
Klaviyo Inc. for sending our marketing emails
digitalnova.at as SMTP service for transactional and service emails
Google Ireland Ltd. for Google Analytics for reach measurement, only with your consent
Meta Platforms Ireland Ltd. for reach measurement and advertising, only with your consent
Privy for sign-up and notice forms
SMS and push services, provided you have activated these notifications
Where data is transferred to third countries, this takes place on the basis of standard contractual clauses under Art. 46 GDPR or an adequacy decision.
5. Cookies and tracking
Essential cookies are required for the operation of the website, for example for the shopping cart and login. We use cookies for statistics, marketing and personalization only with your consent. On your first visit you can make your selection in the cookie banner. You can change or withdraw this selection at any time via the Cookie settings link in the footer of the website.
6. Automated assistant (chat)
An automated assistant is available to you on our website. It is a rule-based system that matches your input against a knowledge base maintained by us. No language model is used, your inputs are not transmitted to third parties and are not used to train AI systems.
We process your input in the chat window, a technical session identifier and a timestamp and, if you are logged in, your customer number, in order to be able to give you information about your orders, your points balance and your credit. If you leave us your email address or telephone number for an open question, we use these exclusively to answer that enquiry.
The legal basis is Art. 6(1)(b) GDPR where the processing serves the performance or initiation of a contract, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in efficient customer support. Processing takes place on our infrastructure at Supabase, server location European Union. Chat sessions are deleted after 30 days, enquiries with contact details once they have been dealt with, at the latest after six months.
7. Newsletter
For the newsletter we use the double opt-in procedure: after you sign up you receive an email with a confirmation link. Only after confirmation do we add you to the distribution list. We log the sign-up and the confirmation as evidence of your consent. You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or by message to office@mintu.shop.
8. Customer account and loyalty program
If you create a customer account, we store your login and profile data, your order history as well as your points balance, status level and credit in the loyalty program. The legal basis is Art. 6(1)(b) GDPR. You can have your account deleted at any time; statutory retention periods remain unaffected.
9. Push notifications
If you activate push notifications, we store the device identifier required for this and the time of your consent. You can deactivate push notifications at any time in your browser or device as well as in your customer account.
10. Retention period
We store personal data only for as long as is necessary for the respective purpose. We retain order and invoice data for seven years in accordance with the requirements of tax and commercial law (Section 132 BAO). Chat sessions are deleted after 30 days, contact enquiries at the latest after six months, newsletter data until you withdraw your consent. Location data from the summit promotion is not stored.
11. Your rights
Access under Art. 15 GDPR to the data stored about you.
Rectification of inaccurate data under Art. 16 GDPR.
Erasure under Art. 17 GDPR, unless statutory retention periods prevent this.
Restriction of processing under Art. 18 GDPR.
Data portability under Art. 20 GDPR in a machine-readable format.
Objection to processing under Art. 21 GDPR, in particular to direct marketing.
Withdrawal of a consent given, with effect for the future; the lawfulness of the processing carried out up to that point remains unaffected.
A message to office@mintu.shop is sufficient to exercise your rights.
12. Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority. In Austria: Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at. In Germany, the supervisory authority of your federal state is responsible.
13. Necessity of provision
Providing your order and contact details is necessary for the conclusion of the contract. Without this information we cannot process your order. Any information beyond this is voluntary.
14. Automated decision-making
Automated decision-making, including profiling, with legal effect or similarly significant impact within the meaning of Art. 22 GDPR does not take place.
15. Minors
Our offering is not directed at persons under 18 years of age. We do not knowingly collect data from minors. Should we become aware of such data, we will delete it immediately.
16. Location data (summit promotion)
For the summit promotion we process your location exclusively at the moment of check-in and only if you actively grant access. We ask for that permission again each time you use the feature. Your location data serves solely to verify whether you are at the respective summit; it is not stored afterwards. Without your express permission we do not process any location data. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future by deactivating location access in your browser or device.
17. Changes
We reserve the right to amend this privacy policy in order to adapt it to changed processing operations or legal requirements. You can find the current version on this page.