Privacy policy
As of October 2026
This English version is a reading aid only; the German version remains the legally binding text and prevails in case of any discrepancy.
This privacy policy tells you which personal data we process, for what purpose and on what basis. It applies to materea-shop.com and to everything you order or enquire about through this shop.
Who is responsible
- Controller
- MATEREA Handels GmbH
- Address
- Dobler Straße 2, 8502 Lannach, Austria
- Telephone
- +43 664 3866779
- kontakt@materea.at
- Company register
- FN 538045 v, Landesgericht für Zivilrechtssachen Graz
If you have a question about data protection or want to exercise one of your rights, write to kontakt@materea.at. A short email is enough; you do not need a particular form.
If you are just browsing
The shop runs on Shopify's platform. When a page is accessed, technical data is generated there: your IP address, date and time, the address accessed, the page visited beforehand, browser, operating system and device type. Without this data no server can deliver a page. We use it to provide the shop, to keep it stable and secure and to defend against attacks.
The legal basis is our legitimate interest in a functioning and secure online shop, Art. 6(1)(f) GDPR.
Shopify additionally collects aggregated access figures for the shop operator, for example how many visits a page had. We describe tools for measuring advertising further below under Audience measurement and advertising; they only run with your consent.
Cookies and your consent
We set technically necessary cookies without consent. They remember the cart, maintain your session, recognise you after you log in, store the selected language and protect forms against automated abuse. Without them the shop does not work.
For anything beyond that, we ask beforehand. For this purpose a banner is shown on the first visit from the EU and the EEA, in which you can consent or decline. Both options are equivalent; declining does not cost you any function of the shop. Shopify stores your decision and takes it into account on every further visit.
You can withdraw a consent you have given at any time with effect for the future, either via the banner or by email to us. You can also delete or block cookies in your browser. The legal basis for cookies that require consent is your consent, Art. 6(1)(a) GDPR in conjunction with § 165(3) of the Telecommunications Act 2021 (Telekommunikationsgesetz 2021).
Fonts
The shop itself serves the fonts Roboto and Roboto Condensed, together with the other files of the page. No data goes to Google or to any other font provider in the process.
Protection of our forms
So that our forms are not flooded with spam by programs, Shopify uses the hCaptcha service. It evaluates technical information about your device and your behaviour on the page in order to distinguish human from machine. The provider is Intuition Machines, Inc., USA. The legal basis is our legitimate interest in preventing abuse, Art. 6(1)(f) GDPR.
Audience measurement and advertising
We advertise the shop on Meta and with Google. So that we can see whether an advertisement has actually led to an order, measurement tags of both providers run on this website. They only start once you have consented in the banner. If you decline or withdraw consent later, they stay off. The legal basis is your consent, Art. 6(1)(a) GDPR.
Meta Pixel. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. The measurement tag reports to Meta which pages you have accessed, which products you have viewed or added to the cart and whether an order was completed, together with technical details about browser and device and a cookie identifier. If you have an account with Facebook or Instagram, Meta can attribute these events to your profile and show us anonymised evaluations. We and Meta are joint controllers within the meaning of Art. 26 GDPR for the collection and the transmission to Meta; Meta alone is the controller for everything Meta does with the data afterwards.
Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The measurement tag attributes an order to the advertisement through which you came and evaluates how the shop is used. In the process the pages accessed, the time, shortened location data, device and browser data and an identifier are collected.
Both providers belong to corporate groups headquartered in the USA, so your data can end up there. What this means is set out below under Transfers to third countries. You can withdraw your consent at any time via the cookie banner.
When you place an order
For an order we need company name, first and last name, billing and delivery address, email address, telephone number, the items ordered and the payment and shipping method chosen. Without this information we cannot perform the contract.
The legal basis is the performance of the contract with you, Art. 6(1)(b) GDPR. For invoicing and bookkeeping our legal obligation also applies, Art. 6(1)(c) GDPR in conjunction with § 132 of the Federal Fiscal Code (Bundesabgabenordnung).
You enter your payment data with the respective payment provider, not with us. We never see complete card numbers. We only learn whether the payment was completed.
- Card, EPS, Apple Pay and Google Pay are processed via Shopify Payments.
- With Klarna and with PayPal, the respective provider processes the payment and checks according to its own rules whether it accepts it.
- Shop Pay is Shopify's accelerated checkout. If you use it, Shopify stores your address and payment data for the next order.
- We handle payment by invoice ourselves; this involves no data beyond that from your order.
For shipping we pass on name, delivery address and, where needed, telephone number or email address to the transport company commissioned, so that it can deliver and reach you to announce the delivery. We send parcels by post (Österreichische Post AG), pallets with K&R Transportmanagement in Kalsdorf bei Graz. Invoices go to our tax advisers.
Your customer account
Every account approval comes with a customer account. It contains your master data, your addresses and your previous orders. You set the password yourself; we cannot see it. For the set-up we send you an invitation by email.
The legal basis is the contract or, as the case may be, steps taken prior to entering into a contract, Art. 6(1)(b) GDPR. You can request deletion of your account at any time; data that we are legally required to retain remains unaffected.
Registration as a business
This shop sells only to entrepreneurs. We therefore check before account approval whether there is really a business behind the registration. In the form we ask for company, first and last name, email address, telephone number, address, country, where applicable website, and the VAT ID number.
These details are received by an interface that is operated on our behalf at materea-bridge.vercel.app. At the same moment it checks the VAT ID number against the VIES register of the European Union, then creates your customer account in Shopify and grants the account approval. We store the result of the check as proof with the customer account, together with the time of the query. The interface runs in the Frankfurt data centre; your details do not leave the European Union in the process. It has no database of its own; it passes the details on and does not retain them.
If you do not have a VAT ID number, the enquiry reaches us and we review it manually. If the VAT ID check remains invalid, we do not create an account and you can correct the number.
The legal basis is steps prior to entering into a contract and the performance of the contract, Art. 6(1)(b) GDPR. For the check itself, our tax-law obligation to verify the customer's VAT ID in the case of intra-Community supplies also applies, Art. 6(1)(c) GDPR.
Workshops
You book workshop places through the shop like a product. For this we process your order and contact data and keep a list of participants on site. If you put yourself on a waiting list, we store name, email address and telephone number until the date has passed or you remove yourself from the list again.
When you write to us
If you write to us by email, call us or use a form on this website, we process your details in order to reply to you. The legal basis is our legitimate interest in answering enquiries, Art. 6(1)(f) GDPR, and, for an enquiry about a purchase, steps prior to entering into a contract, Art. 6(1)(b) GDPR.
Newsletter
If you subscribe to our newsletter, we use your email address and, if provided, your first name to send you news about products and workshop dates. You confirm the subscription via a link in a first email. The legal basis is your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time, via the unsubscribe link in every email or with a message to kontakt@materea.at. We use Mailchimp for sending. Mailchimp stores the subscription data and measures whether an email has been opened and which links in it have been clicked. We store your data until you unsubscribe.
Who else processes your data
We only pass on data where it is necessary for operating the shop. The following services work as processors for us or are involved in the payment and shipping route.
| Service | Purpose | Based in |
|---|---|---|
| Shopify International Limited | Shop platform, hosting, customer accounts, cookie banner, Shopify Payments and Shop Pay | Ireland, parent company in Canada |
| Kompass Consulting GmbH | Development and operation of the registration interface on our behalf | Austria |
| Vercel, Inc. | Server on which this interface runs | Company in the USA, processing in the Frankfurt data centre |
| European Commission (VIES) | Verification of the VAT ID number | European Union |
| Klarna and PayPal | Payment, if you choose this method | European Union |
| Meta Platforms Ireland Limited | Measurement and delivery of our advertising, only with your consent | Ireland, parent company in the USA |
| Google Ireland Limited | Measurement of our ads and evaluation of usage, only with your consent | Ireland, parent company in the USA |
| Intuition Machines, Inc. (hCaptcha) | Spam protection in forms | USA |
| The Rocket Science Group LLC (Mailchimp), a company of Intuit Inc. | Sending our newsletter, only with your consent | USA |
| Österreichische Post AG | Delivery of your parcels | Austria |
| K&R Transportmanagement, Kalsdorf bei Graz | Delivery of your pallets | Austria |
| Tax advisers | Bookkeeping and annual financial statements | Austria |
Beyond that, we only pass on data where we are legally obliged to do so, for example to tax authorities. Your data is neither sold nor rented out.
Transfers to third countries
Some of the services mentioned are based outside the European Union or have group companies there. Where we have a choice, we have the processing done in Europe: the interface for the registration of businesses runs in the Frankfurt data centre. For Canada, where Shopify's parent company is based, the European Commission has determined an adequate level of protection. For transfers to the USA we rely on the standard contractual clauses of the European Commission or on the provider's certification under the EU-US Data Privacy Framework.
How long we store data
| Data | Duration |
|---|---|
| Orders, invoices, receipts | 7 years after the end of the calendar year, § 132 of the Federal Fiscal Code (Bundesabgabenordnung) |
| Customer account including account approval and proof of the VAT ID check | for as long as the account exists, then until the tax-law retention period has expired |
| Enquiries by email, telephone or form | until the matter is resolved, then for a maximum of 3 years in case of follow-up questions |
| Waiting list for workshops | until the date or until you unsubscribe |
| Technical access data | short term, within the scope of Shopify's retention |
| Measurement data at Meta and Google | according to the retention periods of the respective provider, at Google generally up to 14 months |
| Consent to cookies | until withdrawn, at most until the next prompt |
Your rights
You have the right, vis-à-vis us, of access to the data stored about you and the right to rectification, to erasure, to restriction of processing and to data portability. You can object at any time to processing that we base on a legitimate interest. You can withdraw a consent you have given at any time with effect for the future, without the processing carried out until then becoming unlawful as a result.
Simply get in touch for this at kontakt@materea.at. We reply within one month.
If you believe that we are not processing your data correctly, you can lodge a complaint with the supervisory authority:
- Authority
- Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
- Address
- Barichgasse 40-42, 1030 Wien, Austria
- dsb@dsb.gv.at
- Web
- www.dsb.gv.at
Changes to this privacy policy
If anything changes about the shop or the services behind it, we will adapt this privacy policy. The version that is published here always applies. The date of the current version is shown above, under the heading.