Privacy policy

This translation is provided for information purposes only. The German version is legally binding.

Protecting your personal data is a matter of particular importance to us. We therefore process your data exclusively on the basis of the statutory provisions, in particular the General Data Protection Regulation (GDPR) and the Austrian Telecommunications Act (TKG 2021). In this privacy policy, we inform you pursuant to Art. 13 GDPR about which data we process when you visit aquaryloc.shop, place orders and use our other services, for what purpose and on what legal basis, to whom we disclose it and what rights you have.

Controller

The controller responsible for data processing on this website is:

AQUARYLIC GmbH
Klarenbrunnstraße 46
6700 Bludenz
Austria
Email: office@aquarylic.com
Phone: +43 5552 20814

Registered office: Nüziders
Company register no.: FN 568 343 z
Company register court (Firmenbuchgericht): Landesgericht Feldkirch
Managing Directors: Philipp Domenig and Angelika Domenig

For all questions about data protection and to exercise your rights, you can reach us at office@aquarylic.com.

General Information on Data Processing

We only process personal data where there is a legal basis for doing so. The most important ones are:

Consent (Art. 6 (1)(a) GDPR), for example for the newsletter, for analytics and marketing cookies and for loading embedded content after you click. You can withdraw your consent at any time with effect for the future.
Contract and pre-contractual measures (Art. 6 (1)(b) GDPR), for example for orders, payment, shipping, returns, the customer account and the loyalty program.
Legitimate interest (Art. 6 (1)(f) GDPR), for example for the secure and stable operation of the website, protection against misuse, handling inquiries and providing information about our own similar products. You can object to this processing (see “Your Rights”).

Where we are legally obliged to retain data, for example under tax law, we also process the data for this purpose (see “Data Storage via Our Web Shop”).

For certain tasks, we use service providers who process data on our behalf and in accordance with our instructions (processors pursuant to Art. 28 GDPR). Some providers, such as payment service providers and advertising platforms, also process data under their own responsibility; we point this out for the respective service.

We only store personal data for as long as is necessary for the respective purpose or as required by statutory retention periods. Information on the storage period can be found in the respective section.

Transfer of Data to Third Countries

Some of the providers we use are based outside the European Economic Area (EEA), in particular in the USA, or use subcontractors there. We only transfer personal data to such third countries under the conditions of Art. 44 et seq. GDPR:

If there is an adequacy decision of the European Commission for the third country, we base the transfer on it. For the USA, this applies to companies certified under the EU-U.S. Data Privacy Framework (DPF).
Otherwise, data is only transferred on the basis of appropriate safeguards, in particular the standard contractual clauses of the European Commission, or if another statutory requirement is met.

The basis on which such a transfer takes place is stated for the respective service. You can obtain a copy of the standard contractual clauses on request at office@aquarylic.com.

Hosting and Shop System

Our website and web shop run on the Shopify shop system. Shopify provides the website, the checkout, customer accounts, product search and forms, and processes the resulting data on our behalf.

Purpose: Provision of the website, operation of the web shop and checkout, order processing, customer accounts and the security and stability of our services.
Data: Master data, contact data, contract data, payment data, technical usage data (e.g. IP address, browser and device information, pages visited) and communication data; technically necessary cookies (e.g. for the shopping cart, language and currency).
Provider: for users in the European Economic Area, Shopify International Ltd., Ireland.
Legal basis: Performance of a contract (Art. 6 (1)(b) GDPR) and our legitimate interest in a secure, functional web shop (Art. 6 (1)(f) GDPR).
Third country: where applicable, on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: Order and customer data until the statutory retention periods expire; technical log data only as long as it is required for operation and security.
Objection: possible at any time, informally to office@aquarylic.com (see “Your Rights”).

Further information can be found in Shopify's privacy policy:
https://www.shopify.com/legal/privacy

Information on the cookies used by Shopify:
https://www.shopify.com/legal/cookies

Registration and User Account

Users of our web shop can optionally create a user account. As part of registration, we inform users of the required details. The data entered during registration is processed for the purpose of providing and using the user account.

Users may be informed of offer-related, account-related, or technically necessary information by email.

If users cancel their user account, the data associated with that user account is deleted, unless there is a statutory retention obligation or another legal reason for further storage.

To protect against misuse and unauthorized use, we may store the IP address and time of the respective user action. The processing is carried out on the basis of our legitimate interests in the security and stability of our offering pursuant to Art. 6 (1)(f) GDPR.

Data Storage via Our Web Shop

For the purpose of contract processing, the following data is stored with us: salutation, first and last name, address, email address, as well as optionally provided additional data such as company name, phone number, and additional address details.

The data you provide is required for the performance of the contract or for carrying out pre-contractual measures. Without this data, we cannot conclude the contract with you.

Where necessary, data is transmitted in particular to the shop system we use, to payment service providers or banking institutions for the purpose of payment processing, to the transport or shipping company we commission for delivery of the goods, and to our tax advisor to fulfill our tax law obligations.

If the purchasing process is abandoned, the data stored with us is deleted, unless there is a statutory retention obligation or another legal reason for further storage.

In the event a contract is concluded, all data from the contractual relationship is stored until the expiry of the tax law retention period. The data name, address, purchased goods, and purchase date are also stored until the expiry of any applicable product liability period.

The data processing is carried out on the basis of Art. 6 (1)(b) GDPR (performance of a contract) and, where necessary, on the basis of Art. 6 (1)(c) GDPR (legal obligation).

Payment

For payment, we pass on the necessary data (e.g. name, billing address, email address, order amount and order number) to the payment service provider you have chosen. You enter your payment data (e.g. card details) in the checkout or directly with the payment service provider. The payment service providers also process your data partly under their own responsibility, for example for identity verification, fraud prevention or, for invoice and installment purchases, credit checks; their privacy notices, which are displayed to you during the payment process, apply to this.

Klarna

Through Klarna, we offer, among other things, purchase on invoice. On product pages, we also display information about Klarna's payment options; for this purpose, a connection to Klarna is established when the page is loaded.

Purpose: Payment processing and display of payment options.
Data: Name, address, email address, phone number and date of birth if applicable, order data, payment information; when the information is displayed, technical data (e.g. IP address, browser information).
Provider: Klarna Bank AB (publ), Stockholm, Sweden.
Legal basis: Performance of a contract (Art. 6 (1)(b) GDPR); for the information on product pages, our legitimate interest in informing you about payment options (Art. 6 (1)(f) GDPR).
Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until the statutory retention periods expire (see “Data Storage via Our Web Shop”).
Objection: not provided for payment processing, as it is necessary for the performance of the contract. You can object to the information on product pages at any time by sending an informal message to office@aquarylic.com.

PayPal

Purpose: Payment processing, including via the express checkout buttons in the shopping cart.
Data: Name, address, email address, order data, payment information.
Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
Legal basis: Performance of a contract (Art. 6 (1)(b) GDPR).
Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until the statutory retention periods expire (see “Data Storage via Our Web Shop”).
Objection: not provided for, as the processing is necessary for the performance of the contract; your other rights (see “Your Rights”) remain unaffected.

Shopify Payments and Shop Pay

We process card payments as well as Apple Pay and Google Pay via Shopify Payments. With Shop Pay, you can save your data for future purchases; the Shop Pay terms, which you accept there, also apply. For Apple Pay and Google Pay, the privacy notices of the respective provider also apply.

Purpose: Payment processing and accelerated checkout.
Data: Name, address, email address, phone number if applicable, order data, payment information.
Provider: Shopify International Limited, Dublin, Ireland; Shopify itself is responsible for your Shop Pay account. Depending on the case, Shopify processes the payments via a payment partner (Stripe Payments Europe, Ltd., PayPal or Adyen N.V.).
Legal basis: Performance of a contract (Art. 6 (1)(b) GDPR); for saving your data with Shop Pay, your consent (Art. 6 (1)(a) GDPR).
Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until the statutory retention periods expire (see “Data Storage via Our Web Shop”).
Objection: not provided for, as the processing is necessary for the performance of the contract; your other rights (see “Your Rights”) remain unaffected.

Shipping and Order Processing

We use the following services for order processing, shipping, shipment tracking, returns and invoices. For this purpose, name, delivery and billing address, email address, phone number if applicable, order contents as well as order and tracking number are transmitted. We only pass on the data required for delivery to the commissioned transport company.

Sendcloud

Purpose: Creation of shipping labels, shipment tracking and provision of prepaid return labels.
Data: Name, delivery address, email address, phone number if applicable, order and tracking number, parcel data.
Provider: Sendcloud B.V., Eindhoven, Netherlands.
Legal basis: Performance of a contract (Art. 6 (1)(b) GDPR).
Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until the statutory retention periods expire (see “Data Storage via Our Web Shop”).
Objection: not provided for, as the processing is necessary for the performance of the contract; your other rights (see “Your Rights”) remain unaffected.

Billbee

Purpose: Order management and invoicing.
Data: Order, customer and invoice data.
Provider: Billbee GmbH, Twistetal, Germany.
Legal basis: Performance of a contract (Art. 6 (1)(b) GDPR).
Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until the statutory retention periods expire (see “Data Storage via Our Web Shop”).
Objection: not provided for, as the processing is necessary for the performance of the contract; your other rights (see “Your Rights”) remain unaffected.

Xentral

Purpose: Inventory management, order processing and accounting.
Data: Order, customer and invoice data.
Provider: Xentral ERP Software GmbH, Augsburg, Germany.
Legal basis: Performance of a contract (Art. 6 (1)(b) GDPR).
Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until the statutory retention periods expire (see “Data Storage via Our Web Shop”).
Objection: not provided for, as the processing is necessary for the performance of the contract; your other rights (see “Your Rights”) remain unaffected.

Contacting Us

If you contact us via a form on the website (e.g. the contact form or a retailer suggestion on the “Specialist retailers” page) or by email, the data you provide will be stored with us for six months for the purpose of processing the inquiry and in case of follow-up questions. We do not pass on this data without your consent unless there is a legal obligation to do so. The forms are transmitted via Shopify.

The legal basis is our legitimate interest in responding to your inquiry (Art. 6 (1)(f) GDPR) or, if your inquiry concerns an order or a contract, the performance of the contract (Art. 6 (1)(b) GDPR).

hCaptcha

To protect our forms against spam and automated entries, we have integrated the hCaptcha service, which Shopify provides for forms.

Purpose: Distinguishing between humans and automated programs (bots), protection against misuse.
Data: IP address, browser and device information, information on interaction with the form.
Provider: Intuition Machines, Inc., Miami, USA.
Legal basis: our legitimate interest in protecting our forms against misuse (Art. 6 (1)(f) GDPR).
Third country: USA; where applicable, on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: with the provider only as long as necessary for the protection purpose.
Objection: possible at any time, informally to office@aquarylic.com (see “Your Rights”). Without the check, the form cannot be sent; in this case, please write to us by email.

Cookies and Consent

Our website uses cookies and similar technologies (e.g. pixels and entries in your browser's storage). Cookies are small text files that are stored on your device by your browser. They do not cause any damage.

We use technically necessary cookies (e.g. for the shopping cart, checkout, language, currency and your cookie choice) on the basis of our legitimate interest in a functional web shop (Art. 6 (1)(f) GDPR). We only use all other cookies and services for preferences, analytics and marketing with your consent (Art. 6 (1)(a) GDPR).

Cookie banner and consent management (Pandectes)

On your first visit, a cookie banner asks which categories you consent to: necessary (always active), preferences, analytics and marketing. You can accept all categories, allow only necessary cookies or make an individual selection. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer of our website. We pass your choice on to Shopify so that the services integrated via Shopify also respect it.

Purpose: Obtaining, storing and documenting your consent.
Data: Your choice per category, the time of the choice, a consent ID and technical data of your visit (e.g. browser information).
Provider: Pandectes, Kuusalu vald, Estonia.
Legal basis: our legitimate interest in obtaining and documenting consent (Art. 6 (1)(f) GDPR).
Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: Your choice in a cookie in your browser until you change it or delete the cookies; the record of your consent for as long as we have to be able to prove the consent.
Objection: Change your choice at any time via the “Cookie settings” link in the footer; otherwise possible at any time, informally to office@aquarylic.com (see “Your Rights”).

In addition, you can set up your browser so that it informs you when cookies are set and you only allow this in individual cases. If cookies are deactivated, the functionality of our website may be limited.

Storage in the Browser (localStorage)

Some functions of our website remember settings directly in your browser's storage (localStorage or sessionStorage). These entries remain on your device, are not transmitted to us and are not used for analytics or advertising. In detail:

Country notice (aqGeo, aqGeoIgn; aqGeoWeg in sessionStorage): If the region in your browser language (e.g. “de-DE”) does not match the selected country, we ask once whether we should show prices and shipping for your country. Only your browser's language setting is read for this; no location query takes place. All that is stored is that you have answered, closed or skipped the notice.
Reduce motion (aqMotion): your choice for the animation toggle in the footer.
Wishlist (aqMerkliste, aqMerklisteAus): the products you have saved and temporarily unavailable entries. The wishlist only exists in this browser. If you have consented to marketing cookies, Klaviyo learns that you have saved a product (see “Newsletter and Email Marketing”).
Color palette (aqPalette): base shade and harmony shades of the palette you last put together.
Starter set configurator (aqStarterset): your color selection in the configurator.
Retailer suggestion (aqHkStimmen): which retailer suggestions you have already voted for. You send the vote itself via the form (see “Contacting Us”).
Cart notice (aqCpNeu, aqCpAnsage in sessionStorage): a short announcement for screen readers after a change in the shopping cart; the entry is deleted the next time the page is loaded.

My Color Shelf: On the “My Color Shelf” page, we show you the shades you have purchased so far when you are logged in to your customer account. Your browser calculates the suggestions for reordering and for complementing your collection directly on the page; nothing additional is stored and nothing is transmitted to third parties.

These storage entries are technically necessary for the respective function you use; the legal basis is our legitimate interest in a user-friendly website (Art. 6 (1)(f) GDPR). You can delete the entries at any time by deleting the site data for aquarylic.com in your browser; you can remove individual products directly on the wishlist page.

Newsletter and Email Marketing

You can subscribe to our newsletter “Farbenpost” via our website. To send it, we need your email address and your declaration that you agree to receive the newsletter. In order to provide you with targeted information, we may also process further data that you provide voluntarily.

As soon as you have signed up, we will send you an email with a link to confirm your subscription (double opt-in). You will only receive the newsletter after you have confirmed. We store the time of subscription and confirmation in order to be able to prove your consent.

Klaviyo

We use Klaviyo to send the newsletter and our emails. Through the connection to our shop, customer and order data is matched with Klaviyo so that we only send promotional emails to people who have consented or whom we are allowed to inform about our own similar products (see “Information on Similar Products”).

If you have consented to marketing cookies, Klaviyo also records which products you view on our website, add to the shopping cart or put on the wishlist (onsite tracking), so that we can tailor our emails to your interests. Without this consent, no onsite tracking takes place.

Purpose: Sending the newsletter, measuring opens and clicks, tailoring our emails to your interests.
Data: Email address, name and other voluntary information if applicable, time of subscription and confirmation, open and click data, customer and order data from our shop; with consent, usage data on our website and identifiers in cookies and in browser storage (e.g. __kla_id).
Provider: Klaviyo, Inc., Boston, USA.
Legal basis: for the newsletter and onsite tracking, your consent (Art. 6 (1)(a) GDPR); for matching customer and order data, our legitimate interest in correctly assigning consents and unsubscriptions (Art. 6 (1)(f) GDPR).
Third country: USA; where applicable, on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until you unsubscribe; beyond that, we retain proof of your consent where necessary.
Objection: Unsubscribe from the newsletter at any time via the unsubscribe link in every newsletter or at office@aquarylic.com; onsite tracking: withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of our website.

Further information on Klaviyo can be found at:
https://www.klaviyo.com/de/legal/privacy/privacy-notice

WhatsApp channel “Aquarylic Insider”

You can sign up for our WhatsApp channel on a separate sign-up page. For this purpose, we process the data requested in the sign-up form (e.g. your mobile number) and your consent (Art. 6 (1)(a) GDPR); the sign-up runs via a Klaviyo form. The use of WhatsApp is also subject to the privacy notices of WhatsApp Ireland Limited, Dublin, Ireland, a company of the Meta group; in this context, data may be transferred to Meta Platforms, Inc., USA, where applicable on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses. You can unsubscribe at any time.

We delete your data in connection with sending the newsletter after you unsubscribe, unless there is a legal obligation to store it further or the storage serves to prove that consent was given.

Information on Similar Products

To the extent legally permitted, we also use the email address provided as part of an order to send you information about our own similar products by email.

The processing is carried out on the basis of our legitimate interest in direct advertising for our own similar products pursuant to Art. 6 (1)(f) GDPR in conjunction with Section 174 (4) of the Austrian Telecommunications Act 2021 (TKG 2021), to the extent the requirements stated therein are met.

You may object to this use of your email address at any time with effect for the future, in particular via the unsubscribe link in every email.

Reviews and Trust Seal

On our website, we display customer reviews and our trust seal.

Loox (product reviews)

After a purchase, we invite you by email to review the products you have purchased. Reviews are only possible after a confirmed purchase. Published reviews appear on our product pages with the name you have provided.

Purpose: Invitation to review, collection and display of reviews with text, photos and videos.
Data: Name, email address, order data (purchased products, time of order), content of your review and uploaded images or videos; when the reviews are displayed, technical data (e.g. IP address, browser information).
Provider: Loox Online Ltd., Ramat Gan, Israel.
Legal basis: for the invitation and display, our legitimate interest in customer feedback and in a meaningful product presentation (Art. 6 (1)(f) GDPR); for the publication of your review, your consent, which you give by submitting it (Art. 6 (1)(a) GDPR).
Third country: Israel; the basis is the European Commission's adequacy decision for Israel (Art. 45 GDPR).
Storage period: Reviews as long as they are published or until you request their deletion; invitation data as long as it is required for the invitation.
Objection: Unsubscribe from invitations via the unsubscribe link in the email; deletion of your review at any time at office@aquarylic.com.

Trusted Shops (trust seal, buyer protection and shop reviews)

The Trusted Shops Trustbadge is integrated on our website. It displays our trust seal and our shop reviews. After an order, Trusted Shops offers you buyer protection and an invitation to leave a review.

Purpose: Display of the trust seal and reviews, buyer protection, invitation to review the shop.
Data: when the Trustbadge is loaded, technical data (e.g. IP address, browser information, time of access); after an order, order data (e.g. order number, order value and email address).
Provider: Trusted Shops SE, Cologne, Germany.
Legal basis: our legitimate interest in displaying our trust seal and in offering buyer protection and shop reviews (Art. 6 (1)(f) GDPR).
Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: as long as necessary for buyer protection and the review.
Objection: Unsubscribe from invitations via the unsubscribe link in the email; otherwise possible at any time, informally to office@aquarylic.com (see “Your Rights”).

Loyalty Program “Pure Joy Club” (Smile.io)

In our loyalty program “Pure Joy Club”, you collect points for purchases and activities and redeem them for discounts. We operate the program with Smile.io; the club window on our website is loaded by Smile.io.

Purpose: Participation in the loyalty program, management of points balance, rewards and bonuses (e.g. for signing up, birthdays or following us on social networks).
Data: Name, email address, ID of your customer account, orders and order values, points and redeemed rewards, date of birth (only if you provide it for the birthday bonus); when the club window is loaded, technical data (e.g. IP address, browser information).
Provider: Smile Inc., Waterloo (Ontario), Canada.
Legal basis: for participation, the performance of the contract (Art. 6 (1)(b) GDPR); for loading the club window, our legitimate interest in providing the program (Art. 6 (1)(f) GDPR).
Third country: Canada; the basis is the European Commission's adequacy decision for Canada (Art. 45 GDPR).
Storage period: for the duration of your participation; thereafter only as required by statutory retention periods.
Objection: You can end your participation at any time by sending an informal message to office@aquarylic.com.

Affiliate Program (UpPromote)

We use UpPromote for our affiliate program. If you come to us via a partner's link, we record which partner referred you so that we can credit the partner with a commission for your purchase. If you register as a partner yourself, the privacy notices displayed in the registration form also apply.

Purpose: Attribution of visits and orders to partners (affiliate tracking), settlement of commissions.
Data: Partner ID from the link, time of click and order, order number and order value, identifiers in cookies (e.g. _up_clid, _up_apd), browser and device information.
Provider: Secomapp (operator of UpPromote), Hanoi, Vietnam.
Legal basis: Your consent (Art. 6 (1)(a) GDPR).
Third country: Vietnam (registered office) and USA (servers according to the provider); the basis is the standard contractual clauses of the European Commission (see “Transfer of Data to Third Countries”).
Storage period: until you withdraw your consent; cookies and browser entries expire at the latest at the end of the term set by the provider.
Objection: Withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of our website.

Analytics and Audience Measurement

With your consent, we use the following services to understand how our website is used, to improve it and to measure the success of our advertising.

Google Analytics

Your choice in the cookie banner is transmitted to Google via “Consent Mode”; Google adjusts the processing accordingly.

Purpose: Audience measurement and analysis of the use of our website, performance measurement.
Data: Usage data (e.g. pages visited, time spent, clicks, purchases), device and browser information, IP address, identifiers in cookies (e.g. _ga).
Provider: Google Ireland Limited.
Legal basis: Your consent (Art. 6 (1)(a) GDPR).
Third country: where applicable, on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: according to the retention period we have set in Google Analytics; cookies expire at the latest at the end of the term set by Google.
Objection: Withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of our website.

Google's privacy policy:
https://policies.google.com/privacy?hl=de

Settings for personalized advertising:
https://adssettings.google.com/

Microsoft Clarity

Purpose: Analysis of how visitors use our website (e.g. clicks, scrolling behavior, heatmaps and session recordings) in order to find and fix usability problems.
Data: Usage and interaction data, device and browser information, IP address, identifiers in cookies (e.g. _clck, _clsk).
Provider: Microsoft Ireland Operations Limited, Ireland.
Legal basis: Your consent (Art. 6 (1)(a) GDPR).
Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until you withdraw your consent; cookies and browser entries expire at the latest at the end of the term set by the provider.
Objection: Withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of our website.

Triple Whale

Purpose: Attribution of visits and orders to marketing channels and analysis of our advertising success (attribution).
Data: Usage data, origin of the visit (e.g. ad or link), order data (e.g. order value, purchased products), device and browser information, IP address, identifiers in browser storage (e.g. TriplePixel).
Provider: Triple Whale Inc., Columbus (Ohio), USA.
Legal basis: Your consent (Art. 6 (1)(a) GDPR).
Third country: USA; where applicable, on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until you withdraw your consent; cookies and browser entries expire at the latest at the end of the term set by the provider.
Objection: Withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of our website.

ProfitMetrics

Purpose: Measuring advertising success on the basis of the contribution margin and transmitting purchase events to advertising platforms (e.g. Google and Meta).
Data: Order data (e.g. order value, purchased products), identifiers of ad clicks, identifiers in cookies (e.g. _pmb), device and browser information.
Provider: Profitmetrics ApS, Kongens Lyngby, Denmark.
Legal basis: Your consent (Art. 6 (1)(a) GDPR).
Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until you withdraw your consent; cookies and browser entries expire at the latest at the end of the term set by the provider.
Objection: Withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of our website.

Advertising and Remarketing

With your consent to the “Marketing” category, we use services from advertising platforms. This allows us to measure whether our ads lead to visits and purchases (conversion measurement) and to show you advertising for our products on other websites and platforms (remarketing). The providers may link the data to your user account with them and also use it for their own purposes; they are responsible for this themselves.

Google Ads, Google Merchant Center and YouTube

For product ads in Google Search, on Google Shopping and on YouTube, we transmit product data to the Google Merchant Center.

Purpose: Conversion measurement, remarketing and delivery of ads.
Data: Usage data, order data, device and browser information, IP address, identifiers in cookies (e.g. _gcl_au).
Provider: Google Ireland Limited.
Legal basis: Your consent (Art. 6 (1)(a) GDPR).
Third country: where applicable, on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until you withdraw your consent; cookies and browser entries expire at the latest at the end of the term set by the provider.
Objection: Withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of our website.

Information on Google's use of data for marketing purposes:
https://policies.google.com/technologies/ads?hl=de

Google's privacy policy:
https://policies.google.com/privacy?hl=de

Settings for personalized advertising:
https://adssettings.google.com/

Meta Pixel (Facebook and Instagram)

Purpose: Conversion measurement, remarketing and optimization of our ads on Facebook and Instagram.
Data: Usage data, order data, device and browser information, IP address, identifiers in cookies (e.g. _fbp, _fbc).
Provider: Meta Platforms Ireland Limited.
Legal basis: Your consent (Art. 6 (1)(a) GDPR).
Third country: where applicable, on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until you withdraw your consent; cookies and browser entries expire at the latest at the end of the term set by the provider.
Objection: Withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of our website.

Further information can be found in Meta's privacy notices:
https://www.facebook.com/privacy/policy/

Pinterest tag

Purpose: Conversion measurement, remarketing and optimization of our ads on Pinterest.
Data: Usage data, order data, device and browser information, IP address, identifiers in cookies (e.g. _pin_unauth).
Provider: Pinterest Europe Ltd. or Pinterest, Inc., depending on the context.
Legal basis: Your consent (Art. 6 (1)(a) GDPR).
Third country: where applicable, on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until you withdraw your consent; cookies and browser entries expire at the latest at the end of the term set by the provider.
Objection: Withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of our website.

TikTok Pixel

Purpose: Conversion measurement, remarketing and optimization of our ads on TikTok.
Data: Usage data, order data, device and browser information, IP address, identifiers in cookies (e.g. _ttp).
Provider: TikTok Technology Limited, Dublin, Ireland.
Legal basis: Your consent (Art. 6 (1)(a) GDPR).
Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until you withdraw your consent; cookies and browser entries expire at the latest at the end of the term set by the provider.
Objection: Withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer of our website.

Embedded Content

Where possible, we only load content from other providers after you click. Only then is a connection established to the respective provider; in particular, the provider receives your IP address and technical data of your browser.

Vimeo (videos)

We initially show videos as a preview image. Only when you click “Play” is the Vimeo player loaded; Vimeo can then set cookies and collect usage data.

Purpose: Playing embedded videos.
Data: IP address, device and browser information, playback data, identifiers in cookies if applicable.
Provider: Vimeo, Inc.
Legal basis: Your consent by clicking on the video (Art. 6 (1)(a) GDPR).
Third country: where applicable, on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: Vimeo cookies until the end of the term set by Vimeo.
Objection: Do not start the video, or delete the cookies in your browser.

Retailer map

On the “Specialist retailers” page, you can view our retailers on a map. We deliver the map function (Leaflet) and the country outlines entirely from our own shop server. No map tiles are loaded from third parties and no data is transmitted to a map provider. The map is only built after you click “Show map”; in this process, only our shop system processes the technical data that arises anyway when the page is accessed (see “Hosting and Shop System”).

Surveys (Tally)

For individual surveys, for example on the Advent calendar, we embed forms from Tally. When such a survey page is opened, the form is loaded from Tally; Tally processes your answers on our behalf.

Purpose: Conducting and evaluating surveys.
Data: Your answers and voluntary information (e.g. email address, if requested), IP address, device and browser information.
Provider: Tally BV, Ghent, Belgium.
Legal basis: for your answers, your consent through voluntary participation (Art. 6 (1)(a) GDPR); for loading the form, our legitimate interest in conducting the survey (Art. 6 (1)(f) GDPR).
Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: until the survey has been evaluated, unless we state otherwise in the survey.
Objection: Participation is voluntary; deletion of your answers at any time at office@aquarylic.com.

Aquarylic Art Challenge (artchallenge.aquarylic.com)

On the pages for the Aquarylic Art Challenge, we embed our own application from artchallenge.aquarylic.com (gallery, voting and results). When these pages are loaded, your browser establishes a connection to this application. Submissions are also subject to the challenge's conditions of participation.

Purpose: Display of the submitted works, voting and publication of the results.
Data: IP address, device and browser information; for a submission or vote, the information you provide there.
Provider: AQUARYLIC GmbH (own application); hosting: Cloudflare, Inc., San Francisco, USA.
Legal basis: our legitimate interest in conducting the challenge (Art. 6 (1)(f) GDPR); for a submission, participation in accordance with the conditions of participation (Art. 6 (1)(b) GDPR).
Third country: USA; where applicable, on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses (see “Transfer of Data to Third Countries”).
Storage period: as long as necessary for conducting and documenting the challenge.
Objection: possible at any time, informally to office@aquarylic.com (see “Your Rights”).

Other Shop Apps

For other functions of our web shop, such as shipping, shipment tracking, customer service and surveys, we use the following apps. They process data as processors in accordance with our instructions (Art. 28 GDPR). The legal basis is the performance of the contract (Art. 6 (1)(b) GDPR) or our legitimate interest in a functional web shop (Art. 6 (1)(f) GDPR); participation in surveys is voluntary (Art. 6 (1)(a) GDPR). We only store the data for as long as is necessary for the respective purpose or as required by statutory retention periods.

Aquarylic CDP – our own customer data platform, in which we combine customer and order data from our shop. Provider: AQUARYLIC GmbH (own application); hosting: Cloudflare, Inc., San Francisco, USA. Third country: USA; where applicable, on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses (see “Transfer of Data to Third Countries”). The app processes order and contact data on our behalf.
CWILL – shipment tracking, processing of returns and customer service chat. Provider: CWILL INC, Dover (Delaware), USA. Third country: USA, according to the provider also Hong Kong and China; where applicable, on the basis of the EU-U.S. Data Privacy Framework, otherwise on the basis of standard contractual clauses (see “Transfer of Data to Third Countries”). The app processes order and contact data on our behalf.
Zigpoll – customer surveys. Provider: Argonautic Labs LLC (Zigpoll), New York, USA. Third country: USA; where applicable, on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses (see “Transfer of Data to Third Countries”). The app processes order and contact data on our behalf.
Asklayer – customer surveys. Provider: K.K. Peak Digital (PeakDigital), Tokyo, Japan. Third country: Japan; the basis is the European Commission's adequacy decision for Japan (Art. 45 GDPR). The app processes order and contact data on our behalf.
Prowito – storage, picking and shipping of orders from a warehouse in Germany (fulfillment). Provider: Prowito GmbH, Barbing, Germany. Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”). The app processes order and contact data on our behalf.
Post-Labelcenter – creation of shipping labels for shipments with Austrian Post. Provider: ACL advanced commerce labs GmbH, Graz, Austria; the labels are created by the Labelcenter of Österreichische Post AG, Vienna, Austria. Third country: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”). The app processes order and contact data on our behalf.
Qikify, Axe and Easify – shop functions such as shopping cart extensions, add-on offers and product options. Providers: Qikify, Hanoi, Vietnam; Axe Commerce LLC, Paris, France; Tigren Technology Solution Company Limited (Easify), Hanoi, Vietnam. Third country: for Qikify and Easify, Vietnam; the basis is the standard contractual clauses of the European Commission (see “Transfer of Data to Third Countries”). For Axe Commerce: none, provided the provider does not use subcontractors outside the EEA; otherwise on the basis of an adequacy decision or standard contractual clauses (see “Transfer of Data to Third Countries”). The apps process order and contact data on our behalf.

Presence on Social Media

We maintain a presence within social networks and platforms in order to be able to communicate with users, prospects, and customers who are active there.

When you visit the respective networks and platforms, the terms of service and data processing policies of the respective operators apply.

Unless stated otherwise in our privacy policy, we process users' data when they communicate with us on social networks and platforms, e.g. by writing posts on our online presences or sending us messages.

In the footer, we link to our profiles on social networks (e.g. Instagram, Facebook, YouTube, Pinterest and TikTok). These are simple links: data is only transmitted to the platform when you click a link and open the platform.

Your Rights

Under the GDPR, you have the following rights:

Access to information on whether we process data about you and, if so, which data,
Rectification of inaccurate or incomplete data,
Erasure of your data, unless a statutory retention obligation prevents this,
Restriction of processing,
Data portability, i.e. receiving the data you have provided in a common, machine-readable format,
Withdrawal of any consent given, at any time and with effect for the future; the lawfulness of the processing carried out until then remains unaffected.

Right to object

If we process your data on the basis of our legitimate interest (Art. 6 (1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, or the processing serves the establishment, exercise or defense of legal claims. You can object to the processing of your data for direct marketing at any time without giving reasons, for example via the unsubscribe link in every email.

An informal message to office@aquarylic.com is sufficient to exercise your rights. You can change your cookie consents at any time via the “Cookie settings” link in the footer of our website.

Right to lodge a complaint

If you believe that the processing of your data violates data protection law or that your data protection rights have otherwise been infringed, you can lodge a complaint with the competent supervisory authority. In Austria, this is the Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Wien. You can also contact the supervisory authority of the EU member state in which you reside; a list is available from the European Data Protection Board.

You can reach us at the following contact details:
AQUARYLIC GmbH, Klarenbrunnstraße 46, 6700 Bludenz, Austria, office@aquarylic.com, +43 5552 20814

Last updated: October 26, 2026