Privacy policy
PRIVACY POLICY
Last updated: 19 August 2026
1. CONTROLLER
The controller responsible for the processing of personal data through this online store is:
ESVlife e.U.
Owner: Emil Johann Schnötzinger-Vorwahlner
Gerichtsbergstraße 20
4840 Vöcklabruck
Austria
Email: office@esvlife.at
Phone: +43 660 115 47 21
Company Register Number: FN 666825a
Company Register Court: Landesgericht Wels
In this Privacy Policy, “ESVlife”, “we”, “us” and “our” refer to ESVlife e.U.
We process personal data in accordance with the General Data Protection Regulation (“GDPR”), the Austrian Data Protection Act (“DSG”) and other applicable data protection laws.
2. PURPOSE OF THIS PRIVACY POLICY
This Privacy Policy explains how we collect, use, disclose, store and otherwise process personal data when you:
• visit our website or online store;
• purchase products from us;
• create or use a customer account;
• contact us;
• subscribe to marketing communications;
• submit a return or withdrawal request;
• use our online withdrawal function;
• interact with our website, products or services; or
• otherwise provide personal data to us.
This Privacy Policy applies to our online store and related services operated through ESVlife.
3. PERSONAL DATA WE PROCESS
Depending on how you interact with us, we may process the following categories of personal data.
Contact and identification data may include your name, billing address, shipping address, email address and telephone number.
Order and transaction data may include your order number, products ordered, order value, discounts, payment status, shipping information, returns, cancellations, withdrawals and previous transactions.
Payment information may include information necessary to process a payment, such as the selected payment method, payment status and transaction identifiers. Full payment card information is generally processed directly by Shopify and/or the relevant payment provider rather than by ESVlife.
Customer account data may include your account details, order history, preferences and settings.
Communication data may include emails, customer support enquiries, messages and other communications you send to us.
Withdrawal and return data may include your name, email address, order number, the products or part of the contract you wish to withdraw from, optional additional information and the date and time of your withdrawal declaration.
Marketing data may include your email address, marketing preferences, consent status and information relating to marketing communications sent to you.
Device and technical data may include your IP address, browser type, device type, operating system, language settings, cookie identifiers and similar technical information.
Website usage data may include information about how you use and navigate our online store, such as pages viewed, interactions, cart activity and referring pages.
Where you voluntarily submit reviews or other content, we may also process the information contained in that submission.
4. SOURCES OF PERSONAL DATA
We receive personal data primarily directly from you, for example when you place an order, create an account, subscribe to our newsletter, contact us or exercise a right of withdrawal.
We may also collect technical and usage information automatically when you use our website, including through cookies, similar technologies and Shopify functionality.
We may receive information from service providers involved in the fulfilment of your order or the operation of our online store, including Shopify, payment providers, shipping providers and other technical service providers.
We may also receive information from third parties where you have authorised the relevant disclosure or where the disclosure is otherwise permitted by law.
5. PURPOSES AND LEGAL BASES OF PROCESSING
We only process personal data where there is a valid legal basis under applicable data protection law.
5.1 ORDERS AND PERFORMANCE OF CONTRACTS
We process personal data in order to:
• process and administer your order;
• process payments;
• arrange shipping and delivery;
• communicate with you about your order;
• administer customer accounts;
• manage returns, exchanges and subscriptions; and
• provide the products and services you request.
The legal basis is Article 6(1)(b) GDPR, as the processing is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract.
5.2 LEGAL OBLIGATIONS
We process personal data where necessary to comply with legal obligations, including obligations relating to:
• accounting and taxation;
• consumer protection;
• warranty and product safety;
• statutory withdrawal rights;
• record keeping;
• authorities and legally valid requests; and
• other obligations imposed on us by law.
The legal basis is Article 6(1)(c) GDPR.
5.3 CUSTOMER SERVICE AND COMMUNICATION
We process information that you provide when you contact us in order to answer questions, resolve issues and provide customer service.
Depending on the circumstances, the legal basis is Article 6(1)(b) GDPR where the communication relates to a contract, or Article 6(1)(f) GDPR where we have a legitimate interest in providing effective customer service and managing our business relationships.
5.4 SECURITY AND FRAUD PREVENTION
We may process personal data in order to protect our online store, customers and business against fraud, misuse, security threats and unlawful activity.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the security, integrity and protection of our business, website, transactions and customers.
5.5 ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS
We may process and retain personal data where necessary to establish, exercise or defend legal claims.
The legal basis is Article 6(1)(f) GDPR and, where applicable, Article 6(1)(c) GDPR.
5.6 MARKETING AND NEWSLETTERS
Where required by applicable law, we send electronic marketing communications only where you have given your consent.
The legal basis is Article 6(1)(a) GDPR.
Where direct marketing is permitted without separate consent under applicable law, processing may be based on our legitimate interest in marketing our own products, subject to all applicable legal requirements and your right to object.
You may unsubscribe from marketing emails at any time using the unsubscribe link contained in the relevant email or by contacting us.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
5.7 ANALYTICS, ADVERTISING AND NON-ESSENTIAL TECHNOLOGIES
Where cookies, pixels or similar technologies require consent under applicable law, we use them only after you have provided the required consent.
The legal basis for the associated processing is Article 6(1)(a) GDPR.
You can change or withdraw your consent through the cookie or privacy settings made available on our website.
Strictly necessary technologies may be used without consent where they are required for the operation, security or functionality of the online store.
6. SHOPIFY
Our online store is hosted and operated using Shopify.
Shopify processes personal data required to provide the e-commerce platform, including information relating to website use, customer accounts, checkout, orders, transactions and technical operation.
Depending on the particular processing activity, Shopify may act as a processor on our behalf or as an independent controller.
Where Shopify Network Intelligence, enhanced services or similar Shopify functionality is enabled, Shopify may also process information collected through interactions with our store for purposes described in Shopify's applicable terms and privacy information.
Further information about Shopify's processing of personal data is available in the Shopify Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/app-users
Shopify's privacy portal is available at:
https://privacy.shopify.com/
7. PAYMENT PROCESSING
Payments made through our online store are processed using Shopify and/or the payment provider selected during checkout.
The relevant payment provider receives the information necessary to process and authenticate the payment.
Depending on the payment method, this may include your name, billing information, transaction amount, payment details and technical information.
The legal basis for payment processing is Article 6(1)(b) GDPR.
Additional processing for fraud prevention or regulatory compliance may be based on Article 6(1)(c) or Article 6(1)(f) GDPR.
The privacy policy of the respective payment provider may also apply.
8. SHIPPING AND DELIVERY
In order to deliver your order, we may disclose the personal data necessary for delivery to shipping, logistics and fulfilment providers.
This typically includes your name, delivery address, contact details, order or shipment information and, where necessary, your telephone number or email address for delivery notifications.
The legal basis is Article 6(1)(b) GDPR.
9. ONLINE WITHDRAWAL FUNCTION AND GOOGLE APPS SCRIPT
ESVlife provides an online function through which consumers can electronically exercise their right of withdrawal.
When you use this function, we process information including:
your name;
your email address;
your order number;
the email address used for the order, if provided;
whether you are withdrawing from the entire order or part of it;
the relevant products or part of the contract, where applicable;
additional information voluntarily provided by you;
the date and time of submission; and
technical identifiers required to prevent duplicate confirmations and misuse.
The withdrawal declaration itself is submitted to ESVlife through Shopify.
After Shopify confirms successful submission, certain information from your withdrawal declaration is transmitted to a Google Apps Script web application operated by ESVlife.
We use Google Apps Script and Google's MailApp service solely for the purpose of automatically sending the legally relevant confirmation of receipt to the email address provided by you.
The confirmation email contains the information necessary to document your withdrawal declaration, including its content and the date and time of receipt.
The legal basis for this processing is Article 6(1)(c) GDPR insofar as the processing is necessary to comply with statutory obligations relating to the electronic withdrawal function. Where applicable, Article 6(1)(b) GDPR also applies because the processing relates to your contract with us.
Google acts as a service provider involved in the technical transmission of the confirmation email.
Google Apps Script's MailApp service is used only to send the confirmation email and does not provide the script with access to the customer's email inbox.
10. RETURNS, WARRANTY AND CUSTOMER CLAIMS
If you request a return, make a warranty claim, report a damaged product or otherwise contact us regarding an existing purchase, we process the information necessary to assess and handle your request.
This may include your order information, contact details, correspondence, product information and photographs voluntarily supplied by you.
Depending on the request, processing is based on Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR.
11. CUSTOMER ACCOUNTS
Where customer accounts are available, we process account information in order to provide and administer your account, display relevant order information and provide account-related functionality.
The legal basis is Article 6(1)(b) GDPR.
You are responsible for keeping your account credentials confidential.
12. REVIEWS AND USER CONTENT
Where you submit a product review or other content, we process the information you provide for the purpose of receiving, administering and, where applicable, publishing the submission.
Depending on the circumstances, processing is based on your request, consent or our legitimate interest in operating a review and customer feedback system.
Please do not include unnecessary sensitive or confidential personal information in public reviews.
13. COOKIES AND SIMILAR TECHNOLOGIES
Our website uses cookies and similar technologies.
Some technologies are strictly necessary to provide functions such as shopping cart operation, checkout, security, account functionality and the storage of privacy preferences.
Other technologies may be used for analytics, personalisation, marketing or advertising where enabled.
Where legally required, non-essential technologies are activated only after consent has been obtained.
You can manage your choices using the cookie or privacy controls available on our website.
You may also control cookies through your browser settings, although blocking necessary cookies may affect the functionality of the online store.
Shopify and other service providers may set or access cookies in connection with the services they provide to us.
14. MARKETING AND ADVERTISING PARTNERS
Where we use third-party marketing, advertising or analytics services, personal data may be disclosed to or collected by the relevant provider.
Such processing only takes place in accordance with the applicable legal requirements.
Where consent is required, the relevant processing takes place only after consent has been provided.
You may withdraw your consent or adjust your privacy choices using the tools provided on our website.
15. RECIPIENTS OF PERSONAL DATA
We may disclose personal data to service providers and recipients where this is necessary for the purposes described in this Privacy Policy.
These recipients may include Shopify, payment providers, banks, shipping and logistics providers, IT and hosting providers, Google in connection with our withdrawal confirmation function, communication and email service providers, accounting and tax advisers, professional advisers and public authorities where disclosure is required by law.
We disclose only the information reasonably necessary for the respective purpose.
Service providers processing personal data on our behalf are required to process the data in accordance with applicable data protection requirements and relevant contractual obligations.
16. INTERNATIONAL DATA TRANSFERS
Some of our service providers, including Shopify and Google, operate internationally.
As a result, personal data may in certain circumstances be processed outside Austria or outside the European Economic Area (“EEA”).
Where personal data is transferred to a country outside the EEA that is not covered by an adequacy decision of the European Commission, we rely on an appropriate lawful transfer mechanism where required.
This may include the European Commission's Standard Contractual Clauses or another legally recognised safeguard.
Additional technical or contractual safeguards may be used where appropriate.
17. DATA RETENTION
We retain personal data only for as long as necessary for the purposes for which it was collected and as required by applicable law.
Order, invoice and accounting records that are subject to Austrian statutory record-keeping requirements are generally retained for seven years. Records may need to be retained for longer where they are relevant to ongoing tax, administrative or legal proceedings.
Customer account information is generally retained for as long as the account exists and thereafter only to the extent required for contractual, statutory or legal purposes.
Customer service communications, warranty matters, return records and withdrawal declarations are retained for as long as necessary to process the matter and subsequently for the period required to demonstrate compliance with legal obligations or establish, exercise or defend legal claims.
Marketing information is generally retained until consent is withdrawn, you unsubscribe or the relevant marketing purpose no longer applies. We may retain limited suppression information to ensure that an opt-out continues to be respected.
Technical security, fraud-prevention and duplicate-prevention information is retained only for as long as reasonably necessary for the relevant security purpose.
Cookie and similar technology retention periods depend on the specific technology used and can be affected by your consent and browser settings.
When personal data is no longer required, it is deleted, anonymised or otherwise handled in accordance with applicable law.
18. WHETHER YOU MUST PROVIDE PERSONAL DATA
Certain personal data is necessary to conclude or perform a contract with us.
For example, we generally require your contact, delivery and payment information in order to process and deliver an order.
If you do not provide information that is necessary for contractual performance, we may be unable to accept, process or fulfil your order.
Information requested solely for marketing or optional website features is generally voluntary unless otherwise stated.
19. SECURITY
We take appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
However, no internet transmission or storage system can be guaranteed to be completely secure.
You should therefore avoid sending unnecessary confidential or sensitive information through unsecured communication channels.
20. AUTOMATED DECISION-MAKING AND PROFILING
ESVlife does not currently make decisions that produce legal effects or similarly significant effects for you solely on the basis of automated processing within the meaning of Article 22 GDPR.
Certain website, Shopify, analytics or advertising functionality may involve automated analysis or profiling, for example for product recommendations, fraud prevention or personalised advertising.
Where consent is legally required for such processing, it is used only after the relevant consent has been obtained.
21. YOUR RIGHTS UNDER THE GDPR
Subject to the requirements and limitations of applicable law, you may have the right to:
request access to your personal data;
request correction of inaccurate or incomplete personal data;
request deletion of your personal data;
request restriction of processing;
receive certain personal data in a structured, commonly used and machine-readable format;
request transmission of eligible data to another controller;
object to processing based on legitimate interests;
object at any time to processing for direct marketing purposes; and
withdraw consent at any time where processing is based on consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Where processing is based on legitimate interests, you may object to the processing on grounds relating to your particular situation.
Where personal data is processed for direct marketing purposes, you may object at any time without providing reasons.
To exercise your rights, please contact:
office@esvlife.at
We may request information necessary to verify your identity before responding to a request.
We will respond within the periods required by applicable law.
22. RIGHT TO LODGE A COMPLAINT
If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a supervisory authority.
The competent Austrian supervisory authority is:
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
Phone: +43 1 52 152-0
You may also have the right to contact another competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.
23. CHILDREN
Our online store is not specifically directed at children.
We do not knowingly request personal data from children for the purpose of entering into contracts where they are not legally able to do so independently.
If you believe that a child has provided personal data to us unlawfully, please contact us so that we can assess the situation and take appropriate action.
24. THIRD-PARTY WEBSITES
Our website may contain links to third-party websites, social networks or other external services.
When you leave our website, the privacy practices of the relevant third party apply.
We are not responsible for independent third-party websites or their privacy practices.
25. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy where necessary, including to reflect changes in our services, technical systems, service providers or applicable law.
The current version will be published on our website and the “Last updated” date will be amended accordingly.
Where required by law, we will provide additional notice of material changes.
26. CONTACT
For questions concerning this Privacy Policy, the processing of your personal data or the exercise of your data protection rights, please contact:
ESVlife e.U.
Gerichtsbergstraße 20
4840 Vöcklabruck
Austria
Email: office@esvlife.at
Phone: +43 660 115 47 21
Company Register Number: FN 666825a
Company Register Court: Landesgericht Wels