Privacy policy

We take the protection of your data seriously. This policy tells you in plain language which data we collect, what we need it for, and what rights you have.

In short

This shop uses no analytics services, no advertising networks and no external web fonts. There is no Google Analytics, no Meta pixel, no tracker. Your data is not evaluated for advertising and not sold to anyone. We process what your order requires — nothing more.

Controller

Christian Krammer
Modelltoys-Austria
Wiener Straße 36
2433 Margarethen am Moos
Austria

E-mail: shop@modelltoys-austria.at
VAT ID: ATU 62133033

We are not required to appoint a data protection officer; our processing does not reach the relevant thresholds.

Hosting and technical support

The website and our e-mail mailboxes are hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany. The server logs described in the next section are also created there. Mittwald processes the data on our instructions under a data processing agreement pursuant to Art. 28 GDPR. The servers are located in Germany.

Technical maintenance of the shop is carried out by Agentur Life Design, Marcel Hintersteiner, likewise under a data processing agreement.

When you just browse the site

Every time you open a page, your browser transmits technical data that our server logs: IP address, date and time, the address requested, browser type and operating system, and the page you came from.

We need these logs to operate the shop and keep it secure — to detect attacks and find faults. Legal basis is our legitimate interest in a working, secure shop (Art. 6(1)(f) GDPR). Logs are deleted after 14 days at the latest and are not combined with other data.

Cookies and browser storage

We only set cookies that make the shop work. On your first visit a notice shows you which ones these are. It comes from the program Borlabs Cookie (Borlabs GmbH, Hamburg), which runs on our own server and sends no data to third parties.

You can change or withdraw your choice at any time:

Purpose	What it contains	How long
Cart and session (WooCommerce)	a random identifier so your cart is kept	up to 2 days
Sign-in	for signed-in customers only: your identifier	until you sign out, at most 14 days
Language (WPML)	whether you see the German or the English version	1 day
Your cookie choice (Borlabs Cookie)	a random identifier and your choice	6 months
Wish list	only the numbers of the models you marked, no personal data	30 days

So that we can prove what you chose, we also store your choice together with this random identifier and the time on our server (Art. 7(1) GDPR). It contains no name, e-mail address or IP address.

In addition, your browser remembers in its local storage how you prefer to view the catalogue (grid or list, number of columns). That stays on your device and never reaches us.

Legal basis: section 165(3) of the Austrian Telecommunications Act 2021 in conjunction with Art. 6(1)(f) GDPR — strictly necessary storage. You may delete or block cookies in your browser; the cart and sign-in will then no longer work.

Search

The search runs entirely on our own server. Your search terms are not sent to any third-party service.

When you place an order

To process an order we need your name, the delivery and billing address, your e-mail address and the details of the order itself. A telephone number is optional; it helps the carrier with delivery queries.

Legal basis is performance of the contract (Art. 6(1)(b) GDPR), and for invoices additionally our legal obligation (Art. 6(1)(c) GDPR).

Retention: Austrian tax law (section 132 BAO) requires us to keep invoices and records for seven years, counted from the end of the calendar year of the order. Only after that are the data deleted.

Who receives data

Österreichische Post AG or Hermes — whichever carries your parcel: name and delivery address so that the parcel arrives. For shipments abroad, additionally the details required for the customs declaration.
Our bank — as part of the payment. You transfer the money yourself; we never see card details, because we do not accept cards.
PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg — only if you pay by PayPal: name, e-mail address and invoice amount, so that we can send you the payment request. You make the payment itself with PayPal; PayPal’s privacy policy applies to it. Legal basis: performance of the contract (Art. 6 (1)(b) GDPR).
Tax adviser and tax authorities — as far as required by law.

We pass on nothing beyond this. We do not ourselves transfer any data to countries outside the EU — except what your order necessarily requires: if we deliver to a country outside the EU, the carriers and customs authorities there receive the name, address and contents of the parcel (Art. 49 (1)(b) GDPR).

Customer account

You can order without creating an account. If you do create one, we store your address and your order history so that you do not have to type everything again. Your password is stored encrypted only; we cannot read it.

Legal basis: contract and pre-contractual measures (Art. 6(1)(b) GDPR). You may have your account deleted at any time — just write to us. Invoice data remain until the retention period has expired.

Accounts carried over from our previous shop

Modelltoys-Austria has run an online shop for more than twenty years. When moving to the new shop software we carried over the existing customer accounts — address, e-mail address and the encrypted password. Your credentials therefore continue to work unchanged; when you first sign in, the encryption is quietly upgraded to a current method. Legal basis is the continuation of the existing contractual relationship (Art. 6(1)(b) GDPR). If you would rather not have this, we will delete your account on request.

Some accounts carry a note that you consented to a newsletter. We do not currently send one. Should we start, you will only receive it after express consent (Art. 6(1)(a) GDPR), and every message will contain an unsubscribe link.

Reviews

If you review a model, we publish your name and your text with that model. You can delete your own review at any time. Legal basis: your consent (Art. 6(1)(a) GDPR).

When you write to us

There is no contact form — you write to us directly at shop@modelltoys-austria.at. We keep your message for as long as it is needed to deal with the matter and any follow-up. Legal basis: Art. 6(1)(b) GDPR for questions about an order, otherwise our legitimate interest in answering (Art. 6(1)(f) GDPR).

“Withdraw from contract” form

You can also use the form on the page “Withdraw from contract” to withdraw from a contract. We process your name, e-mail address, order number and the details you enter in order to handle the withdrawal and confirm receipt. Legal basis: Art. 6 (1)(c) GDPR in conjunction with the Austrian Distance and Off-Premises Contracts Act (FAGG).

Your rights

You have the right at any time to

access the data we hold about you (Art. 15 GDPR),
rectification of incorrect data (Art. 16 GDPR),
erasure, unless a retention obligation stands in the way (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR),
object to processing based on our legitimate interest (Art. 21 GDPR),
withdraw consent with effect for the future (Art. 7(3) GDPR).

A short e-mail to shop@modelltoys-austria.at is enough. We reply within one month.

If you believe we are not handling your data properly, you may complain to the supervisory authority:
Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at

No automated decisions

We take no decisions based solely on automated processing and carry out no profiling.

Changes

When the shop changes, this policy changes with it. The version published here is the one that applies.

This is a translation for your convenience. In case of doubt, the German version of this text is the legally binding one — see the German version.