Privacy policy

1. Controller and contact

The controller responsible for processing your personal data on tukluk.eu and in connection with our online shop is:

Tukluk GmbH
Managing Director: Benedikt Kirsch
Bendlgasse 2/15, 1120 Vienna, Austria
Phone: +43 699 194 788 22
Email: info@tukluk.eu

For any questions about data protection and to exercise your rights, you can reach us at info@tukluk.eu. We are not legally required to appoint a data protection officer and have not appointed one.

2. Overview

In accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR), this privacy policy explains which personal data we process, for which purposes, on which legal basis, with whom we share it and how long we store it. It applies to our website tukluk.eu (all language versions), the online shop including checkout, and our social media profiles.

Personal data is any information relating to an identified or identifiable natural person, such as name, address, email address, IP address or order data.

We process the following categories of data in particular:

  • Master and contact data (e.g. name, delivery and billing address, email address, phone number)
  • Contract and order data (e.g. products ordered, prices, time of order, delivery status)
  • Payment data (e.g. chosen payment method, payment status; we do not receive card details)
  • Usage and metadata (e.g. IP address, browser, device, pages visited, timestamps, consent status)
  • Communication content (e.g. the content of your emails to us)

The people concerned are visitors to the website, customers (private individuals as well as contact persons at institutions such as kindergartens, schools or therapy practices), newsletter subscribers and people who contact us.

3. Legal bases

We only process personal data on one of the following legal bases. For each processing activity below, we state which one applies.

  • Consent (Art. 6(1)(a) GDPR), e.g. for the newsletter and for marketing cookies. Storing and reading information on your device that is not strictly necessary only takes place with your consent pursuant to Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).
  • Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR), e.g. to process your order.
  • Legal obligation (Art. 6(1)(c) GDPR), e.g. retention obligations under tax and company law.
  • Legitimate interests (Art. 6(1)(f) GDPR), e.g. in operating our online shop securely and economically and in answering enquiries.

In addition to the GDPR, the Austrian Data Protection Act (DSG) applies.

4. Recipients and transfers to third countries

We only share your data if this is necessary for the purposes stated, if you have consented or if we are legally obliged to do so. Recipients are, in particular, our shop platform, payment service providers, shipping service providers, our tax adviser and the service providers named in this policy. We have concluded data processing agreements pursuant to Art. 28 GDPR with service providers that process data on our behalf.

Some service providers are based, or have their parent company, in the USA or other countries outside the European Economic Area ("third countries"). We only transfer data there if an adequate level of data protection is ensured:

  • on the basis of an adequacy decision of the European Commission (Art. 45 GDPR), for the USA in particular the EU-US Data Privacy Framework (DPF), provided the recipient is certified, or
  • on the basis of EU standard contractual clauses (Art. 46(2)(c) GDPR).

For each service, we state which of these applies. Information on the DPF is available at dataprivacyframework.gov, and on standard contractual clauses from the European Commission.

On request, we will provide you with a copy of the relevant safeguards.

5. Provision of the website, hosting and server log files

Shopify. Our online shop runs on the e-commerce platform Shopify. The provider for customers in Europe is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify hosts the website, provides the shop system, cart and checkout, and processes your data on our behalf for this purpose: usage and metadata when you visit the site and, when you place an order, your order, contact and address data. Content such as images, videos and scripts is delivered via Shopify's content delivery network (including cdn.shopify.com).

Shopify may transfer data to Shopify Inc. (Canada) and to sub-processors in other countries, such as the USA. An adequacy decision of the European Commission exists for Canada; otherwise Shopify relies on EU standard contractual clauses. We have concluded a data processing agreement with Shopify.

  • Legal basis: legitimate interest in providing our online shop securely, reliably and efficiently (Art. 6(1)(f) GDPR); for orders, performance of a contract (Art. 6(1)(b) GDPR)
  • Privacy policy: shopify.com/legal/privacy

Server log files. Each time the website is accessed, technical data transmitted by your browser is processed automatically: IP address, date and time, page accessed, referrer URL, browser type and version, operating system and volume of data transferred. This data is needed to deliver the website, keep it stable and defend it against attacks. The legal basis is Art. 6(1)(f) GDPR. Shopify deletes or anonymises the log files after a short period, unless they are needed to investigate a security incident.

Security checks on forms. To protect against spam and misuse, automatic bot checks provided by Shopify, such as Google reCAPTCHA or hCaptcha, may be used on forms (e.g. customer account or newsletter). This involves transmitting technical data such as IP address and browser information to the respective provider. The legal basis is our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR).

SSL/TLS encryption. The website uses SSL/TLS encryption. You can recognise this by "https://" in the address bar.

6. Cookies and consent management

We use cookies and similar technologies (e.g. local storage, pixels). These are small pieces of data that are stored on or read from your device.

We use strictly necessary cookies without consent, because the shop would not work otherwise. They store, for example, your cart, language and currency, login status, the checkout process and your cookie choices (Shopify cookies such as cart, localization, cart_currency, _shopify_essential). The legal basis is Section 165(3) TKG 2021 in conjunction with Art. 6(1)(b) and (f) GDPR.

We only use statistics and marketing cookies if you have consented in our cookie banner (Section 165(3) TKG 2021, Art. 6(1)(a) GDPR). Section 12 explains which services these are.

Consent management. To obtain, store and manage your consent, we use Shopify's consent management (cookie banner) (Shopify International Limited, details in section 5). This processes your consent decision, date and time, a pseudonymous identifier and technical data (IP address, browser, device) and stores them in a cookie on your device (_tracking_consent) and with Shopify. This allows us to respect your choice on your next visit and to meet our obligation to demonstrate consent (Art. 7(1) GDPR). The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and our legitimate interest (Art. 6(1)(f) GDPR). Your consent is stored for a maximum of 12 months. Privacy policy: shopify.com/legal/privacy

Withdrawal and settings. You can withdraw or change your consent at any time with effect for the future by opening the cookie settings again via the "Cookie settings" link in the footer. You can also delete or block cookies in your browser; the shop may then only work to a limited extent.

7. Orders, customer account and shipping

Order processing. When you order from us, we process the data required for the contract: name, delivery and billing address, email address, phone number and company or institution name where applicable, products ordered, prices, payment method and payment status. Mandatory fields are marked in the checkout; without this information we cannot fulfil the order. You receive the order confirmation, invoice and shipping information by email. The legal basis is Art. 6(1)(b) GDPR; for accounting and retention, Art. 6(1)(c) GDPR.

Customer account and Shop Pay. You can order without a customer account. If you create a customer account or sign in via "Shop" or Shop Pay, we store your contact details and your order history so that you can view your orders and order more quickly in future. Shop Pay and the Shop app are Shopify services for which Shopify acts in part as an independent controller; Shopify's privacy policy applies in that respect. The legal basis is Art. 6(1)(b) GDPR. You can have your customer account deleted at any time by writing to us at info@tukluk.eu; data that must be retained by law remains stored with restricted access until the retention periods expire.

Warehouse and shipping. Storage, picking and shipping of our products are handled by BTG Spedition und Logistik GmbH, IZ NÖ-Süd, Straße 14, Objekt 32, 2355 Wiener Neudorf, Austria. For this purpose we transmit name, delivery address, products ordered and, where necessary for delivery, phone number and email address. BTG processes this data on our behalf as a processor (Art. 28 GDPR). For delivery, BTG passes the delivery data on to the transport or parcel company commissioned in each case. The legal basis is Art. 6(1)(b) GDPR.

8. Inventory management, accounting and tax advice

To handle orders, invoices and accounting, we use the following service providers as processors. This involves processing order, contact, address and payment data. The legal basis is Art. 6(1)(b) and (c) GDPR and our legitimate interest in efficient organisation (Art. 6(1)(f) GDPR).

  • Billbee (Billbee GmbH, Arolser Straße 10, 34477 Twistetal, Germany): Order processing, invoices, inventory management
  • AccountOne – Ecommerce2Datev (AccountOne GmbH, Fördepromenade 4d, 24944 Flensburg, Germany): Transfer of order and payment data to accounting
  • DATEV (DATEV eG, Paumgartnerstraße 6–14, 90429 Nuremberg, Germany): Accounting and document filing

We have concluded data processing agreements with these providers; the data is processed in the EU.

To meet our tax obligations, we transmit the necessary data to our tax adviser and to authorities (Art. 6(1)(c) GDPR).

9. Payment processing

We offer the following payment methods: credit and debit cards (Visa, Mastercard, American Express, Maestro, UnionPay), Apple Pay, Google Pay, Shop Pay, Klarna, EPS, Bancontact, BLIK, iDEAL | Wero, MobilePay, PayPal, as well as prepayment by bank transfer and purchase on invoice. The payment methods shown to you depend on your country, your device and the order value. Depending on the payment method chosen, we pass the data required for payment (name, address, email address, invoice amount, order number and, where applicable, IP address and device data for fraud prevention) on to the respective payment service provider. You enter your card or account details directly with the payment service provider; we do not receive them, only the confirmation or rejection of the payment.

The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR). Where payment service providers act as independent controllers, they also process your data in accordance with their own privacy policies, for example to comply with anti-money-laundering obligations.

  • Cards, Apple Pay, Google Pay, Klarna, EPS, Bancontact, BLIK, iDEAL | Wero, MobilePay (via Shopify Payments): Shopify International Limited, Dublin, Ireland; payment processing by Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. Privacy information: shopify.com/legal/privacy, stripe.com/privacy
  • Shop Pay: Shopify International Limited, Dublin, Ireland. Privacy information: shopify.com/legal/privacy
  • Klarna (additionally as an independent controller for purchase on invoice and instalment purchases): Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Privacy information: klarna.com/at/datenschutz
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Privacy information: paypal.com/de/legalhub/privacy-full
  • Prepayment and purchase on invoice (bank transfer): Erste Bank der oesterreichischen Sparkassen AG, Am Belvedere 1, 1100 Vienna

Apple Pay and Google Pay. If you use Apple Pay or Google Pay, Apple Distribution International Ltd. (Cork, Ireland) or Google Ireland Limited (Dublin, Ireland) respectively also process your data in accordance with their own privacy policies.

Credit checks by Klarna and PayPal. For purchase on invoice or payment by instalments, Klarna or PayPal carry out an identity and credit check as independent controllers and may transmit data to credit reference agencies for this purpose. Based on this check, a payment method may be offered or refused. Further information, including on your right to express your point of view and to contest an automated decision (Art. 22 GDPR), can be found in the privacy information of the respective provider.

Klarna and PayPal belong to groups that are based, or use service providers, outside the EEA; according to the providers, transfers are based on adequacy decisions (in particular the EU-US Data Privacy Framework) or EU standard contractual clauses.

10. Contacting us

If you contact us by email, phone or via social networks, we process your details (e.g. name, email address, phone number, content of the enquiry) in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or an order, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete the data once the enquiry has been dealt with and no retention obligation applies; we keep business correspondence for up to seven years (Section 212 of the Austrian Commercial Code (UGB), Section 132 of the Austrian Federal Fiscal Code (BAO)).

11. Newsletter

Content and sign-up. With our newsletter we inform you about new products, promotions and news from Tukluk. To sign up we only need your email address. We send the newsletter exclusively with your consent (Art. 6(1)(a) GDPR, Section 174 TKG 2021).

Double opt-in. After signing up, you receive an email in which you confirm your subscription. This ensures that nobody can sign up someone else's address. We log the time of sign-up and confirmation as well as your IP address in order to be able to demonstrate your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

Email service provider Mailchimp. To send and evaluate the newsletter we use Mailchimp, a service of The Rocket Science Group LLC d/b/a Mailchimp, 405 N Angier Ave. NE, Atlanta, GA 30308, USA (an Intuit Inc. company). Mailchimp stores your email address, your name where provided, sign-up and confirmation data and data on your use of the newsletter on servers in the USA and processes it on our behalf. We have concluded a data processing agreement with Mailchimp. Mailchimp is certified under the EU-US Data Privacy Framework; EU standard contractual clauses apply in addition. Privacy policy: mailchimp.com/legal/privacy, data processing: mailchimp.com/legal/data-processing-addendum

Performance measurement. Our newsletters contain a tracking pixel and trackable links. This allows us to record whether and when a newsletter was opened and which links were clicked, and to associate this with your email address. We use this information to improve our content. It is covered by your consent to the newsletter (Art. 6(1)(a) GDPR); if you do not want this, you can unsubscribe.

Unsubscribing. You can unsubscribe from the newsletter at any time via the link at the end of each email or by sending a message to info@tukluk.eu. After you unsubscribe, we delete your email address from the mailing list. We keep the record of your earlier consent for up to three years in order to be able to defend ourselves against any claims (Art. 6(1)(f) GDPR).

Advertising to customers. If you have ordered from us, we may occasionally send you information about our own similar products to the email address provided with your order, even without a newsletter subscription (Section 174(4) TKG 2021, Art. 6(1)(f) GDPR). You can object to this at any time free of charge, via the unsubscribe link in each email or by sending a message to info@tukluk.eu.

12. Analytics and online marketing

We only use the following services if you have consented to the respective category in the cookie banner (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). You can withdraw your consent at any time with effect for the future (see section 6).

Shopify analytics. With your consent to statistics cookies, Shopify records for us how visitors use the shop: pages accessed, products viewed, cart and checkout events, source of the visit (e.g. search engine, campaign link), device, browser and approximate location based on the IP address. For this purpose Shopify sets cookies such as _shopify_y and _shopify_s or _shopify_analytics. We receive aggregated reports in order to improve our offering. The provider is Shopify International Limited (details in section 5). Cookie storage period: up to 1 year.

Meta Pixel and Conversions API (Facebook and Instagram). With your consent to marketing cookies, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It is integrated via the Shopify app "Facebook & Instagram"; events may be transmitted to Meta both via your browser and server-side by Shopify (Conversions API).

  • Purpose: measuring which adverts on Facebook and Instagram lead to visits and purchases; creating audiences for advertising (custom audiences, lookalike audiences, remarketing) and optimising adverts.
  • Data: events such as page view, product view, add to cart, start of checkout and purchase including product, value and currency; IP address, browser and device information, cookie identifiers (e.g. _fbp, _fbc).
  • Advanced matching: when you place an order or enter data in the checkout, we transmit email address, phone number, name and address to Meta in encrypted (hashed) form so that Meta can match the events to a Facebook or Instagram account.
  • Joint controllership: we are jointly responsible with Meta for collecting the data and transmitting it to Meta (Art. 26 GDPR). The corresponding agreement is available at facebook.com/legal/controller_addendum. Meta is solely responsible for further processing. You can also assert your data subject rights directly against Meta.
  • Third country: Meta may transfer data to Meta Platforms, Inc. in the USA. Meta is certified under the EU-US Data Privacy Framework; EU standard contractual clauses apply in addition.
  • Storage period: cookies up to 90 days (_fbp); Meta states that it stores event data for up to two years.
  • Further information and ad settings: facebook.com/privacy/policy, facebook.com/adpreferences

Campaign links (UTM parameters). Links in newsletters or adverts may contain parameters that show which campaign brought you to us. This information is evaluated statistically without reference to individuals (Art. 6(1)(f) GDPR).

13. Social media profiles

We maintain profiles on social networks in order to communicate with interested people and provide information about our products. Our website only contains simple links to these profiles, so visiting our site does not transfer any data to the networks. You only reach the provider's platform when you click a link.

When you visit our profiles, the operators process your data in accordance with their own terms, often also for advertising and market research and possibly in the USA. The legal basis for our processing is our legitimate interest in communicating with you and in presenting our company (Art. 6(1)(f) GDPR).

Instagram and Facebook. The operator is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We are jointly responsible with Meta for collecting data to produce page statistics ("Insights") (Art. 26 GDPR); Meta has assumed primary responsibility (Page Insights Controller Addendum). Requests concerning your rights are most effectively addressed directly to Meta. Privacy policy: privacycenter.instagram.com/policy, facebook.com/privacy/policy

14. Storage period

We only store personal data for as long as is necessary for the respective purpose or as long as statutory retention obligations apply. After that, we delete it or, while a retention period is still running, restrict access to it.

  • Invoices, accounting records, business correspondence: 7 years from the end of the calendar year (Section 132 BAO, Section 212 UGB); longer while tax or court proceedings are pending
  • Other order data: until the warranty and limitation periods expire, generally 3 years after delivery
  • Customer account: until the account is deleted
  • Enquiries unrelated to a contract: until dealt with, at most 12 months afterwards
  • Newsletter data: until you unsubscribe; record of consent for up to 3 years afterwards
  • Consent in the cookie banner: up to 12 months
  • Cookies from analytics and marketing services: see the details for the respective service

15. Your rights

You have the following rights under the GDPR. To exercise them, simply send a message to info@tukluk.eu.

  • Access to the data we hold about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR), unless a retention obligation prevents this
  • Restriction of processing (Art. 18 GDPR)
  • Data portability in a commonly used, machine-readable format (Art. 20 GDPR)
  • Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR); processing carried out up to that point remains lawful

Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to the processing of your data for direct marketing at any time without giving reasons.

Right to lodge a complaint. If you believe that the processing of your data infringes data protection law, you can lodge a complaint with a supervisory authority. In Austria this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, phone +43 1 52 152-0, email dsb@dsb.gv.at, dsb.gv.at. You can also contact the supervisory authority of your place of residence or work in another EU member state.

16. Obligation to provide data and automated decisions

You are not legally or contractually obliged to provide us with data. However, without the information marked as mandatory in the checkout, we cannot process an order. We do not make any decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR. For credit checks by payment service providers, see section 9.

17. Changes to this privacy policy

We update this privacy policy when our data processing or the legal situation changes. The version currently published on this page applies.

Last updated: 30 September 2026