GDPR Privacy Policy

GDPR Privacy Policy

Our Privacy Policy was last updated on September 21, 2026.

Pumpenkost GmbH operates this shop and this website, including all related information, content, functions, tools, products, and services, to offer you, the customer, a curated shopping experience (the “Services”). Pumpenkost GmbH uses Shopify to provide you with the Services. This Privacy Policy describes how we collect, use, and disclose your personal data when you visit, use, make a purchase or other transaction via the Services, or otherwise communicate with us. In the event of any conflict between our Terms of Use and this Privacy Policy, this Privacy Policy shall prevail with respect to the collection, processing, and disclosure of your personal data.

Please read this Privacy Policy carefully. By using and accessing the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your data as described herein.

Definitions

For the purposes of this Privacy Policy:

• “Account” means a unique account created for you to access our Service or parts thereof.

• “Company” (referred to as either “the Company”, “We”, “Us” or “Our”) refers to Pumpenkost GmbH

  For the purposes of the GDPR, the Company is the Controller.

• “Country” refers to Austria.

• “Cookies” are small files placed on your computer, mobile device, or any other device by a website, containing, among other things, details of your browsing history on that website.

• “Controller” means, for the purposes of the GDPR (General Data Protection Regulation), the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of personal data.

• “Device” means any device that can access the Service, such as a computer, a mobile phone, or a digital tablet.

• “Personal Data” is any information that relates to an identified or identifiable individual.

  For the purposes of the GDPR, personal data means any information relating to you, such as a name, an identification number, location data, an online identifier, or one or more factors specific to your physical, physiological, genetic, mental, economic, cultural, or social identity.

• “Service” refers to the Website.

• “Service Provider” means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service, or to assist the Company in analyzing how the Service is used.
  For the purposes of the GDPR, Service Providers are considered data processors.

• “Usage Data” refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (e.g., the duration of a page visit).

• “Website” refers to Pumpenkost GmbH, accessible at https://pumpenkost.myshopify.com

• “You” means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

  For the purposes of the GDPR (General Data Protection Regulation), you may be referred to as the data subject or as the user, as you are the individual using the Service.

Personal Data We Collect or Process

When we use the term “personal data,” we mean information that identifies you or can reasonably be linked to you or another person. Personal data does not include information that has been collected anonymously or anonymized so that it does not identify you or cannot reasonably be linked to you. Depending on how you interact with the Services, where you live, and to the extent permitted or required by law, we may collect or process the following categories of personal data, including inferences drawn from them:

• Contact details including your name, address, billing address, shipping address, phone number, and email address.

• Financial information including credit card, debit card, and bank account numbers, payment card information, bank account information, transaction details, payment method, payment confirmation, and other payment details.

• Account information including your username, password, security questions, preferences, and settings.

• Transaction information including the items you view, add to your cart, add to your wishlist, or purchase, return, exchange, or cancel, as well as your previous transactions.

• Device information including information about your device, browser, or network connection, your IP address, and other unique identifiers.

• Usage information including information about your interaction with the Services, including how and when you interact with or navigate within the Services.

Sources of Personal Data

We may collect personal data from the following sources:

• Directly from you, including when you create an account, visit or use the Services, communicate with us, or otherwise provide your personal data to us;
• Automatically via the Services, including from your device when you use our products or services or visit our websites, as well as through the use of cookies and similar technologies;
• From our Service Providers, including when we employ them to enable certain technologies, and when they collect or process your personal data on our behalf;
• From our partners or other third parties.

How We Use Your Personal Data

Depending on how you interact with us or which of the Services you use, we may use personal data for the following purposes:

• Providing, customizing, and improving the Services. We use your personal data for marketing and advertising purposes, such as sending marketing, advertising, and promotional communications via email, SMS, or post, and to show you online advertising for products or services on the Services or other websites, based, among other things, on items you have previously purchased or added to your cart, as well as other activities on the Services.

• Security and fraud prevention. We use your personal data to authenticate your account, provide a secure payment and shopping experience, detect, investigate, or take action against potentially fraudulent, illegal, unsafe, or malicious activities, protect public safety, and secure our Services. If you choose to use the Services and register an account, you are responsible for keeping your account details secure. We strongly recommend that you do not share your username, password, or other access credentials with third parties.

Communicating with you. We use your personal data to provide customer support, respond to you, provide effective services, and maintain our business relationship with you.

• Legal reasons. We use your personal data to comply with applicable law or to respond to valid legal proceedings, including requests from law enforcement or government authorities, to participate in or investigate civil discovery, potential or actual litigation, or other disputed legal proceedings, and to enforce or investigate potential violations of our terms or policies.

How We Disclose Personal Data

Under certain circumstances, we may disclose your personal data to third parties for legitimate purposes in accordance with this Privacy Policy. Such circumstances may include:

• With Shopify, providers, and other third parties that perform services on our behalf (e.g., IT administration, payment processing, data analysis, customer support, cloud storage, order fulfillment, and shipping).
• With business and marketing partners to provide marketing services and advertise to you. For example, we use Shopify to support personalized advertising with third-party services based on your online activity across various merchants and websites. Our business and marketing partners use your information in accordance with their own privacy policies. Depending on where you live, you may have the right to instruct us not to disclose information about you for the purpose of showing you targeted advertising and marketing based on your online activity across various merchants and websites.
• When you instruct us, request us, or otherwise consent to the disclosure of certain information to third parties, e.g., to deliver products to you or through your use of social media widgets or login integrations.
• With our affiliates or otherwise within our corporate group.
• In connection with a business transaction such as a merger or bankruptcy, to comply with applicable legal obligations (including responding to subpoenas, search warrants, and similar requests), to enforce applicable Terms of Use or policies, and to protect or defend the Services, our rights, and the rights of our users or others.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal data regarding your access to and use of the Services to provide and improve the Services for you.

We generally process your data when it is necessary to fulfill a contractual obligation (e.g., for processing payments for goods or services), or when we, our partner Shopify, or someone else we work with needs to use your personal data for a legitimate business interest (e.g., to provide you with a service). The laws in the European Economic Area (“EEA”) and the United Kingdom (“UK”) call these reasons “legitimate interests.” These “legitimate interests” include:

• Preventing risk and fraud
• Responding to queries or providing other forms of support
• Assisting merchants in finding and using apps via our App Store
• Providing and improving our products and services
• Providing reporting and analytics
• Testing features or additional services
• Assisting with marketing, advertising, or other communications

We only process personal data for these “legitimate interests” after considering the potential risks to your privacy and balancing them with certain measures—for example, by being transparent about our privacy practices, by giving you control over your personal data where appropriate, by limiting the information we keep, by limiting what we do with your information, by limiting to whom we disclose your information, by limiting how long we keep your information, or by using technical measures to protect your information. You may have the right to request that we stop or restrict the processing of personal data for certain purposes.

We may also process your personal data if you have provided your consent. Specifically, when we use your personal data to show customers personalized advertising, when we cannot rely on an alternative legal basis for processing, or when we are required by applicable law to obtain your consent. You have the right to withdraw your consent at any time by changing your settings at https://privacy.shopify.com/ or by contacting us.

Third-Party Websites and Links

The Services may contain links to websites or other online platforms operated by third parties. If you follow links to sites that are not affiliated with or controlled by us, you should review their privacy and security policies as well as other terms. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of the information found there. Information you provide on public or semi-public platforms, including information you share on third-party social media platforms, may also be visible to other users of the Services and/or users of those third-party platforms without restriction on their use by us or third parties. The inclusion of such links does not in itself imply endorsement of the content on such platforms or their owners or operators, except as stated on the Services.

Children's Data

The Services are not intended for use by children, and we do not knowingly collect personal data from children under the age of majority in your jurisdiction. If you are the parent or guardian of a child who has provided us with their personal data, you can contact us using the contact details provided below to request its deletion. As of the effective date of this Privacy Policy, we have no actual knowledge that we “share” or “sell” (as defined by applicable law) personal data of individuals under 16 years of age.

Security and Retention of Your Data

Please note that no security measure is perfect or impenetrable, and we cannot guarantee “perfect security.” Furthermore, information you send to us may not be secure during transmission. We recommend not using insecure channels to share sensitive or confidential information with us.

How long we keep your personal data depends on various factors, such as whether we need the information to maintain your account, provide you with services, comply with legal obligations, resolve disputes, or enforce other applicable contracts and policies.

Your Rights Under the GDPR

The Company is committed to respecting the confidentiality of your personal data and ensuring that you can exercise your rights.

In accordance with this Privacy Policy and by law, if you are located within the EU, you have the right to:

• Request access to your personal data. The right to access, update, or delete the information we have about you. Whenever possible, you can view, update, or request the deletion of your personal data directly in your account settings. If you are unable to do so, please contact us so that we can assist you. This also allows you to receive a copy of the personal data we hold about you.

• Request correction of the personal data that we hold about you. You have the right to have incomplete or inaccurate information that we hold about you corrected.

• Manage your requests. You have the right to request that we show you all your requests.

• Object to the processing of your personal data. This right exists if we rely on a legitimate interest as the legal basis for processing and there is something about your particular situation that makes you want to object to this processing. You also have the right to object if we process your personal data for direct marketing purposes.
• Request the deletion of your personal data. You have the right to request that we delete or remove personal data where there is no good reason for us to continue to process it.

Request the transfer of your personal data. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw your consent. You have the right to withdraw your consent to the use of your personal data. If you withdraw your consent, we may not be able to provide you with access to certain specific functionalities of the Service.

You can exercise any of these rights where indicated on the Services, or by contacting us using the contact details provided below. To learn more about how Shopify uses your personal data and your rights, including rights related to data processed by Shopify, please visit https://privacy.shopify.com/en.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before we are able to process your requests, as permitted or required by applicable law. In accordance with applicable law, you may designate an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require proof that you have authorized them to act on your behalf, and we may need to verify your identity directly with us. We will respond to your request in a timely manner as required under applicable law.

Complaints

If you have complaints about how we process your personal data, please contact us using the contact details provided below. Depending on where you live, you may have the right to appeal our decision by contacting us using the contact details provided below, or lodge your complaint with your local data protection authority.

International Transfers

Please note that we may transfer, store and process your personal data outside of the country you live in.

If we transfer your personal data out of the European Economic Area or the United Kingdom, we will rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, as relevant, unless the data transfer is to a country that is determined to provide an adequate level of protection.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this website, update the “Last updated” date and take any other steps required by applicable law.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of your rights, please call us or email us at verwaltung@pumpenkost.com