Privacy notice

1. Controller

Pia Marie Wieltsch, Collectamie, Stefan-Moser-Straße 6, Door 9, 9500 Villach, Austria, email: pia.wieltsch@collectamie.com, telephone: +43 650 450 6069.

2. Processing and legal bases

• Shop operation and IT security: connection, device, security and error data for secure delivery of the service, based on legitimate interests under Article 6(1)(f) GDPR.
• Account, basket and order: identity, contact, address, order, delivery and payment-status data for steps before and performance of a contract under Article 6(1)(b) GDPR.
• Statutory records: invoice, business, consent and policy-version data to comply with legal duties under Article 6(1)(c) GDPR and for legal claims under point (f).
• Online withdrawal: name, contract reference, acknowledgement address, scope and content of the declaration and received time to comply with legal duties under Article 6(1)(c) GDPR and as evidence for legal claims under point (f).
• Optional browser features: consent-dependent storage such as Recently viewed under Article 6(1)(a) GDPR; consent may be withdrawn at any time.

3. Recipients and service providers

Providers receive only data required for their task and are engaged under processor agreements where required. SendGrid and advertising platforms are not used. Google Analytics may be used for optional audience and shop measurement after separate consent; section 8 explains this processing.

• Railway for application hosting and PostgreSQL and Redis in EU West (Amsterdam).
• Medusa as the shop, product, customer, basket and order platform.
• Stripe for payment processing and fraud prevention.
• Resend for transactional account, order and withdrawal messages.
• Cloudflare R2 for product and media files.
• Sentry for error, performance and OpenTelemetry monitoring where enabled.
• GLS, DHL, Austrian Post, or another carrier identified at checkout for delivery.
• OVHcloud for messages sent to the published contact address.

4. Transfers outside the EEA

Although hosting is in the EU, providers or subprocessors may be established outside the EEA or access data from there. Necessary transfers rely on an adequacy decision, including the EU-US Data Privacy Framework where applicable, or EU Standard Contractual Clauses with supplementary measures.

5. Retention

Data is retained only while required for its purpose, statutory record-keeping, or establishing and defending claims. Order, invoice and business records are generally retained for statutory periods, typically seven years. Withdrawal and policy-acceptance evidence is kept at least until relevant limitation and evidence periods expire. Account and technical data that is no longer required is deleted or anonymised.

6. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction, portability and objection. Consent may be withdrawn at any time for the future. Contact security@collectamie.com to exercise a right.

You may complain to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb.gv.at, or another competent supervisory authority.

7. Required information and automated decisions

Information marked as required for an account, order, payment or delivery is needed to take pre-contract steps or perform the contract. Without it, the requested account, order, payment or delivery cannot be processed.

Collectamie does not make decisions based solely on automated processing that have legal or similarly significant effects. Stripe may assess payments and fraud risk automatically under its own privacy notice.

8. Optional shop measurement with Google Analytics

We also measure result-count buckets, recognized search types, filter types, category selections, displayed product lists and product clicks. Events use controlled labels and opaque catalog identifiers, never typed search text, item numbers, filter values or form entries. Individual keystrokes are not recorded. Reports represent consenting, measurable visitors only.

When measurement is enabled in the shop and you separately opt in through Storage choices, we use Google Analytics 4 from Google Ireland Limited, Ireland, to understand visits and purchasing journeys. The basis is your voluntary consent under Article 6(1)(a) GDPR. Without that consent, the Google measurement script is not loaded and no analytics requests are sent to Google. Consent is not required to shop, use an account or pay, and is separate from Recently viewed.

Measurement covers page and product views, successful basket additions, checkout visits and orders placed, together with product or variant identifiers, quantities, prices, currency and an opaque order identifier to avoid counting a purchase twice. It also involves pseudonymous browser/session identifiers, timestamps, and technical browser, device and connection data. Google receives the IP address for transmission and location derivation; Google states that it discards IP addresses of EU, Swiss and UK users before storage. This measurement should therefore not be understood as completely anonymous.

Our analytics events exclude names, email addresses, delivery addresses, customer account identifiers, payment details and form entries. We send sanitized shop page addresses without query strings or fragments; account and order paths are generalized. For an external referring website we retain only its origin, without its path or query. Instagram attribution uses a fixed set of campaign labels. Google Signals, advertising personalization, user-provided data and automatic enhanced measurement are disabled for this measurement.

Google processes analytics data for us under its data-processing terms. Google LLC and other subprocessors may process data outside the EEA, including the United States. Google describes reliance on the EU-US Data Privacy Framework for certified recipients and, where required, EU Standard Contractual Clauses. The linked information explains these transfers and safeguards.

The Google Analytics cookies _ga and _ga_<identifier> are configured for 30 days without renewal on activity. When measurement is enabled, we configure user-level and event-level retention for two months without resetting on new activity; Google removes expired data in its monthly deletion cycle. This period does not apply to aggregated standard reports. In your browser, collectamie:analytics-purchases holds at most 50 opaque order identifiers until analytics is withdrawn or browser data is cleared, to prevent duplicate purchase counts.

You may withdraw consent for the future at any time through Storage choices in the footer. Future collection is then disabled, and analytics cookies and the local list of measured purchases are removed. Withdrawal does not automatically delete data already lawfully processed; contact us as explained in section 6 for access or deletion requests.