Privacy Policy

1. Data Controller

MITRAM GmbH (operates ELEO Jewels)
Seitenstettengasse 5/37, 1010 Vienna, Austria
E-Mail: office@eleojewels.com
WhatsApp: +43 670 657 61 05

2. What Data We Collect

When visiting our website and using our services, the following personal data may be processed:

• Contact data: name, postal address, billing and shipping address, phone number, email address
• Order and payment data: ordered products, transaction details, payment method and confirmation (processed by Shopify Payments or the chosen payment provider)
• Account and usage data: username, interaction with the website, pages visited, time spent (via Shopify Analytics and cookies)
• Device information: IP address, browser and device type, network connection, unique identifiers
• Communication data: content you share with us in enquiries, e.g. by email or WhatsApp
• B2B registration data: company name, VAT ID, address, contact person

3. Source of the Data

• Directly from you — e.g. when placing an order, creating an account or contacting us.
• Automatically when using the website — via cookies and similar technologies.
• From our service providers — e.g. payment and shipping providers as part of order fulfilment.

4. Purpose of Processing

• Processing and fulfilment of orders, payments, shipping and returns (Art. 6(1)(b) GDPR)
• Responding to enquiries and customer support (Art. 6(1)(b) GDPR)
• Fulfilment of legal obligations, in particular tax retention requirements (Art. 6(1)(c) GDPR)
• Fraud prevention and ensuring the security of our services (Art. 6(1)(f) GDPR)
• Improving our offering and legitimate interests, e.g. assortment analysis (Art. 6(1)(f) GDPR)
• Marketing and advertising, including personalised advertising via social media platforms, only with explicit consent or as legally permitted (Art. 6(1)(a) or (f) GDPR)

5. Service Providers & Third Parties

We use the following third-party providers acting as processors or as independent controllers:

• Shopify Inc. (Ottawa, Canada) — shop platform, payment processing, hosting, analytics. Shopify is certified under the EU-US Data Privacy Framework. More information can be found in Shopify's privacy policy.
• Meta Platforms (WhatsApp, Instagram, Facebook) — customer communication and, where applicable, social media advertising. Content is subject to Meta's data protection provisions.
• Shipping providers (Austrian Post, DHL, etc.) — delivery; disclosure of name and address for the purpose of delivery.
• Marketing and advertising partners — where you have consented, anonymised or pseudonymised data may be used to display personalised advertising. You may object to the use of your data for targeted advertising at any time (see item 11).
• Marketplaces (Pinterest, eBay, Etsy): product catalogue and order data synchronisation for sales via these platforms; the respective marketplace's own privacy policy applies in addition.

6. International Data Transfers

As we use service providers outside the EU/EEA (e.g. Shopify in Canada, Meta in the USA), personal data may be transferred to third countries. In these cases, we rely on recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses or an adequacy decision recognised by the EU Commission (e.g. the EU-US Data Privacy Framework).

7. Cookies

Our website uses technically necessary cookies that are essential for the operation of the shop (e.g. shopping cart, session). In addition, analytics and marketing cookies may be used to improve the user experience or display relevant advertising. You can disable or delete cookies in your browser at any time and adjust your consent via the cookie settings in the footer.

8. Retention Period

Personal data is only stored for as long as necessary for the respective purpose or as required by statutory retention obligations. Order and invoice data is retained for 7 years in accordance with tax regulations. Enquiries submitted via our contact form, email or WhatsApp are deleted once they have been fully resolved and no statutory retention obligation applies, but no later than after 3 years. B2B registration data is stored for the duration of the business relationship and beyond that within the scope of statutory retention periods.

9. Data Security

We employ appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Please note that no transmission over the internet or electronic storage can be completely secure; we recommend not transmitting sensitive information via unsecured channels.

10. Minors

Our services are not directed at children, and we do not knowingly collect personal data from individuals under the age of 16. If, as a parent or guardian, you become aware that your child has provided us with personal data, please contact us so that we can delete it.

11. Your Rights

Under the GDPR, you have the following rights:

• Access to the personal data we hold about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure of your data, provided no legal obligations prevent this (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing, in particular to direct marketing and profiling for advertising purposes (Art. 21)
• Withdrawal of consent given, with effect for the future (Art. 7(3))

To exercise your rights, please contact: office@eleojewels.com. Exercising these rights will not disadvantage you in any way.

12. Right to Lodge a Complaint

You have the right to lodge a complaint with the Austrian Data Protection Authority (DSB):
Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna — dsb.gv.at

13. Provision of Your Data

Providing certain personal data (e.g. name, delivery address, payment details) is required to conclude and fulfil a purchase contract. Without this information, we cannot process your order or ship the goods to you. Other information, such as that provided through a voluntary contact enquiry, is not mandatory.

14. Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

15. Changes to This Privacy Policy

We reserve the right to update this policy as needed, for example due to changes in our processing practices or legal requirements. The current version is always available on this page.