Adjusting your cookie settings
Privacy policy
1. General information on data protection
The protection of your personal data is important to us. In this privacy policy, we inform you about which personal data is processed when you visit our website and use our services, for what purposes this is done, and what rights you have under applicable data protection regulations.
Personal data is information relating to an identified or identifiable natural person. This includes, for example, name, email address, IP address, order details, or information about website usage.
The processing of personal data is carried out in particular in accordance with the provisions of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and, where applicable, the Telecommunications Act 2021 (TKG 2021).
2. Responsible person
The entity responsible for processing personal data on this website is:
Steiger Art & Media KG
Adolf-Pichler-Platz 12
6020 Innsbruck
Austria
Telephone: +43 664 5965519
E-mail: steiger.art.media@gmail.com
The controller within the meaning of the GDPR is the natural or legal person who decides on the purposes and means of processing personal data.
3. What data we process
When using our website, various types of personal data may be processed.
Some of this data is processed automatically when you access the website. This may include, in particular, your IP address, the time of access, the pages or files accessed, your browser type, your operating system, referrer information, and other technical information.
We receive other data directly from you, for example when you contact us, subscribe to a newsletter, place an order or communicate with us via WhatsApp.
Furthermore, if you have given your consent, data may be processed using analysis, marketing or tracking technologies.
4. Purposes and legal bases of processing
We only process personal data if there is a corresponding legal basis for doing so.
Depending on the processing activity, the following legal bases may be considered in particular:
- Your consent pursuant to Art. 6 para. 1 lit. a GDPR;
- the performance of a contract or the implementation of pre-contractual measures pursuant to Art. 6 para. 1 lit. b GDPR;
- fulfillment of legal obligations pursuant to Art. 6 para. 1 lit. c GDPR;
- our legitimate interests or the legitimate interests of a third party pursuant to Art. 6 para. 1 lit. f GDPR.
Insofar as technologies store information on your device or access information stored there, we also take into account the requirements of Section 165 Paragraph 3 of the German Telecommunications Act (TKG) 2021.
Cookies and similar technologies that are not technically necessary will only be used after you have given your consent.
5. Storage duration
We generally only store personal data for as long as is necessary for the respective processing purpose.
If the purpose of the processing ceases to exist, the data in question will be deleted or anonymized, unless there are legal retention obligations or other permissible reasons for further storage.
Statutory retention obligations, in particular those arising from tax, company or commercial law regulations, remain unaffected.
6. Recipients of personal data
We sometimes work with external service providers to provide our website and services.
Personal data will only be transferred to such recipients if this is necessary for the performance of a contract, there is a legal obligation, corresponding consent has been obtained, there is a legitimate interest or another legal basis permits the transfer.
Insofar as service providers process personal data exclusively on our behalf, they are employed as data processors in accordance with the requirements of the GDPR.
7. Transfer of data to third countries
Some of the service providers we use belong to internationally operating corporate groups. This may result in the processing of personal data outside the European Union or the European Economic Area.
Such transfers only take place in compliance with the GDPR. Depending on the provider, the transfer may be based in particular on an adequacy decision by the European Commission, a valid certification under the EU-US Data Privacy Framework, or suitable safeguards such as the European Commission's Standard Contractual Clauses.
Further information can be found in the respective services within this privacy policy.
Hosting and technical infrastructure
8. Hosting via GoDaddy
Our website is hosted by an external hosting provider.
We use services provided by GoDaddy for this purpose. As part of the hosting process, technical connection data, IP addresses, server log data, communication data, and other data generated during website use may be processed.
The processing serves in particular to technically provide our website and to ensure its stability and security.
Where processing is necessary for the performance or preparation of a contract, it is based on Article 6(1)(b) GDPR. Otherwise, our legitimate interest in the secure, stable, and efficient operation of our website is based on Article 6(1)(f) GDPR.
To the extent that GoDaddy processes personal data on our behalf, this is done on the basis of the corresponding data processing agreements.
GoDaddy – Legal, Office of the Data Privacy Officer
c/o Spaces
Gertrudenstraße 30–36
50667 Cologne
Germany
9. Cloudflare
For the security, stability and fast delivery of our website, we use services from Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.
Cloudflare provides, among other things, a globally distributed content delivery network as well as security and DNS services. Due to technical reasons, a portion of the data traffic between your browser and our website is routed through Cloudflare's infrastructure.
This may involve processing IP addresses and technical information about visits to our website.
The use of Cloudflare is based on our legitimate interest in a secure, reliable and efficient provision of our internet service in accordance with Art. 6 para. 1 lit. f GDPR.
Cloudflare states that it is certified under the EU-US Data Privacy Framework. For certain international data transfers, standard contractual clauses and other safeguards are also used.
Further information on the processing of personal data by Cloudflare can be found in the company's privacy policy. https://www.cloudflare.com/privacypolicy/
Cookies and consent management
10. Cookies and similar technologies
Our website uses cookies and similar technologies.
Cookies are small files or data sets that can be stored on or read from your device. Some cookies are deleted after you close your browser, while others can remain on your device for a specific period of time.
Cookies may be necessary, for example, for a shopping cart to function or for your chosen settings to be saved. Other technologies are used for audience measurement, analysis, or advertising.
Cookies or technologies that are technically essential may be used insofar as this is necessary for the provision of a service that you have expressly requested.
Cookies or similar technologies that are not technically necessary are only used with your prior consent. The legal basis for the associated processing of personal data is generally Article 6(1)(a) GDPR. The requirements of Section 165(3) of the German Telecommunications Act 2021 (TKG 2021) also apply to the storage and retrieval of information on your device.
You can change or revoke your consent at any time with effect for the future.
11. Real Cookie Banner
To manage your privacy and cookie settings, we use Real Cookie Banner from devowl.io GmbH, Tannet 12, 94539 Grafling, Germany.
The system serves to record, store, and technically implement your decision regarding services requiring consent with respect to the services used.
Real Cookie Banner is operated locally on our system. Technically necessary information may be stored on your device to save and document your decision.
The processing is carried out to fulfill our legal obligations pursuant to Art. 6 para. 1 lit. c GDPR and, where applicable, for the technical management of your consent decision.
Contact and communication
12. Contact via email or telephone
When you contact us by email or telephone, we process the information you provide to the extent necessary to handle your request.
This may include, in particular, your name, contact details, the content of your message and other information you voluntarily provide.
If your request relates to a contract or pre-contractual measures, the processing is based on Art. 6 para. 1 lit. b GDPR.
For other inquiries, processing is regularly carried out on the basis of our legitimate interest in the proper handling of communication in accordance with Art. 6 para. 1 lit. f GDPR.
The data will be deleted as soon as it is no longer required for processing the request and there are no legal retention obligations or other permissible reasons for further storage.
13. Communication via WhatsApp Business
We use WhatsApp Business to communicate with customers, prospects and business partners.
The provider for users in the European Economic Area is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Message content on WhatsApp is always transmitted using end-to-end encryption. However, the service may process additional information during operation, such as phone numbers, communication timestamps, device information, and other metadata.
Where communication serves the purpose of preparing or executing a contract, processing is based on Article 6(1)(b) GDPR. For other business communication, Article 6(1)(f) GDPR may serve as the legal basis. Where consent is required, processing is based on Article 6(1)(a) GDPR.
We use WhatsApp Business without automatically syncing our entire smartphone address book.
WhatsApp provides further information on data processing in its privacy policy.
Analysis and Marketing
14. Google Tag Manager
We use the Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The Google Tag Manager allows us to centrally manage various website tags and services. It is therefore particularly useful for the technical control of other analytics and marketing services.
Which personal data is actually processed depends in particular on the services integrated via the Tag Manager and the consent settings you have made.
If consent is required for a service integrated via the Tag Manager, it will generally only be activated in accordance with your consent decision.
Further information on data processing can be found in Google's privacy policy.
15. Google Analytics 4
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics allows us to statistically evaluate the use of our website. This may include processing information such as pages visited, interactions, approximate geographic origin, device and browser information, session duration, and other usage data.
Google states that it does not log or store individual IP addresses of users from the EU or the European Economic Area in Google Analytics. IP addresses can be used technically to derive rough location information and are then discarded.
We only use Google Analytics in accordance with your consent. Where consent is required, the processing is based on Article 6(1)(a) GDPR, and with regard to the storage of or access to information on your device, on Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).
You can withdraw your consent at any time for the future via our cookie and privacy settings.
When using Google services, the processing of data outside the European Economic Area cannot be completely ruled out. Google LLC is certified under the EU-US Data Privacy Framework. In addition, other suitable safeguards for international data transfers may apply.
Further information about the processing of personal data can be found in Google's privacy policy.
https://privacy.google.com/businesses/controllerterms/mccs/
16. Meta Pixel
If you give your consent, we will use the Meta Pixel on our website.
The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
The meta pixel allows us, in particular, to track whether users perform certain actions on our website after clicking on an advertisement. This enables us to measure the effectiveness of our advertising measures and optimize our campaigns.
This may involve processing and transmitting information about website visits, interactions, device and browser information, and online identifiers to Meta.
If you use Meta's services, Meta may, under certain conditions, associate the transmitted information with your user account and process it for its own purposes.
Insofar as Meta Pixel on our website triggers data processing requiring consent, activation only occurs after you have given your consent. The legal basis is Article 6 Paragraph 1 Letter a GDPR in conjunction with Section 165 Paragraph 3 TKG 2021. You can withdraw your consent at any time with effect for the future.
For certain processing operations related to the collection and transfer of data to Meta, we may be jointly responsible with Meta Platforms Ireland Limited within the meaning of Article 26 GDPR. The details of this joint responsibility are set out in the relevant agreements with Meta.
Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. Furthermore, additional appropriate safeguards may be used for international data transfers.
Further information can be found in Meta's privacy policy. https://de-de.facebook.com/about/privacy/
Newsletter
17th Newsletter
When you subscribe to our newsletter, we process in particular your email address and, if applicable, other information you voluntarily provide.
The processing is carried out for the purpose of sending newsletters on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR.
To verify your registration, we may use a so-called double opt-in procedure. After registration, a confirmation message will be sent to the provided email address. Only after this confirmation will the address be activated for newsletter distribution.
You can withdraw your consent at any time with effect for the future, for example via the unsubscribe link in the newsletter.
18. CleverReach
We use CleverReach for sending and managing our newsletter.
The provider is CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany.
CleverReach processes, in particular, the contact details required for sending newsletters. If corresponding functions are activated and the necessary consent has been obtained, information about newsletter usage may also be processed, such as opens or clicks on links contained within.
The processing for newsletter distribution is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR.
After unsubscribing from the newsletter, your data will generally be removed from the active newsletter mailing list. However, your email address may be stored on a suppression list if necessary to ensure that no further newsletters are sent to that address after you have withdrawn your consent.
Insofar as CleverReach processes personal data on our behalf, this is done on the basis of a data processing agreement.
Orders and payment processing
19. Customer, order and contract data
When you place an order or enter into a contract with us via our website, we process the data necessary for the performance of the contract.
This may include, in particular, name, billing and delivery address, contact details, ordered products, invoice information, payment status and other information required for contract processing.
The legal basis for this is Article 6 (1) (b) GDPR.
Furthermore, we process certain contract and invoice data due to legal retention and documentation obligations in accordance with Art. 6 para. 1 lit. c GDPR.
20. Shipping of goods
To the extent necessary for the delivery of an order, we will transmit the required data to the shipping or transport company we have commissioned.
Only the data necessary for carrying out the delivery will be transmitted.
The legal basis for this is Article 6 (1) (b) GDPR.
21. Payment processing
We use external payment service providers to process payments.
Depending on the chosen payment method, data such as name, invoice details, payment amount, transaction information, and account or payment information may be processed.
The processing is generally carried out for the performance of the contract concluded with you in accordance with Art. 6 para. 1 lit. b GDPR.
The respective payment service provider's own data protection regulations also apply to the processing of data.
22. PayPal
We offer PayPal as a payment service provider, among other options.
The provider in the European Economic Area is PayPal (Europe) S.à rl et Cie, SCA, 22–24 Boulevard Royal, L-2449 Luxembourg.
If you select PayPal as your payment method, the information required for payment processing will be transmitted to PayPal.
PayPal processes this data under its own data protection responsibility in accordance with the data protection regulations applicable to the service.
The transfer is carried out for the performance of the contract in accordance with Art. 6 para. 1 lit. b GDPR.
https://www.paypal.com/de/legalhub/paypal/privacy-full
23. Stripe
We use Stripe for certain payments.
The provider for customers in the European Economic Area is Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
When making a payment via Stripe, the data necessary for processing the payment is transmitted to Stripe. This may include, in particular, the payment amount, name, contact details, transaction information, and payment information.
The transfer is carried out for the performance of the contract in accordance with Art. 6 para. 1 lit. b GDPR.
As part of its services, Stripe may process data outside the European Economic Area. Further information on this, as well as on the safeguards implemented by Stripe, can be found in Stripe's privacy policy.
https://stripe.com/de/privacy
Security
24. Encrypted data transmission
Our website uses SSL or TLS encryption.
This protects data transmitted between your browser and our website against unauthorized access during transmission.
You can recognize an encrypted connection in particular by the fact that the address of our website begins with "https://".
Payment information is also transmitted via encrypted connections.
Your data protection rights
25. Information
In accordance with Article 15 of the GDPR, you have the right to request information about whether and which personal data we process about you.
26th Correction
If personal data is incorrect or incomplete, you can request its correction or completion in accordance with Article 16 GDPR.
27. Deletion
Under the conditions of Article 17 GDPR, you can request the deletion of your personal data.
The right to erasure is not unlimited, in particular, if statutory retention obligations or other legally recognized reasons preclude erasure.
28. Restriction of processing
Under the conditions of Article 18 GDPR, you can request that the processing of your personal data be restricted.
This is relevant, for example, if you dispute the accuracy of the data and we need to verify it, or if certain data is required for the establishment, exercise or defense of legal claims.
29. Data portability
Provided the legal requirements are met, you have the right, pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format.
Where technically possible, you can also request that this data be transmitted directly to another controller.
30. Revocation of consent
You can revoke your consent at any time with effect for the future.
The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
You can change or withdraw your consent to cookies, analytics or marketing services, in particular via the privacy and cookie settings available on our website.
31. Right to object
If we process personal data on the basis of Article 6(1)(e) or (f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to this processing on grounds relating to your particular situation.
We will subsequently no longer process the relevant personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of establishing, exercising or defending legal claims.
If your personal data is processed for direct marketing purposes, you can object to this processing at any time. After you object, your personal data will no longer be used for these purposes.
32. Right of appeal
If you believe that the processing of your personal data violates data protection law, you can lodge a complaint with a data protection supervisory authority.
For Austria, this is particularly true:
Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
The right to contact another supervisory authority competent under the applicable legal provisions remains unaffected.
33. Questions about data protection
If you have any questions about the processing of your personal data or about exercising your data protection rights, you can contact us at any time:
Steiger Art & Media KG
Adolf-Pichler-Platz 12
6020 Innsbruck
Austria
E-mail: steiger.art.media@gmail.com
34. Update of this privacy policy
We may amend this privacy policy if our website, the services we use, or the legal framework changes.
The version published on this website at any given time is the applicable one.
As of August 2026