Data protection

§ 1 Provider and Controller under Data Protection

Law GSG Hair Owner: Yvonne Sövdsnes Managing Director: Andreas Danler Bahnhofstraße 2 5700 Zell am See, Austria E-mail: support@gsghair.com

 

§ 2 Scope

This privacy policy informs you about the nature, scope, and purpose of the collection and use of personal data by the provider "GSG Hair" on this website and within its services. Personal data refers to any information relating to an identified or identifiable natural person. In principle, the provision of your personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are under no obligation to provide the data. Failure to provide the data will have no consequences, unless explicitly stated otherwise.

 

§ 3 Collection of General Information

Each time our website is accessed, general information is automatically collected by us or our web host. This information—also known as server log files—includes: Name of the website File Date and time of access IP address Volume of data transferred Referrer URL (the page from which you accessed our service) Web browser and operating system This data is processed on the basis of Art. 6 (1) (f) GDPR to ensure the smooth operation of our website and to improve our services.

 

§ 4 Contacting Us ​

GSG Hair Bahnhofstraße 2 5700 Zell am See Austria E-mail: support@gsghair.com ​ Contacting us via the contact form or e-mail If you contact us via the contact form or by e-mail, we process your personal data (e.g., name, e-mail address, message content) only to the extent necessary to process and respond to your inquiry. Processing takes place: To carry out pre-contractual measures or to fulfill a contract pursuant to Art. 6(1)(b) GDPR. Based on our legitimate interest (Art. 6(1)(f) GDPR), provided no contractual relationship exists. Your data will be deleted once processing is complete, unless statutory retention obligations prevent this.

​

§ 5 Sending images via email ​

If you send us images via email, your data will be processed solely for the purpose of providing the requested service (e.g., creating personalized products). Processing is carried out in accordance with Art. 6(1)(b) GDPR. The data will be deleted after the statutory retention period has expired. ​​

 

§ 6 Customer account and orders ​

Customer account When you open a customer account, we process your personal data (name, address, email address, password) based on your consent pursuant to Art. 6(1)(a) GDPR. You may revoke your consent at any time; in such a case, your customer account will be deleted. ​​ Orders When you place an order via our website, we collect and process personal data (name, address, payment information) necessary for processing the order. Processing is carried out in accordance with Art. 6(1)(b) GDPR. Your data is shared with shipping companies, payment service providers, or IT service providers insofar as this is necessary for the performance of the contract. ​​

 

§ 7 Disclosure of personal data ​

Your personal data is disclosed to third parties only to the extent necessary for the performance of the contract or if we are legally obliged to do so. Disclosure occurs, for example, to: Shipping service providers: For the delivery of the goods you have ordered. Payment service providers: For processing your payment. IT service providers: To ensure the technical operation of our website. ​ Disclosure always takes place within the framework of legal requirements, particularly in accordance with Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(c) GDPR (compliance with a legal obligation). Third parties may use your data exclusively for the specified purposes.

​

§ 8 Data Security ​

We implement technical and organizational security measures to protect your personal data against loss, destruction, manipulation, and unauthorized access. Our security measures are continuously improved in line with technological developments. We use the SSL (Secure Socket Layer) encryption method in conjunction with the highest level of encryption supported by your browser. You can tell whether an individual page of our website is being transmitted in encrypted form by the closed key or lock symbol displayed in the bottom status bar of your browser. Despite the measures taken, we would like to point out that data transmission over the Internet may have security vulnerabilities (e.g., during email communication). Complete protection of data against access by third parties is not possible. ​​

 

§ 9 Analytics, Marketing, and Tracking Services ​

To analyze, optimize, and market our online services, we use analytics, marketing, and tracking services from various providers. Processing takes place exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR. Depending on how you use our website, cookies or similar technologies may be employed, and personal data (e.g., IP address, device information, browser data, usage behavior, or conversion data) may be processed. In particular, the following services may be used for this purpose: Google (e.g., Google Analytics 4, Google Ads, Google Tag Manager, YouTube) Meta (Facebook and Instagram) TikTok Pinterest Microsoft Advertising (Bing) Klaviyo or comparable email marketing services Payment service providers (e.g., Klarna, PayPal, Stripe, Apple Pay, Google Pay, as well as credit and debit card providers) Shipping, hosting, IT, and other technical service providers, insofar as this is necessary for the operation of our online shop. Personal data may be transmitted to providers outside the European Economic Area. In these cases, data transmission takes place exclusively on the basis of statutory data protection regulations, particularly through appropriate safeguards in accordance with Art. 44 et seq. of the GDPR. You may revoke your consent at any time with effect for the future via the cookie settings on our website.

​

§ 10 Cookies ​

Our website uses cookies to ensure functionality and improve the user experience. Technically necessary cookies are stored based on Art. 6(1)(f) GDPR. For all other cookies, we obtain your consent in accordance with Art. 6(1)(a) GDPR. You can disable cookies in your browser at any time; however, doing so may impair the website's functionality.

 

§ 11 Payment Service Providers ​

We work with various payment service providers—such as those for credit/debit cards, Apple Pay, Google Pay, and Klarna—to offer you a range of payment options. Depending on the payment service provider selected, the necessary data is transmitted to them. Processing is carried out in accordance with Art. 6(1)(b) GDPR. When using payment services such as Klarna or Ratepay, the providers may conduct a credit check. This processing takes place based on Art. 6(1)(f) GDPR to prevent payment defaults. Please refer to the respective providers' privacy policies for further information. ​​​

 

§ 12 Your Rights ​​

Under the GDPR, you have the following rights: Access (Art. 15 GDPR): Regarding the personal data we process. Rectification (Art. 16 GDPR): To have incorrect data corrected. Erasure (Art. 17 GDPR): To have your data deleted, provided there are no statutory retention obligations. Restriction of processing (Art. 18 GDPR). Data portability (Art. 20 GDPR). Objection (Art. 21 GDPR): Against the processing of your data based on legitimate interests. To exercise these rights, please contact: support@gsghair.com ​​

​

§ 13 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your data is unlawful. Competent authority: Austrian Data Protection Authority (Österreichische Datenschutzbehörde) Barichgasse 40-42 1030 Vienna Tel.: +43 1 52 152-0 E-mail: dsb@dsb.gv.at

 

Published on 1 April 2025

Last updated: 16 June 2026