BREUER BONO
← Back

Privacy Policy

1. Data Controller

The data controller responsible for data processing under the GDPR is:

  • [Full legal company name, e.g. BREUER BONO GmbH]
  • [Address (street, postal code, city, country)]
  • [Email address for privacy-related inquiries]
  • [Phone number (optional)]
  • [Company registration number / VAT ID]

2. General Information on Data Processing

We only process personal data of our users to the extent necessary to provide a functioning website and our content and services. Processing generally occurs only with the user's consent (Art. 6(1)(a) GDPR) or where permitted by law, in particular:

  • Art. 6(1)(a) GDPR — consent (e.g. analytics and marketing tools/cookies)
  • Art. 6(1)(b) GDPR — performance of a contract (e.g. order processing via Shopify)
  • Art. 6(1)(f) GDPR — legitimate interest (e.g. technically necessary cookies, fraud prevention)

3. Your Rights as a Data Subject

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — in Austria: Austrian Data Protection Authority, www.dsb.gv.at

4. Hosting & Server Log Files

4.1 Website Hosting (Vercel)

Our website is hosted by Vercel Inc. Vercel processes technically necessary server log data (including IP address, time of access, page requested, browser type).

[Enter Vercel server region and confirm Data Processing Addendum (DPA) status]

[If Vercel servers are outside the EU: specify legal basis for third-country transfer (e.g. EU Standard Contractual Clauses / SCCs)]

4.2 Order Processing (Shopify)

The checkout process (cart, payment, order completion) runs via Shopify Inc. / Shopify International Ltd. Upon purchase, the following data is transmitted to and processed by Shopify: name, shipping address, billing address, email address, payment data, order contents.

[Confirm Shopify Data Processing Addendum and reference it here]

5. Cookies — General

Our website uses cookies. Cookies are small text files stored on the user's device. We distinguish between technically necessary cookies (no consent required) and analytics/marketing cookies or comparable technologies (consent required).

6. Google Analytics 4

We use Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to analyze usage of our website. In our setup, data transmission occurs server-side via the Measurement Protocol API, triggered by our own server route.

  • Events captured: page views, view_item, add_to_cart, begin_checkout, purchase
  • Property: "BREUER BONO Shop v2" (Property ID G-XQ96QT9KYM)
  • Data transfer to the US relies on the EU-U.S. Data Privacy Framework (DPF), to the extent Google is certified under it

[Confirm Google's current DPF certification status and reference it (dataprivacyframework.gov)]

[Enter data retention period configured for GA4]

7. Meta Conversions API (Facebook/Instagram)

We use the Meta Conversions API (CAPI) to measure the effectiveness of our advertising on Facebook and Instagram (provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). Events (e.g. completed purchases) are transmitted to Meta server-side.

  • Pixel ID: 1030537779796787
  • Data transmitted (partly hashed via SHA-256): external_id (hashed Shopify customer ID), client_ip_address, client_user_agent, as well as fbc/fbp identifiers to attribute ad clicks
  • Purpose: measuring advertising effectiveness (return on ad spend) and optimizing ad delivery

[Confirm Meta Business Tools Terms / Data Processing Terms with Meta]

[Enter Meta Business and domain verification status once finalized with Martin]

Users may object to Meta's own use of this data or manage their ad preferences at: https://www.facebook.com/settings?tab=ads

8. Contact

[If a contact form/email contact is offered: describe data processed, legal basis (Art. 6(1)(b) or (f) GDPR), retention period]

9. Data Retention

We process and retain personal data only for as long as necessary to fulfil the stated purpose, or as required by statutory retention obligations (e.g. commercial/tax record-keeping requirements, typically 7 years for order data).

10. Changes to this Privacy Policy

We reserve the right to amend this privacy policy to ensure it complies with current legal requirements or to reflect changes to our services.

11. Privacy Contact

[Email address / contact person for privacy inquiries]

← Back