Privacy policy

1. Controller

The controller responsible for data processing on this website is:

Martin Breuer-Bono Sole proprietorship BREUER BONO Lastenstraße 41 8051 Graz, Austria Email: mbb@breuerbono.com

(hereinafter "we" or "BREUER BONO")

2. General Information on Data Processing

We process our users' personal data only to the extent necessary to provide a functioning website and our content and services. Processing regularly takes place only with the user's consent (Art. 6(1)(a) GDPR), for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), to comply with a legal obligation (Art. 6(1)(c) GDPR), or on the basis of our legitimate interests (Art. 6(1)(f) GDPR), for example in the technically flawless presentation and optimization of our website.

We use several external service providers (processors) to operate this website. Where required, we have entered into a data processing agreement under Art. 28 GDPR with each such provider that processes personal data on our behalf.

3. Hosting and Audience Measurement (Vercel)

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the website, Vercel automatically collects technical access data (server log files), in particular:

• IP address of the accessing device
• date and time of access
• page/file accessed, referrer URL
• browser and operating system used

This data is technically necessary to deliver the website and ensure the stability and security of operations (Art. 6(1)(f) GDPR). Server log files are automatically deleted after 7 days.

We additionally use Vercel Analytics for audience measurement. This service collects aggregated, anonymized usage statistics (e.g. page views, load times, approximate country-level location) without the use of cookies and without re-identifying individual users. The legal basis is our legitimate interest in optimizing our offering (Art. 6(1)(f) GDPR).

For international data transfers, see Section 14.

4. Cookies and Local Storage

Our website uses cookies and comparable storage technologies (local storage). Cookies are small text files stored on the user's device.

Strictly necessary storage (no consent required, legal basis: legitimate interest / § 165(3) of the Austrian Telecommunications Act 2021 (TKG)):

Cookies requiring consent: We currently do not use any analytics or marketing cookies or corresponding tracking services (e.g. Google Analytics, Meta Pixel). Our cookie banner already provides for the categories "Analytics" and "Marketing" for potential future use; should such services be introduced, this Privacy Policy will be updated accordingly and consent obtained in advance.

You can change or withdraw your cookie preferences at any time by clearing your local browser data for this website — the cookie banner will then reappear on your next visit, allowing you to make a new selection.

5. Order Processing and Shopping Cart (Shopify)

We use the storefront interface of Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (and its parent company, Shopify Inc., 151 O'Connor Street, Ottawa, Ontario, Canada) to display our product catalog, shopping cart, and to process orders.

In the course of the ordering process, Shopify processes, on our behalf or as joint controller, among other things:

• name, delivery address, billing address
• email address, phone number (if provided)
• order content, order value, payment status
• payment data (payment processing itself is carried out via the payment service providers integrated by Shopify, not via our own systems)

The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). The checkout page is currently displayed on a Shopify-owned domain (myshopify.com); this does not affect Shopify's data protection responsibility for this part of the process.

6. Image and Video Hosting (Cloudinary)

Product images, configurator views, and photos uploaded by customers as part of the review system are hosted and delivered via Cloudinary Ltd. (USA). When a page with embedded images is accessed, the user's IP address is transmitted to Cloudinary's servers. The legal basis is our legitimate interest in performant, reliable image delivery (Art. 6(1)(f) GDPR).

If customers upload their own photos as part of a product review, these photos are likewise stored via Cloudinary and displayed publicly on the relevant product page. Submission is voluntary; the legal basis is the user's consent (Art. 6(1)(a) GDPR).

7. Customer Account in the Dealer/Administration Area (Clerk)

For login to the internal dealer portal and administration area, we use the authentication service of Clerk, Inc. (USA). This processes email address, login credentials, and session/security metadata of the logged-in individuals. This function concerns only authorized individuals (trade partners, internal staff), not general website visitors. The legal basis is the performance of a contract and/or our legitimate interest in a secured access area (Art. 6(1)(b), (f) GDPR).

8. Database and Review System (Supabase)

Website content, product reviews (including review text, star rating, optionally an uploaded photo and first name/display name), review invitation tokens, and internal chat messages between dealers and administration are stored in a database at Supabase, Inc. Access to review and chat data is restricted by access rules (Row Level Security) to authorized individuals and to the data necessary for the respective function. The legal basis is the performance of a contract and/or consent (for voluntary reviews), Art. 6(1)(a), (b) GDPR.

Some of our publicly visible product reviews originate from an import from the Catawiki platform; anonymized Catawiki usernames are replaced with a language-specific label ("Catawiki customer" or similar).

9. Sending Emails (Resend)

For sending transactional emails — such as order confirmations (where not sent directly by Shopify) and invitations to submit a product review after purchase — we use the email delivery service Resend (Plus Five Five, Inc., USA). This involves transmitting the recipient's email address and the email content to Resend. The legal basis is the performance of a contract and/or our legitimate interest in reliable communication (Art. 6(1)(b), (f) GDPR).

10. Automated Background Service (cron-job.org)

For the scheduled sending of review invitation emails, we use the scheduling service cron-job.org. This service calls a technical interface of our website at defined intervals; no personal data is transmitted to cron-job.org itself, and the call is secured by a secret access token.

11. Bot and Spam Protection (Cloudflare Turnstile)

To protect forms from automated abuse, we use Cloudflare Turnstile (Cloudflare, Inc., USA). This processes technical device data and the IP address in order to distinguish between human users and automated access. The legal basis is our legitimate interest in a functional website resistant to abuse (Art. 6(1)(f) GDPR).

12. Automated Translation of Reviews (Anthropic)

For the automated translation of product reviews into our five website languages (English, German, Italian, French, Spanish), we transmit the title and body of each review to the Claude language model of Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland (and its US parent company, Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA). Name, email address, and other personal data of the reviewer are not transmitted. Translation is performed once when the review is submitted or imported; the results are stored in our database (see Section 8) and delivered locally on subsequent page views.

The legal basis is our legitimate interest in a multilingual presentation of the review offering (Art. 6(1)(f) GDPR). A data processing agreement with Anthropic is in place on the basis of Anthropic's published Data Processing Addendum (available at https://www.anthropic.com/legal/data-processing-addendum), which incorporates the EU Standard Contractual Clauses (Implementing Decision 2021/914) as the basis for the transfer to the USA.

13. Contact

If you contact us by email (mbb@breuerbono.com) or via a contact form, we process the data you provide (including email address, name, message content) to handle your inquiry. The legal basis is Art. 6(1)(b) or (f) GDPR (pre-contractual inquiry or legitimate interest in responding).

14. Recipients and Transfers to Third Countries

Several of the service providers named above process data wholly or partly on servers outside the EU/EEA, in particular in the USA and Canada. We base these transfers on an appropriate safeguard within the meaning of Art. 46 GDPR:

Beyond the Standard Contractual Clauses, we have not implemented additional technical safeguards (e.g. client-side encryption); as US-based entities, the US providers are in principle subject to the U.S. CLOUD Act.

15. Retention Periods

Personal data is deleted as soon as the purpose of processing no longer applies, unless statutory retention obligations require otherwise. In particular:

• Order and invoice data: 7 years under Austrian commercial and tax law (§ 132 of the Austrian Federal Fiscal Code, BAO)
• Review data: until withdrawal of consent or a deletion request
• Contact inquiries: 6 months after the inquiry has been fully resolved, provided no further correspondence occurs
• Server log files (Vercel): 7 days

16. Rights of Data Subjects

Under the GDPR, you have the following rights with respect to us regarding personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interest (Art. 21 GDPR)
• Right to withdraw consent already given, with effect for the future (Art. 7(3) GDPR)

An informal message to mbb@breuerbono.com is sufficient to exercise these rights.

17. Right to Lodge a Complaint with the Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence. In Austria, this is the

Austrian Data Protection Authority (Österreichische Datenschutzbehörde) Barichgasse 40-42, 1030 Vienna, Austria www.dsb.gv.at

18. Changes to this Privacy Policy

We update this Privacy Policy whenever our data processing changes (e.g. upon introducing analytics or marketing tools, switching to a Clerk Production instance, or moving to our own domain). The version current at the time of your visit applies.

Last updated: July 22, 2026