Last updated: 24 October 2026. This policy describes what happens to personal data when you visit highrizz.shop or place an order. It lists only the services this shop actually uses.
1. Controller
E-Commerce Solutions e.U., owner Mahamood Attia, Triester Straße 236, 8055 Graz, Austria, support@highrizz.shop. We have not appointed a data protection officer; we are not required to.
2. What we process, why, and on what legal basis
Order data (name, delivery and billing address, email address, items, size, order number, payment status). Purpose: to perform the contract and to produce and ship your order. Legal basis: Art 6 (1) (b) GDPR. Storage: seven years from the end of the year, because Austrian tax law requires it (§ 132 Federal Fiscal Code).
Payment data (card or account details, payment confirmation). We never see or store full card numbers. The payment provider you choose collects them directly. Legal basis: Art 6 (1) (b) GDPR.
Messages you send us (email, contact requests). Purpose: to answer you. Legal basis: Art 6 (1) (b) and (f) GDPR. Storage: as long as the matter is open, then in line with statutory retention periods.
Server log files (IP address, time, requested page, browser and referrer). Purpose: operating and securing the website and defending against attacks. Legal basis: Art 6 (1) (f) GDPR. Storage: 14 days, then deleted.
Shop cookies that make the shop work (shopping cart, session). Without them the cart cannot work. Legal basis: § 165 (3) Austrian Telecommunications Act and Art 6 (1) (f) GDPR.
Fraud prevention by our payment providers. On the cart and checkout pages, Stripe and PayPal set cookies and collect device data to detect fraudulent payments. Legal basis: Art 6 (1) (b) and (f) GDPR.
Visitor statistics (Google Analytics), only with your consent. If you click “Accept all” or switch on “Statistics” in the cookie banner, we use Google Analytics 4 to see which pages are visited and how many visits lead to a purchase: pages viewed, products viewed and added to the basket, checkout started, order value, device and browser type, approximate location (country, city) and a random ID stored in a cookie. Google Analytics 4 does not store IP addresses. Legal basis: Art 6 (1) (a) GDPR and § 165 (3) Austrian Telecommunications Act. Storage in Google Analytics: 2 months. Without your consent no Google script is loaded at all.
Ad measurement (Google Ads), only with your consent. If you switch on “Marketing” in the cookie banner or click “Accept all”, Google Analytics tells Google Ads whether a visit that came from one of our ads led to a purchase (order value, ad click ID). Google may use this to show our ads to people similar to buyers. Legal basis: Art 6 (1) (a) GDPR and § 165 (3) Austrian Telecommunications Act.
Consent, where we ask for it. Legal basis: Art 6 (1) (a) GDPR. You can withdraw consent at any time with effect for the future.
3. Who receives data
We pass on data only where it is needed for the contract, where we are legally obliged to, or where you have consented.
- Hetzner Online GmbH (Germany), processor: hosting of this shop.
- AS Printful Latvia, part of Printful, Inc., processor: printing and shipping your order. Printful works with group companies in Latvia, Poland, Spain, the United Kingdom and the USA.
- Stripe Payments Europe, Limited (Ireland), own controller: card payments, Klarna and wallet payments. For Apple Pay and Google Pay, Apple and Google receive the data needed for the payment on their own responsibility.
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), own controller: PayPal and EPS. PayPal uses hCaptcha to tell humans from bots.
- Microsoft Ireland Operations Limited, processor: our mailboxes and the emails about your order.
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), processor: Google Analytics, only with your consent. Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023. That decision is currently challenged before the Court of Justice of the EU.
- Google Ireland Limited, own controller: Google Ads, for measuring our ads, only with your consent. The same transfer rules to the USA apply.
Payment providers decide themselves how they process payment and fraud data. Their own privacy policies apply, see stripe.com/privacy and paypal.com.
Transfers outside the EU. Printful transfers data to its parent company in the USA and uses the European Commission’s standard contractual clauses of 4 June 2021 (Decision 2021/914), module 2. Stripe, PayPal and Microsoft also work with group companies outside the EU and rely on the same clauses or on an adequacy decision. Under US law, authorities there may be able to access data, and the level of protection is not identical to the European one.
Our profiles on Instagram, TikTok, Pinterest and Etsy. If you follow, comment on or message our profiles, or buy in our Etsy shop, the platform processes your data under its own privacy policy and as its own controller. We see your username, comments and messages and use them only to reply, to run giveaways you enter and to handle Etsy orders (produced and shipped by Printful). Legal basis: Art 6 (1) (b) and (f) GDPR. We publish posts and manage comments and messages with Zernio Software SL (Spain), our processor.
4. Cookies and similar technologies
On the home page, the shop and product pages this shop sets only its own cookies needed for the basket and your session: woocommerce_items_in_cart, woocommerce_cart_hash and wp_woocommerce_session_*. They last for the session or up to two days. It also stores your cookie choice in hrz_consent for 6 months. No third party is loaded on those pages unless you consent.
On the cart and checkout pages, the payment providers load their scripts as soon as the page opens, so that Apple Pay, Google Pay and card payment work. Stripe sets __stripe_mid (up to 12 months) and __stripe_sid (30 minutes) plus cookies of its fraud provider; PayPal and hCaptcha set their own cookies with a runtime of up to 400 days.
Only with your consent: Google Analytics sets _ga and _ga_<ID> (up to 2 years). With “Marketing” switched on, Google Ads cookies _gcl_* (up to 90 days) are set as well.
You can change or withdraw your choice at any time via Cookie settings at the bottom of every page. When you withdraw, we delete the Google Analytics and Google Ads cookies in your browser.
5. Your rights
You have the right to access your data, to have incorrect data corrected, to have data deleted, to have processing restricted, to data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time with effect for the future.
Write to support@highrizz.shop. We answer within one month.
You can also complain to the Austrian Data Protection Authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.
6. Do you have to give us data
To buy something, yes: without name, address and email we cannot conclude or perform the contract. Everything else is voluntary.
7. Automated decision-making
We do not use automated decision-making or profiling that produces legal effects for you. Payment providers may run automated fraud checks on their own responsibility, which can result in a payment being refused.
8. Changes
If the shop changes, this policy changes with it. The date at the top shows the current version.
