Privacy Policy
Last updated: November 2026
1. Data Controller
The entity responsible for processing personal data in connection with this online store is:
Morphera e.U., Owner: Mina Kurz,
Business Address: Hansalgasse 4/2, 1030 Vienna, Austria,
Email: [email protected],
Website: https://morphera.at.
2. Processing of Personal Data
We process personal data to the extent necessary to operate our online store, process orders, and communicate with customers. This may include first and last name, billing and shipping address, email address, phone number (where applicable), order and invoice details, payment and transaction information, customer inquiries, voluntarily provided information, and technical access data such as IP address, browser information, and time of website access. Complete credit card details are processed by the respective payment service providers and are not stored directly by us.
3. Purposes and Legal Bases for Data Processing
Performance of a Contract (Art. 6(1)(b) GDPR): We process personal data to handle orders, payments, invoicing, shipping, customer communication, and pre-contractual inquiries. Without the necessary information, we may not be able to process your order.
Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Certain personal data must be processed and retained to comply with legal obligations, particularly tax, accounting, and statutory record-keeping requirements.
Legitimate Interests (Art. 6(1)(f) GDPR): Where necessary, we process personal data to ensure the security of our online store, prevent misuse, and establish, exercise, or defend legal claims.
Consent (Art. 6(1)(a) GDPR): Where consent is legally required for specific data processing activities, such processing will only take place on the basis of your consent. You may withdraw your consent at any time with effect for the future.
4. Online Store and Hosting by Big Cartel
Our online store is operated using the Big Cartel platform. Big Cartel provides the technical infrastructure for displaying products, managing orders, and processing purchases. When using our store, personal data, particularly order information and technical access data, may be processed by Big Cartel. Further information can be found in Big Cartel's Privacy Policy: https://www.bigcartel.com/resources/policies/privacy-policy.
5. Payment Processing
Payments are processed through the payment service providers offered during checkout. The information required to complete a payment is transferred to the respective payment provider or collected directly by that provider. This may include your name, billing address, payment amount, transaction details, and payment information. Processing is carried out for the performance of a contract in accordance with Art. 6(1)(b) GDPR. Any additional processing carried out independently by payment service providers is subject to their respective privacy policies.
6. Shipping and Delivery
To deliver purchased products, we share the necessary personal data with the shipping provider responsible for your order. This may include your name, shipping address, contact details where applicable, and shipment-related information. This data is shared for the performance of a contract pursuant to Art. 6(1)(b) GDPR. For international shipments, personal data may also be shared with customs authorities or other relevant authorities where legally required.
7. Cookies and Technical Access Data
Our online store uses technically necessary cookies and similar technologies where required for essential functions such as the shopping cart, checkout process, and website security. When visiting our website, technical information such as your IP address, browser type, device information, and access time may be processed. Where additional analytics or marketing technologies requiring consent are used, they will only be activated after the necessary consent has been obtained. You can manage or delete cookies through your browser settings. Disabling technically necessary cookies may affect the functionality of our online store.
8. Sharing of Personal Data
Personal data is only shared where necessary for contract fulfillment, compliance with legal obligations, or another valid legal basis. Potential recipients include Big Cartel as our online store and hosting provider, payment service providers used during checkout, shipping and logistics companies, tax advisors or accounting service providers (where applicable), and authorities or other competent bodies where legally required. We do not share personal data with third parties for their own advertising purposes.
9. International Data Transfers
Some of our service providers, particularly Big Cartel, are based outside the European Union or European Economic Area. As a result, personal data may be processed in third countries, particularly the United States. Such transfers are carried out in accordance with the requirements of Art. 44 et seq. GDPR, for example on the basis of an applicable adequacy decision by the European Commission or appropriate data protection safeguards.
10. Data Retention
Personal data is stored only for as long as necessary for the respective processing purposes or as required by statutory retention obligations. Business records relevant for tax purposes, particularly invoices and accounting documents, are generally retained for seven years in accordance with Austrian legal requirements. Longer retention periods may apply in certain cases. Data relating to customer inquiries is deleted once it is no longer required for processing the inquiry, unless legal obligations or legitimate interests require further retention.
11. Automated Decision-Making
Morphera e.U. does not itself use automated decision-making, including profiling, that produces legal effects concerning individuals or similarly significantly affects them.
12. Your Data Protection Rights
Subject to the applicable legal requirements, you have the right of access to your personal data, rectification of inaccurate data, erasure of personal data, restriction of processing, data portability, objection to certain processing activities, and withdrawal of consent at any time with effect for the future. To exercise your rights, please contact us at [email protected].
13. Right to Lodge a Complaint
If you believe that the processing of your personal data violates applicable data protection laws, you have the right to lodge a complaint with a competent data protection supervisory authority. In Austria, the competent authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria. Phone: +43 1 52 152-0, Email: [email protected], Website: https://www.dsb.gv.at.
14. Changes to This Privacy Policy
This Privacy Policy may be updated to reflect legal, technical, or organizational changes. The version published on our website at the relevant time shall apply.