1. Data Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (Datenschutzgesetz, DSG) is:

Denisa-Iuliana Calomfirescu
WandDo e.U.
Company Register No. FN 682021y, Wiener Neustadt Regional Court
Anzengrubergasse 17
2601 Sollenau, Austria
VAT-exempt according to § 6 Abs. 1 Z 27 UStG (Small Business Regulation)
Email: hi@wanddo.space
Website: www.wanddo.space

2. What Personal Data We Collect

We collect and process the following personal data:

2.1 When Placing Orders

•       First and last name

•       Delivery and billing address

•       Email address

•       Phone number (if provided)

•       Payment data (processed directly by the payment service provider)

•       Order history and purchase details

2.2 When Registering an Account

•       First and last name

•       Email address

•       Password (stored in encrypted form)

•       Address data

2.3 When Subscribing to the Newsletter

•       Email address

•       Date and time of registration (double opt-in log)

2.4 Technical Data

•       IP address

•       Browser type and version

•       Operating system

•       Date and time of access

•       Pages accessed (referrer URL)

3. Purposes of Processing and Legal Bases

3.1 Performance of a Contract (Art. 6(1)(b) GDPR)

We process your data to process orders, deliver physical products, issue invoices, and communicate with you in connection with your order.

3.2 Legal Obligation (Art. 6(1)(c) GDPR)

We are legally required to retain invoices and accounting records for seven years (Section 132 of the Austrian Federal Fiscal Code, Bundesabgabenordnung, BAO).

3.3 Consent (Art. 6(1)(a) GDPR)

Soweit du dich für unseren Newsletter angemeldet oder der Nutzung von Analyse- und Marketing-Cookies zugestimmt hast, verarbeiten wir deine Daten auf Basis deiner Einwilligung. Du kannst diese jederzeit widerrufen.

3.4 Legitimate Interest (Art. 6(1)(f) GDPR)

We use web analytics services (Google Analytics) to analyse user behaviour and optimise our online shop. This serves our legitimate interest in improving our offering.

4. Services Used and Third-Party Providers

4.1 Squarespace (Website Platform)

Our online shop is operated on the Squarespace platform. Squarespace Ireland Limited, Le Pole House, Ship Street Great, Dublin 8, Ireland, processes technical data (IP addresses, server logs) as our processor. A data processing agreement (DPA) is in place. Further information: https://www.squarespace.com/privacy

4.2 Payment Processing

Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Payment data is transmitted directly and in encrypted form to Stripe and is not stored by us. Privacy information: https://stripe.com/at/privacy

PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. When paying via PayPal, the data required for this purpose is transmitted to PayPal. Privacy information: https://www.paypal.com/at/webapps/mpp/ua/privacy-full

4.3 Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyse your usage behaviour. The information generated is generally stored on a Google server in the USA. We have activated IP anonymisation (IP masking).

This use is based on your consent (Art. 6(1)(a) GDPR) as well as our legitimate interest (Art. 6(1)(f) GDPR). You may withdraw your consent at any time via our cookie settings. Google's privacy policy: https://policies.google.com/privacy

4.4 Meta Pixel (Facebook/Instagram)

We use the Meta Pixel provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The Meta Pixel allows us to define visitors to our website as a target audience for advertising on Facebook and Instagram.

This use is based on your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time via our cookie settings. Meta's privacy policy: https://www.facebook.com/privacy/policy/

4.5 Newsletter (e.g. Mailchimp)

We use Squarespace Email Campaigns to send our newsletter. The email address you provide is used exclusively for sending the newsletter. Dispatch is based on your express consent (Art. 6(1)(a) GDPR) via a double opt-in procedure. You may unsubscribe from the newsletter at any time using the unsubscribe link at the end of each newsletter or by emailing us.

5. Disclosure of Data to Third Parties

Your personal data is disclosed to third parties only:

•       where necessary for the performance of the contract (e.g., shipping providers for delivery of your order),

•       where we are legally required to do so,

•       where you have given your consent,

•       to the processors named above (Squarespace, Stripe, PayPal, Google, Meta) under corresponding agreements.

Data is not disclosed to any other third parties for advertising purposes without your express consent.

6. Transfers to Third Countries

Some of the services we use (in particular Google Analytics and Meta Pixel) may transfer data to the USA. Such transfers are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) or an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework).

7. Storage Period

•       Order data: 7 years (statutory retention obligation under Section 132 BAO)

•       Customer account: until deleted by you or us, at most 3 years after the last activity

•       Newsletter data: until you withdraw your consent

•       Technical log data: 30 days

•       Marketing and analytics data: depending on cookie settings, at most 2 years

8. Your Rights as a Data Subject

You have the following rights under the GDPR:

•       Right of access (Art. 15 GDPR): You may request information about the data we process about you.

•       Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate data.

•       Right to erasure (Art. 17 GDPR): You may request the deletion of your data, provided no statutory retention obligations prevent this.

•       Right to restriction of processing (Art. 18 GDPR)

•       Right to data portability (Art. 20 GDPR)

•       Right to object (Art. 21 GDPR): You may object to the processing of your data based on legitimate interests.

•       Right to withdraw consent (Art. 7(3) GDPR): You may withdraw any consent given at any time, with effect for the future.

To exercise your rights, please contact: hi@wanddo.space

9. Right to Lodge a Complaint with the Data Protection Authority

You have the right to lodge a complaint with the Austrian data protection authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)

Barichgasse 40-42, 1030 Vienna, Austria

Phone: +43 1 52 152-0

Email: dsb@dsb.gv.at

Website: www.dsb.gv.at

10. Cookies and Consent Management

Our website uses cookies. Technically necessary cookies are set without your consent on the basis of Art. 6(1)(b) and (f) GDPR. Non-essential cookies (analytics, marketing) are only set with your express consent, which you can grant or refuse via our cookie banner.

You can change your cookie settings at any time via the cookie settings on our website, or reject or delete all cookies via your browser settings.

11. Data Security

We employ technical and organisational security measures to protect your data against unauthorised access, loss, or manipulation. Our website transmits data in encrypted form via an SSL/TLS connection (indicated by "https://" in the address bar).

12. Currency of this Privacy Policy

This Privacy Policy is currently valid and dated: 24 August 2026.

We reserve the right to amend this Privacy Policy in the event of changes to the legal basis or to our data processing. The current version can always be found on our website.

─────────────────────────────

WandDo e.U. | Denisa-Iuliana Calomfirescu | Austria