Datenschutzerklärung

Below we explain which personal data we process when you visit our website and use our online shop, on what legal basis, who receives it and what rights you have. This information is provided under Art 13 and Art 14 GDPR. Where we store information on your device or access information already stored there, § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) applies in addition, see the section on cookies, tracking and consent. We keep as little data as possible in our own systems, order and account data are held in our shop system and not in a separate customer database of ours.

This privacy policy is dated 19.8.2026. We update it whenever our processing changes.

Our website is hosted by Vercel. The application runs in the Frankfurt region, static content is delivered through globally distributed edge servers of Vercel and Cloudflare, which also handles DNS. When you visit the site, technical access data such as your IP address, date and time of access, browser and device data and the pages you visit is processed in server logs so that we can deliver the site securely and reliably and detect attacks. Server logs are deleted after 30 days.

Legal basis: our legitimate interest in the secure and stable operation of the site (Art 6(1)(f) GDPR).

We do not set analytics or marketing cookies without your consent (see the section on cookies, tracking and consent).

For orders in our shop (Shopify checkout) we process your name, billing and delivery address, email address, telephone number, cart contents and chosen payment method. Payment data is processed by the payment provider and is not stored by us. Providing this data is necessary for the conclusion and the performance of the contract. Without it we cannot accept or fulfil your order.

After payment we pass a production and shipping order, containing the recipient's name, delivery address, email address and telephone number, to our manufacturing and shipping partner in India, who dispatches the goods directly to you. The parcel carrier receives the same data in order to deliver the goods and to keep you informed about the delivery. Because the goods are shipped from India, the recipient's data is also transmitted to the customs authorities and customs agents involved in the export and in the import into your country, and, in the event of loss or damage, to our transport insurer.

If you have goods delivered to someone other than yourself, we also process that person's name, delivery address and telephone number.

Before we release production we check the order for indications of fraud and of a payment default. This check does not lead to an automated decision, a decision not to accept an order is always taken by a person.

We do not hold order or customer data in a separate database of our own, this data is held in the shop system.

Legal basis: performance of the contract (Art 6(1)(b) GDPR), for the customs and import formalities compliance with a legal obligation (Art 6(1)(c) GDPR), and for the fraud check our legitimate interest in preventing fraud and payment defaults (Art 6(1)(f) GDPR).

You can open a customer account, but you do not have to, you can also order as a guest. Login is handled by Shopify using your email address and a one-time code. Your name, email address, telephone number, addresses and orders are shown live from the shop system. We keep the account for as long as you maintain it. You can ask us to delete it at any time, statutory retention periods for the underlying orders remain unaffected.

Legal basis: performance of the contract and pre-contractual steps (Art 6(1)(b) GDPR).

If you subscribe to our newsletter, we process your email address in a double opt-in procedure (through Klaviyo). To be able to demonstrate your consent we also store the date and time of your subscription and of your confirmation and the IP address used.

Legal basis: your consent (Art 6(1)(a) GDPR).

If you have also consented to marketing cookies, we additionally process your on-site behavior, such as products viewed and cart contents, and, if you have ordered from us, your order data, in order to tailor the newsletter and to remind you of an abandoned cart. You can withdraw your consent at any time, for example through the unsubscribe link in each newsletter. This does not affect processing carried out before the withdrawal (Art 7(3) GDPR).

If you use our contact form, we process your name, email address, subject and message. The same applies if you write to us directly by email or ask us about a bespoke piece. The message reaches us by email (our mail is delivered through Resend) and is not stored in a separate database. We keep enquiries for as long as we need them to deal with your request, unless a contract results from the enquiry or we need the correspondence as evidence.

Legal basis: pre-contractual and contractual steps and our legitimate interest in answering your enquiry (Art 6(1)(b) and (f) GDPR).

If you book a consultation, we process your name, email address, the appointment and any message you add, through Cal.com. On our consultation page the calendar is not loaded until you click on it. Once you do, your IP address is transmitted to Cal.com so that the calendar can be shown to you. We keep appointment data for twelve months after the appointment.

Legal basis: pre-contractual steps and performance of the contract (Art 6(1)(b) GDPR), and, for loading the calendar at your request, our legitimate interest in offering the booking function (Art 6(1)(f) GDPR).

After a purchase we invite you by email to review the goods you bought. You can object to these invitations at any time and free of charge, when you place your order and in every message we send.

If you leave a review, we process the name you give, your email address, the review text and, if you add one, an image, through Judge.me. Your review is published on our website together with the name you give and, where applicable, with a note that the purchase has been verified, and it can be read worldwide. For that verification your review is matched against the corresponding order. We keep published reviews until you ask us to delete them.

Legal basis: your consent for the publication of your review and of any image (Art 6(1)(a) GDPR), our legitimate interest in verified customer reviews (Art 6(1)(f) GDPR), and, for the review invitation, § 174(4) TKG 2021.

Beyond the processing described above we process your data in order to run our business. This covers the internal administration of your order and of your account, our correspondence with you, the filing and archiving of business records, our bookkeeping and our obligations under tax law, and the assertion, exercise and defence of legal claims, including the recovery of unpaid invoices through a debt collection agency or through our lawyers.

Legal basis: performance of the contract (Art 6(1)(b) GDPR), compliance with our legal obligations, in particular under tax and commercial law (Art 6(1)(c) GDPR), and our legitimate interest in the orderly administration of our business, in proper documentation and in the enforcement and defence of claims (Art 6(1)(f) GDPR).

A wishlist you create is stored only locally in your browser and is not transmitted to us. That storage is necessary for the function you have asked for and therefore does not require your consent. If you clear your browser storage, the wishlist is gone.

Our website uses cookies and comparable technologies. Cookies which are strictly necessary to operate the site and the shop, for instance to keep your cart and your login, are used without your consent because they are needed for the service you have asked for (§ 165(3) TKG 2021). The processing of your data connected with them is based on the performance of the contract and on our legitimate interest in a functioning shop (Art 6(1)(b) and (f) GDPR).

For analytics and marketing we use the following only with your consent (Art 6(1)(a) GDPR, § 165(3) TKG 2021): Google Tag Manager and Google Analytics 4, Meta Pixel and the Meta Conversions API including the server-side transmission of purchase events to Meta, and Klaviyo on-site tracking for tailored newsletters. In that context we transmit online identifiers such as cookie IDs, your IP address, information about the pages you view and about the products you view and buy. For the Meta Conversions API we also transmit your email address in hashed form so that the purchase can be matched to your Meta account.

We run our own consent banner and do not use a third-party consent tool. On your first visit you see a banner with the equally weighted options "Only necessary" and "Accept all". Under "Settings" you can enable or disable the category "Marketing & Analytics", which is not pre-selected. Your choice is stored in the cookie dig_consent (180 days). Without your consent no third-party scripts are loaded. The Cal.com calendar on the consultation page is only loaded once you click on it. You can withdraw or change your consent at any time through the link in the footer. In the Shopify checkout, Shopify's own cookie controls apply.

To operate the shop and fulfill your order we use the recipients below. The list reflects the position as at 28.10.2026 and is updated when our service providers change.

Where a recipient acts as our processor, a data processing agreement under Art 28 GDPR is in place. Where we rely on standard contractual clauses, you can obtain a copy from us using the contact details in the last section.

Recipient: BKS Bank AG, acting as an independent controller; for details see their privacy policy at https://www.bks.at/footer/datenschutz. Purpose: banking (settlement of payments and refunds). Legal basis: Art 6(1)(b) and Art 6(1)(c) GDPR. Registered office: Austria (Klagenfurt am Wörthersee). Transfer basis: none, recipient within the EU.

Recipient: 7BOTANICALS PTE. LTD., acting as our processor under a data processing agreement pursuant to Art 28 GDPR. Purpose: creation and maintenance of the website. Legal basis: our legitimate interest in a professionally built and maintained website (Art 6(1)(f) GDPR). Registered office: Singapore.

Recipient: the lawyers instructed by us, acting as independent controllers. Purpose: legal advice and the enforcement and defence of legal claims. Legal basis: Art 6(1)(f) GDPR. Registered office: Austria (Vienna). Transfer basis: none, recipient within the EU.

Recipient: a debt collection agency instructed by us, acting as an independent controller. Purpose: recovery of outstanding claims. Legal basis: our legitimate interest in recovering unpaid invoices (Art 6(1)(f) GDPR). Registered office: Austria. Transfer basis: none, recipient within the EU.

Recipient: our tax advisor, acting as an independent controller. Purpose: bookkeeping and compliance with statutory obligations. Legal basis: Art 6(1)(c) and Art 6(1)(f) GDPR. Registered office: Austria. Transfer basis: none, recipient within the EU.

Recipient: Vercel Inc., acting as our processor under a data processing agreement pursuant to Art 28 GDPR; privacy information at https://vercel.com/legal/privacy-policy. Purpose: website hosting and content delivery. Legal basis: our legitimate interest in the secure and stable operation of the site (Art 6(1)(f) GDPR). Registered office: USA (application region Frankfurt, edge servers worldwide). Transfer basis: EU-US Data Privacy Framework.

Recipient: Cloudflare, Inc., acting as our processor under a data processing agreement pursuant to Art 28 GDPR; privacy information at https://www.cloudflare.com/privacypolicy/. Purpose: DNS and content delivery (CDN). Legal basis: Art 6(1)(f) GDPR. Registered office: USA. Transfer basis: EU-US Data Privacy Framework, and standard contractual clauses (Art 46(2)(c) GDPR).

Recipient: Shopify International Ltd. / Shopify Inc., acting as our processor under a data processing agreement pursuant to Art 28 GDPR; privacy information at https://www.shopify.com/legal/privacy. Purpose: shop system, checkout, customer account. Legal basis: Art 6(1)(b) GDPR. Registered office: Ireland / Canada. Transfer basis: adequacy decision for Canada (Art 45 GDPR), Ireland is within the EU.

Recipient: Shopify Payments, acting as an independent controller; for details see their privacy policy at https://www.shopify.com/legal/privacy. Purpose: payment processing (card, Apple Pay, Google Pay, Shop Pay). Legal basis: Art 6(1)(b) GDPR. Registered office: Ireland. Transfer basis: none, recipient within the EU.

Recipient: ARINA JEWELLERY, acting as our processor under a data processing agreement pursuant to Art 28 GDPR. Purpose: finishing, production and direct shipping of the goods. Legal basis: Art 6(1)(b) GDPR. Registered office: India. Transfer basis: standard contractual clauses (Art 46(2)(c) GDPR).

Recipient: the parcel carrier commissioned for your shipment, acting as an independent controller. Purpose: transport and delivery of the goods. Legal basis: Art 6(1)(b) GDPR. Registered office: depends on the shipment, India and the country of destination. Transfer basis: standard contractual clauses (Art 46(2)(c) GDPR).

Recipient: the customs authorities and customs agents involved in the export and in the import, acting as independent controllers. Purpose: customs clearance of your shipment. Legal basis: Art 6(1)(b) and Art 6(1)(c) GDPR. Registered office: India and the country of destination. Transfer basis: Art 49(1)(b) GDPR.

Recipient: our transport insurer, acting as an independent controller. Purpose: insurance of the shipment and handling of claims for loss or damage. Legal basis: Art 6(1)(b) and Art 6(1)(f) GDPR.

Recipient: Klaviyo, Inc., acting as our processor under a data processing agreement pursuant to Art 28 GDPR; privacy information at https://www.klaviyo.com/legal/privacy-notice. Purpose: newsletter. Legal basis: Art 6(1)(a) GDPR. Registered office: USA. Transfer basis: EU-US Data Privacy Framework.

Recipient: Resend, Inc., acting as our processor under a data processing agreement pursuant to Art 28 GDPR; privacy information at https://resend.com/legal/privacy-policy. Purpose: sending our emails, in particular order confirmations and replies to enquiries. Legal basis: performance of the contract (Art 6(1)(b) GDPR) and our legitimate interest in reliable email delivery (Art 6(1)(f) GDPR). Registered office: USA. Transfer basis: EU-US Data Privacy Framework.

Recipient: Judge.me, acting as our processor under a data processing agreement pursuant to Art 28 GDPR; privacy information at https://judge.me/privacy. Purpose: product reviews. Legal basis: Art 6(1)(a) and (f) GDPR. Registered office: United Kingdom. Transfer basis: adequacy decision for the UK (Art 45 GDPR).

Recipient: Cal.com, Inc., acting as our processor under a data processing agreement pursuant to Art 28 GDPR; privacy information at https://cal.com/privacy. Purpose: appointment booking. Legal basis: Art 6(1)(b) and (f) GDPR. Registered office: USA. Transfer basis: standard contractual clauses (Art 46(2)(c) GDPR).

Recipient: Google Ireland Ltd. / Google LLC, acting as our processor under a data processing agreement pursuant to Art 28 GDPR (Google Ads Data Processing Terms); for details see their privacy policy at https://policies.google.com/privacy. Purpose: Tag Manager, Analytics 4, and in future Google Ads. Legal basis: Art 6(1)(a) GDPR. Registered office: Ireland / USA. Transfer basis: EU-US Data Privacy Framework.

Recipient: Meta Platforms Ireland Ltd. / Meta Platforms, Inc., acting as a joint controller (Art 26 GDPR); for details see their privacy policy at https://www.facebook.com/privacy/policy/. Purpose: Meta Pixel and Conversions API. Legal basis: Art 6(1)(a) GDPR. Registered office: Ireland / USA. Transfer basis: EU-US Data Privacy Framework.

For the Meta Pixel and the Conversions API we and Meta are joint controllers within the meaning of Art 26 GDPR, but only for the collection of the data on our website and its transmission to Meta. Everything Meta does with the data after that is Meta's own responsibility. We have agreed with Meta that Meta is responsible for informing you and for handling your requests concerning that further processing. The essence of that arrangement is set out in Meta's Controller Addendum at https://www.facebook.com/legal/controller_addendum. You can exercise your rights against us and against Meta, and we will forward your request if it concerns Meta's part.

Apart from the shop system and the newsletter tool named above we do not maintain a customer database. Google, Meta and Klaviyo tracking, including the server-side purchase event to Meta, runs only after your consent.

Some recipients are located outside the EEA. Transfers to the USA rely, for recipients certified under the EU-US Data Privacy Framework, on the Commission's adequacy decision of 10 July 2023. Where a recipient is certified we have additionally agreed standard contractual clauses, which apply if the certification lapses or the adequacy decision ceases to apply. For all other recipients in the USA the standard contractual clauses apply directly (Art 46(2)(c) GDPR).

Transfers to Canada and the United Kingdom rely on the respective adequacy decisions (Art 45 GDPR), transfers within the Shopify group additionally on its binding corporate rules (Art 47 GDPR). Transfers to India rely on standard contractual clauses (Art 46(2)(c) GDPR). Where your shipment is delivered outside the EEA, the transmission of your delivery data to the carrier and to the customs authorities of the country of destination is necessary for the performance of your contract with us (Art 49(1)(b) GDPR).

You can obtain a copy of the standard contractual clauses from us at any time using the contact details in the last section.

We keep your data only as long as necessary for the purposes for which it was collected. Statutory retention obligations remain unaffected, in particular the seven-year retention of accounting-relevant documents, which runs from the end of the calendar year concerned (§ 132 BAO, § 212 UGB).

In addition the following applies. Server logs are deleted after 30 days. Enquiries are deleted six months after they have been dealt with. Appointment data is deleted twelve months after the appointment. Account data is deleted when you delete your account. Newsletter data is deleted when you withdraw your consent, the record of your consent three years later. Reviews remain published until you ask us to delete them. Your cookie choice is stored for 180 days.

In justified individual cases, for example to assert or defend legal claims, we may keep data until the end of the applicable limitation period, which in exceptional cases can be up to thirty years.

We currently do not obtain personal data about you from third-party sources.

We do not use automated decision-making within the meaning of Art 22 GDPR. Neither the fraud check described above nor the tailoring of our newsletter produces legal effects concerning you or similarly significantly affects you. A decision not to accept an order is always taken by a person.

We would like to inform you that, provided the legal requirements are met:

You have the right to request information about which of your data we process (see Article 15 of the GDPR for details).

You have the right to request the rectification or completion of inaccurate or incomplete data concerning you (see Article 16 of the GDPR for details).

You have the right to erasure of your data (see Article 17 of the GDPR for details).

You have the right to request the restriction of the processing of your data (see Article 18 of the GDPR for details).

You have the right to object, on grounds relating to your particular situation, to the processing of your data which is based on our legitimate interests or those of a third party (see Article 21 of the GDPR for details).

You have the right to receive the data you have provided in a structured, commonly used and machine-readable format and to have it transmitted to another controller (see Article 20 of the GDPR for details).

You can object at any time to the processing of your data for direct marketing purposes, including any profiling connected with it. You do not have to give reasons and it costs you nothing. If you object, we will no longer process your data for those purposes (Article 21(2) and (3) GDPR). An email to the address below or the unsubscribe link in any of our messages is enough.

If we process your data based on your consent, you have the right to withdraw this consent at any time via the settings. This does not affect the lawfulness of the data processing carried out up to that point (Article 7(3) GDPR).

Should, contrary to expectations, your right to lawful processing of your data be violated, please contact us by mail or email. We will endeavour to address your concern promptly. However, you also have the right to lodge a complaint with the supervisory authority responsible for data protection matters in your jurisdiction.

In Austria this is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna.

If you have any further questions about the processing of your data, please feel free to contact us using the contact information provided below.

The controller within the meaning of Article 4(7) of the GDPR is:

Natascha Schenk, Diamonds in Glass

Moosbrunnweg 1, 8042 Graz, Austria

Email: office@diamondsinglass.com

Telephone: +43 676 9042472

Author of this Privacy Policy: Attorney Dr. Tobias Tretzmüller, LL.M.; www.digital-recht.at

Any use of this privacy policy, or even parts thereof, without the author's consent constitutes a copyright infringement.