Last updated: October 20261. ControllerThe controller within the meaning of the GDPR is: solocca GmbH, Am Fischagraben 6, 2433 Margarethen am Moos, Austria, email: office@solocca.com2. Data collected and purposesServer log filesWhen you visit our website, information is automatically stored in server log files (IP address, browser type, operating system, referrer URL, date and time). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the website securely and without errors).NewsletterIf you subscribe to our newsletter, we process your email address solely to send information about our products and offers. Subscription uses the double opt-in procedure: your subscription only becomes active after you confirm via the link in our email. The data is stored in our newsletter system (listmonk). Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time, e.g. via the unsubscribe link in every newsletter.Orders and configuratorTo process orders we process your name, delivery and billing address, email address, your configuration (size, colours, stickers, back panel) and order details. If you upload your own image for the back panel, we store it to carry out your order. Payment data (e.g. card number) is processed directly by our payment provider Stripe; we only receive information about the payment status. Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and tax retention obligations (lit. c). Your configuration draft is stored only locally in your browser.WithdrawalIf you withdraw from a contract using our withdrawal form, we process the data you enter (name, email address, order number, optionally address, date and message) to handle your withdrawal and to confirm receipt. Legal basis: Art. 6(1)(b) and (c) GDPR.ContactIf you contact us by email, we process your details to handle your request. Legal basis: Art. 6(1)(b) or (f) GDPR.Affiliate trackingIf you open a referral link with a partner code, we store the code for the current session and count the visit using a shortened, non-reversible identifier of your IP address (SHA-256 hash) and your user agent. Only with your consent do we additionally store the code for 30 days in a cookie (sl_ref) so that the partner can be remunerated for a later order. Legal basis: Art. 6(1)(a) GDPR (cookie) and lit. f GDPR (counting visits).Location detectionWith your consent, we determine your country (Germany/Austria) from your IP address in order to preselect it in the configurator. The lookup is performed locally on our server using a database (MaxMind GeoLite2); your IP address is neither transmitted to third parties nor stored for this purpose. Legal basis: Art. 6(1)(a) GDPR.3. Disclosure to third partiesYour data is only passed on to third parties where this is necessary to perform the contract (e.g. shipping providers, payment providers), where you have consented, where we have a legitimate interest, or where we are legally obliged to do so. Service providers who process data on our behalf are contractually bound to data protection (Art. 28 GDPR). Where data is transferred to countries outside the EEA, this is based on the EU Commission's standard contractual clauses or an adequacy decision.4. Storage periodYour data is stored only as long as necessary for the respective purposes or as required by statutory retention periods (generally 7 years for tax-relevant documents under Section 132 BAO). We store newsletter data until you withdraw your consent.5. Your rightsYou have the right to:– Access to your stored data (Art. 15 GDPR)– Rectification of inaccurate data (Art. 16 GDPR)– Erasure of your data (Art. 17 GDPR)– Restriction of processing (Art. 18 GDPR)– Data portability (Art. 20 GDPR)– Object to processing (Art. 21 GDPR)– Withdraw consent you have given (Art. 7(3) GDPR)
To exercise your rights, please contact: office@solocca.comYou also have the right to lodge a complaint with the Austrian Data Protection Authority (https://www.dsb.gv.at).6. Cookies and local storageOur website uses technically necessary cookies and local storage required for operation, e.g. storing your cookie choice (cookie "klaro", 12 months), your cart and configuration draft, and configurator settings (local storage or session storage of your browser). We set further cookies only with your consent via our cookie banner: affiliate tracking (cookie "sl_ref", 30 days) and location detection. We do not use analytics or marketing services. You can change your choice at any time via "Cookie settings" in the footer.7. External servicesPayment processing (Stripe)Payments are processed by Stripe Payments Europe, Ltd., Ireland (where applicable Stripe, Inc., USA). The data required for the payment (including name, email address, amount, payment data) is transmitted directly to Stripe. Legal basis: Art. 6(1)(b) GDPR. Information: https://stripe.com/at/privacyShipping (Sendcloud)To create shipping labels we use Sendcloud B.V., the Netherlands. We transmit your name, delivery address and email address to Sendcloud and to the commissioned parcel carrier. Legal basis: Art. 6(1)(b) GDPR.Content and images (Plasmic)Content and images of this website are provided via Plasmic (Plasmic Inc., USA; delivered via img.plasmic.app). Your IP address is transmitted to Plasmic when you access the site. Legal basis: Art. 6(1)(f) GDPR (efficient, secure provision of the website).Error monitoring (GlitchTip)To detect and fix technical errors we use GlitchTip (Sentry-compatible). Error reports (including error text, browser, page visited) are sent via our own server to our error monitoring system. Legal basis: Art. 6(1)(f) GDPR.Email delivery and data storageWe send order, invoice and other transactional emails through an email service provider we have commissioned. Uploaded images and invoice PDFs are stored in S3-compatible object storage. Legal basis: Art. 6(1)(b) and (f) GDPR. 
