Privacy Policy
Last updated: August 2026
1. Data Controller
The data controller responsible for data processing on this website is:
Sara Mast
Riesstraße 160
8010 Graz, Austria
Email: studiosaramast@proton.me
Phone: +43 6703556962
2. General Information
I only process personal data of website users to the extent necessary
to provide a functioning website and my content and services.
Processing takes place only with users' consent or, where legally
permitted, on other legal grounds (Art. 6 GDPR), in particular for the
performance of a contract, compliance with legal obligations, or on the
basis of legitimate interests.
3. Hosting and Shop Software (Shopify)
This website is operated and hosted via the Shopify platform (Shopify
Inc., 151 O'Connor Street, Ottawa, ON K2P 2L8, Canada, and/or Shopify
International Limited for the EU). Shopify processes technical data on
my behalf (including IP address, access time, browser type) to operate
the shop. A data processing agreement is in place with Shopify. As
Shopify processes some data outside the EU, Standard Contractual Clauses
issued by the European Commission are used to ensure an adequate level
of data protection.
More information: https://www.shopify.com/legal/privacy
4. Cookies
This website uses technically necessary cookies (e.g. for the shopping
cart, session management, language settings) required to operate the
shop. These do not require separate consent.
5. Orders and Purchase Processing
When you place an order with me, I collect the following data as
necessary for order fulfillment: name, billing and shipping address,
email address, phone number (if provided), and payment information.
This data is processed for the performance of a contract (Art. 6(1)(b)
GDPR) and stored only as long as required by law (in particular for tax
purposes, generally 7 years).
6. Payment Processing
I use the following providers for payment processing:
Shopify Payments: Payment data (e.g. credit card details) is transmitted
directly to and processed by Shopify Payments (Stripe infrastructure).
More information: https://www.shopify.com/legal/privacy
PayPal: If you select PayPal as your payment method, the data required
for this purpose (including name and payment details) is transmitted
to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal,
L-2449 Luxembourg. PayPal is independently responsible for its own data
processing.
PayPal's privacy policy: https://www.paypal.com/us/webapps/mpp/ua/privacy-full
The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).
7. Shipping
To deliver your order, I share the necessary data (name, shipping
address, and, where applicable, phone number/email for shipping
notifications) with the shipping provider engaged (Austrian Post,
DHL, GSL). The legal basis is the performance of a contract
(Art. 6(1)(b) GDPR).
8. Contact
If you contact me by email, phone, or contact form, your information
will be stored by me to process your inquiry and any follow-up
questions (Art. 6(1)(b) or (f) GDPR).
9. Newsletter
If you sign up for my newsletter, I use your email address to send
you regular information about my products. Sign-up follows a
double opt-in process: after signing up, you will receive a
confirmation email. The legal basis is your consent (Art. 6(1)(a)
GDPR), which you may withdraw at any time via the unsubscribe link in
every email.
10. Disclosure of Data
Your data is only disclosed to third parties as described above
(Shopify, payment providers, shipping providers) or where I am
legally required to do so. I do not share data with third parties for
advertising purposes without your consent.
11. Your Rights
You have the right at any time to:
- Access the data I hold about you (Art. 15 GDPR)
- Rectify inaccurate data (Art. 16 GDPR)
- Request deletion of your data (Art. 17 GDPR)
- Restrict processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing (Art. 21 GDPR)
- Withdraw any consent given, with effect for the future
To exercise these rights, simply send an informal email to:
studiosaramast@proton.me
You also have the right to lodge a complaint with the Austrian data
protection authority:
Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40-42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
12. Updates to this Privacy Policy
This privacy policy may be updated as needed, for example when
introducing new tools (newsletter, analytics tools) or in response to
changes in the law. The version published on this page at any given
time applies.