Privacy policy

This privacy policy explains which personal data Entenfellner und Partner GmbH processes when you visit the BOOXit online shop at shop.booxit.cloud, place an order, create a customer account or contact us, and which rights you have. We process personal data only on the basis of the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). Version of 7 September 2026.

1. Controller

Entenfellner und Partner GmbH
Georg-Reitinger-Straße 7
4609 Thalheim bei Wels, Austria
E-mail: office@booxit.cloud
Phone: +43 7242 41151

We have not appointed a data protection officer, as we are not legally required to do so. For all questions on data protection, please contact us at the address above.

2. Overview of purposes and legal bases

We process personal data (a) to perform the contract with you and to take steps at your request before entering into a contract, Art. 6 (1) (b) GDPR; (b) to comply with legal obligations, in particular tax and commercial retention duties, Art. 6 (1) (c) GDPR; and (c) on the basis of our legitimate interests, Art. 6 (1) (f) GDPR, namely the secure and reliable operation of the shop, the answering of enquiries and the establishment, exercise or defence of legal claims. We do not process data on the basis of consent, except where you ask us to do so in a specific case; such consent can be withdrawn at any time with effect for the future.

3. Hosting, server logs and backups

Our shop is operated on a virtual server rented from IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, in a data centre in Frankfurt am Main, Germany. When you visit the shop, the web server records technical access data in log files: the IP address of the requesting device, date and time, the page or file requested, the amount of data transferred, the referring page, browser type and version and operating system. This data is needed to deliver the website, keep it secure and analyse errors; it is not merged with other data about you. Legal basis: Art. 6 (1) (f) GDPR. Log files are deleted after 14 days unless they have to be kept for the investigation of a security incident.

We keep encrypted backups of the shop database and media on storage rented from Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany (storage location within the EU). Backups are kept according to a rolling schedule for up to 12 months (14 daily, 8 weekly and 12 monthly snapshots) and are accessible only to us; data deleted from the shop disappears from the backups at the end of that period. Legal basis: Art. 6 (1) (f) GDPR and Art. 32 GDPR.

All connections to the shop are encrypted (TLS). Data processing agreements pursuant to Art. 28 GDPR are in place with the processors named in this policy.

4. Cookies and comparable technologies

Our shop uses only technically necessary cookies. They are required to operate the shop and are set without your consent pursuant to § 165 (3) TKG 2021; the cookie banner informs you about them and lets you save your preference.

We do not use analytics, tracking, advertising or social-media cookies, and we do not load fonts, scripts or images from third-party servers. The payment providers named in section 7 may set their own cookies on their pages once you are redirected to them or use their payment components in the checkout; these are subject to the providers' own privacy policies.

5. Customer account and registration

You can order as a guest or create a customer account. For an account we process your salutation, first and last name, e-mail address, password (stored only as a hash), phone number, billing and delivery addresses and, for business customers, company name and VAT ID. The e-mail address is confirmed by a double opt-in link; we log the time of the confirmation. Legal basis: Art. 6 (1) (b) GDPR. You can view and correct your data in the account at any time and ask us to delete the account; data that we must retain under statutory retention obligations (section 6) is then blocked instead of deleted. Guest accounts that were not used to complete an order are deleted automatically after 24 hours.

6. Orders, invoicing and contract processing

When you place an order we process the data you enter (name, addresses, e-mail address, phone number, company data and VAT ID where given), the order data (products, quantities, prices, order number), the payment method chosen and the payment status, and the communication about the order. We use this data to conclude and perform the contract, deliver the goods, issue invoices, process payments, withdrawals and returns, handle warranty claims and answer your questions about the order. Legal basis: Art. 6 (1) (b) GDPR. We are also required by law to retain invoices and business records; the legal basis for this is Art. 6 (1) (c) GDPR in conjunction with § 132 of the Federal Fiscal Code (BAO) and § 212 of the Commercial Code (UGB).

Order confirmations, invoices, dispatch notices and other transactional e-mails are sent from shop@booxit.cloud through the mail service of IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. We do not send newsletters or advertising e-mails.

Retention: order and invoice data is kept for seven years after the end of the calendar year of the order (§ 132 BAO) and, where a warranty or liability claim is open, until it is settled.

7. Payment providers

Depending on the payment method you choose, we share the data needed for the payment (name, e-mail address, billing and delivery address, order amount, currency, order number) with the following providers. The provider processes your payment data under its own responsibility and in accordance with its own privacy policy; card numbers and bank login details are never transmitted to or stored by us.

• Advance bank transfer: you transfer the amount to our account at Raiffeisenbank (BIC RZOOAT2L770); we process the sender name, IBAN and payment reference that appear on our bank statement.

Legal basis: Art. 6 (1) (b) GDPR.

8. Shipping providers

To deliver your order we pass your name, delivery address and, where needed for delivery notifications or to arrange a pallet delivery, your e-mail address and phone number to the carrier: Österreichische Post AG, Rochusplatz 1, 1030 Wien, Austria; General Logistics Systems Austria GmbH (GLS), Ansfelden, Austria; and, for pallet shipments, the freight forwarder commissioned for the shipment [FORWARDER(S) once contracted, e.g. Dachser Austria GmbH, DB Schenker, Gebrüder Weiss GmbH]. Legal basis: Art. 6 (1) (b) GDPR.

9. Contact form, e-mail and phone

When you use our contact form we process salutation, first and last name, e-mail address, phone number, subject and your message; when you write to us by e-mail or call us, we process the data you provide. We use this data solely to handle your request. Legal basis: Art. 6 (1) (b) GDPR where the request concerns a contract, otherwise Art. 6 (1) (f) GDPR. Requests are deleted once they have been dealt with and no statutory retention obligation applies, at the latest after 12 months.

10. Shop platform

Our shop runs on the Shopware software, which we operate ourselves. Certain platform services (the payment service described in section 7, extension management and licence checks) are provided by shopware AG, Ebbinghoff 10, 48624 Schöppingen, Germany, under a data processing agreement. Statistical revenue figures are transmitted to shopware AG for the operation of Shopware Payments; no customer names or addresses are transmitted for this purpose.

11. Recipients and transfers to third countries

Apart from the processors and providers named in this policy, we disclose personal data only to our tax adviser and bank, to legal advisers where necessary to enforce or defend claims, and, where legally required, to authorities and courts. We process data within the EU. Transfers to third countries take place only in the course of a payment via PayPal (section 7) and are safeguarded as described there.

12. Your rights

You have the right to access the personal data we hold about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21). To exercise these rights, contact us at office@booxit.cloud; we answer within one month. If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, phone +43 1 52 152-0, e-mail dsb@dsb.gv.at, www.dsb.gv.at. You may also complain to the supervisory authority of your place of residence.

13. Obligation to provide data, automated decisions

Providing the data marked as required in the order, registration and contact forms is necessary to conclude and perform the contract or to answer your request; without it we cannot accept your order. All other data is voluntary. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

14. Data security

We protect your data by technical and organisational measures appropriate to the risk (Art. 32 GDPR): encrypted transport, access restricted to the persons who need it, hashed passwords, encrypted off-site backups and regular security updates of the shop software.

15. Changes to this policy

We update this policy when the shop's processing operations change, for example when we add a payment method, carrier or newsletter. The version published in the shop applies.