–––––––––––––––––––––––––––
Data Protection Declaration
–––––––––––––––––––––––––––

1) Information on the Collection of Personal Data and Contact Details of the Controller
1.1 This declaration explains the processing of personal data in connection with www.sambeklik.com, including its personal website pages and online shop. Both form part of the same website and share technical services. Shop-specific processing described below takes place when you use the corresponding shop functions. Personal data means information relating to an identified or identifiable individual.
1.2 The controller within the meaning of the General Data Protection Regulation (GDPR) is Sam Beyglikli, trading as a sole trader and professionally known as Sam Beklik, Seitenstettengasse 5/37, 1010 Vienna, Austria, E-Mail: support@shop.sambeklik.com. You can contact the controller at this address about this declaration or to exercise your data protection rights.
1.3 HTTPS encryption protects data in transit between your browser and the website. Encryption does not prevent the recipients described below from processing information needed to provide their services.

2) Data Collection When You Visit Our Website
Accessing the website involves processing technical information necessary to deliver pages, operate the server and investigate security incidents. Depending on the request and server configuration, this includes:
– The requested page or file
– Date and time of access
– Response status and amount of data transmitted
– Referring page, where supplied by your browser
– Browser and operating system information
– IP address
The legal basis is Art. 6 (1) point f GDPR. Our legitimate interests are reliable website operation, troubleshooting and protection against unauthorised access and abuse. An IP address is personal data; it is not necessarily anonymised merely because it appears in a server log.
We use Hostinger for website hosting and e-mail services. Our hosting provider is HOSTINGER operations, UAB, Švitrigailos str. 34, 03230 Vilnius, Lithuania. Hosting involves storing website files, databases and technical logs; e-mail hosting involves processing message contents, attachments, sender and recipient details and delivery information. Hostinger and the infrastructure providers involved in delivering these services can receive the relevant data. Hosting is distinct from optional advertising or visitor tracking.
Further information about Hostinger’s processing is available at: https://www.hostinger.com/legal/privacy-policy
Storage is limited according to the criteria in section 15. Information about international processing is set out in section 13.3.

3) Cookies
Cookies and similar technologies can store information on, or retrieve information from, your device. Session cookies normally expire when the browser session ends; persistent cookies remain until their expiry or deletion.
Under § 165 (3) of the Austrian Telecommunications Act 2021 (TKG 2021), consent is required before storing or accessing information on your device unless the operation is solely necessary for transmitting a communication or strictly necessary to provide a service you explicitly request. This requirement also applies to comparable technologies that do not use cookies.
Shopping cart, requested login and consent-preference functions can qualify for this exception. WooCommerce uses cookies for cart contents and session identification. Other features, such as attribution, advertising and optional usage measurement, must be assessed separately; the installation of WooCommerce does not make every cookie necessary.
Where strictly necessary functions involve personal data, the legal basis is Art. 6 (1) point b GDPR for requested contractual functions, Art. 6 (1) point c GDPR for compliance with applicable obligations, or Art. 6 (1) point f GDPR for necessary operation and security, according to the purpose. Consent-based processing relies on Art. 6 (1) point a GDPR.
CookieYes provides our cookie banner and preference management. You can accept or reject optional categories through the banner and change a previously recorded choice through the cookie settings where that control is available. You may also withdraw consent by contacting support@shop.sambeklik.com. Withdrawal does not affect the lawfulness of earlier processing. It does not automatically delete information already lawfully retained for another purpose.
Browser settings also allow you to inspect, delete or restrict cookies. Restricting necessary cookies can affect cart, account and checkout functions. Cookie names and expiry periods depend on the enabled features and configuration; browser cookie information and the cookie preference information identify the applicable lifetimes.

4) Contacting Us
4.1 Enquiries and Customer Service
If you contact us by e-mail or through a form, we process your contact details, message, attachments and information necessary to handle your request. Required fields are indicated in the relevant form. Please avoid sending sensitive information unless it is necessary for your enquiry.
Processing relating to an order or steps you request before entering a contract is based on Art. 6 (1) point b GDPR. General enquiries are processed under Art. 6 (1) point f GDPR, based on our legitimate interest in responding to correspondence. Compliance with applicable legal obligations is based on Art. 6 (1) point c GDPR.
4.2 Technical Handling and Retention
Hostinger provides our e-mail service and therefore processes correspondence as part of providing that service. Contact form requests may also involve the website hosting infrastructure. Messages are retained according to their purpose and any applicable accounting, evidential or legal obligations, as explained in section 15.

5) Data Processing When Opening a Customer Account and for Contract Processing
When you create or use a customer account, we process the information entered in the account form, login credentials, account settings and associated order history to provide the requested account functions. The legal basis is Art. 6 (1) point b GDPR. Necessary security processing is based on Art. 6 (1) point f GDPR, with the legitimate interest of protecting accounts and preventing misuse.
When you place an order, we process the information needed for that transaction, such as your name, billing and delivery addresses, contact details, selected products, order value, payment method, payment status and order correspondence. This is based on Art. 6 (1) point b GDPR. Accounting and tax records are processed under Art. 6 (1) point c GDPR.
The relevant forms identify which information is required. Without information necessary for payment or delivery, we cannot complete the corresponding transaction. Optional information is not required merely to browse the website.
You may request deletion of your account by contacting support@shop.sambeklik.com. Account deletion does not require us to erase records that must be retained by law or are necessary to establish, exercise or defend legal claims.

6) Commentary Function
If you submit a comment or product review using an available publication function, we process the content, chosen display name and submission time. Published contributions are accessible to other visitors. An e-mail address supplied for administration is not intended for publication as part of the contribution.
Technical submission information, including an IP address where recorded, can be processed to prevent spam, investigate misuse and moderate unlawful content. The legal basis for necessary publication and moderation processing is Art. 6 (1) point f GDPR, based on our legitimate interests in operating the contribution function, preventing abuse and protecting the rights of others.
Do not include information about other people in a public contribution without an appropriate basis. You can contact us about correction or removal; the applicable rights and exceptions are explained in section 14.

7) Use of Client Data for Direct Advertising
We do not operate an e-mail newsletter. Accordingly, there is no newsletter registration, Mailchimp newsletter distribution or newsletter-open tracking described by this declaration.
Order confirmations, payment correspondence, delivery messages and responses to your enquiries are communications relating to the requested transaction or service. Their legal basis is the applicable basis explained in sections 4, 5 and 8.
Providing an e-mail address during checkout does not, by itself, constitute consent to advertising. Any consent-based advertising communication requires a separate, valid consent and an opportunity to withdraw it. Austrian rules governing unsolicited electronic communications, including § 174 TKG 2021, apply in addition to the GDPR.

8) Processing of Data for the Purpose of Order Handling
8.1 Order Fulfilment
We use WooCommerce to operate the shop. Order information is stored and processed through the website infrastructure. Data necessary for fulfilment is disclosed to the relevant delivery and payment providers, as described below, under Art. 6 (1) point b GDPR. Legal obligations, including tax documentation and legally required product-update notifications where applicable, are fulfilled under Art. 6 (1) point c GDPR.
Handling complaints, returns, refunds and warranty requests involves processing the corresponding order, contact and transaction information. The basis is Art. 6 (1) point b or c GDPR, depending on the obligation. Necessary processing to establish, exercise or defend legal claims is based on Art. 6 (1) point f GDPR.
8.2 Passing on Personal Data to Shipping Service Providers
Depending on the destination and shipment, we use Austrian Post, DHL or GLS. The carrier handling the shipment receives information necessary to deliver it, such as the recipient’s name, delivery address and relevant shipment details. For cross-border shipments, necessary data can also be provided to delivery partners and customs authorities. Required customs disclosures are based on Art. 6 (1) point c GDPR.
Contact details are provided where necessary for the selected delivery service or on the basis of an appropriate consent for an optional notification service. Optional notification processing must not be confused with information necessary to deliver the goods.
Carriers also process delivery information for their own transport, security and legal obligations. Further information is available from their privacy notices:
– Austrian Post: https://www.post.at/i/c/datenschutz
– DHL: https://www.dhl.com/global-en/home/footer/privacy-notice.html
– GLS Austria: https://gls-group.com/AT/de/datenschutz/
8.3 Use of Payment Service Providers
– WooPayments and Stripe
Our shop uses WooPayments, a WooCommerce payment service provided within the Automattic group and built in partnership with Stripe. Payment-related processing can therefore involve both WooPayments/Automattic and Stripe, even though payment management is integrated into our WooCommerce dashboard.
Depending on the payment selected, information processed includes customer and billing details, purchase amount and currency, payment identifiers, transaction status and technical information required for authentication and fraud prevention. Payment credentials entered into the provider’s payment interface are processed through the payment infrastructure. We receive transaction information needed to administer the order, refunds and payment disputes.
We disclose information necessary to process your chosen payment under Art. 6 (1) point b GDPR. Our necessary fraud-prevention and dispute-handling processing is based on Art. 6 (1) point f GDPR. Payment providers may act as processors for particular services and as independent controllers for their own regulatory, security and payment obligations, as specified in their terms and privacy notices.
Further information:
https://woocommerce.com/document/woopayments/our-policies/
https://automattic.com/privacy-notice/
https://automattic.com/privacy/
https://stripe.com/privacy
– Wallets and Other Payment Methods
The checkout displays the payment methods actually available for the particular order. If you choose a wallet such as Apple Pay or Google Pay, the wallet provider and the payment infrastructure process the information needed to authorise and complete that payment. Using a wallet can involve payment tokens rather than disclosure of the underlying card number to us.
If you choose a financing or other local payment method displayed at checkout, the relevant provider can also process data under its own customer agreement. Information about that provider’s processing, including any credit assessment or automated decision-making, is supplied through the payment flow and its privacy notice. Availability of a method through WooPayments does not mean it is used for every transaction.
Apple privacy information: https://www.apple.com/legal/privacy/
Google Payments privacy information: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice
You can exercise rights concerning a provider’s independent processing directly with that provider. You may also contact us about the disclosures made in connection with your order.

9) Online Marketing
Online advertising and measurement of advertising effectiveness are separate purposes from processing necessary to operate the website or complete an order. Device storage or access for these optional purposes requires prior consent under § 165 (3) TKG 2021; associated consent-based personal data processing is based on Art. 6 (1) point a GDPR.
Consent must identify the relevant purposes and services. You are not required to agree to optional advertising processing merely to place an order. The presence of a cookie banner does not, by itself, establish that a particular advertising service is active or that it is prevented from loading before consent.

10) Web Analysis Services
10.1 WooCommerce Analytics
We use WooCommerce’s shop reporting functions to review sales, orders, products, refunds and related commercial information. These reports draw on information processed in operating the shop. The legal basis for necessary order administration is Art. 6 (1) point b GDPR; internal commercial reporting is based on Art. 6 (1) point f GDPR, with the legitimate interest of understanding and managing the business. Statutory accounting processing is based on Art. 6 (1) point c GDPR.
WooCommerce Analytics is not, by itself, proof that Google Analytics or a separate general-purpose visitor tracking service is installed. Information about shop reporting is available at: https://woocommerce.com/document/woocommerce-analytics/
10.2 Technical Access Information and Optional Measurement
Server access information used for reliability and security is described in section 2. Processing it for those purposes is distinct from optional profiling or measurement of browsing behaviour. A claim that a service uses no cookies or shortened IP addresses does not, by itself, mean that it processes no personal data or requires no consent. Additional device-based attribution or measurement functions must be assessed under the rules in section 3.

11) Retargeting/Remarketing/Referral Advertising
Retargeting and cross-site advertising involve additional processing purposes, such as recognising visitors or linking visits to advertising interactions. Neither a purchase nor use of the personal website constitutes consent to these purposes. Where consent-based processing is involved, you may withdraw consent as described in sections 3 and 14. The right to object to direct marketing also applies to related profiling, as explained in section 14.2.

12) Site Functionalities
12.1 External Links
Following a link to a social network or another external website takes you to a service operated by that provider. The provider processes information about your visit under its own privacy notice. A normal link differs from embedded content that can establish a connection within our page.
12.2 YouTube Videos
We embed YouTube videos. For users in the European Economic Area, the relevant Google service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When an embedded player connects to YouTube or Google, the provider receives technical information such as your IP address, browser information and the page containing the video. Playback can involve cookies or similar technologies, identifiers and usage information. If you are signed into a Google account, the provider may associate activity with that account according to its settings and policies. A privacy-enhanced embed does not justify an assurance that no information is transmitted.
Optional device storage or access requires prior consent under § 165 (3) TKG 2021. Consent-based personal data processing is based on Art. 6 (1) point a GDPR. Merely displaying a cookie banner or playing a video does not automatically establish a valid, informed consent to all related processing.
Google privacy information: https://policies.google.com/privacy
12.3 Google Fonts
The website uses Google Fonts to display typefaces. Locally hosted font files are delivered through our hosting infrastructure without a font request to Google. Where fonts are retrieved from Google’s servers, Google receives the IP address and technical request information needed to deliver the files. Google Fonts does not need an advertising cookie to involve personal data processing.
Retrieving fonts externally requires an appropriate legal basis; visual consistency alone does not establish that the transfer is necessary or justify reliance on legitimate interests. For consent-based external retrieval, the legal basis is Art. 6 (1) point a GDPR. Local hosting avoids this external font request.
12.4 Google reCAPTCHA
We use Google reCAPTCHA to help distinguish legitimate interactions from automated abuse and protect website functions against spam and fraud. Processing can include IP addresses, browser and device information and interaction signals used to assess whether a request appears automated. Execution also involves a reCAPTCHA cookie.
For reCAPTCHA customer data, Google acts as a processor under the Google Cloud terms and data processing provisions applicable from 2 April 2026. This differs from Google’s independent processing for services such as YouTube.
Our necessary and proportionate security processing is based on Art. 6 (1) point f GDPR, with the legitimate interest of preventing automated abuse and protecting website functions. The exception from device-consent requirements applies only where the storage or access is strictly necessary for the service explicitly requested. Otherwise, prior consent is required under § 165 (3) TKG 2021 and consent-based personal data processing relies on Art. 6 (1) point a GDPR. A provider’s description of a cookie as necessary does not replace this assessment for the actual implementation.
Further information:
https://docs.cloud.google.com/recaptcha/docs/faq
https://cloud.google.com/terms/data-processing-addendum

13) Tools and Miscellaneous
13.1 CookieYes Consent Management
We use CookieYes, provided by CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom, to display the cookie banner and administer preferences. This involves a preference cookie and information about choices. Where consent logging is used, records can include a consent identifier, choices and their date and time, together with technical information required by the configured service.
Processing necessary to obtain and document consent is based on Art. 6 (1) point c GDPR in connection with applicable consent and accountability obligations. Necessary technical preference management is based on Art. 6 (1) point f GDPR, with the legitimate interest of respecting and administering visitors’ choices. Optional services themselves require their respective legal bases; CookieYes does not provide a legal basis for them merely by being installed.
Provider information: https://www.cookieyes.com/privacy-policy/
13.2 LiteSpeed Cache
We use LiteSpeed Cache to improve delivery speed and reduce server load by caching website resources. Processing necessary for website delivery and performance is based on Art. 6 (1) point f GDPR, with the legitimate interest of operating a responsive and reliable website. Installing the plugin does not, by itself, establish that an external CDN or optimisation service receives visitor data.
13.3 Recipients and International Processing
Recipients of data include the hosting and e-mail infrastructure, the payment providers involved in your transaction, the carrier handling your shipment, and providers of the website functions you use. Authorities receive information where disclosure is required by law. Professional advisers may receive information where necessary to meet legal obligations or establish, exercise or defend legal claims, under Art. 6 (1) point c or f GDPR as applicable.
Some services can involve processing outside the European Economic Area, including in the United States. Such processing requires a valid Chapter V GDPR transfer mechanism in addition to a legal basis for the underlying processing. Depending on the recipient, this can be an applicable European Commission adequacy decision or safeguards such as standard contractual clauses, together with supplementary measures where required. A provider’s general statement about safeguards does not establish that every transfer by this website is covered.
You may contact support@shop.sambeklik.com for information about the recipients, destinations and safeguards applicable to your data and, where appropriate, a copy of the relevant safeguards. Provider notices linked above also explain their processing and international arrangements. Cookie consent does not, on its own, replace the requirements for international transfers.

14) Rights of the Data Subject
14.1 The GDPR grants you the following rights, subject to the conditions and exceptions in the relevant provisions:
– Right of access pursuant to Art. 15 GDPR: You may request confirmation of processing, access to your personal data, a copy and information about purposes, recipients, retention and applicable safeguards.
– Right to rectification pursuant to Art. 16 GDPR: You may request correction of inaccurate data and completion of incomplete data.
– Right to erasure pursuant to Art. 17 GDPR: You may request deletion where the conditions in Art. 17 (1) are met. Exceptions include necessary compliance with legal obligations and the establishment, exercise or defence of legal claims.
– Right to restriction pursuant to Art. 18 GDPR: You may request restriction in the circumstances specified by that provision, including while a dispute about accuracy or an objection is being assessed.
– Information about recipients pursuant to Art. 19 GDPR: Where correction, erasure or restriction must be communicated to recipients, you may request information about those recipients.
– Right to data portability pursuant to Art. 20 GDPR: For automated processing based on consent or contract, you may request the data you provided in a structured, commonly used and machine-readable format and transmission to another controller where technically feasible.
– Right to withdraw consent pursuant to Art. 7 (3) GDPR: You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Data may still be retained where a separate lawful basis requires or permits this.
– Rights concerning automated decisions pursuant to Art. 22 GDPR: You have the protections set out in that provision concerning decisions based solely on automated processing that produce legal or similarly significant effects. Where applicable, these include human intervention, expressing your view and contesting the decision. A payment provider’s independent decision-making is addressed through that provider.
– Right to lodge a complaint pursuant to Art. 77 GDPR: You may complain to a competent supervisory authority, including the authority in your place of habitual residence, work or the alleged infringement. The Austrian authority is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria, E-Mail: dsb@dsb.gv.at, Website: https://www.dsb.gv.at/.
You may exercise your rights by contacting support@shop.sambeklik.com. Where necessary, proportionate information may be requested to verify your identity. Requests are normally answered within one month; a permitted extension will be explained within that period. You do not need to contact us before lodging a complaint.
14.2 RIGHT TO OBJECT
IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF ART. 6 (1) POINT F GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.
AFTER AN OBJECTION, WE WILL STOP THAT PROCESSING UNLESS WE DEMONSTRATE COMPELLING LEGITIMATE GROUNDS OVERRIDING YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
IF PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, INCLUDING TO PROFILING RELATED TO SUCH MARKETING. AFTER THAT OBJECTION, YOUR PERSONAL DATA WILL NO LONGER BE PROCESSED FOR THOSE PURPOSES.

15) Duration of Storage of Personal Data
Personal data is retained only for as long as necessary for the stated purpose or to meet applicable legal obligations. Retention depends on the type of information, the transaction or enquiry, the need to investigate security incidents and any relevant legal proceedings. A lawful basis does not justify indefinite storage.
Accounting records, invoices and supporting documents subject to Austrian tax retention requirements are generally retained for seven years from the end of the relevant calendar year. Longer periods apply where required by a specific statutory rule or relevant pending proceedings. This does not require every item of website usage data to be retained for seven years.
Contact information and correspondence are retained for handling the enquiry and any resulting transaction. Further retention is limited to applicable statutory requirements or necessary evidence for legal claims. Account information is retained for providing the account; after deletion, only information with a continuing lawful retention purpose is kept.
Technical logs are retained according to operational and security needs, taking account of their sensitivity and whether an incident requires investigation. Consent records are retained for administering choices and demonstrating consent where necessary. Cookies expire according to their configured duration or can be deleted through the browser. Consent-based data is deleted when its purpose ends or consent is withdrawn, unless another lawful retention ground applies.
Providers acting as independent controllers apply their own lawful retention periods, as explained in their notices. Erasure from active systems can be followed by expiry from backup systems through their backup cycle; retained backup information must remain protected and must not be reused for an incompatible purpose.

Last reviewed: 2 October 2026