Privacy policy

The protection of your personal data is an important concern for us. We process your data exclusively on the basis of the statutory provisions (GDPR, TKG 2021/TDDDG, DSG). In this privacy policy we inform you about the essential aspects of data processing within our online shop.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Gössl Gwand GmbH
Plainbachstrasse 4, 5101 Bergheim, Austria
Managing Director: MMag. Maximilian Gössl
E-mail: kundenservice@goessl.com
Telephone: +43 662 46966

A data protection officer has not been appointed. If you have questions about data protection, you can reach us at any time using the contact details given above, in particular by e-mail to kundenservice@goessl.com.

2. General information on data processing

We process personal data only to the extent necessary to provide a functioning website as well as our content and services. As a rule, processing takes place only with your consent or where the processing is permitted by statutory provisions.

The following in particular may serve as legal bases for the processing: your consent (Art 6(1)(a) GDPR), the performance of a contract or pre-contractual measures (Art 6(1)(b) GDPR), compliance with legal obligations (Art 6(1)(c) GDPR) and the safeguarding of our legitimate interests (Art 6(1)(f) GDPR).

3. Provision of the website and server log files

Each time our website is accessed, our hosting service provider automatically collects information transmitted by your browser. This includes: IP address, date and time of access, page accessed, volume of data transferred, browser type and browser version, operating system and the previously visited page (referrer).

This data is stored in server log files and serves the technical provision, the security and the stability of the website. The processing takes place on the basis of our legitimate interest in secure and trouble-free operation (Art 6(1)(f) GDPR).

For the map and the location search in our store finder, your browser loads data from servers of the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. In doing so, the Foundation receives your IP address and, where applicable, the place you enter in the search. The legal basis is our legitimate interest in a working store finder (Art 6(1)(f) GDPR).

4. Cookies and consent

Our website uses cookies and comparable technologies. Cookies are small text files that are stored on your device. Technically necessary cookies are required for the operation of the website and the basket; their processing is based on our legitimate interest (Art 6(1)(f) GDPR) and on § 165(3) TKG 2021.

Cookies and services that are not technically necessary – in particular for web analytics and advertising – are set exclusively following your express consent via our cookie consent banner (Art 6(1)(a) GDPR, § 165(3) TKG 2021/TDDDG). No such processing takes place before consent is given. You can withdraw or adjust your consent at any time with effect for the future via the cookie banner.

5. Order processing and customer account

In connection with an order we process the data required for the performance of the contract, in particular form of address, first and last name, billing and delivery address, e-mail address, telephone number as well as order and payment data. The processing takes place for the performance of the purchase contract and for the implementation of pre-contractual measures (Art 6(1)(b) GDPR).

You can create a customer account with us. The data provided is stored in order to allow you to manage your orders and address details. You can have a customer account deleted at any time. Statutory retention obligations remain unaffected by this.

We create and send your invoice with Sufio, a service of Sufio s.r.o., Bratislava, Slovakia. For this, Sufio receives the invoice data of your order and may also process it via its subsidiary Sufio Inc. in the USA; such a transfer takes place on the basis of the EU standard contractual clauses. The legal basis is the performance of the contract and our statutory obligation to issue invoices (Art 6(1)(b) and (c) GDPR).

For our customer loyalty programme Gössl Members Club we transmit the data of your order, including name, e-mail address, postal address, items and amounts, to hello again GmbH, Dr. Herbert-Sperl-Ring 3, 4060 Leonding, Austria. hello again operates the Gössl app and the points administration on our behalf; points are only credited if you are registered in the Gössl app with the same e-mail address. For members the legal basis is the performance of the contract (Art 6(1)(b) GDPR), otherwise our legitimate interest in a simple, automatic crediting of points (Art 6(1)(f) GDPR).

6. Hosting and shop system

Our online shop is operated and hosted by Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, Ireland. Shopify processes the data arising in the shop on our behalf, in particular for the provision of the website, for order processing and for the handling and securing of payments.

The legal basis is the performance of the contract (Art 6(1)(b) GDPR) as well as our legitimate interest in secure operation and in the prevention of fraud (Art 6(1)(f) GDPR).

7. Payment processing

Payments are processed via Shopify Payments (Shopify International Limited, address as above) and, if you pay with PayPal, via PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you pay with Klarna, Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, receives the data required for this. Depending on the payment method chosen, the data required for the payment is processed and transmitted to the respective payment service provider. The payment data may be checked in order to prevent fraud.

The legal basis is the performance of the contract (Art 6(1)(b) GDPR) as well as our legitimate interest in fraud prevention (Art 6(1)(f) GDPR).

8. Web analytics and advertising

We use Google Analytics 4 (property ID G-R5M3DY734J), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics serves the statistical evaluation of the use of our website. IP anonymisation is activated, so that your IP address is processed in shortened form.

Google Analytics is loaded exclusively following your express consent via our cookie consent banner. No collection takes place before consent is given. The legal basis is your consent (Art 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021/TDDDG). You can withdraw your consent at any time with effect for the future via the cookie banner.

A transfer of data to the USA cannot be ruled out. Such a transfer takes place on the basis of the EU standard contractual clauses and Google's certification under the EU-US Data Privacy Framework.

Likewise only following your consent via the cookie consent banner, we use Google Ads (Google Ireland Limited, address as above) and the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. With them we measure which ads lead to visits and orders, and we can show you ads for our products on Google, YouTube, Facebook and Instagram. Where we have your contact details, for example when you place an order, the Meta Pixel also transmits your e-mail address, telephone number, name and address in hashed (pseudonymised) form so that Meta can assign your visit to an account. The legal basis is your consent (Art 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021/TDDDG), which you can withdraw at any time with effect for the future via the cookie banner. A transfer of data to the USA cannot be ruled out; it takes place on the basis of the EU standard contractual clauses and the certification of Google and Meta under the EU-US Data Privacy Framework.

9. Newsletter

If you sign up for our newsletter, we use the double opt-in procedure: after your registration you receive an e-mail in which you confirm your registration. In this way we ensure that the registration actually originates from you. You can unsubscribe from the newsletter at any time, for example via the unsubscribe link in every newsletter e-mail. The legal basis is your consent (Art 6(1)(a) GDPR).

For sending our newsletter and for transactional e-mails we currently use the following service providers:

  • Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA – dispatch of our newsletter, including the confirmation e-mail when you sign up, and of notifications you request, for example when an item is available again. Following your consent in the cookie banner, Klaviyo also records which pages of our shop you visit so that our e-mails match your interests. Data is transferred to the USA on the basis of certification under the EU-US Data Privacy Framework.
  • Shopify (see section 6) – dispatch of order and shipping confirmations.
  • Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA – dispatch of individual service e-mails, for example your return label, the confirmation of a reservation in a store and the confirmation of receipt for forms. Data is transferred to the USA on the basis of the EU standard contractual clauses and certification under the EU-US Data Privacy Framework.

Transactional e-mails that serve the processing of your order are sent by us on the basis of the performance of the contract (Art 6(1)(b) GDPR).

10. Shipping and returns

In order to deliver your order we pass on your name and your delivery address to our shipping service provider DPD Austria (DPD Direct Parcel Distribution Austria GmbH). DPD uses this data for delivery and parcel tracking. The legal basis is the performance of the contract (Art 6(1)(b) GDPR).

We ship some orders from the warehouse of our logistics service provider iSklad in Senec (Slovakia). For this, iSklad receives your name, delivery address, telephone number and e-mail address as well as the items ordered and hands the parcel over to DPD or DHL. Items of individual partner brands are shipped to you directly by the manufacturer; for this, the manufacturer receives your name, delivery address and telephone number as well as the items ordered. The legal basis is the performance of the contract (Art 6(1)(b) GDPR).

You register returns on our page "Start a return". We create the return label via DPD Austria and send it to you by e-mail; for this, DPD receives your name, address, telephone number and e-mail address as well as the order number. Returns registered via the REVER returns portal up to the end of August 2026 were handled for us by HERMONT RTU, Inc. Sucursal en España. The legal basis is the performance of the contract (Art 6(1)(b) GDPR).

11. Content delivery network and security

For the secure and fast delivery of our website we use services of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA). Cloudflare provides a content delivery network and protects our website against harmful data traffic and against overload attacks. In addition, individual functions of our shop run on Cloudflare, such as the search, the wishlist, the basket in your customer account, reservations in a store, the contact form and the return registration. For this, Cloudflare stores the necessary data on our behalf, for example your customer number and the items you have saved or, for a reservation, your name and e-mail address; Cloudflare Turnstile protects individual forms against misuse. The legal basis is our legitimate interest in secure and efficient operation (Art 6(1)(f) GDPR) and, for the shop functions mentioned, the performance of the contract (Art 6(1)(b) GDPR). Data is transferred to the USA on the basis of certification under the EU-US Data Privacy Framework.

12. Merchandise management

We manage orders from the online shop in Shopify (see section 6). Orders up to 27 July 2026 were additionally processed in our merchandise management system (Intex). The provider of Intex acts for us as a processor and processes the data exclusively in accordance with our instructions. The legal basis is the performance of the contract (Art 6(1)(b) GDPR).

13. Recipients and processors

To provide our services we use carefully selected service providers. Insofar as they act for us as processors, data processing agreements pursuant to Art 28 GDPR are in place with them; payment service providers, shipping companies, manufacturers shipping directly and the OpenStreetMap Foundation process your data under their own responsibility. In detail these are:

  • Shopify International Limited, Dublin, Ireland – hosting, shop system, payment processing and order e-mails
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg – payment processing when paying with PayPal
  • Klarna Bank AB (publ), Stockholm, Sweden – payment processing when paying with Klarna
  • Google Ireland Limited, Dublin, Ireland – web analytics and advertising (only following consent)
  • Meta Platforms Ireland Limited, Dublin, Ireland – advertising on Facebook and Instagram (only following consent)
  • Klaviyo, Inc., Boston, USA – newsletter and notifications by e-mail
  • Plus Five Five, Inc. (Resend), San Francisco, USA – service e-mails
  • Sufio s.r.o., Bratislava, Slovakia – invoices
  • hello again GmbH, Leonding, Austria – Gössl Members Club and Gössl app
  • DPD Direct Parcel Distribution Austria GmbH – parcel delivery and return labels
  • iSklad, Senec, Slovakia – warehousing and shipping of some orders
  • DHL – parcel delivery for shipments from the warehouse in Senec
  • Manufacturers of individual partner brands – direct shipping of their items
  • HERMONT RTU, Inc. Sucursal en España (REVER) – returns processing until August 2026
  • Cloudflare, Inc., USA – content delivery network, security and individual shop functions
  • OpenStreetMap Foundation, Cambridge, United Kingdom – maps and location search in the store finder
  • Intex – merchandise management (orders up to 27 July 2026)

Your data is not transferred to recipients beyond the purposes stated.

14. Storage period

We process and store your personal data only for as long as is necessary to achieve the respective processing purpose. Data arising in connection with an order is stored by us for the duration of the performance of the contract.

In addition, we are subject to statutory retention obligations. In particular, under the Federal Fiscal Code (BAO) we are obliged to retain invoice-related documents for seven years. After these periods have expired, the data concerned is deleted, unless it is still required for other permissible purposes.

15. Your rights as a data subject

With regard to the personal data processed by us, you have the following rights:

  • Right of access to the processed data (Art 15 GDPR)
  • Right to rectification of incorrect data (Art 16 GDPR)
  • Right to erasure (Art 17 GDPR)
  • Right to restriction of processing (Art 18 GDPR)
  • Right to data portability (Art 20 GDPR)
  • Right to object to the processing (Art 21 GDPR)
  • Right to withdraw a consent given, with effect for the future (Art 7(3) GDPR)

To exercise your rights, a message to the controller's contact details given above is sufficient.

16. Right to lodge a complaint

If you are of the opinion that the processing of your data infringes data protection law, you have the right to lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority:

Austrian Data Protection Authority
Barichgasse 40-42, 1030 Wien
Web: www.dsb.gv.at

17. SSL and TLS encryption

For security reasons and to protect the transmission of confidential content, our website uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser begins with "https://". As long as the encryption is active, the data you transmit to us cannot be read by third parties.

Version of this privacy policy: October 2026. As our offering develops further or due to changed legal requirements, it may become necessary to adapt this privacy policy. You will find the respective current version on this page.