Privacy Policy
1. Controller
The controller responsible for the processing of personal data on this website is:
Haldon Clark Limited
Mellergasse 4, OG 21
1230 Vienna
Austria
Email: privacy@haldonclark.com
2. General Information on Data Processing
We process personal data only insofar as this is necessary to provide a functional website, respond to enquiries, process orders and contracts, or for the other purposes described below. Personal data means any information relating to an identified or identifiable natural person.
The applicable legal basis is specified for each processing activity. Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
3. Retention Period
Unless a more specific retention period is stated in this Privacy Policy, we store personal data only for as long as necessary for the respective purpose. The data is subsequently deleted unless statutory retention obligations, particularly obligations under company or tax law, or legitimate reasons for further storage apply. Data relevant to contract performance and accounting is generally retained for seven years in accordance with statutory retention periods. A longer retention period may be necessary if the data is required for pending proceedings or for the establishment, exercise or defence of legal claims.
4. Your Rights
Subject to the applicable statutory requirements, you have the following rights in particular:
- the right of access to your personal data (Art. 15 GDPR),
- the right to rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR),
- the right to erasure (Art. 17 GDPR),
- the right to restriction of processing (Art. 18 GDPR),
- the right to data portability (Art. 20 GDPR),
- the right to object to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR), and
- the right to withdraw consent with effect for the future (Art. 7(3) GDPR).
If we process personal data for direct marketing purposes, you may object to such processing at any time. You can exercise your rights using the contact details provided above.
You also have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna.
5. Provision of the Website and Server Log Files
When you access our website, the web server processes technically necessary information. This may include, in particular, your IP address, the date and time of access, the page or file accessed, the amount of data transferred, the referrer URL, browser type and version, operating system and the requesting provider. Processing is necessary to provide the website securely and reliably, detect errors and prevent attacks and misuse.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our online services securely, reliably and without technical errors. Log data is generally stored for 14 days and subsequently deleted unless longer retention is necessary to investigate a specific security incident.
Hosting provider: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Where the hosting provider processes data on our behalf, a contract pursuant to Art. 28 GDPR is in place.
6. Contacting Us
If you contact us via a contact form, email or by other means, we process the information you provide, including your contact details, in order to handle your enquiry and any follow-up questions. Where your enquiry relates to a contract or pre-contractual measures, processing is based on Art. 6(1)(b) GDPR. In other cases, processing is based on our legitimate interest in properly handling enquiries pursuant to Art. 6(1)(f) GDPR. Where we obtain consent, the legal basis is Art. 6(1)(a) GDPR.
We delete the data once your enquiry has been conclusively resolved and no statutory retention obligations or legitimate reasons for further storage apply.
7. Customer Account
You may create a customer account. In doing so, we process the information marked as mandatory as well as any information provided voluntarily in order to provide the customer account and process orders. The legal basis is Art. 6(1)(b) GDPR.
You may request the deletion of your customer account at any time. However, data relating to orders that have already been completed will continue to be stored where statutory retention obligations or other legal grounds apply.
8. Orders and Contract Processing
When you place an order, we process, in particular, master data, contact details, delivery details, order details, invoice details and payment data. Processing serves to initiate and perform the contract and is based on Art. 6(1)(b) GDPR. Where processing is necessary to comply with legal obligations, particularly retention obligations under tax and company law, it is based on Art. 6(1)(c) GDPR.
For the purpose of contract processing, we transmit the necessary data to the shipping and logistics service providers, payment service providers and banks we use, as well as, where applicable, tax advisers, IT service providers and public authorities. Data transfers are limited to the extent necessary for the respective purpose.
Shipping and logistics service provider: General Logistics Systems Austria GmbH, Traunuferstraße 105a, 4052 Ansfelden, Austria.
9. Payment Service Providers
When you select one of the available payment methods, the data required to process the payment is transmitted to the respective payment service provider. This may include your name, address, email address, order value, currency, transaction data, IP address and payment-related information. The legal basis is Art. 6(1)(b) GDPR. Where payment service providers process data to fulfil their own legal obligations or for fraud prevention, identity verification or credit checks, they act as independent controllers in this respect.
PayPal
The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Further information can be found in PayPal’s Privacy Statement.
Klarna
The provider is Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Depending on the payment method selected, Klarna may perform identity and credit checks. Further information can be found in Klarna’s Privacy Notice.
Stripe
We use Stripe for credit card and other payments. For users in the European Economic Area, Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, is involved in particular, depending on the service. Further information can be found in Stripe’s Privacy Policy. Stripe may also transfer data to affiliated companies and service providers outside the EEA. According to Stripe, the applicable transfer mechanisms under Chapter V GDPR are used for this purpose.
10. Newsletter
If you subscribe to our newsletter, we process your email address and, where applicable, the name you provide voluntarily for the purpose of sending the newsletter. Registration generally takes place using a double opt-in procedure. To document your consent, we store, in particular, the time of registration and confirmation as well as the IP address used.
The legal basis for sending the newsletter and any expressly authorised performance measurement is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 174 TKG 2021. Where the statutory requirements for advertising to existing customers are met, the newsletter may be sent on the basis of Section 174(4) TKG 2021 and our legitimate interest in direct marketing pursuant to Art. 6(1)(f) GDPR.
You may unsubscribe from the newsletter at any time using the unsubscribe link or by notifying us. Data stored exclusively for sending the newsletter will be deleted after you unsubscribe or stored on a suppression list where this is necessary to prevent further mailings or provide evidence of previous consent. Such evidence may be retained until the applicable limitation periods expire.
11. Cookies and Similar Technologies
Our website uses cookies and similar technologies, such as local storage and pixels. We use technically necessary technologies to provide the functions you have expressly requested and enable secure use of the website. Accessing or storing information on your device is based on Section 165(3) TKG 2021; the subsequent processing of personal data is based, depending on the purpose, particularly on Art. 6(1)(b) or (f) GDPR.
All technologies that are not technically necessary, particularly those used for analytics, marketing or external media, are used only after you have given your consent. The legal basis for accessing your device is Section 165(3) TKG 2021, while the legal basis for the subsequent processing of personal data is Art. 6(1)(a) GDPR. You may change your selection at any time with effect for the future via the cookie settings. You can also delete cookies already stored using your browser.
The specific technologies, providers, purposes, retention periods and recipients are listed in the cookie settings. You may view and change your selection at any time via the cookie settings.
12. Google Analytics 4
If you have given your consent, we use Google Analytics 4 to measure reach and analyse the use of our website. The provider for users in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The data processed may include, in particular, pages viewed, interactions, approximate location information, technical device and browser data, referrer information and your IP address. According to Google, IP addresses are not logged or stored but are used solely to determine approximate location data and are subsequently discarded.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 165(3) TKG 2021. You may withdraw your consent at any time via the cookie settings. We have concluded a data processing agreement with Google.
The retention period we have specified for event-related data is 14 months. Google may also process data in the United States. Google LLC is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses may also be used. Further information can be found in Google’s Privacy Policy and the information about Google Analytics.
13. Google Ads and Conversion Measurement
If you have given your consent, we use Google Ads, including conversion measurement, to measure the success of our advertisements and optimise advertising. The provider for users in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Cookies or comparable identifiers, device and browser data, your IP address, pages visited and interactions may be processed and linked to advertising contacts.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 165(3) TKG 2021. Google may also process data in the United States. Google LLC is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses may also be used. Further information can be found in Google’s Privacy Policy. You can manage your personalised advertising settings in Google My Ad Center.
14. Microsoft Advertising
If you have given your consent, we use Microsoft Advertising, including Universal Event Tracking (UET), to measure the success of advertisements and optimise advertising. The provider for users in the EEA is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Cookies or comparable identifiers, your IP address, device and browser data, pages visited and interactions may be processed.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 165(3) TKG 2021. Microsoft may also process data in the United States. Certified US companies within the Microsoft group may rely on the EU-US Data Privacy Framework; Standard Contractual Clauses may also be used. Further information can be found in Microsoft’s Privacy Statement. You can manage your interest-based advertising settings under Microsoft advertising settings.
15. YouTube
If you have given your consent, we embed videos provided by YouTube. The provider for users in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you play a video, your IP address, device and browser data, the page accessed and information about your use of the video may be transmitted to Google. If you are signed in to a Google account, Google may associate this information with your account.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 165(3) TKG 2021. No connection to YouTube may be established before consent is given. Google may also process data in the United States. Google LLC is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses may also be used. Further information can be found in Google’s Privacy Policy.
16. Data Transfers to Third Countries
Some service providers may process data outside the European Union or the European Economic Area. Such transfers take place only where the requirements of Art. 44 et seq. GDPR are met. This may be based, in particular, on an adequacy decision by the European Commission, including the EU-US Data Privacy Framework for appropriately certified US companies, or on the European Commission’s Standard Contractual Clauses and, where applicable, additional safeguards. Despite such safeguards, processing in third countries may involve a risk that public authorities could access the data and that European data subject rights may not be enforceable to the same extent.
17. Data Security
We take appropriate technical and organisational measures to protect personal data against loss, destruction, unauthorised access, alteration or disclosure. Confidential content is generally transmitted in encrypted form using TLS. Please keep the login details for your customer account confidential and log out after use, particularly when using shared devices.
18. Updates to This Privacy Policy
We update this Privacy Policy whenever our data processing activities, the services we use or the legal requirements change. The version published on this website at the relevant time applies.