As of July 2023

Responsible person for data protection, It General Data Protection Regulation (GDPR)

Peter Riedl

Fleischmarkt 16/1/R

1010 Vienna

Telephone: +43 1 276 30 51

office@mandalhof.at

Basics:

The following data protection declaration is intended to inform you about the type, scope and purpose of the collection and use of personal data by the website operator (“U&W Gmbh”).

We take your data protection very seriously and treat your personal data confidentially and in accordance with legal regulations. Since changes to this data protection declaration may be made due to new technologies and the constant development of this website, we recommend that you read the data protection declaration again at regular intervals.

Data protection

Introduction

This privacy policy describes:

• What information we collect and why we collect it
• How we use this information
• What choices you have to access information and update or delete information

We have tried to keep this data protection declaration as simple as possible. If you have any questions after reviewing the privacy policy, please do not hesitate to contact us at office@mandalhof.at or info@pelikastri.com .

This privacy policy was last updated on July 4th, 2023.

What information do we collect and how do we collect information

Personal information submitted by you

When you visit our websites, your IP address is transmitted to our servers and stored for a certain period of time. When you use certain parts of our websites, for example when requesting information, contacting us via our web contact form or registering for a newsletter, you may be required to provide your name and email address to identify you as an individual .

Non-Personal Information

When you visit our website, we may collect non-identifying information from you, such as your interactions with the website and our services, referring URL, browser, operating system and cookie information.

Information we collect from third parties

In addition to the personal information you provide, we use third-party services to collect additional information about your visit when you visit our websites or register for our services. More on this below.

How we use the personal information we collect

We will never sell, transfer or transfer your personal information to third parties without your consent

pass along. However, you agree that we may use your information as follows:

• To increase and improve the user experience
• To provide you with our services

• To contact you and respond to inquiries via telephone, email or newsletter

• To document any communication with you

In addition, we may disclose your information to the authorities for law enforcement if we are compelled to do so by a court order, if there is a breach of EU law or if there is a breach of the Terms of Use or Privacy Policy.

Sharing of Personal Information

The personal information that you have submitted to our website or that we collect through the third-party services mentioned will be shared with certain third-party services in order to provide and improve our service to you.

• Österreichische Post AG, corporate headquarters Rochusplatz 1, 1030 Vienna, Austria – delivery data
• Squarespace Ireland Limited
  Attention: Legal – Privacy
  Squarespace House
  Ship Street Great
  Dublin 8, D08N12C
  Ireland

Access and control of personal data

As a user, you have the right to information, correction, data transfer and deletion as well as to revoke your consent.

1.Data collection:

When you use the website, we only collect log data that your browser transmits to our server and that is necessary for technical processing. These are:

• Website visited
• Date and time at the time of access
• Amount of data sent in bytes
• Referring domains from which you came to the site
• Which browser you use and the language used
• The operating system used and the IP address.

1.a:

Processing is carried out in accordance with Article 6 Paragraph 1 GDPR based on our legitimate interest in improving the stability and functionality of our website. We will not pass on or otherwise use the data. However, we reserve the right to subsequently check the server log files if there are concrete indications of illegal use.

We would like to point out that our website is created and hosted using SquarespaceTM.

The Squarespace provider is Squarespace Ireland Ltd., Le Pole House, Ship Street Great, Dublin 8, Ireland (hereinafter referred to as Squarespace). Squarespace a tool for creating and hosting websites. When you visit our website, your data will be processed on Squarespace’s servers. Personal data may also be transmitted to Squarespace’s parent company, Squarespace Inc., 8 Clarkson St, New York, NY 10014, USA. Squarespace also stores cookies that are necessary to display the site and to ensure security (essential cookies). The use of Squarespace is based on Article 6 Paragraph 1 Letter f GDPR. We have a legitimate interest in ensuring that our website is presented as reliably as possible. If appropriate consent has been requested, processing is carried out exclusively on the basis of Art. 6 Para. 1 lit . B. Device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time. Data transfer to the USA is based on the EU Commission’s standard contractual clauses. Details can be found here:

https://support.squarespace.com/hc/de/articles/360000851908-DSGVO-und-Squarespace

Squarespace collects personal information when you visit this website. This includes:

• Information about your browser, network and device
• Web pages that you visited before visiting this website
• Web pages that you visit on this website
• Your IP address

Squarespace needs the data to operate this website and to protect and improve its platform and services. Squarespace analyzes the data in a depersonalized form.

This website collects personal data that serves as the basis for Squarespace website analytics. This includes:

• Information about your browser, network and device
• Web pages that you visited before visiting this website
• Your IP address

This information may also include details about your use of this website, including clicks, internal links, pages visited, scrolling, searches, timestamps

1b:

We share this information with Squarespace, our website analytics provider, to learn more about traffic and activity on this website.

On July 16, 2020, the Court of Justice of the European Union invalidated the EU-US Privacy Shield. Squarespace will no longer use the Privacy Shield frameworks as a legal basis for transferring personal data to the United States. However, Squarespace continues to apply these principles to provide additional protection.

Questions about the data collected or a request for deletion can be sent to info@pelikastri.com or privacy@squarespace.com.

2.Cookies:

This website uses cookies, which are small files that are stored on your device. The use of cookies increases the user-friendliness and security of this website. If you do not want to allow cookies to be stored on your device, you can change this in your browser settings, among other things. We would like to point out that this does not guarantee that all functions of the website will work or that access will then work for you.

Cookies are deleted after the end of the browser session, i.e. after closing your browser (so-called session cookies). Other cookies remain on your device and enable you to recognize your browser the next time you visit (so-called persistent cookies). If cookies are set, they collect and process certain user information such as browser and location data as well as IP address values ​​on an individual basis. Persistent cookies are automatically deleted after a specified period of time, which may vary depending on the cookie. You can find out how long each cookie is stored in the overview of the cookie settings in your web browser.

In some cases, cookies are used to simplify the ordering process by storing settings (e.g. remembering the contents of a virtual shopping cart for a later visit to the website). If personal data is also processed through individual cookies we use, the processing takes place in accordance with Art. 6 Para. 1 lit. b GDPR either to implement the contract, in accordance with Art. 6 Para. 1 lit in accordance with Art. 6 Para. 1 lit. f GDPR to protect our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit

Please note that you can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them or exclude the acceptance of cookies for certain cases or in general. Each browser differs in the way it manages cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings.

For information about viewing the cookies placed on your device, see

About the cookies Squarespace uses – Squarespace Help Center

These functional and necessary cookies are always used because they allow Squarespace, our hosting platform, to securely deliver this website to you.

As described, these analytics and performance cookies are only used on this website if you confirm our cookie banner. This website uses analytics and performance cookies to gain insight into site traffic, site activity and other data.

To find out more about cookies, how to see what cookies have been set and how to manage and delete them, please visit www.allaboutcookies.org .

The Network Advertising Initiative has also developed a tool to help you understand which third parties currently have cookies enabled on your browser and how to decline those cookies. For more information, see http://www.networkadvertising.org/managing/opt_out.asp.

3.Collection and processing of personal data:

The website operator only collects, uses and passes on your personal data if this is permitted by law or if you consent to the data collection.

Personal data includes all information that is used to identify you as a person and that can be traced back to you – for example your name, email address and telephone number.

You can also visit this website without providing any personal information. However, in order to improve our online offering, we store your access data to this website (without personal reference). These access data include, for example: B. the file you requested or the name of your internet provider. By anonymizing the data, it is not possible to draw conclusions about you personally.

3a.When you make a purchase in our webshop, we process personal data such as:

• First name
• Last name
• IP address
• E-mail address
• Place of residence/delivery address
• Postal code
• Information from the contact form/info in the order form
• amounts
• Payment provider

3b.We only process personal data with the express consent of the users concerned and in compliance with the applicable data protection regulations. Personal data that you share with us via the contact form or email will be stored and used exclusively for the purpose of answering your message and, if necessary, making further contact. (including associated technical administration). The legal basis for this is Art 6 Paragraph 1 a, bu/oc, GDPR.

3c.The processing of personal data takes place to fulfill our contractually agreed services and to optimize our online offering (legitimate interest). This also applies to processing operations that are necessary to carry out pre-contractual measures

Without your consent, this data will not be passed on to third parties, apart from to fulfill contractual obligations .

3d.Which data is collected can be seen from the respective input forms. We store and use the data you provide to process the contract. After the contract has been fully processed or your customer account has been deleted, your data will be deleted in consideration of legal deadlines (currently after 8 years).

3e.When you purchase something on this website, we collect personal information from you to complete the order

to handle. We may collect information such as: B. Your:

• Billing and shipping address
• Details about your purchase (e.g. your order quantity)
• E-mail address
• Surname
• Telephone number

We share this information with Squarespace, our online store hosting provider, so that they can provide website services to us.

Find out more here: Privacy Policy – ​​Squarespace

As you go through the checkout process, this website may automatically complete your shipping and billing address by sharing your input with the Google Places API and making suggestions to improve your checkout process.

To process payments, we work with technical service providers, credit institutions and payment service providers. Depending on the payment method selected, we pass on the personal data you provide to our technical service providers or to the commissioned credit institutions or to the selected payment service provider to process the payment, insofar as this is necessary to process the payment.

If you submit information to this website via a web form, we collect the information requested in the web form in order to track and respond to your submissions. We share this information with Squarespace, our online store hosting provider, so that they can provide us with website services. We also share this information with Zapier for data transfer purposes.

3f.Data processing for order processing

To process your order, we work with service providers (e.g. product suppliers, shipping companies and logistics centers) who support us in whole or in part in the implementation of concluded contracts. Certain personal data (name, address, items ordered and quantity) will be transmitted to these service providers in accordance with the following information . For delivery type “Pickup”

The personal data we collect will be passed on to the transport company commissioned with the delivery as part of the order processing, to the extent that this is necessary to deliver the goods.

4. Data processing for advertising purposes (direct advertising)

Certain personal data provided by you when placing an order (such as name, address, email address, order history) will be processed by us for the purpose of sending electronic and postal advertising material to the extent necessary.

The legal basis for the processing of your data for the purpose of electronically and postally sending self-promotional material is Art. 6 Para. 1 lit. f GDPR (necessary to protect our legitimate interests).

You have the right to object at any time to the processing of your personal data for the purpose of sending you promotional material. Objection is possible at any time and can be done during the ordering process in the online shop by clicking on a box provided for this purpose, by sending a message to the contact option described in this data protection processing or via a link provided for this purpose in the advertising email received.

If you register for our newsletter and consent to the processing of your personal data, we will use your personal data (such as name, address, email address, order history) to regularly send you our newsletter by post or electronically for advertising purposes. In the newsletter you will receive advertising material about our products (self-promotion) and about products and offers from our partner companies (external advertising).

The legal basis for sending our newsletter electronically and by post is your consent in accordance with Article 6 (1) (a) GDPR.

You can revoke your consent to the processing of your personal data for the purpose of sending our newsletter by unsubscribing from the newsletter. Unsubscribing is possible at any time and can be done either by sending a message to the contact option described in this data protection processing or, in the case of a newsletter received electronically, via a link provided for this purpose in the newsletter.

After unsubscribing from the online newsletter, we delete the relevant personal data unless you have expressly consented to further or different use of your personal data or we reserve the right to use data beyond this, which is permitted by law and which we inform you about in this data protection declaration inform.

We collect data from our website visitors via our site created with Squarespace. This can be via a contact form, a widget or cookies. In this way, data is collected, among other things, data such as

• names,
• Email address,
• IP addresses,
• referring domains and
• Browser settings such as the language used.

5.Rights of the person concerned

The applicable data protection law grants you comprehensive data subject rights vis-à-vis the person responsible regarding the processing of your personal data, which we will inform you about below:

1. Right to information in accordance with Art. 15 GDPR:

In particular, you have the right to information about your personal data processed by us, the processing purposes, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage period and the criteria for this Determination of the storage period, the existence of a right to correction, deletion, restriction of processing, objection to processing, complaint to a supervisory authority, the origin of your data if it was not collected from you by us, the existence of automated decision-making including profiling and If necessary, meaningful information about the logic involved and the scope that affects you and the intended effects of such processing, as well as your right to be informed about what guarantees exist in accordance with Art. 46 GDPR when your data is forwarded to third countries;

2. Right to correction in accordance with Art. 16 GDPR:

You have the right to immediate correction of incorrect data concerning you and/or completion of incomplete data stored by us;

3. Right to deletion in accordance with Art. 17 GDPR:

You have the right to request the deletion of your personal data if the requirements of Article 17 Para. 1 GDPR are met. However, this right does not apply in particular if the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;

4. Right to restriction of processing in accordance with Art. 18 GDPR:

You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data that you dispute is verified, if you refuse to have your data deleted due to unlawful data processing and instead request the restriction of the processing of your data if you reject your data to assert, exercise or defend legal claims after we no longer need this data after the purpose has been achieved or if you have lodged an objection for reasons relating to your particular situation, as long as it is not yet clear whether our legitimate reasons outweigh them;

5. Right to information in accordance with Art. 19 GDPR:

If you have asserted the right to rectification, deletion or restriction of processing against the controller, the controller is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this rectification or deletion of the data or restriction of processing, unless: this turns out to be impossible or involves disproportionate effort. You have the right to be informed about these recipients.

6. Right to data portability in accordance with Art. 20 GDPR:

You have the right to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request that it be transmitted to another person responsible, to the extent that this is technically feasible;

7. Right to revoke consent given in accordance with Art. 7 Para. 3 GDPR:

You have the right to revoke your consent to the processing of data at any time with future effect. In the event of revocation, we will delete the data concerned immediately unless further processing can be based on a legal basis for processing without consent. The revocation of consent does not affect the lawfulness of the processing carried out based on the consent before its revocation;

8. Right to complain in accordance with Art. 77 GDPR:

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in Austria the data protection authority, without prejudice to any other administrative or judicial remedy.

6. Right to object in accordance with Art. 21 GDPR

Users of this website can exercise their right to object and object to the processing of their personal data at any time.

If your personal data is processed to protect our legitimate interests (Art. 6 Para. 1 lit. f GDPR), you have the right to object to this processing at any time with future effect .

If you object to the processing, the personal data will no longer be processed. unless there are compelling legitimate reasons on our part that outweigh your interests, rights and freedoms or the processing serves to assert, exercise or defend our legal claims.

If personal data is processed on the basis of Article 6 Paragraph 1 Letter f of the GDPR in order to conduct direct advertising, you have the right to object at any time to the processing of your personal data for the purpose of such advertising.

If you object to processing for direct advertising purposes, the personal data will no longer be processed for these purposes.

If you would like correction, blocking, deletion or information about the personal data stored about you or have questions regarding the collection, processing or use of your personal data or would like to revoke your consent, please contact the following email address : office@mandalahof.at

7. Plugins and tools Google Fonts

This site uses so-called Google Fonts, which are provided by Google, for the uniform display of fonts. When you access a page, your browser loads the required fonts into your browser cache in order to display texts and fonts correctly. For this purpose, the browser you use must connect to Google servers. This gives Google knowledge that this website was accessed via your IP address. The use of Google Fonts is based on Art. 6 Para. 1 lit. f GDPR. The website operator has a legitimate interest in the uniform presentation of the typeface on his website. If appropriate consent has been requested, processing is carried out exclusively on the basis of Art. 6 Para. 1 lit . B. Device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time. If your browser does not support Google Fonts, a standard font will be used by your computer. Further information about Google Fonts can be found at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

8.Newsletter subscription

We offer you a newsletter in which we inform you about current events and offers. If you would like to subscribe to the newsletter, you must provide a valid email address. If you subscribe to the newsletter, you agree to receive the newsletter and the procedures explained.

We currently send the newsletter directly. Please check here again and again to see if we use a shipping service provider. We may send you marketing emails, from which you can unsubscribe by clicking the link at the bottom of the email. We may share your contact information with Squarespace, our email marketing provider, so that Squarespace can send these emails on our behalf.

Revocation and termination: You can revoke your consent to receive the newsletter at any time and thus cancel your newsletter subscription. After your termination, your personal data will be deleted. Your consent to receive the newsletter expires at the same time. At the end of each newsletter you will find the link to cancel.

9.Email:

We may send you emails regarding your order or account activity. This is how we can help you

for example, send an email to let you know that:

• You have created a customer account
• The password for your customer account has been reset or updated
• you have made a purchase
• Your order has been shipped

It is not possible to unsubscribe from these messages.

We share your contact information with Squarespace, our website hosting provider, so that Squarespace can send these emails to you on our behalf.

10.Instagram/Meta:

We have a profile on Instagram that you can access via a so-called button on our website.

Meta Inc can usually comprehensively analyze your user behavior when you visit their website or a website with integrated social media content (e.g. like buttons). Visiting our Instagram account triggers numerous data protection-relevant processing operations. For example, if you are logged in, the operator of the social media portal can assign your visit to your user account. However, your personal data may also be collected if you are not logged in or do not have an Instagram or Meta social media platform account. In this case, this data is collected, for example, via cookies that are stored on your device or by recording your IP address.

We clearly point out that we do not know or understand all of the processes of Meta Platforms Irelend Limited and associated networks and companies. We sell olive oil… Therefore: Details can be found in the terms of use and data protection regulations of the respective social media portals.

Instagram is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Data transfer to the USA is based on the EU Commission’s standard contractual clauses. Details can be found here:

You
https://www.facebook.com/legal/EU_data_transfer_addendum, https://help.instagram.com/519522125107875 etc

nd https://de-de.facebook.com/help/566994660333381.

Details on how they handle your personal data can be found in Instagram’s privacy policy: https://help.instagram.com/519522125107875.

11.Deletion of data

You have the right to restrict or object to the processing of your personal data or the right to exercise data portability in accordance with applicable law. You also have the right to lodge a complaint with a relevant supervisory authority, subject to applicable law. If EU data protection laws apply to you, we recommend that you submit such complaints to our leading supervisory authority:

Irish Data Protection Commissioner

Data Protection Commission

21 Fitzwilliam Square South, Dublin 2, D02 RD28

Ireland

Telephone: 01 7650100 and 1800437 737

Email: info@dataprotection.ie

This Website and Squarespace may be independent data controllers (“Independent Data Controllers”). Independent data includes data relating to your interactions with our website, such as IP address, device/browser details, websites visited before coming to your website and browsing activity on that website. Independently Responsible Data may be collected by the Services through an End User’s browser and technologies such as cookies. Note that Independently Responsible Data includes both Personal Data that is Squarespace’s responsibility and Personal Data that is yours.

Squarespace collects your payment information to be processed by third party providers (e-commerce payment systems). In this case, the terms and conditions and policies of the respective e-commerce payment system apply. We collect full payment information when they initially share their information with us or update their information so that we can forward it to the e-commerce payment systems. Your payment information is neither collected nor stored by our site or by squarspace.

12.Contact us!

If you have any further questions about this privacy policy or how we handle your data, or have any other questions, you can contact us at the following address:

U&W GmbH

Fleischmarkt 16/1/R

1010 Vienna, Austria

Email: office@mandalahof.at

Telephone: +43 1 276 30 51