The protection of your personal data is important to us. This Privacy Policy explains which personal data we process when you visit our website, contact us or place an order, why we process it and which rights you have.

1. Data controller

The controller responsible for the processing of personal data is:

fabrari e.U.
Sole proprietor: Farnaz Abrari
Herbeckstraße 94/3
1180 Vienna
Austria

Phone: +43 664 411 44 42
Email: welcome@fabrari.com
Website: https://www.fabrari.com/

2. Legal bases for processing

Depending on the individual processing activity, we process personal data on the following legal bases:

• your consent under Article 6(1)(a) GDPR;
• performance of a contract or pre-contractual measures under Article 6(1)(b) GDPR;
• compliance with a legal obligation under Article 6(1)(c) GDPR;
• our legitimate interests under Article 6(1)(f) GDPR.

Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

3. Website access and server logs

When you access our website, our hosting provider may process:

• your IP address;
• date and time of access;
• the page or file requested;
• the amount of data transferred;
• browser type and version;
• operating system;
• referring website;
• access and HTTP status information.

These data are processed to display the website, ensure its stability and security, and identify technical attacks or misuse.

The legal basis is our legitimate interest in providing a secure and functional website under Article 6(1)(f) GDPR.

Server logs are retained only for as long as necessary for security and technical purposes unless a longer period is required to investigate a specific incident or comply with a legal obligation.

4. Contacting us

If you contact us by email, telephone or contact form, we process the information you provide, such as:

• your name;
• email address;
• telephone number, where provided;
• the content of your enquiry;
• any additional information you voluntarily provide.

If your enquiry relates to an order or potential contract, the legal basis is Article 6(1)(b) GDPR. Other enquiries are processed on the basis of our legitimate interest in responding to you under Article 6(1)(f) GDPR.

The data will be deleted when they are no longer required, provided that no statutory retention obligations or legitimate interests require further storage.

5. Orders placed through our online shop

When you place an order, we process:

• your first and last name;
• billing and delivery addresses;
• email address;
• telephone number, where required or provided;
• ordered products;
• prices and payment information;
• order number;
• shipping and delivery information;
• date and time of the order;
• information concerning returns, refunds and complaints;
• customer account information, where applicable.

These data are used to process your order, allocate payments, deliver the products, handle returns and complaints, fulfil warranty obligations, comply with legal requirements and prevent fraud or misuse.

The legal bases are Article 6(1)(b), Article 6(1)(c) and, where necessary, Article 6(1)(f) GDPR.

Records required for accounting and taxation are generally retained for seven years. Longer retention may apply where required by law or necessary for the establishment, exercise or defence of legal claims.

6. Customer accounts

If you create a customer account, we process the information you provide, your login details, order history and account settings.

The legal basis is Article 6(1)(b) GDPR.

You may request deletion of your account at any time. Data subject to statutory retention requirements or required for legal claims will be deleted only after the relevant periods have expired.

7. Recipients of customer and order information

Where necessary for order processing, personal data may be shared with:

• hosting and IT service providers;
• providers of shop software and technical extensions;
• payment service providers and banks;
• shipping and delivery companies;
• accounting and tax advisers;
• legal advisers, authorities or courts where required.

Service providers processing personal data solely on our behalf are engaged under a data processing agreement in accordance with Article 28 GDPR.

8. Payments through Stripe

If you select a payment method processed by Stripe, the information necessary for the payment is transferred to:

Stripe Payments Europe, Limited
1 Grand Canal Street Lower
Grand Canal Dock
Dublin
Ireland

Stripe may process your name, billing address, email address, payment amount, currency, payment information, IP address, device information and fraud-prevention data.

The legal bases are Article 6(1)(b) GDPR and our legitimate interest in secure payment processing under Article 6(1)(f) GDPR.

Stripe may process information in the United States and other countries using recognised international transfer mechanisms.

Further information is available at:

https://stripe.com/at/privacy

9. Payments through PayPal

If you select PayPal, information necessary for payment processing is transferred to:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

PayPal may process your name, address, email address, telephone number, IP address, order information, payment amount and transaction data.

The legal bases are Article 6(1)(b) GDPR and our legitimate interest in secure payment processing under Article 6(1)(f) GDPR.

PayPal may process information for identity verification, fraud prevention and credit assessment under its own responsibility.

Further information is available at:

https://www.paypal.com/at/legalhub/paypal/privacy-full

10. Shipping and delivery

We provide the appointed shipping or delivery company with the information necessary to deliver your order.

This may include your name, delivery address, order or tracking number and, where necessary, your email address or telephone number.

The legal basis is Article 6(1)(b) GDPR.

11. Newsletter

If you subscribe to our newsletter, we process your email address and, where provided, your name.

Newsletter subscriptions generally use a double opt-in procedure. We may store the time of registration and confirmation and the IP address used to document the consent.

The legal basis for sending the newsletter is your consent under Article 6(1)(a) GDPR. Documentation of the consent is based on our legitimate interest under Article 6(1)(f) GDPR.

You may unsubscribe at any time by using the link included in each newsletter or by emailing welcome@fabrari.com.

After unsubscribing, your address will be removed from the active mailing list. It may be retained on a suppression list where necessary to document your withdrawal and prevent further messages.

12. Reviews and comments

If you leave a product review or comment, we process the information you submit and any technical data required to prevent misuse.

Your chosen name or pseudonym may be published. Your email address will not be displayed publicly.

The legal basis is your consent under Article 6(1)(a) GDPR or our legitimate interest in providing the feature and preventing misuse under Article 6(1)(f) GDPR.

13. Cookies and similar technologies

Our website uses cookies and similar technologies.

Essential cookies are required for features such as:

• the shopping cart;
• checkout;
• customer account login;
• website security;
• storage of your cookie preferences.

Essential cookies are used on the basis of our legitimate interest in providing a functional website and online shop under Article 6(1)(f) GDPR and the applicable provisions of the Austrian Telecommunications Act 2021.

Non-essential technologies used for analytics, marketing or personalised advertising are activated only after you have given your consent.

The legal basis is Article 6(1)(a) GDPR in conjunction with the Austrian Telecommunications Act 2021.

You may change or withdraw your consent at any time through the cookie settings. Further information about individual cookies, providers, purposes and storage periods is available in those settings.

14. Google Analytics

Subject to your consent, we use Google Analytics to analyse the use of our website.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics may process your IP address in a shortened or otherwise protected form, device and browser data, approximate location, visited pages, interactions, source of visit and purchase or conversion information.

The legal basis is your consent under Article 6(1)(a) GDPR.

Google may process information in the United States and other countries based on an applicable adequacy decision, the EU-US Data Privacy Framework or European Commission Standard Contractual Clauses.

You may withdraw your consent at any time through the cookie settings.

Further information is available at:

https://policies.google.com/privacy

15. Meta Pixel

Subject to your consent, we use the Meta Pixel to measure the effectiveness of advertising on Facebook and Instagram and to create advertising audiences.

The provider is:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland

Meta may process your IP address, device and browser information, visited pages, website interactions, purchases, conversions and the time of those actions.

If you are signed in to Facebook or Instagram, Meta may associate the information with your account.

The legal basis is your consent under Article 6(1)(a) GDPR.

Meta may process information in the United States and other countries based on recognised international transfer mechanisms.

You may withdraw your consent at any time through the cookie settings.

Further information is available at:

https://www.facebook.com/privacy/policy/

16. YouTube

Some pages may contain embedded YouTube videos.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

YouTube content will be loaded only where this is possible in a privacy-friendly manner or after you have given your consent. Loading a video may transmit your IP address, device information and details of the visited page to Google or YouTube.

The legal basis is your consent under Article 6(1)(a) GDPR.

Further information is available at:

https://policies.google.com/privacy

17. Social media links

Our website contains links to fabrari profiles on platforms such as Instagram, Facebook and YouTube.

If these are ordinary links, no data are transferred to the platform merely by visiting our website. A connection to the provider is established only when you click the relevant link.

18. International data transfers

Some providers may process personal data outside the European Union or European Economic Area.

Such transfers take place only where a legal basis exists, such as an adequacy decision, certification under the EU-US Data Privacy Framework or European Commission Standard Contractual Clauses.

19. Retention periods

We retain personal data only for as long as required for the relevant purpose.

Data may be stored for a longer period where statutory retention obligations apply or where the data are required for the establishment, exercise or defence of legal claims.

The data will subsequently be deleted or anonymised.

20. Your rights

Subject to the statutory requirements, you have the right to:

• obtain information about your personal data;
• correct inaccurate or incomplete data;
• request erasure;
• request restriction of processing;
• receive your data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent with effect for the future;
• lodge a complaint with a data protection authority.

To exercise your rights, please contact:

welcome@fabrari.com

21. Objection to direct marketing

You have the right to object at any time to the processing of your personal data for direct marketing purposes.

After your objection, your personal data will no longer be processed for those purposes.

22. Right to lodge a complaint

You may lodge a complaint with a data protection authority.

The competent authority in Austria is:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria

Website: https://www.dsb.gv.at/
Email: dsb@dsb.gv.at

23. Data security

We use appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration and disclosure.

Our website uses an encrypted HTTPS connection.

24. Updates to this Privacy Policy

We may update this Privacy Policy if legal requirements, the services we use or our data-processing activities change.

The version currently published on our website applies.

This English translation is provided for information purposes. In the event of discrepancies or questions of interpretation, the German version shall prevail, subject to mandatory data protection law.

Last updated: August 2026