Last updated: 20 October 2026
The controller responsible for the processing described in this policy is:
Mineni e.U. (Mag. Monica Fokkelman)
Josefstädterstraße 43/1/4, 1080 Vienna, Austria
Email: office@mineni.at
VAT identification number: ATU67142488
You can contact us at this address about your data and your privacy rights. This policy covers our website, online shop, newsletter and related customer correspondence. It explains which data we process, why we process it, who receives it and how long we keep it. Data comes from your entries and communications, technical requests from your browser, and the shop, payment, delivery and newsletter services described below, including their transaction, subscription and delivery-status updates.
We process personal data only where there is a legal basis under the General Data Protection Regulation (GDPR) and applicable Austrian law, including the Datenschutzgesetz (DSG) and Telekommunikationsgesetz 2021 (TKG 2021):
Contract and pre-contractual steps you request: Article 6(1)(b) GDPR, for example processing a purchase, delivery, collection or a product enquiry.
Legal obligations: Article 6(1)(c) GDPR, for example keeping accounting and tax records.
Legitimate interests: Article 6(1)(f) GDPR, where necessary for secure and reliable operation, responding to general enquiries, documenting consent, respecting objections and establishing or defending legal claims. The relevant interest is explained below; we must also take your interests and rights into account.
Your consent: Article 6(1)(a) GDPR, for example newsletter subscriptions and optional analytics. The rules for storing or accessing information on your device are considered separately under section 165(3) TKG 2021. Email advertising is also subject to section 174 TKG 2021.
When you access the website, technical information is processed to deliver pages and files, operate the shop and detect errors or misuse. Depending on the request, this includes your IP address, time of access, requested resource, response status, referring page, and browser or device information. Please avoid placing sensitive information in URLs or search fields.
We use Vercel Inc., USA, for hosting and delivery. Vercel and its infrastructure providers process technical request and security data. Our legal basis is Article 6(1)(f) GDPR: providing a reliable website, diagnosing faults and protecting the service. Processing outside the EEA is addressed in section 10.
Technical data is processed for delivery of the requested resource and necessary operational checks. We use Vercel Pro's standard retention of one day (24 hours) for application runtime logs. This period concerns the hosting platform's routine runtime logs, rather than all infrastructure or security records. Where particular records must be preserved as evidence of a specific incident, they are retained only until the investigation or related claim is resolved, or for a longer period required by law; unrelated routine logs are not retained for that reason.
Further information: Vercel Privacy Notice and Vercel Data Processing Addendum.
We use Storyblok to manage website content. Text is retrieved by our website infrastructure; images and other media can be delivered through Storyblok's delivery infrastructure. When your browser requests these resources, the delivery providers receive the technical information needed to transmit them, including your IP address and request information.
The service is provided by the Storyblok group, including Storyblok GmbH in Austria, and its infrastructure providers. The legal basis is Article 6(1)(f) GDPR, reflecting our interest in maintaining and delivering website content efficiently and securely. We do not use the content management system as our newsletter subscription or order database.
Further information: Storyblok Privacy Policy and Storyblok Data Processing Agreement.
We process the information needed to provide your cart, accept and fulfil orders, arrange payment, deliver goods or prepare in-store collection, and handle cancellations, returns, warranty requests and customer service. This may include your name, email address, billing and delivery addresses, telephone number where provided, selected products, order and transaction references, payment status and correspondence. Optional delivery instructions are processed if you provide them.
We use Shopify for shop functions and its hosted checkout; the website frontend is hosted by Vercel. For merchants in the EEA, Shopify's contracting entity is generally Shopify International Limited, Ireland, with processing involving other Shopify companies, including Shopify Inc. in Canada, and service providers. Shopify generally processes store data on our behalf for the shop service.
Shopify determines its own purposes for certain additional services, including a customer's separate use of Shop or Shop Pay. Where Shopify Network Intelligence and its enhanced services are enabled, Shopify can also combine interactions and transactions from this shop with information from other shops and Shopify to provide and improve analytics, customisation and advertising services. This processing is distinct from fulfilling an order on our behalf and is subject to the applicable consent and objection requirements. Shopify explains its own processing in its Consumer Privacy Policy; you can exercise the rights and choices it offers through Shopify's privacy portal. Our contact details remain available for requests concerning our processing.
The payment provider selected at checkout receives the information necessary to process that payment and meet its legal obligations. We receive the transaction information needed to administer the order. The available methods and the relevant payment providers are shown at checkout. Shipping and delivery companies receive the name, delivery address and contact information required for delivery. For in-store collection, authorised staff use the order information to prepare and hand over the goods.
The legal bases are Article 6(1)(b) GDPR for the requested transaction, Article 6(1)(c) GDPR for statutory obligations, and Article 6(1)(f) GDPR where necessary to investigate misuse or establish or defend claims. Data required to process an order must be provided to complete that order; optional information is not required merely to browse the website.
The storefront uses a session cookie called cartId to associate your browser with its Shopify cart. Necessary checkout, session and security storage is also used in the hosted checkout. Details of storage used there are provided by Shopify and the checkout's privacy controls. Rejecting optional analytics does not prevent purchases.
Further information: Shopify Privacy Policy, Shopify Consumer Privacy Policy and Shopify Data Processing Addendum. Retention is explained in section 11.
If you contact us, we process your contact details, the content of your enquiry and the information needed to respond. Please send only information relevant to the enquiry. Authorised staff and the communications and IT providers supporting the correspondence may receive it.
For enquiries about a purchase or another requested contract, the legal basis is Article 6(1)(b) GDPR. For general correspondence, it is Article 6(1)(f) GDPR, reflecting our interest in responding and maintaining appropriate business records. Legal retention obligations may also apply under Article 6(1)(c) GDPR. Correspondence is deleted when the enquiry is resolved and it is no longer needed for contractual obligations, statutory retention or a specific potential claim.
The website also offers a link for contacting us through WhatsApp. If you choose this channel, we receive your telephone number, displayed profile information and the message or attachments you send, and process them to handle your enquiry on the bases and for the periods stated above. You may use email instead. WhatsApp Ireland Limited provides the service for users in the European Region and processes account, usage and connection information for its own purposes under its EEA Privacy Policy. Its global operation can involve processing outside the EEA. Following the link connects you to that service; the link is separate from an embedded WhatsApp tracking plugin.
Subscribing and unsubscribing
If you subscribe, we use your email address and any optional information you submit, such as your name or language preference, to send Mineni news, product information and offers. Subscription and consent records can include the source and time of signup and confirmation. Where confirmation is used, its purpose is to verify the subscription and document your choice.
We use Omnisend as a processor for signup forms, popups and newsletter delivery. The Omnisend group includes UAB Omnisend, Lithuania, Omnisend Limited, United Kingdom, and Omnisend, Inc., USA. These companies and their service providers can process technical and subscription data outside the EEA. See section 10 and Omnisend's Data Processing Agreement.
Sending the newsletter is based on your consent under Article 6(1)(a) GDPR and section 174 TKG 2021. You do not have to subscribe to purchase from us. You may withdraw consent at any time using the unsubscribe link in each newsletter or by contacting us. Withdrawal does not affect the lawfulness of earlier processing.
We retain subscription data while the subscription is active. Omnisend does not automatically delete a contact or its message history when you unsubscribe; it records the opt-out and stops the relevant marketing sends. After withdrawal, we review and delete data no longer needed. A limited suppression record and evidence of your subscription or withdrawal may be retained where necessary to avoid contacting you again, demonstrate compliance or address a specific legal claim, under Article 6(1)(c) or (f) GDPR as applicable. Unsubscribing does not necessarily erase separate order records.
Basic forms and website tracking
Basic signup forms and popups can load without accepting optional analytics or marketing tracking. Loading them connects your browser to Omnisend, which receives technical connection data, including an IP address and browser or request information. Functional storage can remember that a form has been submitted or dismissed. This delivery of forms is separate from subscribing to emails.
For the limited transmission of technical data to deliver a form, our interest under Article 6(1)(f) GDPR is making a newsletter signup option available. This basis does not cover behavioural profiling or additional device storage. The subscription itself is based on Article 6(1)(a) GDPR. The exemption in section 165(3) TKG 2021 applies only to storage or access strictly necessary to provide a service you expressly request. Additional form storage that does not meet that condition requires prior consent; describing it as functional does not by itself exempt it.
Omnisend's behavioural website tracking is disabled in this setup, including after accepting the website's optional cookie categories. We do not send website page-view or route-tracking events to Omnisend. A newsletter signup or a cookie choice does not automatically enable that tracking.
Email open and click measurement
Our newsletter emails can contain opening pixels and tracked links. Loading a pixel or following a tracked link enables Omnisend to record the email concerned, the time, the link clicked where applicable, and technical information such as IP address and email-client or browser information. These events can be associated with your subscriber profile. We use this information to evaluate newsletter readership and the relevance of linked content.
Individual email measurement requires separate prior consent under Article 6(1)(a) GDPR and, where device storage or access is involved, section 165(3) TKG 2021. Newsletter subscription alone, a purchase, and acceptance of website cookies do not provide that consent. Receiving the newsletter does not require agreeing to individual measurement. You can withdraw measurement consent by contacting us at office@mineni.at, and unsubscribe from future newsletters through the link in each email. Withdrawal ends the consent-based use of measurement data and applies to future emails. It cannot alter an email already delivered: its embedded pixel or tracked links may still generate provider requests if that older email is opened or a link followed. Restricting external images in your email application is an additional protective option, not a condition for withdrawing consent or exercising your rights.
Omnisend does not apply a single fixed automatic expiry to all contact and campaign history. Deleting a contact removes its associated activity and synced contact data; unsubscribing alone retains that history. We review individual engagement records for deletion or aggregation when they are no longer needed for the relevant mailing and lawful newsletter communication. Following withdrawal, we stop the consent-based use and retain only records necessary for compliance, suppression or a specific legal claim as explained above. You may request deletion or information about the records held about you.
Connection to Shopify
The connected Shopify integration can also transfer contact information and subscription status to Omnisend and, depending on the connected-store configuration, order and product information. This server-to-server processing is separate from behavioural tracking in your browser. We use transferred data only for a purpose with an applicable legal basis; marketing communications and consent-based personalisation require the corresponding consent. Buying an item or being synchronised as a contact does not by itself subscribe you to the newsletter or grant tracking consent. Order records required for the shop remain subject to the separate contract and retention rules in this policy.
Further information: Omnisend Privacy Policy.
Cookies and similar technologies store or access information on your device. Some are necessary to provide a service you request, such as a working cart or recording your privacy choice. Other technologies measure use or support optional purposes. They can involve personal data and are not necessarily anonymous.
Optional storage and access require your consent before activation under section 165(3) TKG 2021. Associated personal-data processing is based on Article 6(1)(a) GDPR where consent is required. For strictly necessary functions, the applicable GDPR basis depends on their purpose: generally Article 6(1)(b), (c) or (f), as explained in this policy. A legitimate interest does not replace the consent required for optional device storage or access. Continuing to browse, submitting an order or reading this policy is not consent.
We use CookieScript, provided by Objectis, UAB, Laisves str. 60, LT-05120 Vilnius, Lithuania, to manage privacy choices. It processes technical request information to deliver the banner and stores your decision in the CookieScriptConsent cookie. Where consent recording is enabled, records can include a consent identifier, choices, time, the page concerned, browser information and a masked IP address. We treat identifiers as potentially personal data rather than assuming they are anonymous.
The GDPR bases are Article 6(1)(c) where required to meet a legal obligation and Article 6(1)(f) for administering and demonstrating privacy choices. The consent cookie is configured for 30 days. Where server-side consent evidence is recorded, its retention is determined by the period in which the choice applies and any further period necessary to demonstrate the lawfulness of a specific processing activity or resolve a relevant claim. Such evidence is not used to create marketing profiles. Information about CookieScript, its providers and transfers outside the EEA is available in its Privacy Policy. Section 10 also applies.
You may accept or reject optional purposes, and change or withdraw your choices through Cookie Settings in the footer. Refusal does not prevent shopping or newsletter signup. The cookie declaration available in the settings lists the relevant providers, purposes, storage names and lifetimes. Browser settings can also delete or block storage; blocking necessary storage can affect cart or checkout functions.
We use Google Tag Manager (GTM) to deliver the consent manager and manage website tags. GTM loads when the page opens, before an optional consent choice, and this establishes a connection to Google's servers. Technical request information, including your IP address, can therefore be transmitted to Google at that stage. GTM and the measurement tags it manages are separate services.
For EEA users, Google services are provided by Google Ireland Limited, Ireland, with possible processing by Google LLC, USA, and other infrastructure providers. The legal basis for the limited technical delivery of GTM and the consent controls is Article 6(1)(f) GDPR, reflecting our interest in administering the website and its privacy choices. According to Google, GTM's standard HTTP request logs are deleted within 14 days. Any optional tags require their own applicable legal basis.
Google Analytics 4 is used to understand how the website is used and improve it. The optional measurement requires your statistics consent under Article 6(1)(a) GDPR and section 165(3) TKG 2021 where device storage or access is involved. Data can include page visits, product and cart interactions, navigation, newsletter-form interactions, scroll depth, timestamps, page and referring addresses, approximate location, browser and device information, and cookie-based online identifiers. These events can be linked to a browser's usage history; they are not necessarily anonymous.
With the unchanged default, GA4 event-level data is retained for two months, with expired data removed in Google's monthly deletion process. User-level retention can extend to 14 months, and new activity can restart the user-identifier retention period. These limits do not apply to standard aggregated reports.
Analytics cookies such as ga and ga_* have a default lifetime of two years. Their expiry is renewed with subsequent use while the relevant consent permits it; browsers can impose shorter limits. This cookie lifetime is separate from Analytics server-side data retention. Storage details are also available in the cookie declaration.
You can refuse or withdraw statistics consent in Cookie Settings. The website sends denied defaults before loading GTM. Google Consent Mode adjusts supported tags to the consent signals, but denied storage settings alone do not block tag execution or all transmissions. Loaded measurement tags can send consent status, page addresses, event data and technical request information without storing an analytics cookie. This is separate from the request needed to download GTM. Optional measurement, including such cookieless Analytics signals, still requires an applicable legal basis; our consent basis for measurement is not replaced by the legitimate interest stated for GTM delivery. Advertising and advertising-personalisation consent are not granted by the site's default configuration. We do not intentionally send your name, email address or form contents as analytics event data.
Further information: Google Privacy Policy, GTM data privacy information, and Google's processing terms.
Access is limited to authorised people and providers where needed for the stated purpose. Recipients include hosting and content-delivery providers, Shopify and selected payment and delivery providers, Omnisend, the consent-management provider, Google, and the communications service you choose, for the purposes explained above. Professional advisers, accounting providers, authorities and courts may receive relevant data where required by law or necessary for a specific claim.
Providers and their subprocessors can process data outside the European Economic Area, including in the USA, Canada and the United Kingdom. Where applicable, transfers rely on a European Commission adequacy decision under Article 45 GDPR, but only within that decision's scope. For example, the decision concerning Canada applies to covered commercial organisations, and the EU–US Data Privacy Framework applies only to participating US organisations covered by it.
For transfers not covered by an applicable adequacy decision, appropriate safeguards under Article 46 GDPR are required, such as the European Commission's Standard Contractual Clauses together with any necessary supplementary measures. Such clauses are included in the relevant providers' processing terms; they are not an unrestricted guarantee against access under foreign law. You can contact us for information about the safeguards applicable to your data and a copy, subject to protecting confidential information and other people's rights.
We keep personal data only for the stated purpose and for applicable legal obligations:
Accounting and tax documents: generally seven years from the end of the relevant calendar year under section 132 BAO and applicable commercial-law requirements, and longer where relevant to pending proceedings or another applicable duty. This does not mean every item of customer data is kept for seven years.
Other order and service records: for contract performance, returns, warranties and any specifically applicable claim or retention period. We restrict further use where records must be preserved solely for a legal obligation or claim.
Enquiries: until resolved, unless their content must be retained for the reasons described in section 6.
Newsletter data: while subscribed; thereafter only the limited records justified in section 7.
Logs, consent records and analytics: the periods specified in sections 3, 8 and 9. Device-storage lifetimes are stated in the cookie declaration. A cookie's lifetime is different from the retention of data already received by a provider.
Data is erased or anonymised when no longer needed. A legally required retention period or a specifically justified claim can prevent immediate erasure of the relevant records; their use must then remain limited to that reason. Backup copies can remain until overwritten or deleted within the applicable backup cycle. They remain subject to access restrictions, purpose limitation and the same erasure obligations, including after restoration.
Subject to the applicable legal conditions, you have the rights to access and obtain a copy of your personal data (Article 15 GDPR), correct inaccurate data (Article 16), request erasure (Article 17), restrict processing (Article 18), and receive or transmit qualifying data in a portable format (Article 20). You may withdraw consent at any time for future processing.
You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. We then stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or it is necessary for legal claims. You may object to direct marketing, including associated profiling, at any time without giving a reason; we must then stop that use.
Contact office@mineni.at to exercise your rights. Where reasonably necessary, we may request information proportionate to verifying your identity. We respond without undue delay and generally within one month of receiving your request. If the complexity or number of requests justifies an extension of up to two further months, we explain the extension and its reasons within the first month. You do not need to contact us before complaining to a supervisory authority, including in the EEA country of your habitual residence, workplace or the alleged infringement. In Austria, you can contact:
Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria
Email: dsb@dsb.gv.at
Website: dsb.gv.at
We do not use website or newsletter data to make solely automated decisions producing legal or similarly significant effects on you within Article 22 GDPR. Optional website analytics is described separately above. Payment providers can perform their own fraud or risk checks under their privacy information; that processing must not be confused with a decision made solely by us.
Links to social networks or other websites take you to services operated by their respective providers. When you follow a link, that provider processes data according to its own notice. A normal external link does not itself install a social-media tracking plugin on this website.
We use appropriate technical and organisational safeguards, including encrypted transmission and access restrictions, to protect personal data. We update this policy when our processing or legal requirements change. New purposes requiring consent are not authorised simply by changing this policy; we obtain the necessary consent separately.