Privacy Policy

Last updated: 1 August 2026

This policy explains what personal data we collect when you visit woodboard.at or order from our shop, why we collect it, who receives it and what rights you have. We have written it to be readable rather than exhaustive in legal jargon – if anything is unclear, write to us and we will explain it.

1. Who is responsible

The controller for the processing of your personal data under the General Data Protection Regulation (GDPR) is:

Woodboard KG
Urbaniweg 12
7091 Breitenbrunn
Austria

Phone: +43 664 811 99 25
Email: info@woodboard.at
Company register: FN 582791x, Regional Court of Eisenstadt
VAT ID: ATU78299057

We are not required to appoint a data protection officer under Art. 37 GDPR. For any data protection question, please contact us directly at the address above.

2. Your rights

Under the GDPR you have the following rights regarding your personal data:

  • Access (Art. 15) – you can ask us whether we process data about you, and receive a copy of it.
  • Rectification (Art. 16) – you can have inaccurate data corrected and incomplete data completed.
  • Erasure (Art. 17) – you can have your data deleted, unless we are legally required to keep it (for example invoices under tax law).
  • Restriction of processing (Art. 18) – you can require us to limit processing instead of deleting data.
  • Data portability (Art. 20) – you can receive the data you provided to us in a structured, machine-readable format.
  • Objection (Art. 21) – you can object to processing that we base on our legitimate interests.
  • Withdrawal of consent (Art. 7(3)) – where processing is based on your consent, you can withdraw it at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.

Objection to direct marketing: If we process your data for direct marketing purposes, you have an unconditional right to object at any time (Art. 21(2) GDPR). We will then stop using your data for that purpose immediately, without you having to give a reason.

To exercise any of these rights, send an informal message to info@woodboard.at. We will respond within one month. We do not charge for this.

Right to lodge a complaint

If you believe we are handling your data unlawfully, you can complain to the supervisory authority:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Web: www.dsb.gv.at

3. Legal bases we rely on

Every processing operation described below rests on one of these legal bases:

  • Art. 6(1)(a) GDPR – consent: you have actively agreed, for example via our cookie banner or by subscribing to the newsletter.
  • Art. 6(1)(b) GDPR – contract: the processing is necessary to fulfil an order or to take steps at your request before entering into a contract.
  • Art. 6(1)(c) GDPR – legal obligation: we are required by law to process the data, for example to retain invoices under Austrian tax law.
  • Art. 6(1)(f) GDPR – legitimate interests: we have a legitimate interest that is not overridden by your rights, for example keeping our website secure and functional.

4. Cookies and your consent

We use cookies and comparable technologies (local storage, pixels, scripts) on this website. Cookies are small files stored in your browser; some are needed for the shop to work at all, others are only set once you allow them.

We manage this through the consent tool Complianz (Complianz B.V., Netherlands). When you first visit, you choose which categories to allow:

  • Functional – required for the site to work: shopping cart, login session, language selection, storing your cookie choice. These are set without consent under § 165(3) TKG 2021, because you cannot use the shop without them.
  • Preferences – store settings you have chosen so you do not have to re-enter them.
  • Statistics – help us understand how the site is used (see section 12).
  • Marketing – used to measure and target advertising (see sections 13 to 17).

Statistics and marketing technologies are only loaded after you have actively consented. Until then they are blocked. The legal basis for those is Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021.

Your choice is stored in cookies beginning with cmplz_ for 365 days, together with a record of when and to what you consented – we need this record to demonstrate compliance (Art. 7(1) GDPR).

You can change or withdraw your consent at any time via the „Cookie settings“ link in the footer of every page. A full, always current list of every individual cookie, its purpose and its lifetime is available in our Cookie Policy.

You can also delete cookies in your browser settings or block them entirely. If you block functional cookies, the shop will not work correctly.

5. Hosting and server log files

Our website is hosted by Hostinger. Our hosting provider processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Our servers are located within the European Union.

Each time a page is requested, the web server automatically records:

  • your IP address
  • date and time of the request
  • the page or file requested and the amount of data transferred
  • the page you came from (referrer)
  • browser type and version, operating system and language

We use this data to deliver the website, to identify and fix technical faults, and to detect and defend against attacks. We do not combine it with other data and we do not use it to identify individual visitors.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and error-free operation of our website.

Retention: log files are deleted after 30 days at the latest, unless a specific security incident requires us to keep them longer for evidence.

6. Ordering in our online shop

When you place an order, we process the data you enter in the checkout:

  • first and last name, company name where applicable
  • billing address and, if different, shipping address
  • email address and, if provided, phone number
  • the products ordered, order value, order date and order number
  • the payment method you selected and the payment status
  • the IP address used to place the order

We need this data to conclude and perform the purchase contract with you, to ship your board, to issue an invoice, and to handle any warranty or returns.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). For the retention of invoices and accounting records, additionally Art. 6(1)(c) GDPR in conjunction with § 132 of the Austrian Federal Fiscal Code (BAO) and § 212 of the Austrian Commercial Code (UGB).

Retention: order and invoice data is retained for seven years from the end of the calendar year in which the order was placed. Beyond that, we may retain data for up to three years where necessary to defend against or assert legal claims (§ 1489 ABGB).

7. Customer account

You can order as a guest or create a customer account. An account stores your contact and address details, your order history and your saved preferences, so you do not have to re-enter them.

Your password is stored only as a cryptographic hash – we cannot read it and we will never ask you for it.

Legal basis: Art. 6(1)(b) GDPR.

Retention: for as long as your account exists. You can delete your account at any time by contacting us. Orders already placed remain subject to the statutory retention periods described in section 6, even after account deletion.

B2B accounts

Retailers and business partners can apply for a B2B account, which gives access to dealer pricing. In addition to the data above, we process your company name, VAT identification number, and information demonstrating your commercial status, along with the name and contact details of the person acting for the company.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for verifying that an applicant is genuinely a business customer.

8. Payment

We do not store complete payment card details on our own servers at any time. Depending on the payment method you choose, your data is passed to the relevant payment service provider, who acts as an independent controller for the payment transaction.

Stripe

Card payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.

You enter your card details directly into payment fields provided by Stripe. Stripe receives your name, email address, billing address, card details, the payment amount and technical data such as your IP address, browser and device information, which it also uses to detect and prevent fraud. Stripe sets the cookies __stripe_mid and __stripe_sid for this purpose. We receive only a confirmation of whether the payment succeeded, plus the last four digits and the card type.

Legal basis: Art. 6(1)(b) GDPR for processing the payment; Art. 6(1)(f) GDPR for fraud prevention, which is in the interest of both you and us.

Stripe's privacy policy: stripe.com/privacy

PayPal

If you pay by PayPal, the payment is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.

You are redirected to PayPal, where you log in with your own credentials. PayPal receives your name, address, email address, the order amount and order number. We do not receive your PayPal login details or your stored bank or card data – only confirmation that the payment was made.

Legal basis: Art. 6(1)(b) GDPR.

PayPal's privacy policy: paypal.com/at/legalhub/privacy-full

Advance bank transfer

If you pay in advance by bank transfer, we receive your name, the payment reference and your IBAN through our bank statement. This data is processed by our bank and used for our accounting.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for the resulting accounting records.

9. Shipping

To deliver your order, we pass your name, delivery address and – where needed for delivery notification – your email address and phone number to the carrier handling the shipment. We work with:

  • DPD Direct Parcel Distribution Austria GmbH, Arbeitergasse 46, 2333 Leopoldsdorf, Austria (our standard carrier)
  • Österreichische Post AG, Rochusplatz 1, 1030 Vienna, Austria (in individual cases)

Each carrier processes this data as an independent controller for the purpose of delivering your parcel, and applies its own privacy policy.

Legal basis: Art. 6(1)(b) GDPR. Where we pass on your email address or phone number solely so the carrier can notify you about the delivery, this is additionally based on Art. 6(1)(f) GDPR, our and your legitimate interest in a smooth delivery.

10. Accounting and tax

Invoices and the associated order data are passed to our tax adviser and, where required, to the tax authorities. Our tax adviser is bound by professional confidentiality.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Austrian tax and commercial law.

11. Contact form, email and newsletter

Contact form and email

Our contact form asks for your name, email address and your message. We use this data solely to answer your enquiry. The form and the messages it produces are stored on our own web server – we do not use an external form service.

Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to an existing or prospective contract; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries addressed to us.

Retention: we delete enquiries once they have been dealt with and no further questions are expected, at the latest after three years, unless retention obligations apply.

Google reCAPTCHA

To prevent automated spam submissions, our forms are protected by reCAPTCHA v3 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA analyses your behaviour on the page to distinguish humans from bots. It processes your IP address, how long you stay on the page, mouse movements and keystrokes, browser and device information, and any Google cookies already present. This analysis runs in the background; no puzzle is displayed.

Legal basis: Art. 6(1)(a) GDPR. On our website reCAPTCHA is only loaded after you have consented to marketing technologies in the cookie banner. If you decline, the protected forms cannot be submitted – in that case, please contact us by email or phone.

Google's privacy policy: policies.google.com/privacy

Newsletter (Mailchimp)

You can subscribe to our newsletter to receive information about new products and offers. We ask for your first name, last name and email address. The name is used only to address you personally and is optional.

We use the double opt-in procedure. After you enter your address, we send you an email asking you to confirm that you really want to receive our newsletter. You are only added to the distribution list once you click the confirmation link. If you do not confirm, your entry is deleted automatically. This protects you from someone else signing you up with your address.

The newsletter is sent using Mailchimp, a service of The Rocket Science Group LLC d/b/a Mailchimp, 405 N Angier Ave NE, Atlanta, GA 30308, USA, part of Intuit Inc. Mailchimp stores your subscription data on our behalf under a data processing agreement pursuant to Art. 28 GDPR and analyses whether newsletters are opened and which links are clicked, so we can see which content is relevant.

We also record the IP address and the time of both your subscription and your confirmation, so we can demonstrate that the subscription was genuine.

Legal basis: Art. 6(1)(a) GDPR. You can unsubscribe at any time using the link at the end of every newsletter, or by emailing us. After you unsubscribe, we delete your data from the distribution list; we keep a record of the subscription and unsubscription solely as proof of the previous consent.

Mailchimp transfers data to the USA. See section 18 on third-country transfers.

Mailchimp's privacy policy: intuit.com/privacy/statement

12. Abandoned cart reminders (Retainful)

If you place items in your cart and enter your email address but do not complete the order, we may send you a reminder email. For this we use Retainful, a service of Cartrabbit Technologies Private Limited, Coimbatore, India, which acts as our processor under a data processing agreement pursuant to Art. 28 GDPR.

Retainful processes your email address, your name where provided, and the contents and value of your cart. Cookies beginning with retainful_ and _wc_retainful_ are used to link the cart to the reminder.

Legal basis: Art. 6(1)(a) GDPR – we only send these reminders if you have consented. You can withdraw your consent at any time using the unsubscribe link in the reminder email or by writing to us.

India is a third country for which the European Commission has not issued an adequacy decision. The transfer is therefore safeguarded by the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. See section 18.

Retainful's privacy policy: retainful.com/privacy-policy

13. Board Finder (product quiz)

Our Board Finder helps you find the right board by asking about your riding level, style, weight and preferences. The quiz is provided by RevenueHunt (Durian Capital Inc., British Virgin Islands), acting as our processor under a data processing agreement pursuant to Art. 46(2)(c) GDPR including Standard Contractual Clauses.

Your answers are processed to generate a product recommendation. If you choose to enter your email address to receive the result, that address is processed as well. Entering an email address is optional – you can see the recommendation without it.

Legal basis: Art. 6(1)(a) GDPR (consent), given by starting the quiz and, where applicable, by entering your email address.

The British Virgin Islands are a third country without an adequacy decision. See section 18.

14. Google Analytics

We use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how our website is used – which pages are visited, how visitors arrive, and where they leave.

Google Analytics uses cookies and similar identifiers. The data collected includes:

  • a pseudonymous identifier for your browser or device
  • pages viewed, time spent, and interactions such as clicks
  • approximate location (country, region, city), derived from a shortened IP address
  • device type, screen resolution, browser, operating system and language
  • the source that brought you to our site (search engine, advertisement, referring website)

IP addresses are shortened before any further processing, so that they cannot be traced back to you. We do not merge this data with other data we hold, and we cannot identify individual visitors from it.

Legal basis: Art. 6(1)(a) GDPR. Google Analytics only loads if you have consented to statistics cookies. You can withdraw that consent at any time via the cookie settings in the footer.

Retention: user-level and event-level data in Google Analytics is deleted after 14 months.

Google's privacy policy: policies.google.com/privacy

15. Google Ads conversion tracking

We use the advertising programme Google Ads, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to promote our products on external websites and in Google's search results.

If you reach our website by clicking one of our Google ads, Google Ads stores a cookie on your device. This cookie lets us see whether a purchase followed the click on an ad. We only ever receive aggregated statistics on the total number of people who clicked an ad and then completed an order. We do not receive any information that would allow us to identify individual people.

Data processed: click identifier (Google Click Identifier), pages visited, time of purchase, order value, shortened IP address.

Cookie lifetime: the conversion cookie expires after a maximum of 90 days.

Legal basis: Art. 6(1)(a) GDPR – your consent, given through our cookie banner. You can withdraw it at any time with effect for the future by changing your cookie settings.

16. Google Merchant Center and Google Shopping

We transmit data about our products – such as title, description, price, availability and product image – to the Google Merchant Center, so that our items can be shown in Google Shopping ads.

This transmission covers product data only. No personal data of our customers is processed as part of it.

If you click such a Shopping ad in the search results, the rules described under „Google Ads conversion tracking“ above apply to the subsequent measurement of success.

17. Meta Pixel and Conversions API

We use the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to measure the effectiveness of our advertising on Facebook and Instagram and to show ads to people who have shown an interest in our products (remarketing).

The pixel runs in your browser and records which pages you view and which actions you take – for example viewing a product, adding it to the cart, or completing a purchase – together with your IP address and browser information. Meta sets cookies such as _fbp for this, which expire after three months.

In addition, the Conversions API transmits the same events directly from our server to Meta. To allow Meta to match an event to an account, contact details you have entered – such as email address, name, address and phone number – are irreversibly encrypted using a cryptographic hash function (SHA-256) before transmission. Meta never receives these details from us in plain text.

Meta may combine this data with your Facebook or Instagram account if you have one, and use it for its own advertising purposes. We have no influence over that and no access to the underlying data. For processing where we and Meta act as joint controllers within the meaning of Art. 26 GDPR, we have concluded a joint controller agreement with Meta.

Legal basis: Art. 6(1)(a) GDPR. The pixel and the Conversions API only become active once you have consented to marketing technologies. Without your consent, no data is transmitted, including via the Conversions API. You can withdraw your consent at any time via the cookie settings.

Meta's privacy policy: facebook.com/privacy/policy
Meta's information on the joint controller arrangement: facebook.com/legal/controller_addendum

18. Transfers to third countries

Some of the services described above involve data being transferred outside the European Economic Area.

Google and Meta: although our contracting parties are based in Ireland, it cannot be ruled out that data is transferred to Google LLC and Meta Platforms, Inc. in the United States and processed there. Both companies are certified under the EU-US Data Privacy Framework. On this basis, the European Commission determined in its adequacy decision of 10 July 2023 that transfers to certified US companies benefit from an adequate level of data protection. In addition, both providers have concluded EU Standard Contractual Clauses with us pursuant to Art. 46(2)(c) GDPR.

Mailchimp: transfers to the USA are covered by the EU-US Data Privacy Framework and by Standard Contractual Clauses.

Retainful (India) and RevenueHunt (British Virgin Islands): no adequacy decision exists for these countries. The transfers are safeguarded by EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, together with supplementary technical and organisational measures.

We want to be transparent about the residual risk: authorities in the United States and in other third countries may, under certain conditions, access data stored there, and in an individual case you may not have the same legal remedies available to you as you would within the European Union. You can avoid these transfers entirely by declining statistics and marketing technologies in our cookie banner.

19. Social media and embedded content

Instagram feed

On some pages we display our latest Instagram posts. The posts themselves are loaded from our own server, but the images are retrieved from Instagram's content delivery network. When this happens, your IP address is transmitted to Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). If you are logged in to Instagram at the time, Instagram can associate the visit with your account.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in presenting our brand and products in an appealing way.

YouTube videos

We embed videos hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Videos are embedded in extended data protection mode, which means YouTube does not store cookies about you until you actively start a video. Once you do, YouTube receives the information that you have visited the relevant page, along with your IP address and device data. If you are logged in to YouTube, it can assign this to your account.

Legal basis: Art. 6(1)(a) GDPR – videos are only loaded once you have given consent through the cookie banner or by clicking to play.

Customer reviews

We display Google reviews of our business using the widget of Trustindex. The review content is loaded from Trustindex's content delivery network; your IP address is transmitted in the process. The reviews themselves are public and were written by the reviewers on Google.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in showing genuine, verifiable feedback about our products.

Links to our social media profiles

Our website links to our profiles on Facebook, Instagram and YouTube. These are ordinary links – no data is transmitted to those platforms until you click one. Once you are on a platform's own pages, that platform's privacy policy applies, not ours.

20. Data security

This website uses SSL/TLS encryption. You can recognise this by the „https“ in the address bar and the padlock symbol in your browser. Everything you send us – order details, form entries, login credentials – is encrypted in transit and cannot be read by third parties.

We use technical and organisational measures to protect your data against loss, manipulation and unauthorised access, and we review them regularly. Please note, however, that data transmission over the internet can never be completely secure. If you would prefer not to send sensitive information through the website, you are welcome to contact us by phone.

21. Automated decision-making and profiling

We do not use automated decision-making within the meaning of Art. 22 GDPR – no decision with legal effect for you, or which similarly significantly affects you, is made automatically.

We do, however, want to be clear about the following: if you consent to marketing technologies, the advertising services described in sections 15 to 17 analyse your behaviour on our website and use it to decide which advertising to show you. Google and Meta also use automated bidding strategies in this context. This constitutes profiling within the meaning of Art. 4(4) GDPR. It has no effect on the prices we charge you or on the terms of any contract with us. You can prevent this entirely by declining marketing technologies in the cookie banner or by withdrawing your consent at any time.

22. How long we keep your data

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as we are legally required to keep it. In summary:

  • Order and invoice data: 7 years (Austrian tax and commercial law), plus up to 3 years for potential legal claims
  • Customer account data: until you delete the account
  • Contact enquiries: until the matter is resolved, at the latest after 3 years
  • Newsletter data: until you unsubscribe
  • Server log files: a maximum of 30 days
  • Consent records: 365 days for the cookie choice, and for the duration of the legal limitation period as evidence of consent
  • Cookies and tracking data: as set out in the individual sections above and in the Cookie Policy

Once the relevant period expires, the data is deleted or irreversibly anonymised as a matter of routine.

23. Do you have to provide your data?

You can browse our website without providing any personal data.

If you want to place an order, we do need certain data – your name, address, email address and payment details. Without it, we cannot conclude or perform a contract with you. Providing data for the newsletter, the Board Finder or a contact enquiry is entirely voluntary and has no disadvantage for you if you decline.

24. Changes to this privacy policy

We update this privacy policy when our services or the legal situation change. The version published here always applies. The date at the top of the page shows when it was last revised.

If you have any questions about how we handle your data, write to us at info@woodboard.at – we will answer.