Privacy policy

1. Data controller

Email: office@breininger.art
Phone: +43 676 9301466

2. Website provision and hosting

When you visit this website, connection data required for technical purposes is processed. This may include your IP address, the date and time of access, the requested address, the amount of data transferred, the referrer, browser type, operating system and status code.

This processing enables the secure and stable provision of the website, the prevention of abusive access and the analysis of errors. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure, reliable and cost-effective operation of the website.

This website is hosted and delivered by Netlify, Inc., 101 2nd Street, San Francisco, California 94105, USA. Netlify processes connection and log data as a processor. Processing in the USA and other countries outside the EEA is possible. According to Netlify, transfers to the USA are based on the EU-US Data Privacy Framework and, where necessary, the European Commission’s Standard Contractual Clauses. For more information, please see Netlify’s privacy policy and Netlify’s Data Processing Agreement.

Log data is processed only for as long as necessary for operation, security and error analysis. Longer retention occurs only where a security incident needs to be investigated or legal obligations or legal claims require it.

3. Display of artworks and Shopify

On the homepage and in the gallery, the website retrieves product information and images via the Shopify Storefront API. For technical reasons, Shopify receives data including your IP address and connection and device data. The request is necessary to display the current gallery, availability and product information. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the up-to-date and technically reliable presentation of the artworks offered.

When you select the “Buy painting” button, a Shopify cart is created and you are redirected to Shopify Checkout. The associated processing serves to take steps prior to entering into a contract and to perform the contract under Article 6(1)(b) GDPR. The privacy information displayed at checkout also applies.

The service provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify may use other group companies and subprocessors in Canada, the USA and other countries. According to Shopify, transfers to Canada are based on the European Commission’s adequacy decision, while other transfers are based in particular on Standard Contractual Clauses. For more information, please see Shopify’s privacy policy, the information on subprocessors and the information on international data transfers.

Data processed through Shopify is stored only for as long as necessary to display the gallery, process an order, comply with statutory retention obligations or establish, exercise or defend legal claims.

4. Contact by email or telephone

When you contact us, we process the data you provide to handle your enquiry and any follow-up questions. For enquiries about a purchase or another service, the legal basis is Article 6(1)(b) GDPR. General enquiries are processed under Article 6(1)(f) GDPR on the basis of our legitimate interest in responding to your message.

Recipients may include the email and telecommunications providers used for communication. The data is deleted once the enquiry has been fully resolved and there are no statutory retention obligations or legitimate grounds for further storage.

5. Cookies and similar technologies

This website does not use analytics, marketing or social media cookies. Optional usage statistics are nevertheless loaded only after your express consent. Rejecting and allowing are equally accessible. If you have not made a choice or have rejected statistics, neither the Umami script nor analytics events are sent to Umami.

After your choice, we save only the decision, the choice version and its expiry time as “malsalon-statistics-v1” in local browser storage (localStorage), for a maximum of 180 days. No individual visitor identifier is stored there. This storage is used exclusively to respect your privacy decision and is strictly necessary for that purpose under Section 165(3) TKG 2021. The legal basis for the associated processing is Article 6(1)(c) GDPR. If browser storage is blocked, your choice applies only to the current page. Clearing browser storage causes the choice to be requested again.

Open privacy settings to change or withdraw consent. Withdrawing consent stops further analytics transmissions. Processing carried out before withdrawal remains lawful; withdrawal does not automatically delete previously collected analytics data.

The technical provision of the website by Netlify and the retrieval of the gallery through Shopify require the processing of connection data, but the website’s own code does not store an identifier. Under Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), consent would not be required for strictly necessary cookies.

The website’s own code does not use Shopify cookies merely to retrieve the gallery. If you proceed to Shopify Checkout or another external website, the cookie settings and privacy notices provided there apply.

5a. Optional usage statistics with Umami

With your consent, we use Umami Cloud, provided by Umami Software, Inc., 28 Geary St, Suite 650 #243, San Francisco, California, USA, to understand the use of our website and improve its content. We record pageviews and selected clicks: opening an artwork view, selecting the buy button, email and telephone links, and links to the Orange & Pink shop. A click does not prove that a message was sent or a purchase completed.

We transmit the page path and title, referring domain, browser language, screen size and the selected action name. Artwork actions also include the publicly displayed artwork title. URL parameters, URL fragments, full referring URLs, names, email addresses and form contents are not transmitted as analytics fields. No session recordings, heatmaps or custom visitor identifiers are used.

IP addresses and browser information are also processed when a connection is established. Umami uses these, among other things, to derive approximate location and a rotating identifier that groups activity for statistical purposes. According to the provider, the IP address is not stored as a field in analytics records, but it may be included in separate operational and security logs. These statistics therefore do not guarantee anonymity.

The legal bases are your consent under Article 6(1)(a) GDPR and, where information is accessed on your device, Section 165(3) TKG 2021. Consent is voluntary. You can use the website without statistics and change your choice at any time using the privacy settings.

The EU data region is selected for this account. Analytics data are retained for six months under the Hobby plan in use. The EU region applies to analytics storage; delivery, security, support and operational logs in particular may also involve processing outside the EU. Recipients are Umami and its appointed subprocessors. For transfers to third countries, the Data Processing Agreement provides in particular for Standard Contractual Clauses. Residual copies in backups are subject to the provider’s backup and deletion cycles.

Further information: Umami privacy policy, Data Processing Agreement and transfer safeguards and Subprocessors. For questions about processing or exercising your rights, please contact the controller named above.

6. Locally hosted fonts

The fonts used are loaded from this website. Loading the fonts does not establish a connection to Google Fonts or any other font service.

7. External links

Links to other websites transmit data to the respective provider only when you select the link. The operator of the destination website is responsible for processing on that website.

8. Your rights

Subject to the statutory requirements, you have the rights of access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on your consent, you may withdraw it at any time with effect for the future.

To exercise your rights, please contact office@breininger.art.

You also have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, email: dsb@dsb.gv.at, website: www.dsb.gv.at.

9. Automated decisions

This website does not carry out solely automated decision-making with legal or similarly significant effects, nor does it carry out profiling.

10. Updates to this privacy policy

This privacy policy will be updated if the services used or legal requirements change. The version published on this website at the time applies.