Privacy policy

How we process personal data, on what legal basis, for how long and who we share it with.

1. An overview of data protection

General information

The following gives a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. Detailed information on data protection can be found in the sections below.

Data collection on this website

Who is responsible for collecting data on this website?

Data on this website is processed by the website operator. You will find their contact details in the section "Information about the controller" in this privacy policy.

How do we collect your data?

Some data is collected because you give it to us. This may be data you enter when placing an order or in an email to us.

Other data is collected automatically, or with your consent, by our IT systems when you visit the site. This is mainly technical data such as your browser, operating system or the time of the page view. It is collected automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure the site is provided without errors. Other data is needed to process your order, answer your enquiry or send you the newsletter.

What rights do you have regarding your data?

You have the right at any time to receive information about the origin, recipients and purpose of the personal data stored about you, free of charge. You also have the right to have this data rectified or erased. If you have given consent, you can withdraw it at any time with effect for the future. You also have the right, under certain circumstances, to request that processing of your personal data be restricted. Finally, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about this and about any other question on data protection.

2. Hosting

We host this website and handle the ordering process with the following provider:

Shopify

The provider is Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify provides the shop and website infrastructure and processes on our behalf all data arising when you visit the site and place an order, in particular access data, contact details, order data and payment status.

This is based on Art. 6(1)(f) GDPR. We have a legitimate interest in our online shop being presented and operated as reliably as possible. Where consent has been requested, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act 2021, to the extent that the consent covers storing information on your device. Consent can be withdrawn at any time.

Data may be transferred to Shopify Inc. in the USA. The transfer is based on the European Commission's standard contractual clauses.

Data processing agreement

We have concluded a data processing agreement with the provider named above. This is a contract required by data protection law which ensures that the provider processes the personal data of our website visitors only on our instructions and in compliance with the GDPR.

3. General information and mandatory disclosures

Data protection

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection provisions and this privacy policy.

When you use this website, various items of personal data are collected. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

We point out that data transmission over the internet can have security gaps. Complete protection of data against access by third parties is not possible.

Information about the controller

The controller for data processing on this website is:

Aviation Upcycling GmbH
Grenzgasse 111/9/1/EG/12
2344 Maria Enzersdorf
Austria

Phone: +43 677 677 016 59
Email: office@aircrafttag.com

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Retention period

Unless a more specific retention period is stated in this privacy policy, your personal data remains with us until the purpose of processing no longer applies. If you make a justified request for erasure or withdraw consent to processing, your data will be deleted unless we have other legally permissible grounds for storing it, such as commercial or tax retention periods. In the latter case, deletion follows once those grounds cease to apply.

General information on the legal bases for processing

Where you have consented to processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. Where your data is required to perform a contract or to take steps prior to entering into a contract, we process it on the basis of Art. 6(1)(b) GDPR. To comply with a legal obligation, we process your data on the basis of Art. 6(1)(c) GDPR. Processing may also take place on the basis of our legitimate interest under Art. 6(1)(f) GDPR.

Recipients of personal data

In the course of our business we work with various external parties, and this sometimes requires personal data to be transferred to them. We pass on personal data only where it is necessary to perform a contract, where we are legally obliged to, where we have a legitimate interest in doing so, or where another legal basis permits it. Recipients are in particular our shop and hosting provider, payment providers, carriers and our tax advisers. We do not sell data.

Many processing operations are only possible with your express consent. You can withdraw consent already given at any time. The lawfulness of processing carried out up to the withdrawal is unaffected.

Where processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If your personal data is processed for direct marketing, you have the right to object to that processing at any time. After the objection your data will no longer be used for that purpose.

Right to lodge a complaint with a supervisory authority

In the event of infringements of the GDPR you have the right to lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna. This right exists without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request direct transfer of the data to another controller, this will only be done where it is technically feasible.

Access, rectification and erasure

Within the scope of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of processing, and where applicable a right to have this data rectified or erased.

Right to restriction of processing

You have the right to request restriction of the processing of your personal data. This right applies in particular in the following cases: if you contest the accuracy of the data we hold about you, if the processing was or is unlawful, if we no longer need your data but you need it to assert, defend or exercise legal claims, or if you have objected under Art. 21(1) GDPR and the balancing of interests is still pending.

SSL and TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address bar switching from "http://" to "https://". While encryption is active, the data you send us cannot be read by third parties.

4. Data collection on this website

Cookies

Our pages use cookies. Cookies are small data packets and do no harm to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies).

Cookies may come from us (first-party cookies) or from third parties (third-party cookies). Strictly necessary cookies hold the cart, the chosen language and the colour scheme; without them parts of the shop do not work.

Strictly necessary cookies are stored on the basis of Art. 6(1)(f) GDPR. Where consent to storing cookies has been requested, storage takes place exclusively on the basis of that consent (Art. 6(1)(a) GDPR, § 165(3) of the Austrian Telecommunications Act 2021); consent can be withdrawn at any time.

You can set your browser to inform you about cookies being set, to allow cookies only in individual cases, or to exclude them generally. Disabling cookies may limit the functionality of this website.

We use a consent management tool to obtain and administer your consent to non-essential cookies and comparable technologies. It records your choice and stores it so that we can honour it on your next visit and demonstrate it in the event of a dispute. The legal basis is Art. 6(1)(c) GDPR.

Server log files

The provider of these pages automatically collects and stores information in server log files, which your browser transmits to us automatically:

browser type and version
operating system
referrer URL
host name of the accessing device
time of the server request
IP address

This data is not merged with other sources. It is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and the security of the website.

Enquiry by email or telephone

If you contact us by email or telephone, your enquiry including all personal data arising from it is stored and processed by us for the purpose of dealing with your request. We do not pass this data on without your consent.

Processing is based on Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary to take steps prior to entering into a contract. In all other cases processing is based on our legitimate interest in dealing effectively with enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR).

The data you send us remains with us until you ask us to delete it, withdraw your consent, or the purpose for storing it no longer applies. Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

Customer account

You may create a customer account, but you do not have to. If you create one, we store the data given there until you delete the account or ask us to delete it. The legal basis is Art. 6(1)(b) GDPR.

5. Online shop, orders and shipping

Processing of customer and contract data

We process personal customer and contract data in order to establish, define and amend our contractual relationships. We process data about the use of this website only where this is necessary to enable the user to use the service or to bill for it. The legal basis is Art. 6(1)(b) GDPR. Customer data collected is deleted once the order is complete or the business relationship has ended and the statutory retention periods have expired.

Transfer of data on conclusion of a contract for online shops and shipping

When you order goods from us, we pass your personal data to the carrier engaged for the delivery, usually Österreichische Post AG or DHL. Only what is necessary for delivery is transmitted, as a rule your name and delivery address.

Your data is passed to the bank handling payment, or to the payment provider shown at checkout, only to the extent necessary for the payment. Your payment details, such as full card numbers, are entered directly with that provider and are not disclosed to us.

The transfer is based on Art. 6(1)(b) GDPR.

Personalisation

If you have a product personalised and upload a file or image for it, we process that file solely to make your piece. It is deleted once production is complete and the return period has expired.

If you would like to receive the newsletter offered on this website, we need an email address from you. Sign-up uses double opt-in: after you enter your address we send you a confirmation email, and you are only added to the list once you confirm. No further data is collected, or only on a voluntary basis.

Processing is based exclusively on your consent (Art. 6(1)(a) GDPR). You can withdraw that consent at any time, for example using the unsubscribe link in the newsletter. The lawfulness of processing already carried out is unaffected.

The data you provide for the purpose of receiving the newsletter is stored by us until you unsubscribe and is deleted from the distribution list afterwards. Data stored by us for other purposes is unaffected.

6. Analytics and advertising

Google Analytics

This website may use functions of the web analytics service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics allows us to record visitor behaviour and to evaluate how our shop is used. This processes, among other things, pages viewed, time on page, approximate location and the source of the visit. The IP address is truncated.

Use is based exclusively on your consent under Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act 2021. Consent can be withdrawn at any time. Transfer of data to the USA is based on the EU Commission's standard contractual clauses and the EU-US Data Privacy Framework.

Meta pixel

This website may use the visitor action pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to measure the effectiveness of advertising and to show relevant advertising to visitors of our shop.

Use is based exclusively on your consent under Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act 2021. Consent can be withdrawn at any time.

7. Plugins and tools

YouTube

On some product pages we embed videos from the YouTube platform. The operator is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A video is only loaded once you start it. When playback starts, a connection to YouTube's servers is established, telling YouTube which of our pages you have visited and transmitting your IP address.

This is used in the interest of presenting our products attractively, which constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. Where consent has been requested, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act 2021.

Aircraft photographs

On the aircraft pages we show photographs by external photographers which are loaded from their platform. Your IP address is transmitted to that provider, without which the image cannot be delivered. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in showing the aircraft a piece was cut from.

Fonts

This website embeds fonts that are delivered from our own server when the page is loaded. No connection to third-party servers is established for this.