Privacy policy

We are pleased that you are visiting our Shopify store iKegger Europe. The protection of your personal data is important to us. In this Privacy Policy, we explain which personal data we collect and how we process it when you use our website or shop with us. In doing so, we comply with the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Controller

The controller responsible for data processing on this website is:

MashCamp GmbH (iKegger Europe)
Perfektastraße 89
AT-1230 Vienna, Austria
Phone: +43 1 971 14 68 (Mon–Fri 10:00–16:00)
Email: info@ikegger.eu

(MashCamp GmbH is the operator of the iKegger Europe store.)

If you have any questions about data protection or would like to exercise your statutory rights (see section “Your Rights”), you can contact us at any time using the contact details above.

2. Data we collect and process

a. Visiting our website / Hosting by Shopify

When you visit our website without placing an order, certain technical data is automatically collected. This includes, for example:

Server log data: IP address of the requesting device, date and time of access, page/file accessed, previously visited page (referrer), browser and operating system used, as well as status codes.

We require this data to deliver the website, ensure security and stability, and, where necessary, analyze technical issues. The legal basis for this is our legitimate interest in the secure and functional operation of the website (Art. 6(1)(f) GDPR). We do not draw any direct conclusions about your identity from this data, nor do we combine it with other data sources. Server log data is automatically deleted after a short period, unless a security incident requires longer retention.

Our website is hosted on the e-commerce platform Shopify. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify provides us with the online shop platform that enables us to sell our products to you. All data collected on our website (e.g. order information, payment data, newsletter sign-ups, etc.) is stored on Shopify’s servers and processed by Shopify on our behalf. Shopify therefore acts as a so-called “processor” for us. Further information on data protection at Shopify can be found in Shopify’s Privacy Policy.

Note on international data transfers by Shopify: Shopify may also transfer your data to servers outside the EU (in particular in Canada or the USA) in order to provide its services. Shopify ensures an adequate level of data protection through appropriate safeguards (e.g. standard contractual clauses).

b. Cookies and consent management

Our website uses cookies and similar technologies to improve the user experience and provide certain functions. Cookies are small text files that are stored on your device. Some cookies are technically necessary (e.g. for the shopping cart or login), while others help us optimize our services or carry out marketing.

When you first visit our website, we ask for your consent for optional cookies via a cookie banner. For this purpose, we use the consent management tool Pandectes GDPR Compliance. This tool displays our cookie banner and allows you to accept or reject certain cookie categories. Pandectes itself sets a cookie in order to store your preferences. If you choose “Reject,” all non-essential cookies remain disabled.

You can change your cookie settings at any time by clicking the relevant “Cookie Settings” link at the bottom of the page (if available) or by configuring your browser to block cookies or delete cookies that have already been set. Please note that if you reject cookies, some functions of our store may be restricted.

Necessary/functional cookies: These cookies are required for the shop to function (legal basis: Art. 6(1)(b) GDPR or our legitimate interest pursuant to Art. 6(1)(f) GDPR). They store, for example, the items in your shopping cart or your language settings.
Optional/analytical cookies: We only set such cookies with your consent (Art. 6(1)(a) GDPR). They help us, for example, understand how visitors use our shop or serve marketing purposes. Details of the cookies used (provider, purpose, storage period) are shown in our cookie banner or cookie settings.

c. AMP (Accelerated Mobile Pages)

To improve loading times on mobile devices, we use AMP technology. If you access our website via Google search results on a smartphone, you may be shown a simplified AMP version of our site. This is delivered directly via Google’s servers. This means that, when using the AMP page, certain usage data (e.g. your IP address) may be processed by Google, as Google caches and provides the page. Unfortunately, we have no control over this. The processing is based on our legitimate interest in performant page delivery (Art. 6(1)(f) GDPR). More information can be found in Google’s Privacy Policy. If you do not want this, you can always use our regular website (non-AMP).

d. Use of Google Tag Manager, Google Analytics and Facebook Pixel

Google Tag Manager
We use Google Tag Manager provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Tag Manager is used for the technical integration and management of tracking codes and services on our website. It does not itself process any personal data of users, but it may trigger other tags which in turn collect data. More information can be found in Google’s Privacy Policy: https://policies.google.com/privacy

Google Analytics
If you have consented via the cookie banner, we use Google Analytics, a web analytics service provided by Google Ireland Limited. Google Analytics uses cookies to analyse your use of our website. The information collected in this process (including IP address, usage behaviour, device type, referrer URL) is transmitted to Google servers and stored there – including in the USA.

We use Google Analytics with IP anonymisation enabled. This means that your IP address is shortened within the EU or EEA before being transmitted. Only in exceptional cases is the full IP address transmitted to Google servers in the USA and shortened there.

The processing is based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings.
Further information can be found at: https://support.google.com/analytics/answer/6004245

Facebook Pixel (Meta Pixel)
With your consent, our website uses the so-called Facebook Pixel provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). Using Facebook Pixel, we can track whether users were redirected to our website after clicking on a Facebook or Instagram advertisement. This helps us measure the effectiveness of our advertising and deliver it specifically to relevant target groups.

Various types of information are transmitted to Meta in this process (e.g. IP address, browser information, pages visited, device ID). This data may be linked by Meta to existing user profiles. However, we ourselves receive only anonymised evaluations.

This data processing is also carried out exclusively with your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the cookie settings.
Further information can be found at: https://www.facebook.com/about/privacy

Data transfers to third countries (in particular the USA)
Please note that, through the use of the above-mentioned tools, personal data may also be transferred to the USA. The USA is currently not considered a secure third country within the meaning of the GDPR. There is therefore a risk that US authorities may access your data without adequate legal remedies being available to you.

The transfer of this data is based on the European Commission’s standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Your consent pursuant to Art. 6(1)(a) GDPR also includes this potential transfer to insecure third countries pursuant to Art. 49(1)(a) GDPR.

3. Customer account and order

a. Customer account (registration)

You can either place an order as a guest or create a customer account. A customer account allows you, among other things, to complete future orders more quickly, view your order history and manage your delivery addresses.

Registration: During registration, we ask for certain information (mandatory fields are marked as such, e.g. name, email address, password). We require this data to set up and manage your account (legal basis: Art. 6(1)(b) GDPR – performance of a contract). Your email address must be valid, as we send you a confirmation email for verification (double opt-in procedure). Once you confirm the link in the email, your account is activated.
Use of the account: You can manage your data via your account. We store the data collected during registration and use for as long as your account exists. You can delete your customer account yourself at any time or instruct us informally to delete it. We may also delete inactive accounts after a certain period for security and data protection reasons.

b. Order processing and delivery

If you place an order in our shop, we process the personal data you provide in order to fulfil the contract and deliver the goods to you. This includes in particular:

Order data: the data you enter during checkout (name, billing and delivery address, email address, where applicable telephone number for delivery notifications, ordered items, payment information).
We process this data in order to handle your order, inform you about its status and arrange delivery. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Without this data, we would not be able to process the order.

Transfer to shipping service providers: To deliver the goods you ordered, we work with external shipping companies (e.g. Austrian Post, DHL, DPD or others, depending on the shipping method selected during the ordering process). We transfer the required data to these shipping service providers (usually name, delivery address and, where applicable, email address and telephone number for delivery information) solely for the purpose of delivering the goods. The transfer is based on Art. 6(1)(b) GDPR. The shipping service providers use your data under their own responsibility within the scope of delivery and are subject to their own data protection provisions.

Use of weclapp (ERP system): We use the cloud-based ERP software weclapp, provided by weclapp SE (Germany), to process our orders. Your order and customer data (e.g. name, address, ordered products, invoice amounts) is processed on our behalf on weclapp’s secure servers. Weclapp is used for inventory management, order management and invoicing. We have concluded a data processing agreement with weclapp. According to the provider, weclapp’s servers are located in Germany, meaning that your data is stored within the EU. The legal basis for this processing is again the performance of a contract (Art. 6(1)(b) GDPR) as well as our legitimate interest in efficient business processing (Art. 6(1)(f) GDPR).

B2B customers – VAT identification number (EU): If you are an EU-based business customer purchasing from us, you have the option to enter a VAT ID during checkout in order to shop tax-free (net). To verify this VAT identification number, we use the Exemptify service (provider: daxanema: Silvercord 2, 907, 9/F, 30 Canton Road, Tsim Sha Tsui, Hong Kong). Exemptify validates the VAT ID you enter in real time via the EU VAT database system (MIAS/VIES). In doing so, your VAT ID and the respective country (and, where required for validation, company name) are sent to the EU database. This verification is necessary in order to correctly implement the tax rules for intra-Community supplies without VAT. The legal basis is Art. 6(1)(c) GDPR (legal obligation) in conjunction with Art. 6(1)(b) GDPR (performance of a contract for B2B orders). If you do not provide a VAT ID or if the validation is unsuccessful, statutory VAT will be charged. The data processed as part of Exemptify is not stored permanently, but used only for the validation request.

4. Payment processing

We offer various payment methods for orders. Depending on which payment method you select during checkout, we pass on the data required for payment processing to the relevant payment service provider. This normally includes payment information such as credit card number (for card payments), account holder and IBAN (for SEPA direct debit or bank transfer), email address (for PayPal/Klarna), etc., as well as the invoice amount and the transaction ID.

We use the following payment service providers (all as independent controllers for data protection purposes):

Shopify Payments / Shop Pay – For credit card payments, Apple Pay, Google Pay and similar methods, we use Shopify Payments, a service of Shopify International Ltd. (Ireland), or Stripe, Inc. (USA) as the technical payment processor. Your payment data is transmitted in encrypted form to Shopify/Stripe. Stripe/Shopify Payments processes this data to carry out the payment. Details can be found in the Shopify Payments Privacy Policy and Stripe Privacy Policy.
PayPal – Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. If you pay with PayPal, we transfer to PayPal the data you provided during the order process (name, shipping/billing address, email, phone number and order details). PayPal is independently responsible for your payment data. More information can be found in PayPal’s Privacy Policy.
Klarna – Provider: Klarna Bank AB, Sweden. When paying via Klarna (e.g. purchase on invoice or instalment payments), data is transferred to Klarna (in particular contact data and order details). Klarna may carry out a credit check under its own responsibility. Details can be found in Klarna’s Privacy Notice.
EPS transfer – For customers in Austria, we may offer EPS (Electronic Payment Standard). We process this bank transfer via our payment provider (Shopify/Stripe) or your bank. In this process, you enter your banking details into your bank’s secure payment form. We only receive confirmation of payment from the bank, but not your login credentials.
Other payment methods: If we offer additional payment methods (e.g. advance payment, cash on delivery, etc.), your data will be used accordingly for processing. In the case of advance payment, for example, we process the payment data transferred by you via our bank account.

The legal basis for the transfer of payment data is in each case Art. 6(1)(b) GDPR (performance of a contract). Please note that each payment service provider processes the transmitted data under its own responsibility for payment processing and may also use additional data (e.g. from your existing account there or from credit agencies in Klarna’s case). Please refer to the privacy notices of the respective payment provider for details of what information is processed there and how long it is stored.

We receive only a confirmation or error message from the payment service providers regarding the successful payment. Payment data such as credit card numbers or bank details are not stored in our shop (unless, for example, you voluntarily store credit card details in your customer account for future purchases – in that case, they are securely stored with Shopify/Stripe, not on our own servers).

5. Newsletter and marketing

a. Email newsletter

If you subscribe to our email newsletter, we will regularly inform you about news, offers and promotions related to iKegger Europe.

Newsletter registration: Registration usually takes place using the so-called double opt-in procedure. This means that after registering on our website, you will receive an email in which you must confirm by clicking that you wish to receive the newsletter. This ensures that no unauthorized person can sign up using your email address. Your email address will only be added to our mailing list after this confirmation.
What data: We need your email address for the newsletter. You may optionally provide your name – we use this to address you personally in the newsletter. Your name is not mandatory. When you register, we also store the date of registration and confirmation as well as the IP address in order to be able to prove the registration if necessary (the legal basis for this is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, as we are obliged to document consent).
Legal basis: The processing of your email address for sending the newsletter is carried out only with your express consent (Art. 6(1)(a) GDPR). You may withdraw this consent at any time with effect for the future, for example by clicking the “unsubscribe” link at the end of each newsletter or by sending us a short message. After unsubscribing, you will no longer receive newsletters from us, and we will delete your newsletter data from the mailing list.

We send newsletters only to persons who have actively subscribed. If you nevertheless receive advertising from us without having subscribed, this may be due to an error – in that case, please contact us so that we can investigate and stop it.

b. Marketing and product information for customers

If you purchase from us, we may send you, as an existing customer, recommendations for similar products or accessories by email (so-called direct advertising to existing customers pursuant to Section 7(3) UWG). You will only receive these emails if you provided your email address during the purchase and did not object to this use. You may object to the use of your email address for such purposes at any time without incurring any costs other than the transmission costs according to the basic tariff – simply click the unsubscribe link or inform us informally that you no longer wish to receive product information. The legal basis for this processing is our legitimate interest in customer care and direct marketing (Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG).

6. Product reviews

Your opinion is important to us. For this reason, after a purchase we give you the opportunity to submit a product review. For collecting and displaying customer reviews, we use the service Stamped Reviews, provided by Stamped.io (WeCommerce Holdings Limited Partnership dba Stamped, 1800-510 W Georgia St, Vancouver, B.C., Canada V6B 0M3):

Review invitations: A few days after your order, we may send you an email inviting you to submit a review for the products you purchased. We send this invitation via Stamped on our behalf. For this purpose, we transfer your name, your email address, and information about the purchased product (e.g. product name) and purchase date to Stamped. You will only receive such emails if you did not object during the purchase process. The legal basis for this is Art. 6(1)(f) GDPR (legitimate interest in obtaining feedback and improving our offering). You may object to this review request at any time, for example by briefly informing us by email. Participation in reviews is, of course, entirely voluntary.
Submitting a review: If you submit a review, it will be published on our website. In addition to your actual review text, the name or alias you provide and any other voluntary information (e.g. star rating, photos) may also be visible. Please therefore ensure that you do not include any information in the review that you do not wish to share publicly. The processing of the data contained in the review is carried out with your consent (Art. 6(1)(a) GDPR) – by submitting the review, you consent to its publication.
Use of Stamped: Stamped processes the data transmitted by us (for invitation emails) and the review data entered by you on its servers. These servers may also be located outside the EU (e.g. in the USA). We have contractually agreed with Stamped that European data protection standards are complied with (including standard contractual clauses). Stamped uses the data solely in accordance with our instructions in order to provide the review system (data processing).

If you would like to change or have a published review deleted at a later date, please contact us – we will take care of it.

Further information can be found in Stamped.io’s Privacy Policy: https://stamped.io/privacy

7. Multilingualism and currency display (Transcy)

Our shop is aimed at customers throughout Europe and beyond. So that you can view our products and content in your preferred language, we use the translation app Transcy (provider: FireGroup, F21-22, 182 Le Dai Hanh St., Ward 15, District 11, Ho Chi Minh City). Transcy translates our shop content into various languages and can also adapt the currency to your country.

Automatic language/currency detection: Based on certain information (e.g. IP address or the language set in your browser), Transcy detects which country you are visiting from and automatically displays the appropriate language and, where applicable, currency. For this purpose, Transcy connects to a server when the page loads in order to determine your region. Your IP address is processed briefly to perform this localisation. This processing is based on our legitimate interest in displaying the shop to our customers in a comprehensible language and the correct currency (Art. 6(1)(f) GDPR).
User selection: You can also manually change the language via the language menu. In that case, Transcy remembers your selection by setting a cookie so that your preference is retained for future visits.
Data processing by Transcy: Transcy acts as a processor on our behalf. We have ensured that Transcy also complies with EU data protection rules. Where data is transferred to third countries (Transcy servers may be located outside the EU), such transfers take place on the basis of appropriate safeguards (e.g. contractual clauses).

Without this translation support, it would hardly be possible for us to operate the shop in multiple languages. If you prefer to view only the original version (English), you can switch to English manually at any time.

8. Use of third-party and additional services

DelightChat – live chat & customer service
We use the DelightChat app (provider: Saasberry Apps, Inc., 2093 Philadelphia Pike #1051, Claymont, DE 19703, USA) in order to communicate with you via chat as part of customer support and process your enquiries efficiently. When using this function, data such as your name, your email address, chat history or other information you provide in the chat is transmitted to DelightChat and stored there. The processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in efficient customer communication and support handling. Your consent may also be required if you actively use a chat function.

DelightChat may also process and store this data in the USA. For transfers to this third country, we have concluded appropriate contractual arrangements with DelightChat for data processing and, where applicable, standard contractual clauses pursuant to Art. 46(2)(c) GDPR in order to ensure an adequate level of data protection. Please note that despite these measures, a residual risk of accessibility of data by US authorities cannot be completely ruled out.

Further information can be found in DelightChat’s Privacy Policy: https://www.delightchat.io/legal/privacy-policy

Discounty (discount and voucher app)
We use the “Discounty” app (provider: 7080 River Rd, 202A, Richmond, BC, V6X1X5, CA), which allows us to implement discount and voucher campaigns in our shop. When using this app, personal data may be processed, for example when customers redeem vouchers or use campaigns linked to customer data (such as name, email address, order data). The processing is based on our legitimate interests (Art. 6(1)(f) GDPR) in carrying out and optimising discount campaigns and improving our offering.

Where personal data is transferred to the provider of the app or to third parties (e.g. in order to provide the app’s functionality), we ensure that this is done in compliance with the GDPR. If data is transferred to a third country outside the European Economic Area, we have implemented appropriate technical and organisational measures (e.g. standard contractual clauses).

If you do not want your data to be processed in connection with such voucher and discount campaigns, you can contact us at any time using our contact details.

Further information on data processing can be found in the privacy policy of the app provider.

9. Data security and backups

We implement technical and organisational security measures in order to protect your personal data as effectively as possible against risks. These include, for example, the use of SSL encryption across the entire website (recognisable by “https://” in the URL), strong password policies, access restrictions so that only authorised persons can access data, regular software updates and security checks.

Despite all measures, data transmission over the internet (e.g. communication by email) may contain security vulnerabilities. We therefore cannot guarantee absolute security. However, you can be assured that we apply very high standards to protect your data.

Backups with Rewind: To additionally protect your data against loss, we use the backup service Rewind provided by Rewind Software Inc. (Canada). Rewind creates regular backups of our Shopify shop. These backups may also contain your personal data (e.g. order and customer data), as this allows us to restore the shop and all data in the event of a technical issue. Rewind stores the data in encrypted form on secure servers. As a Canadian provider, Rewind is subject to Canadian data protection law, which is considered by the EU to provide an adequate level of protection (Canada has an adequacy decision by the European Commission). In addition, we have concluded a data processing agreement with Rewind that includes standard contractual clauses. The use of Rewind is based on our legitimate interest in reliable data backup (Art. 6(1)(f) GDPR).

Backups are routinely retained by us for a certain period and then automatically deleted if no longer needed. If we were required to retain backups for a longer period (e.g. as part of an audit procedure), we would inform you if your data were affected.

10. Storage period and deletion

We do not store your personal data for longer than necessary. Specifically, we delete or anonymise your data as soon as the purpose of processing has been fulfilled and no statutory retention obligations prevent deletion. Here are some typical retention periods for guidance:

Order data (purchase contracts, invoices, proof of payment): We are required to retain these for 7 years (pursuant to Austrian commercial law) or up to 10 years (under certain German/European regulations) due to commercial and tax law requirements. During this time, however, the data is blocked for other purposes.
Customer account data: For as long as your account remains active. After account deletion or prolonged inactivity (more than 2 years), we delete your account data unless other retention obligations apply.
Newsletter data: Until you unsubscribe from the newsletter. After that, we may keep your email address on a suppression list for a short period in order to ensure that you do not receive any further mailings before it is fully deleted.
Support enquiries (e.g. by email): We store these for as long as necessary to process your request. For warranty claims or legal claims, we may retain relevant communications until the expiry of the applicable limitation period.

After the expiry of the periods mentioned above, the relevant data is routinely deleted, provided that it is no longer required for the performance or initiation of a contract and/or you have not consented to further storage.

11. Your rights as a data subject

As a user of our shop and as a person affected by data processing, you have the following rights under the GDPR. You may exercise these rights informally at any time using the contact channels listed above:

Right of access (Art. 15 GDPR): You may request information about which personal data we have stored about you. Upon request, we will inform you which data relating to you we hold, including the purposes of processing, recipients and the planned storage period.
Right to rectification (Art. 16 GDPR): If we process incorrect or incomplete data about you, you have the right to have it corrected or completed without undue delay.
Right to erasure (Art. 17 GDPR): You may request that we delete your personal data, provided that the legal requirements are met. This is the case, for example, if the purpose of data processing no longer applies or if you have withdrawn consent previously given. Please note that there are exceptions (e.g. data we are required by law to retain will not be deleted immediately).
Right to restriction of processing (Art. 18 GDPR): Under certain conditions, you have the right to request restriction of the processing of your data (e.g. if you contest the accuracy of the data, for the duration of the review).
Right to data portability (Art. 20 GDPR): You have the right to receive the data you have provided to us in a commonly used, machine-readable format. Upon request – and where technically feasible – we can also transfer this data directly to another service provider.
Right to object (Art. 21 GDPR): If we process your data on the basis of legitimate interests, you have the right to object to this processing on grounds relating to your particular situation. If you exercise your right to object, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds. Objection to direct marketing: You may object at any time to the processing of your data for direct marketing purposes; we will then cease contacting you for that purpose.
Right to withdraw consent (Art. 7(3) GDPR): If we process certain data on the basis of your consent (e.g. sending newsletters), you may withdraw that consent at any time for the future. The withdrawal can be made informally by message to us or, where available, via technical means (e.g. an “unsubscribe” link). The lawfulness of processing carried out up to the time of withdrawal on the basis of your consent remains unaffected.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): If you believe that we have violated data protection law when processing your personal data, you have the right to lodge a complaint with a data protection supervisory authority. You may do so with the authority responsible for us or with any other supervisory authority in the EU. In Austria, the competent supervisory authority is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna (email: dsb@dsb.gv.at). In Germany, for example, you may contact the data protection authority of your federal state. However, we would appreciate it if you would first speak to us in the event of a problem so that we can try to resolve your concern directly.

Note: In order to exercise your rights, we may require proof of your identity (e.g. confirmation of your email address or, in case of doubt, additional identification) to ensure that no unauthorised person gains access to your data. We will respond to your requests as quickly as possible, but no later than within the statutory period of 1 month.

12. Additional information

External websites and links
Our website may contain links to external websites, for example to partners or information pages. If you click on such links, you leave our website. We are not responsible for the content or the data protection practices of these external sites. Please consult the relevant privacy policy there to find out how your data is used.

No automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. In other words, important decisions – such as whether a contract is concluded or which offers you receive – are not made exclusively by automated means.

Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy from time to time so that it always complies with current legal requirements and accurately reflects our current services. In the event of significant changes (e.g. if we introduce new tools that process your data differently), we will inform you in an appropriate manner. You can always find the current version of the Privacy Policy on this page. You will also find the date of the latest update at the top.

Thank you for your trust and for taking the time to read about data protection. We know that this is a comprehensive topic. If you have any questions or concerns, please do not hesitate to contact us at info@ikegger.eu. We will be happy to assist you.

Your iKegger Europe Team (MashCamp GmbH)