Protecting your personal data is important to us. Here we explain which data we process when you visit our website and place orders, for what purposes and on what legal basis, and what rights you have.

1. Controller

octogon GmbH
Roseggerstraße 16, 8700 Leoben, Austria
Phone: +43 676 362 8453
Email: office@octogon.org

We are not legally required to appoint a data protection officer. Please send data protection enquiries to the address above.

2. Hosting and shop system

Our website and online shop are operated via Shopify (Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify processes the data arising from website visits and orders on our behalf and may transfer data to its parent company Shopify Inc. in Canada and to service providers in the USA. An EU adequacy decision exists for Canada; for transfers to other third countries Shopify relies on the EU Commission's standard contractual clauses.

When you access the website, technically necessary data are processed, in particular IP address, date and time, page accessed, referrer URL, browser and operating system. This is necessary to provide the website and ensure its security (Art. 6(1)(f) GDPR).

3. Contacting us

If you contact us by email, phone or via the contact or enquiry form, we process your details (e.g. name, company, email address, phone number, content of the enquiry) to answer your enquiry and, where applicable, to prepare a quotation (Art. 6(1)(b) GDPR, for other enquiries Art. 6(1)(f) GDPR).

For email and office applications we use Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Microsoft is certified under the EU-US Data Privacy Framework; standard contractual clauses also apply.

4. Orders

To process your order we process the necessary data: company, name of contact person, delivery and billing address, email address, where applicable phone number and VAT ID, ordered items and payment data (Art. 6(1)(b) and (c) GDPR).

For delivery we pass name, company and delivery address and, where applicable, phone number and email address to the commissioned carrier, insofar as this is necessary for delivery and shipment notifications.

5. Payment service providers

Depending on the payment method chosen, we pass the data required for payment to the respective payment service provider (Art. 6(1)(b) GDPR):

• Shopify Payments for credit and debit cards, Apple Pay, Google Pay, eps bank transfer and other payment methods processed via Shopify. Payments are processed by Shopify and the payment processors it uses.
• Shop Pay (Shopify), if you save your details in a Shop account for faster checkout. The Shop terms and privacy policy also apply.
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). Privacy information: paypal.com.
• Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden). Klarna may carry out an identity and credit check for certain payment methods. Privacy information: klarna.com.
• Prepayment and purchase on invoice are handled by us; payment is made to our bank account.

6. Cookies and consent

We use technically necessary cookies and similar technologies so that the cart, checkout, language and currency selection work (Art. 6(1)(f) GDPR and § 165(3) Austrian Telecommunications Act 2021).

We only set cookies for statistics and advertising with your consent (Art. 6(1)(a) GDPR). You make your choice in the cookie notice on your first visit; consent is stored via Shopify's consent management. You can withdraw it at any time with effect for the future by deleting your browser's cookies for this website and making a new choice.

7. Statistics and advertising (only with consent)

Shopify statistics: Shopify provides us with reports on visits and orders so that we can improve the shop.

Google Analytics 4 and Google Tag Manager: With Google Analytics we evaluate the use of the website (e.g. pages viewed, time spent, approximate location, device). The IP address is shortened by Google. Google Tag Manager controls the loading of these services.

Google Ads conversion tracking and remarketing: We measure whether visitors come to us via a Google ad and, for example, complete an order or enquiry, and we may show ads to visitors of our website on other sites later. Cookies or identifiers are set for this purpose.

The provider of the Google services is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. We also provide our product data via Google Merchant Center; no visitor data are transferred in this process. More information: policies.google.com/privacy.

8. Email marketing

If you agree at checkout or elsewhere to receive news and offers by email, we use your email address for this purpose (Art. 6(1)(a) GDPR). You can withdraw your consent at any time, for example via the unsubscribe link in every email or by writing to office@octogon.org.

9. Storage period

We store personal data only as long as necessary for the respective purpose. Order and invoice data are kept for seven years because of statutory retention obligations (in particular § 132 Austrian Federal Fiscal Code and § 212 UGB), and beyond that for as long as necessary for ongoing warranty or legal disputes. Enquiries that do not lead to a contract are deleted once they have been dealt with and there is no reason for further storage.

10. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can withdraw consent at any time with effect for the future. Please contact office@octogon.org.

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons.

You also have the right to lodge a complaint with a data protection supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

This English version is for information only; the German version is legally binding.

As of: October 2026