Data protection

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Ticket to the Moon GmbH
Herklotzgasse 21/1
1150 Vienna
Austria
Email: hello@ticketothemoon.com
Phone: +43 660 6683835
Company registration number: FN 542856 v
VAT ID number: ATU76229118
Managing Director: Dipl.-Ing. Florian Hubmann, MSc

A data protection officer has not been appointed. Questions regarding data protection and inquiries concerning the exercise of your data protection rights can be directed to hello@ticketothemoon.com.

We only process personal data if there is a legal basis for doing so. Depending on the processing, we rely in particular on:

• Art. 6 (1) (a) GDPR – your consent;
• Art. 6 (1) (b) GDPR – performance of pre-contractual measures or fulfillment of a contract;
• Art. 6 (1) (c) GDPR – fulfillment of legal obligations;
• Art. 6 (1) (f) GDPR – safeguarding our legitimate interests or the legitimate interests of third parties;
• § 165 (3) TKG 2021 – storage of or access to information on your terminal equipment, in particular through cookies;
• § 174 TKG 2021 – electronic direct advertising and marketing communication.

When we rely on legitimate interests, we weigh these interests against your rights and freedoms.

You may revoke any consent given at any time with effect for the future. The lawfulness of the processing carried out until the revocation remains unaffected.

Our online shop is powered by the e-commerce platform Shopify.

The provider for merchants in the European Economic Area is generally:

Shopify International Limited
Ireland

Shopify processes data required for operating the online shop, providing the website, customer accounts, shopping carts, orders, payments, fraud prevention, and technical security.

This may include, in particular:

• Name and contact details;
• Billing and delivery address;
• Order and transaction information;
• Customer account and login data;
• IP address;
• Device and browser information;
• Cookie and session identifiers;
• Information about the use of the online shop; and
• Communication and support information.

The processing is carried out for the performance of pre-contractual measures and for the fulfillment of the contract pursuant to Art. 6 (1) (b) GDPR as well as to ensure a secure and functional online shop pursuant to Art. 6 (1) (f) GDPR.

Shopify processes customer data for basic platform services primarily as a data processor. For certain standalone or extended Shopify services, particularly Shop and Shop Pay, Shopify may process data for its own purposes as an independent controller.

Certain shop, order, and customer data of European merchants are stored at rest in Europe. However, Shopify operates an international infrastructure. Processing by Shopify group companies and authorized service providers outside the European Economic Area therefore cannot be excluded.

For international data transfers, Shopify uses the applicable legal transfer mechanisms, including adequacy decisions, binding corporate rules, and EU Standard Contractual Clauses.

Further information:
https://www.shopify.com/legal/privacy
https://www.shopify.com/legal/dpa

When you visit our website, technically necessary information is processed to provide the website, ensure its stability and security, and detect technical errors or unauthorized access.

This may include:

• IP address;
• date and time of access;
• the page or file accessed;
• referrer URL;
• browser type and version;
• operating system;
• device information;
• amount of data transferred; and
• technical error and security information.

Processing is based on our legitimate interest in the secure and reliable operation of our website in accordance with Art. 6 (1) (f) GDPR.

Log data is only stored for as long as is necessary for technical operation, IT security, error analysis, and the prevention of misuse. Longer storage may occur if a specific security incident or legal obligation requires it.

Our website uses SSL or TLS encryption. You can recognize an encrypted connection by "https://" and the padlock icon in your browser's address bar.

We use cookies and similar technologies, such as pixels, tags, local storage technologies, and device identifiers.

Technically necessary technologies

Technically necessary cookies and technologies are used so that the online shop functions properly. In particular, they enable:

• shopping cart and checkout functions;
• customer account and login;
• language, country, and currency settings;
• security and fraud prevention;
• load balancing and technical stability;
• storage of your privacy settings; and
• fulfillment of your expressly requested functions.

To the extent that personal data is processed in this context, this is done in accordance with Art. 6 (1) (b) or (f) GDPR. Access to your terminal device is permitted under Section 165 (3) TKG 2021, provided it is absolutely technically necessary.

Technologies requiring consent

Technologies for personalization, statistics, analysis, and marketing are only used if you have provided your consent via our cookie and privacy settings, to the extent that consent is legally required.

The legal basis is Art. 6 (1) (a) GDPR in conjunction with Section 165 (3) TKG 2021.

We use the consent management system integrated into Shopify. There, you can choose between the following categories:

• technically necessary;
• personalization;
• analytics; and
• marketing.

You can change or revoke your selection at any time via the cookie or privacy settings available on the website.

The respective storage durations result from the cookie settings or from the functional duration of the technology in question.

When you open a customer account or place an order, we process the data required for account opening and contract fulfillment.

This may include:

• Name;
• Email address;
• Phone number;
• Billing and shipping address;
• Country and language;
• Products ordered;
• Order number and order history;
• Purchase price and currency;
• Payment and refund status;
• Shipping and tracking information;
• Returns;
• Warranty, guarantee, and repair information; and
• Tax-related information.

Processing is carried out for the performance of pre-contractual measures and for the fulfillment of the contract pursuant to Art. 6(1)(b) GDPR, as well as for compliance with legal retention and documentation obligations pursuant to Art. 6(1)(c) GDPR.

You can request the deletion of your customer account via hello@ticketothemoon.com. Order, billing, and transaction information that must be retained by law may continue to be stored even after the customer account has been deleted.

We use Odoo as a system for enterprise resource planning, customer management, order processing, accounting, logistics, and other operational processes.

The provider is:

Odoo S.A.
Belgium

In Odoo, the following data in particular may be processed:

• Customer and contact data;
• Order and product information;
• Delivery and shipping information;
• Invoice and transaction information;
• Returns;
• Customer service communication;
• Warranty, guarantee, and repair information; and
• other data required for the management of the customer relationship.

Processing is carried out for the performance of a contract pursuant to Art. 6 (1) (b) GDPR, for compliance with legal obligations pursuant to Art. 6 (1) (c) GDPR, and for the efficient organization of our business operations pursuant to Art. 6 (1) (f) GDPR.

Our Odoo database uses the European hosting region. Production data is generally processed in European data centers. Depending on the Odoo version and technical infrastructure, backup copies or limited support access may also take place outside the EU, in particular in a country with an adequacy decision or on the basis of EU standard contractual clauses.

Further information:
https://www.odoo.com/privacy

For payment processing, we process the order, contact, billing, and payment information required for this purpose.

Full credit or debit card numbers are generally processed directly by the respective payment service provider and are not stored by us independently.

Depending on the country and the payment method selected at checkout, the following providers and services, in particular, may be used:

Shopify Payments

We use Shopify Payments for credit and debit card payments as well as various local and accelerated payment methods.

These may include, among others:

• Visa;
• Mastercard;
• Maestro;
• American Express;
• Bancontact;
• EPS;
• iDEAL/Wero;
• MobilePay;
• Apple Pay;
• Google Pay; and
• Shop Pay.

Shopify and its payment and banking partners process the data required for payment processing, identity verification, fraud prevention, refunds, and legal compliance.

PayPal

If PayPal is selected, payment and transaction information will be transmitted to the relevant company within the PayPal Group.

For the European Economic Area, this is generally:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

Further information:
https://www.paypal.com/at/legalhub/paypal/privacy-full

Klarna

If a Klarna payment method is selected, the necessary contact, order, and payment information will be transmitted to Klarna.

The provider is:

Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden

Klarna may carry out an identity or credit check to decide on certain payment methods. Details on this can be found in Klarna's privacy policy:
https://www.klarna.com/at/datenschutz/

Payment processing is generally carried out for the performance of a contract in accordance with Art. 6 (1) (b) GDPR. Legally required checks are carried out in accordance with Art. 6 (1) (c) GDPR. Fraud prevention and security checks may be based on legitimate interests in accordance with Art. 6 (1) (f) GDPR.

For the storage, processing, packaging, and dispatch of orders, we use Logsta as our fulfillment service provider.

In this context, the following data in particular may be processed:

• Name;
• Delivery address;
• E-mail address;
• Telephone number;
• Ordered products;
• Order and shipment number;
• Shipping status;
• Return information; and
• Customs data, where applicable.

For delivery, we transmit the necessary information to the respective commissioned shipping company. We use in particular:

• United Parcel Service – UPS;
• Österreichische Post AG, Rochusplatz 1, 1030 Vienna; and
• Other shipping service providers, where applicable, if this is necessary due to the country of delivery, the shipping method, or availability.

The shipping companies may use contact details to transmit delivery information, tracking notifications, or queries regarding the delivery.

For deliveries to countries outside the European Union, information may also be transmitted to customs authorities, customs agents, or other competent public bodies.

Processing is carried out for the performance of a contract in accordance with Art. 6 para. 1 lit. b GDPR as well as for the fulfillment of legal customs, tax, and record-keeping obligations in accordance with Art. 6 para. 1 lit. c GDPR.

Data protection notices:
https://www.post.at/i/c/datenschutz
https://www.ups.com/at/de/support/shipping-support/legal-terms-conditions/privacy-notice

If you contact us via email, contact form, live chat, or through our Help Center, we process the data you provide in order to handle your request.

This may include:

• Name and contact details;
• Content and time of your message;
• Order number;
• Order and shipping information;
• Returns, repair, and warranty information;
• Images and documents transmitted by you; and
• Technical information regarding the use of the chat.

For our Help Center and the live chat, we use Gorgias. The provider is Gorgias Inc.

Gorgias processes customer service and communication data on our behalf. This may involve processing in the United States and by international sub-processors. Where necessary, international transfers are based on appropriate safeguards, in particular EU Standard Contractual Clauses.

The legal basis is Art. 6(1)(b) GDPR if your request relates to an order or a contract. For general inquiries, processing is based on our legitimate interest in efficient customer communication pursuant to Art. 6(1)(f) GDPR.

Further information:
https://www.gorgias.com/legal/privacy

When you subscribe to our newsletter, we process your email address and, where applicable, your name, language, preferences, and information regarding your interaction with our newsletters.

We use Shopify Email for distribution.

Subscription is generally carried out via a double opt-in procedure. After registering, you will receive a message allowing you to confirm your subscription. The time, IP address, and confirmation status may be stored to provide proof of consent.

The legal basis is your consent in accordance with Art. 6(1)(a) GDPR in conjunction with Section 174 TKG 2021.

You can unsubscribe from the newsletter at any time using the unsubscribe link in every message or by notifying hello@ticketothemoon.com.

After unsubscribing, we may store your email address in a suppression list to the extent necessary to ensure that you do not receive any further marketing messages. This storage is based on our legitimate interest in respecting your unsubscribe request in accordance with Art. 6(1)(f) GDPR.

To the extent permitted by law, we may send existing customers information about our own similar products. You may object to this use of your email address at any time.

Judge.me

We use Judge.me to collect, manage, and display product reviews.

The provider is:

Judge.me Ltd
United Kingdom

When you submit a review, the following data in particular may be processed:

• Name or display name chosen by you;
• Email address;
• Review text;
• Star rating;
• Images or videos that you voluntarily upload;
• Product and order information;
• Time of the review; and
• Technical information for the prevention of abuse.

Reviews can be displayed publicly with your chosen name. Your email address will not be displayed publicly.

Review invitations are only sent insofar as this is legally permissible and the necessary consent has been provided.

Further information:
https://judge.me/privacy

Google Customer Reviews

Insofar as we use Google Customer Reviews, you can voluntarily consent to participate in a review survey after a purchase.

Only if you provide consent will the data required for this, in particular your email address, order information, and the expected delivery date, be transmitted to Google.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

The legal basis is your consent in accordance with Art. 6(1)(a) GDPR.

We use GoAffPro for our ambassador and affiliate program.

GoAffPro enables the registration of ambassadors, the provision of individual referral links, the attribution of referred orders, and the calculation of commissions.

In this context, the following data in particular may be processed:

• Name and contact details of ambassadors;
• Account and login data;
• Referral and affiliate ID;
• Click, device, and browser information;
• IP address;
• Attributed orders;
• Commission and payout information; and
• Cookie or tracking identifiers.

The processing of ambassador data is carried out for the performance of the ambassador contract in accordance with Art. 6 (1) (b) GDPR.

Affiliate tracking on the end devices of shop visitors is carried out on the basis of your consent in accordance with Art. 6 (1) (a) GDPR in conjunction with Section 165 (3) of the TKG 2021, provided that the technology is not strictly technically necessary.

GoAffPro may process data in India and other countries. International transfers are, where necessary, based on appropriate safeguards such as EU standard contractual clauses.

Further information:
https://goaffpro.com/privacy

We use various Shopify applications to provide additional shop functions.

Quizify and Product Finder

We use Quizify so that you can find suitable hammocks or other products based on your answers.

In doing so, answers, product recommendations, technical usage data, and cookie or session identifiers may be processed. Unless you enter contact details, the answers are generally only used for product recommendations.

Product Personalization

For customizable products, we use a product personalization application. The personalization details you enter are processed together with the order.

Please do not enter any sensitive personal data into free-text personalization fields.

Processing is carried out for the fulfillment of a contract in accordance with Art. 6 (1) (b) GDPR.

Storeify and Google Maps

We use Storeify and mapping services from Google Maps for our store finder.

When you access the store finder or a map, your IP address, device information, location or search data, and information about the use of the map may be processed.

Google Maps is only loaded after you have given your consent, insofar as consent is required by law. The legal basis is Art. 6 (1) (a) GDPR in conjunction with § 165 (3) TKG 2021.

The provider of Google Maps is Google Ireland Limited. Processing by Google LLC and other Google companies outside the EEA cannot be excluded.

Discount, Bundle, Gift, Upsell, and Shopping Cart Functions

We use further Shopify applications for:

• Discounts and promotional prices;
• Product bundles;
• Free products;
• Upselling and product recommendations;
• Progress bars for shipping benefits;
• Shopping cart reminders;
• Product personalization; and
• Technical optimization of the shopping process.

In this context, shopping cart, product, order, cookie, device, and session information may be processed. Insofar as these functions are required for a purchasing process you have requested, processing is carried out in accordance with Art. 6 (1) (b) GDPR. Otherwise, it is based on our legitimate interest in accordance with Art. 6 (1) (f) GDPR or, in the case of tracking requiring consent, on Art. 6 (1) (a) GDPR.

Analysis and marketing technologies requiring consent are only used after you have given your consent via our cookie settings.

The legal basis is Art. 6 (1) (a) GDPR in conjunction with § 165 (3) TKG 2021.

Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited.

Google Analytics helps us understand how visitors use our website. In particular, the following data may be processed:

• IP address;
• device and browser information;
• pages visited;
• interactions and events;
• approximate location information;
• origin of the visit;
• cookie and device identifiers; and
• purchase and conversion information.

The IP address is truncated according to the procedures provided by Google or is not permanently logged as a full IP address.

Google Ads and Remarketing

We use Google Ads, including conversion measurement and remarketing, to measure the effectiveness of our advertising and to display interest-based advertising.

In this process, information about page views, clicks, shopping carts, purchases, devices, and cookie identifiers may be transmitted to Google and linked with other information from Google, especially if you are logged into a Google account.

Meta Pixel

We use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

The pixel allows us to measure the effectiveness of advertising on Facebook and Instagram and to create target groups for advertising.

In this process, browser, device, usage, purchase, and conversion information can be processed. Meta may process certain information under its own responsibility for advertising and measurement purposes.

Further information:
https://www.facebook.com/privacy/policy/

TikTok Pixel

We use the TikTok Pixel from TikTok Technology Limited, Dublin, Ireland.

The pixel is used to measure advertising campaigns and to create target groups. In this process, cookie, device, browser, usage, and conversion information can be processed.

Further information:
https://www.tiktok.com/legal/page/eea/privacy-policy/de

Pinterest Tag

We use the Pinterest Tag from Pinterest Europe Ltd., Dublin, Ireland.

The Pinterest Tag helps us to measure conversions and to create interest-based target groups for Pinterest advertising. In this process, cookie, device, usage, and purchase data can be processed.

Further information:
https://policy.pinterest.com/de/privacy-policy

International processing by marketing providers

Google, Meta, TikTok, and Pinterest may process data inside and outside the European Economic Area, particularly in the United States.

To the extent that a provider is certified under the EU-U.S. Data Privacy Framework, a transfer can be based on the corresponding adequacy decision. Otherwise, or in addition, appropriate safeguards, in particular EU Standard Contractual Clauses, are used.

You can revoke your consent at any time via our cookie and privacy settings.

Our website may embed videos from YouTube or other social network content.

YouTube is provided by Google Ireland Limited. When playing an embedded video, your IP address, device information, cookie identifiers, and information about your interaction with the video may be transmitted to Google.

Embedded content is only loaded with your consent, as required by law.

Our website also contains links to our profiles on Facebook, Instagram, Pinterest, YouTube, and TikTok. If it is merely a link, data is generally not transmitted to the respective provider until you click the link.

The respective platform operator is responsible for any further processing on their platform.

Ticket to the Moon works internationally with PT Ayunan Bulan International in Bali, Indonesia.

Authorized employees of PT Ayunan Bulan International may access limited EU customer data in Shopify, Odoo, and other operational systems as necessary for the following purposes:

• Order management;
• Customer service;
• Warranty and repair processing;
• Logistics;
• Product and master data management;
• Accounting and administration;
• IT support; and
• other required operational activities.

Access is restricted to authorized individuals and data necessary for the specific task.

Indonesia does not currently have an adequacy decision from the European Commission. Therefore, data transfer is secured, where necessary, by appropriate safeguards in accordance with Chapter V of the GDPR, in particular by the European Commission's standard contractual clauses as well as supplementary technical and organizational measures.

The legal basis for the respective processing is Art. 6 (1) (b), (c), or (f) GDPR. The legal basis for the international transfer is derived from Art. 46 GDPR.

Depending on the respective processing, personal data may be transmitted to the following categories of recipients:

• Shopify and Shopify sub-processors;
• Odoo;
• PT Ayunan Bulan International;
• Payment service providers and banks;
• Logsta as well as shipping, postal, and logistics companies;
• Gorgias and customer service providers;
• Newsletter and communication providers;
• Review platforms;
• Affiliate and ambassador platforms;
• Providers of product finder, map, personalization, discount, and shop applications;
• Analytics and advertising providers;
• IT, hosting, and security service providers;
• Tax advisors, accountants, auditors, and legal advisors;
• Customs, tax, and other authorities, as required by law; and
• other recipients if you have consented or there is a legal basis.

As a rule, data processors may only process personal data in accordance with our documented instructions and within the framework of the concluded data processing agreements.

We do not sell your personal data.

Some of our service providers and affiliated companies are located outside the European Economic Area or use international sub-processors.

For transfers to a third country, we rely – depending on the respective recipient – in particular on:

• an adequacy decision by the European Commission;
• the EU-US Data Privacy Framework for appropriately certified US recipients;
• standard contractual clauses of the European Commission;
• binding corporate rules; or
• a statutory exception pursuant to Art. 49 GDPR, provided its requirements are met.

You can request further information about the safeguards used for a specific transfer at hello@ticketothemoon.com.

We only store personal data for as long as is necessary for the respective purpose or as required by statutory retention obligations.

In particular, the following principles apply:

• Orders, invoices and accounting documents: generally at least seven years in accordance with the applicable Austrian tax and corporate law retention obligations;
• Customer account: until the account is deleted and beyond that only insofar as data is required for statutory obligations or the establishment, exercise or defense of legal claims;
• Customer service, returns, repairs and warranty: until processing is complete and subsequently for the period during which claims can be asserted;
• Newsletter and marketing: until consent is withdrawn or an objection is raised; necessary suppression list information may be stored for longer;
• Records of consent: for as long as this is necessary to prove lawful processing and to defend against claims;
• Reviews: until the review is deleted or until storage is no longer necessary;
• Cookies and similar technologies: in accordance with the duration specified in the cookie settings;
• Server and security logs: only for as long as is necessary for operation and security, unless a security incident justifies longer storage.

Upon expiry of the respective periods, the data will be deleted or anonymized, provided there is no further legal basis for storage. Temporary residual copies may remain in backup copies until they are scheduled to be overwritten.

We implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

These may include, in particular:

• access restrictions and user permissions;
• authentication measures;
• encrypted data transmission;
• role and authorization concepts;
• data backups;
• logging of security-relevant processes;
• contractual obligation of service providers;
• restriction of access to authorized employees; and
• internal data protection and security processes.

No electronic system can guarantee absolute security. We therefore review our measures in accordance with the risk and the state of the art.

We do not, as a matter of principle, make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

Payment service providers may carry out their own automated checks, in particular for fraud prevention, identity verification, or credit assessment. The respective payment service provider is responsible for such independent checks.

Provided that the legal requirements are met, you have the following rights in particular:

• Access to your processed personal data pursuant to Art. 15 GDPR;
• Rectification of incorrect or incomplete data pursuant to Art. 16 GDPR;
• Erasure of your data pursuant to Art. 17 GDPR;
• Restriction of processing pursuant to Art. 18 GDPR;
• Notification of recipients pursuant to Art. 19 GDPR;
• Data portability pursuant to Art. 20 GDPR;
• Objection to processing based on legitimate interests pursuant to Art. 21 GDPR;
• Objection to direct marketing at any time and without giving reasons;
• Withdrawal of consent with effect for the future pursuant to Art. 7 para. 3 GDPR; and
• Lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR.

To exercise your rights, please contact us at:
hello@ticketothemoon.com

We may request information necessary to verify your identity. This is to ensure that personal data is not disclosed to unauthorized third parties.

Special Note on the Right to Object

If we process personal data on the basis of Art. 6 para. 1 lit. f GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation.

If we process personal data for the purpose of direct marketing, you may object to this processing at any time without giving reasons. In this case, we will no longer use your data for direct marketing.

You have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for us in Austria is:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at

You may also contact the supervisory authority of your habitual residence, your place of work, or the place of the alleged data protection infringement.

Our online shop is not specifically aimed at children who, under applicable law, cannot provide valid consent or enter into a contract without the agreement of their legal guardians.

If you believe that a child has submitted personal data to us without the necessary consent, please contact us at hello@ticketothemoon.com.

Our website may contain links to websites or services of independent third parties.

The respective operators are responsible for the data protection practices of independent websites. Please read their privacy policies before providing personal data there.

We may amend this privacy policy if our services, technical systems, service providers used, business processes, or legal requirements change.

The current version will be published on this page. You can find the date of the last update at the beginning of the privacy policy.

If you have any questions regarding this privacy policy, the processing of your personal data, or the exercise of your rights, please contact:

Ticket to the Moon GmbH
Herklotzgasse 21/1
1150 Vienna
Austria
Email: hello@ticketothemoon.com
Phone: +43 660 6683835