Privacy Policy

Privacy Policy
Last updated: September 22, 2026

Mavristé runs this store and website — along with all related content, features and tools — to give you a smooth shopping experience (the "Services"). Our store runs on Shopify's platform, which helps us deliver these Services to you. This Privacy Policy explains what personal data we collect, why we collect it, and who we share it with when you browse, shop with, or otherwise get in touch with Mavristé. Where this policy and our Terms & Conditions disagree on how your personal data is handled, this policy takes priority.

By using our site, you're confirming you've read and understood how we handle your information as described here.

1. Who's Responsible for Your Data
The data controller for this website is:
Mavristé, Marie Ivanoski
Weinberggasse 60, 1190 Wien, Austria
Email: hello@mavriste.com
Phone: +43 681 20306090

As a small business, we have not appointed a formal Data Protection Officer, as we are not legally required to under Art. 37 GDPR. For any privacy question or request, please contact us directly using the details above.

2. Personal Data We Collect
"Personal data" means information that identifies you or could reasonably be linked back to you. It doesn't include anonymous or fully de-identified data. Depending on how you use our store and where you're located, we may collect:

Contact details — name, billing and shipping address, phone number, email.
Payment information — processed through Shopify Payments; we don't store full card numbers ourselves.
Account details — username, password, saved preferences.
Order activity — items viewed, added to cart or wishlist, purchased, returned or exchanged.
Your messages to us — anything you tell us via email, phone, or our contact form.
Device & browsing data — IP address, browser type and version, operating system, referrer URL, the time of your visit, and how you interact with our site, gathered automatically through server log files and cookies.

Is providing this data required? Contact and payment details are required to place an order — without them, we can't process or ship it. Account details are only needed if you choose to create an account; you can also check out as a guest. Providing other information, like marketing preferences, is always optional.

3. Where This Data Comes From
Mostly directly from you — when you create an account, place an order, or contact us. Some comes automatically through cookies and server logs as you browse. The rest comes from service providers who support our store (like Shopify, our payment processor, and shipping partners).

4. Hosting: Shopify
Our store's content is hosted by Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). When you visit our store, Shopify collects your IP address and information about your device and browser, and uses this to analyze visitor numbers, traffic sources, and customer behavior. If you make a purchase, Shopify also processes your name, email, delivery and billing address, payment details, and related order information. Shopify stores cookies in your browser to support this. See Shopify's own privacy notice at https://www.shopify.com/legal/privacy. We rely on Article 6(1)(f) GDPR (our legitimate interest in reliably running our website) for this, or on your consent under Article 6(1)(a) GDPR where cookie consent has been requested.

5. Cookies
Our site uses cookies — small data files stored on your device, either temporarily (session cookies, deleted when you close your browser) or for longer (persistent cookies, until they expire or you delete them). Some cookies are set by us directly; others by third-party services we use (for example, to run payments or advertising). For a full list of cookies we use, see our Cookie Policy.

Necessary cookies support core functions like the shopping cart and checkout, and are set under our legitimate interest (Art. 6(1)(f) GDPR) in running a working website, unless a specific consent basis applies instead. Analytics and marketing cookies are only set with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via your browser's cookie settings or our cookie banner, in line with § 165 TKG (Austrian Telecommunications Act).

You can configure your browser to notify you when cookies are set, accept them only in specific cases, or reject them entirely — note that this may limit some site functionality.

6. How We Use Your Data

To run the shop — process orders and payments, arrange shipping, handle returns and exchanges, manage your account.
To communicate with you — order updates, replies to contact form or email/phone enquiries, and, only if you've opted in, our newsletter.
To keep things secure — detect fraud, protect your account, and keep transactions safe (server log files support this too).
To meet legal obligations — respond to valid legal requests, and comply with tax and commercial record-keeping rules.

Legal bases: performance of a contract with you (Art. 6(1)(b) GDPR), compliance with a legal obligation (Art. 6(1)(c) GDPR), our legitimate interest (Art. 6(1)(f) GDPR), or your consent (Art. 6(1)(a) GDPR) where we've asked for it — you can withdraw consent at any time without affecting processing carried out before the withdrawal.

7. Contact Form, Email & Phone Enquiries
When you contact us — by form, email, or phone — we store the details you provide (including your contact information) to handle your request and any follow-up. We don't pass this on without your consent. We keep it until you ask us to delete it, withdraw any consent given, or the purpose for keeping it no longer applies (e.g. your enquiry is resolved), subject to any legal retention duties.

8. Who We Share It With
We don't sell your data. We only pass personal data to outside parties where it's needed to fulfil a contract with you, where we're legally required to (e.g. to tax authorities), where we have a legitimate interest in doing so, or where another legal basis allows it. This includes:

Shopify and the vendors that power our store — payment processing, hosting, analytics, and fulfillment, under data processing agreements where applicable.
Shipping carriers, to get your order to you — and, with your consent, your email address so they can send you delivery updates directly.
Payment service providers (see below), to process your order.
If required by law, or to protect our legal rights.

9. Payment Services
We use Shopify Payments to process your payment. The EU provider is Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Your payment details (such as name, amount, account or card details) are processed by this provider under its own terms and privacy notice. This processing rests on Art. 6(1)(b) GDPR (fulfilling our contract with you) and our interest in a smooth, secure checkout (Art. 6(1)(f) GDPR).

10. Social Media — Instagram
Our site links to and may embed features from Instagram, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. If an Instagram element is active on a page you visit, a direct connection is made between your device and Instagram's servers, and Instagram receives information about your visit. If you're logged into Instagram, clicking an Instagram button can link that visit to your Instagram profile; we don't see the content or use of any data transferred this way. This runs on your consent (Art. 6(1)(a) GDPR) where requested, or otherwise on our legitimate interest in being visible on social media (Art. 6(1)(f) GDPR). Where we are joint controller with Meta for the initial collection and hand-off of this data, details of that arrangement are available at https://www.facebook.com/legal/controller_addendum. More on how Instagram uses your data: https://privacycenter.instagram.com/policy/.

11. Advertising — TikTok Pixel
We may use the TikTok Pixel, provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, to show relevant ads to people who've visited our store and to measure how well our TikTok ads perform. This involves processing data such as your IP address, pages viewed, time spent on site, device/browser type, and ad interactions, tied to a device-level identifier. This only runs with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. More information: TikTok's Privacy Policy.

12. International Data Transfers
Some of the tools we use are based outside the EU/UK, including in the United States. Where personal data is transferred to a country without an adequate level of data protection recognized by the EU, we rely on approved safeguards such as the European Commission's Standard Contractual Clauses (or the UK equivalent), or, for US-based providers, certification under the EU-US Data Privacy Framework, where applicable.

13. Links to Other Sites
Our site may link out to third-party pages we don't control. We're not responsible for their privacy practices, so it's worth checking their own policies before sharing information there.

14. Children
Our Services aren't directed at children, and we don't knowingly collect personal data from anyone under the age of legal majority in their jurisdiction. If you're a parent and believe your child has shared data with us, contact us and we'll delete it.

15. Security & Retention
Our checkout and any forms you submit to us are protected with SSL/TLS encryption — you'll see "https://" and a padlock icon in your browser when this is active, meaning the data you send can't be read by third parties in transit. That said, no online system is ever fully secure, so please avoid sending sensitive details to us through unsecured channels like plain email.

We keep personal data only as long as we need it for the purpose it was collected. As a general guide: order, invoice and payment records are kept for seven years in line with Austrian tax and accounting law (§ 132 Bundesabgabenordnung); account data is kept for as long as you hold an account with us; contact-form and enquiry data is kept until your request is resolved and any follow-up period has passed; and marketing consent data is kept until you withdraw consent or unsubscribe. Where none of these apply, we delete personal data once it is no longer needed, unless a legal retention duty requires otherwise.

16. Automated Decision-Making
We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

17. Your Rights
If you're in the EU, UK, or another jurisdiction with similar protections, you have the right to:

Access the personal data we hold about you, including its origin, recipients, and purpose.
Rectify inaccurate data.
Erase your data, subject to any legal retention duties.
Restrict processing in certain cases — for example, while we verify disputed data, or instead of deletion where you need the data for a legal claim.
Data portability — receive data you gave us, processed by automated means under contract or consent, in a common machine-readable format.
Object at any time to processing based on our legitimate interest (Art. 21(1) GDPR), including profiling, on grounds relating to your particular situation — we'll stop unless we can show compelling legitimate grounds that override your interests, or the processing is needed for a legal claim. You can also object, with no need to give a reason, to any processing of your data for direct marketing purposes (Art. 21(2) GDPR), including related profiling — we'll stop immediately.
Withdraw consent at any time, where we rely on it — this doesn't affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these, contact us at hello@mavriste.com. We may need to verify your identity first. You also have the right to lodge a complaint with a data protection supervisory authority. As we are established in Austria, that's primarily the Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria — www.dsb.gv.at; UK residents can instead contact the ICO.

18. Marketing Preferences
You can unsubscribe from our marketing emails any time using the link at the bottom of any email. You'll still receive essential emails about your orders or account.

19. Changes to This Policy
We may update this policy from time to time, including to reflect changes in our practices or in the law. Any changes will be posted here with a new "Last updated" date.

20. Contact Us
Questions about this policy or your data? Email us at hello@mavriste.com, call us at +43 681 20306090, or write to us at Weinberggasse 60, 1190 Wien, Austria.