Spinestrain

Privacy Policy

Last updated: March 6, 2026

This Privacy Policy explains how Spinestrain ("we," "us," or "our") collects, uses, discloses, and protects your personal data when you visit our website or use our services. We are committed to protecting your privacy and ensuring transparency in our data processing activities in compliance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (Bundesgesetz über den Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten – DSG 2018), and other applicable data protection laws.

1. Data Controller

The data controller responsible for processing your personal data is:

Spinestrain
Bahnhofstraße 14
4802 Ebensee
Austria
Email: community@spinestrain.world

We may use third-party advertising services on this website. Where we do so, those partners may collect and use data for ad personalization and measurement. You can control ad personalization via your cookie preferences and through the links in our Cookie Policy.

2. Personal Data We Collect

We may collect the following categories of personal data:

2.1 Information You Provide Directly

  • Contact Information: Name, email address, phone number, and postal address when you place an order or contact us.
  • Order Information: Details related to your purchases, including billing and shipping addresses.
  • Communication Data: Messages, inquiries, and feedback you send to us.

2.2 Information Collected Automatically

  • Technical Data: IP address, browser type and version, operating system, device information.
  • Usage Data: Pages visited, time spent on pages, click patterns, referring website.
  • Cookie Data: Information collected through cookies and similar technologies (see our Cookie Policy).

3. Purposes and Legal Basis for Processing

We process your personal data for the following purposes:

3.1 Contract Performance (Art. 6(1)(b) GDPR)

  • Processing and fulfilling your orders
  • Communicating with you about your orders
  • Providing customer support

3.2 Legitimate Interests (Art. 6(1)(f) GDPR)

  • Improving our website and services
  • Analyzing website usage and trends
  • Protecting against fraud and security threats
  • Maintaining records for administrative purposes

3.3 Consent (Art. 6(1)(a) GDPR)

  • Sending marketing communications (where you have opted in)
  • Setting non-essential cookies

3.4 Legal Obligation (Art. 6(1)(c) GDPR)

  • Complying with tax and accounting requirements
  • Responding to legal requests from authorities

4. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

  • Order Data: 7 years from the date of purchase (for tax and legal compliance)
  • Contact Inquiries: 3 years from the last communication
  • Marketing Consent: Until you withdraw your consent
  • Website Analytics: 26 months

5. Data Sharing and Recipients

We may share your personal data with the following categories of recipients:

  • Service Providers: Payment processors, shipping companies, hosting providers, and IT support services that help us operate our business.
  • Advertising Partners: Where you have consented, we may allow third-party advertising services (e.g. for interest-based advertising) to place cookies or use similar technologies. These partners have their own privacy policies; we do not sell your personal data to them.
  • Legal Authorities: When required by law or to protect our legal rights.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not sell your personal data to third parties.

5.1 Advertising on This Website

This website may display third-party advertisements. Advertising partners may use cookies and similar technologies to show relevant ads and measure effectiveness. Such processing is based on your consent where required by law. You can withdraw consent or manage preferences via our cookie banner and Cookie Policy.

6. International Data Transfers

If we transfer your personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

  • Standard Contractual Clauses approved by the European Commission
  • Adequacy decisions by the European Commission
  • Other legally recognized transfer mechanisms

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

  • Right of Access (Art. 15): Request a copy of your personal data we hold.
  • Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
  • Right to Erasure (Art. 17): Request deletion of your personal data under certain conditions.
  • Right to Restriction (Art. 18): Request limitation of processing in certain circumstances.
  • Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
  • Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing.
  • Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at community@spinestrain.world. We will respond to your request within one month.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

  • SSL/TLS encryption for data transmission
  • Secure data storage with access controls
  • Regular security assessments
  • Employee training on data protection

9. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.

10. Right to Lodge a Complaint

If you believe that our processing of your personal data violates data protection laws, you have the right to lodge a complaint with a supervisory authority. In Austria, the relevant authority is:

Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40-42
1030 Vienna, Austria
Website: www.dsb.gv.at

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting a notice on our website. The updated policy will be effective from the date stated at the top of this document.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: community@spinestrain.world
Address: Bahnhofstraße 14, 4802 Ebensee, Austria