Privacy Policy

Your Privacy Matters

We take the protection of your personal data seriously. This Privacy Policy explains which personal data we process when you visit SunnyHillSeeds, create a customer account, place an order, contact us or subscribe to our newsletter.

1. Data Controller

The controller responsible for processing personal data on this website is:

Gassner Vertriebs GmbH
Villacherstraße 60
9220 Velden am Wörthersee
Austria

2. Hosting and Server Log Files

When you visit our website, technical information is automatically transmitted to the server hosting the website. This information may include:

• IP address
• Date and time of access
• Pages and files accessed
• Referring website or URL
• Browser type and browser version
• Operating system
• Device and connection information
• HTTP status and amount of data transferred

Server log files are processed to provide the website, ensure technical stability, detect errors and protect our systems against unauthorised access, fraud and other security threats.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and efficient operation of our online shop.

3. WordPress and WooCommerce

Our website is operated using WordPress and WooCommerce. These systems provide the technical functions required for displaying products, managing the shopping cart, processing orders and administering customer accounts.

Depending on how you use the shop, the following data may be processed:

• Name and contact information
• Billing and delivery address
• Email address and optional telephone number
• Customer account and login information
• Products ordered and order history
• Payment method and payment status
• Shipping information
• Customer notes and communications
• Technical information such as IP address and browser data

Processing is based primarily on Article 6(1)(b) GDPR for the performance of a contract and Article 6(1)(c) GDPR for compliance with legal obligations.

4. Orders and Contract Processing

When you place an order, we process the information necessary to accept, prepare, dispatch and administer your purchase.

This usually includes:

• First and last name
• Billing and shipping address
• Email address
• Optional telephone number
• Ordered products and quantities
• Order value and chosen payment method
• Payment and transaction information
• Shipping and tracking information
• Messages associated with the order

The legal basis is Article 6(1)(b) GDPR. Data required for accounting, taxation or other legal obligations is additionally processed under Article 6(1)(c) GDPR.

Without the required information, we may be unable to process and deliver your order.

5. Customer Accounts

You may be able to create a customer account to view previous orders, save addresses and simplify future purchases.

When an account is created, we process the information entered during registration as well as account activity connected with your orders. Passwords are stored only in a technically protected, encrypted or hashed form and are not visible to us in plain text.

The legal basis is Article 6(1)(b) GDPR where the account is used to manage purchases. Where account creation is optional, processing may also be based on your consent under Article 6(1)(a) GDPR.

You may request deletion of your customer account at any time. Data that must be retained for legal, tax or accounting reasons will not be deleted until the applicable retention period has expired.

6. Contact and Customer Support

If you contact us by email, through a contact form or in connection with an order, we process the information you provide in order to respond to your enquiry.

This may include your name, email address, order number, message content and any files or photographs you send to us.

If your enquiry relates to an existing or proposed purchase, processing is based on Article 6(1)(b) GDPR. Other enquiries are processed on the basis of Article 6(1)(f) GDPR.

Our legitimate interest is to respond to enquiries, provide customer support and document relevant business communications.

7. Payment Processing

Depending on the payment method selected, the information required to process the payment may be transmitted to banks, payment providers or other service providers involved in the transaction.

The legal basis is Article 6(1)(b) GDPR. Additional processing for fraud prevention, payment security and the assertion or defence of legal claims may be based on Article 6(1)(f) GDPR.

7.1 Bank Transfer

When payment is made by bank transfer, payment information is processed by the banks involved. We receive information such as the account holder, payment amount, payment reference, date of payment and, where displayed, the sending account number.

7.2 PayPal

If you choose PayPal, personal and transaction information may be processed by:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

PayPal processes data under its own responsibility for purposes such as payment processing, account administration, authentication, security, fraud prevention and compliance with legal obligations.

Further information can be found in the PayPal Privacy Statement .

7.3 Bitcoin Payments

If you pay using Bitcoin, transaction information is recorded on the public Bitcoin blockchain. Blockchain transactions generally cannot be deleted or subsequently altered.

Public transaction information may include the sending and receiving wallet addresses, transaction amount, transaction time and transaction identifier. Wallet addresses are pseudonymous but may be associated with an individual through additional information.

We process information required to identify and confirm the payment on the basis of Article 6(1)(b) GDPR. Your wallet provider, exchange or payment service may process additional information under its own privacy policy.

8. Shipping and Delivery Providers

To deliver your order, we transmit the information required for delivery to the selected postal or shipping provider.

This information may include:

• Recipient name
• Delivery address
• Optional telephone number or email address
• Parcel and shipping information
• Customs information where required for international delivery

Shipping is generally carried out by Österreichische Post or its international delivery partners. Other postal or courier services may be used where appropriate.

Processing is based on Article 6(1)(b) GDPR. Information required for customs declarations or other statutory obligations is processed under Article 6(1)(c) GDPR.

9. Cookies and Similar Technologies

Our website uses cookies and comparable storage technologies. Cookies are small files stored on your device.

Technically necessary cookies may be used to:

• Maintain the shopping cart
• Enable checkout and order processing
• Manage customer logins and sessions
• Remember language or display settings
• Protect forms and accounts against misuse
• Provide essential website functions

Essential cookies are used where necessary to provide the online service requested by the visitor. The associated processing is based on Article 6(1)(b) or Article 6(1)(f) GDPR.

Non-essential cookies or comparable technologies used for analytics, advertising or external media are activated only where legally required consent has been obtained. The legal basis is Article 6(1)(a) GDPR.

You may withdraw consent for optional cookies at any time through the cookie settings on our website. You may also control cookies through your browser settings. Disabling essential cookies may restrict the functionality of the shop.

10. Newsletter

If you subscribe to our newsletter, we process your email address and, where voluntarily provided, your name in order to send information about products, availability, shop news and special promotions.

Newsletter processing is based on your consent under Article 6(1)(a) GDPR. Where required, subscription may be confirmed through a double-opt-in procedure.

We may store the date and technical information relating to registration and confirmation in order to document consent and prevent misuse.

You may withdraw your consent at any time by using the unsubscribe link in the newsletter or by contacting us at office.sunnyhillseeds@gmail.com .

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

11. Product Reviews and Comments

If you submit a product review or comment, we may process the information entered in the form, your chosen display name, email address, IP address and technical information required to prevent spam and misuse.

Published reviews may remain visible under the display name selected by you. Your email address is not intended to be displayed publicly.

Processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to provide authentic customer feedback, operate interactive website functions and prevent misuse.

You may contact us if you would like a review or comment associated with you to be removed, provided no overriding legal grounds require its continued storage.

12. Recipients of Personal Data

We disclose personal data only where this is necessary for operating the shop, fulfilling orders, complying with legal obligations or protecting legitimate interests.

Possible recipients include:

• Hosting and technical service providers
• Payment providers and banks
• Postal, courier and logistics providers
• Accounting and tax service providers
• IT support and security providers
• Newsletter service providers, where used
• Public authorities where legally required
• Legal advisers and courts where necessary

13. International Data Transfers

Some service providers may process personal data outside Austria, the European Union or the European Economic Area.

Where personal data is transferred to a country without an adequacy decision, appropriate safeguards are used where required, such as the European Commission’s Standard Contractual Clauses or another legally recognised transfer mechanism.

Certain providers may also process data under their own legal obligations or privacy policies. Details concerning individual providers can be obtained from their respective privacy notices.

14. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected or for as long as required by applicable law.

In particular:

• Order, invoice and payment information is retained for the applicable statutory accounting and tax retention periods.
• Customer account data is stored until the account is deleted, unless individual records must be retained for legal reasons.
• Customer correspondence is retained for as long as required to process the enquiry and protect or enforce legal claims.
• Newsletter information is retained until consent is withdrawn, subject to limited retention for documenting previous consent.
• Technical security logs are normally retained only for a limited period unless longer storage is necessary to investigate an incident.

After the relevant purpose or retention period ends, data is deleted or anonymised unless further processing is legally permitted or required.

15. Legal Bases for Processing

16. Your Data Protection Rights

Subject to the conditions provided by law, you have the following rights:

• Right of access – Article 15 GDPR
• Right to rectification – Article 16 GDPR
• Right to erasure – Article 17 GDPR
• Right to restriction of processing – Article 18 GDPR
• Right to data portability – Article 20 GDPR
• Right to object – Article 21 GDPR
• Right to withdraw consent – Article 7(3) GDPR

The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, please contact office.sunnyhillseeds@gmail.com . We may request appropriate information to verify your identity before responding to your request.

17. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a supervisory authority.

The competent supervisory authority in Austria is:

Austrian Data Protection Authority
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria

18. Data Security and Encryption

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, alteration, destruction, disclosure or unauthorised access.

Our website uses SSL/TLS encryption. An encrypted connection can generally be recognised by the “https://” address and the lock symbol displayed by the browser.

Despite careful security measures, no internet transmission or storage system can provide absolute security.

19. Automated Decision-Making

We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significantly affect customers, unless this is expressly stated for a particular service or required for fraud prevention by an independent payment provider.

20. Changes to This Privacy Policy

We may update this Privacy Policy when legal requirements, technical systems, payment methods or services used by the shop change. The current version published on this website applies.

Privacy Questions

For questions about this Privacy Policy or the processing of your personal data, please contact office.sunnyhillseeds@gmail.com .