Cookie Policy

1. Scope of this Cookie Policy

This Cookie Policy applies to the English-language website hochzeitsdruckwerk.com. For the German-language websites hochzeitsdruckwerk.at and hochzeitsdruckwerk.de and for the Slovenian-language website porocnitisk.si, the versions published there in the respective language apply; the operator is the same in all cases – Michael Jöbstl, established in Graz, Austria.

What is described here is exclusively the use of cookies and comparable storage technologies in your browser. How we process personal data beyond that – for example when you place an order or create a customer account – is set out in our Privacy Policy (Datenschutzerklärung). The two documents complement each other.

2. Who is responsible for the use of cookies

The controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR; in German: Datenschutz-Grundverordnung, DSGVO) is:

Michael Jöbstl Einzelunternehmen (sole proprietorship under Austrian law) Puchstrasse 145 8054 Graz Austria

Email: michaeljoebst87@gmail.com Phone: 06604736784

If you have questions about cookies, about your consent or about your data protection rights, write to us at the email address above. An informal message is sufficient.

3. What cookies are

Cookies are small text files that a website stores in your browser and can read again the next time you visit. They contain no executable program code and cannot install any software on your device. Typically they store an identifier or a setting so that the website recognises you the next time a page is loaded.

A distinction is made according to origin and according to lifespan:

- First-party cookies come from the website you are currently visiting. Third-party cookies come from an external provider whose content is embedded in a page. On our website, only first-party cookies from our own domain are set. - Session cookies are deleted as soon as you close your browser. Persistent cookies remain stored until a defined expiry date.

“Comparable technologies” include, among others, local storage, session storage and so-called tracking pixels (web beacons). We use none of them: apart from the two cookies described below, we store nothing in your browser – neither in local storage nor in session storage – and we do not embed any tracking pixels.

4. The legal basis on which we use cookies

Storing information on your terminal equipment and gaining access to information already stored there is, as a general rule, permitted only with your consent under § 165(3) TKG 2021 (Telekommunikationsgesetz 2021, the Austrian Telecommunications Act, which implements the EU ePrivacy rules in Austria). This provision implements Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive). Exempt from this are cookies whose sole purpose is to carry out the transmission of a communication, and cookies that are strictly necessary in order for us to provide a service that you have expressly requested.

Both cookies used by us fall under this exemption and therefore do not require consent:

- The login cookie is strictly necessary so that you can stay signed in at all. The data protection basis for the associated processing is Article 6(1)(b) GDPR (performance of a contract, or steps taken prior to entering into a contract, within the customer account). - The consent cookie is strictly necessary in order to give effect to the choice you have made in the banner at all and to respect it on your next visit. The data protection basis is Article 6(1)(f) GDPR – our legitimate interest lies in making your selection technically effective and in being able to document it in view of the obligation to demonstrate consent under Article 7(1) GDPR.

If we were to use cookies in the future that are not strictly necessary, we would obtain your consent beforehand under § 165(3) TKG 2021 in conjunction with Article 6(1)(a) GDPR. Such cookies will only be set after you have actively agreed.

5. Which cookies we actually set

There are exactly two. Both are served from our own domain, and both belong to the “Necessary” category.

| Name | Provider / set by | Purpose | Storage period | Category | | --- | --- | --- | --- | --- | | sb-<project-ref>-auth-token | Set from our own domain; Supabase is used as our database and authentication service (EU region Frankfurt, Germany) | Keeps you signed in to a customer account so that you do not have to sign in again on every page view. Only set if you actually sign in. | Session-based – ends with the browser session or when you sign out | Necessary | | hdw_consent | Michael Jöbstl (our own domain) | Stores your selection in the cookie banner so that we do not have to ask you again on every visit and can comply with your decision. | 365 days from the decision | Necessary |

Regarding the cookie name sb-<project-ref>-auth-token: the middle part of the name is a fixed, project-specific identifier of our Supabase instance. It identifies the project, not you.

Content of the hdw_consent cookie: what is stored is exclusively (1) your category selection, (2) the version number of the cookie consent you decided on, and (3) the timestamp of the decision. It contains no user identifier, no ID and no information from which a profile about you could be built. The cookie is read exclusively by our own website and is not transmitted to any third party.

When you open our pages, no cookie is set that would require consent – neither before nor after your decision in the banner.

6. Categories – and why three of them are empty

Our cookie banner and the “Cookie Settings” page distinguish four categories:

- Necessary: currently contains the two cookies named above. This category cannot be deselected, because without it signing in and giving effect to your cookie decision would not work. - Statistics: currently empty. Not a single statistics or analytics tool is in use. - Marketing: currently empty. No advertising, remarketing or conversion technologies are in use. - External media: currently empty. No external content is embedded – no maps, no videos, no social media elements.

The three empty categories remain visible in the banner so that you can see what you are deciding about and so that any later change becomes transparent. As long as a category is empty, your consent to it has no technical effect, because there is nothing that could be set.

In concrete terms this means: we use no analytics, marketing or tracking services, no tracking pixels, no social media plug-ins and no external embeds. The fonts used on our website were already embedded when the website was built and are served from our own domain; no connection to Google or to any other font provider is established in the process. Technically, this is additionally secured by a Content Security Policy that only permits our own domain and the Supabase origin.

7. How you give, refuse and withdraw your consent

On your first visit you will see our cookie banner. Accept and Reject are presented there side by side as equals: rejecting takes exactly one click – just like accepting. There are no pre-ticked boxes for categories that require consent, and merely continuing to browse or scrolling does not constitute consent (Article 4(11) GDPR).

Your decision is not final. You can change it or withdraw it entirely at any time, with effect for the future:

- via the “Cookie Settings” page, which can be reached from every page through the link in the footer, - by deselecting individual categories there or resetting your entire selection.

Withdrawing consent is therefore just as easy as giving it; this is expressly required by Article 7(3) GDPR. The withdrawal takes effect for the future – the lawfulness of processing carried out on the basis of the consent up to that point remains unaffected.

Whether you accept or reject has no bearing on whether and how you can use our website. Since only strictly necessary cookies are currently used, the website works in exactly the same way after a rejection.

8. Version of the consent and renewed request

In the hdw_consent cookie, the version of the cookie consent that you decided on is stored together with your selection. This version belongs to the state of the cookies and categories described here.

If something material changes about this – for example because a new cookie is added, a purpose changes, or one of the currently empty categories is actually filled – we increase the version number. Your stored value then no longer matches the current version, and the banner asks you again. An old consent is therefore not silently carried over to new cookies.

Independently of this, your decision expires after 365 days. After that we ask again in any event.

9. Controlling cookies through your browser settings

In addition to our cookie settings, you can also control cookies directly in your browser. All common browsers offer functions for this in their settings, usually under “Privacy and security”:

- view cookies and website data that have already been stored and delete them individually or entirely, - block the setting of cookies generally or for individual websites, - delete cookies automatically when the browser is closed.

Exactly how this works is explained in your browser’s help section. Two practical notes on this:

- If you delete our hdw_consent cookie, your stored decision is gone with it. The banner will appear again on your next visit. - If you block cookies entirely, you will not be able to sign in to a customer account, because signing in technically relies on the session cookie.

Private or incognito mode does not prevent cookies, but it usually deletes them when the window is closed.

10. Redirection to the payment process and other external sites

The payment process does not run on our website, but on a checkout page hosted by our payment service provider Stripe at checkout.stripe.com. No Stripe script is embedded on our own pages for this purpose. Note: our ordering and payment system is currently running in test mode; at present, no real payments and no binding orders are made this way.

As soon as you are redirected to checkout.stripe.com, you leave our website. Stripe is responsible for the use of cookies and comparable technologies on that page; Stripe’s own cookie and privacy notices apply there, not this Cookie Policy. Our cookie banner has no influence on this.

The same applies to every other external website that you reach via a link on our pages: what is stored there is a matter for the respective operator.

11. Who else has access

Our website is hosted with Vercel Inc. and delivered via its edge network; the database and user accounts run on Supabase in the EU region Frankfurt (Germany). These services process data on our behalf so that the website is accessible at all and so that signing in works; in doing so, server logs of the respective platform are generated. We have not set up any logging of personal data of our own beyond this.

The hdw_consent cookie is stored exclusively in your browser and read by our website. It is not passed on to third parties and is not evaluated for advertising purposes.

Further details about the services used, about recipients and about storage periods can be found in our Privacy Policy.

12. Your rights

Insofar as personal data are processed via cookies, you have the rights under the GDPR: access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing based on legitimate interests (Article 21). You can withdraw consent you have given at any time under Article 7(3) GDPR – how to do this is described in Section 7.

For this purpose, simply contact us informally at michaeljoebst87@gmail.com.

Independently of this, you have the right under Article 77 GDPR to lodge a complaint with a supervisory authority – in particular in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Austrian Datenschutzbehörde (Austrian Data Protection Authority).

13. Changes to this Cookie Policy

We adapt this Cookie Policy as soon as something changes about the cookies used, about their purposes or about the legal situation. The version published here is always the authoritative one.

If something changes that affects your consent, we additionally increase the version of the cookie consent, and you will be asked again (see Section 8). There is no silent carry-over of old consents to new cookies.