Privacy Policy

1. Controller and contact

The controller for the processing of data within the meaning of Art 4(7) GDPR is:

Michael Jöbstl Einzelunternehmen (sole proprietorship under Austrian law), owner: Michael Jöbstl Puchstrasse 145 8054 Graz Austria

Email: michaeljoebst87@gmail.com Phone: +43 660 4736784 (within Austria: 0660 4736784) UID-Nummer (Austrian VAT ID): ATU79764514 Website: www.hochzeitsdruckwerk.at (this English site: www.hochzeitsdruckwerk.com)

If you have questions about data protection or would like to exercise your rights, please contact us directly at this address or at the email address above. There is no contact form on our website – contact runs exclusively by email, telephone or post.

2. Which websites this policy applies to

We operate four websites with the same offering and the same controller:

- hochzeitsdruckwerk.at (German) - hochzeitsdruckwerk.de (German) - hochzeitsdruckwerk.com (English) - porocnitisk.si (Slovenian, brand name “Poročni tisk”)

This English version applies to hochzeitsdruckwerk.com. We provide the same content in German for hochzeitsdruckwerk.at and hochzeitsdruckwerk.de and in Slovenian for porocnitisk.si. The controller for all four domains is the same Austrian sole proprietorship (Einzelunternehmen) established in Graz, Austria; technically, all four sites run on the same infrastructure, which we describe below.

3. What we deliberately do not do

So that you can put the rest of this policy in context, here first is what does not happen with us:

- We do not use any analytics, statistics, tracking or marketing services. There are no tracking pixels, no remarketing, no advertising IDs and no audience measurement. - We do not embed third-party content: no map services, no videos, no social media plugins, no external comment or review systems. - We do not load fonts from third-party servers. They are embedded with next/font when the site is built and are served from our own domain. Visiting our site therefore creates no connection to Google. - Apart from the two cookies described in section 5 (the login session cookie and the consent cookie), we store nothing in your browser’s local storage (no localStorage profile, no fingerprinting techniques). - We do not send newsletters or promotional emails. - We do not sell, rent out or trade personal data.

This is additionally secured on a technical level by a Content Security Policy: our pages may only load content from our own domain and from our database service Supabase. All other sources are blocked.

4. Visiting the website and server logs

Our website is hosted with Vercel Inc. (serverless functions and edge network). Our database and the login function run with Supabase in the EU region Frankfurt.

When you call up our pages, technical log data is generated automatically at these service providers – typically the IP address, the date and time of access, the address requested, and status and error messages. These logs arise at platform level (Vercel platform logs, Supabase logs); we have not set up any additional logging of personal data of our own.

Purpose: delivery of the website, stability and security of operations, detecting and tracing malfunctions and misuse.

Legal basis: Art 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of the website. We do not evaluate these logs for advertising or analytics purposes and do not merge them with your account or order data unless a specific security incident or error requires it.

Transmission between your device and our website is encrypted (HTTPS/TLS).

5. Cookies and your consent

When you first visit our website, a cookie notice appears with four categories: Necessary, Statistics, Marketing and External Media. “Accept all” and “Necessary only” are the same size and shape; rejecting is possible with a single click on the first level, just like accepting. No optional category is pre-selected. Because we currently do not use any statistics, marketing or external-media embedding services (see section 3), selecting those categories currently triggers no additional processing; only the following two technically necessary cookies are actually set:

1) Login session cookie – name: “sb-<project-ref>-auth-token”. It is set technically by our database and login service Supabase, and only when you log in to a user account; it keeps your session alive. It is session-based and technically necessary for the login to work at all.

2) Consent cookie – name: “hdw_consent”, storage period 365 days. It is set by us and contains only which cookie categories you selected, the version of the notice and a timestamp. It contains no user identifier, no ID and no data that would allow your device to be recognised again. We need this cookie in order to document your decision and to avoid showing you the notice again on every visit.

Legal basis: for technically necessary cookies we rely on Section 165(3) TKG 2021 (storage that is strictly necessary in order to provide the service you have expressly requested) in conjunction with Art 6(1)(b) or (f) GDPR. Should we actually start using non-necessary categories in future, the corresponding cookies will be set exclusively after your consent pursuant to Art 6(1)(a) GDPR and Section 165(3) TKG 2021 – we do not use pre-ticked boxes.

Withdrawal: you can change or withdraw your decision at any time with effect for the future via the permanently available “Cookie settings” link in the footer; the change takes effect immediately. Alternatively, you can also delete the “hdw_consent” cookie manually in your browser – the notice will then appear again on your next visit. This does not affect the lawfulness of the processing carried out up to the withdrawal (Art 7(3) GDPR).

6. User account and login

You can create a user account. Registration and login are handled via Supabase Auth; the data is held in the EU region Frankfurt.

Data processed: email address, password, the times of registration and login, and the status of your email confirmation. Your password is not stored in plain text; we have no access to it.

System emails: in connection with the account, Supabase Auth sends automated messages – specifically the confirmation of your email address and password reset emails. We do not operate any email system beyond this.

Purpose: provision of the account, allocation of your designs and orders, protection against unauthorised access.

Legal basis: Art 6(1)(b) GDPR (performance of the user relationship you enter into by registering) and Art 6(1)(f) GDPR for the security of the account.

Deletion: you can request deletion of your account at any time by email, with no particular form required. We will then delete the account unless a statutory retention obligation stands in the way – we must keep order and invoice data even after the account has been deleted, for the duration of the tax retention period (see section 11).

7. Designing and personalising your products

Our products are personalised wedding stationery and decor. In the configurator you enter the content that is later printed or manufactured – for example your names, your wedding date, texts of your choice or the names of guests.

Data processed: all design and personalisation content you enter, together with the product options selected, as well as the print and production files generated from it. This content is stored in our database with Supabase (EU region Frankfurt).

Purpose: display of your preview, manufacture of the product ordered (high-quality paper printing, direct UV printing on purchased blanks, 3D printing) and queries regarding your order.

Legal basis: Art 6(1)(b) GDPR (performance of the contract and pre-contractual steps taken at your request). Drafts saved before an order are processed on the same basis or – if you keep them without any intention to order – pursuant to Art 6(1)(f) GDPR, so that you do not lose your work.

Data about other people: if you enter names or details of guests, wedding witnesses or relatives, we process these exclusively for the purpose you have specified – namely to put them on the product ordered. We use them for nothing else, do not pass them on for advertising purposes and do not create profiles from them. Please only enter details you are entitled to use, and inform the people concerned where this is necessary. Third parties concerned can assert their rights under Art 15 et seq GDPR directly with us (Art 14 GDPR); we handle such requests ourselves and, if needed, get in touch with you as the customer who placed the order.

8. Order, payment and delivery

Order data: for an order we process the billing address you provide (mandatory), the delivery address, your email address, the content of the order including personalisation, the total amount and the payment and order status. All prices are gross prices in euro and include 20% Austrian value added tax (Umsatzsteuer). We deliver exclusively to delivery addresses in Austria and Germany.

Payment via Stripe: for payment we will redirect you to the checkout page hosted by Stripe at checkout.stripe.com. You enter the payment data (in particular credit card details) there, directly with Stripe. We do not embed any Stripe script in our own pages and do not receive full card details. Stripe reports back to us whether a payment has been completed, together with the information needed for allocation and invoicing. Stripe also processes the data entered there for its own purposes and in accordance with its own data protection terms; we have no influence on that processing.

Current operating status: the payment process currently runs in Stripe’s test mode. No real payments are executed and no real card data is charged.

Production and shipping: production begins only after payment has been received. We use the name and delivery address to deliver the goods ordered to you.

Legal bases: Art 6(1)(b) GDPR for handling the purchase contract including payment and delivery; Art 6(1)(c) GDPR for retaining invoices and accounting records under tax law provisions (Section 132 BAO – Bundesabgabenordnung, the Austrian Federal Fiscal Code).

9. Contacting us by email and telephone

There is no contact form on our website. You can reach us by email, by telephone or by post.

If you write us an email, we process your sender address, the content of your message and any attachments in order to answer your request. If you call us, we process the information you give us during the conversation; calls are not recorded.

Legal basis: Art 6(1)(b) GDPR where the enquiry concerns an existing or prospective contract, otherwise Art 6(1)(f) GDPR (legitimate interest in answering enquiries).

Retention period: until your request has been dealt with conclusively and no further clarification is needed. If the correspondence concerns an order or is relevant for tax purposes, the retention period under Section 132 BAO applies.

10. Recipients, processors and third-country element

We pass on your data only where this is necessary for the purposes named above or where we are legally obliged to do so. The following are used:

- Vercel Inc. – hosting, serverless functions and edge network for all four domains. - Supabase – database, storage of your account, design and order data, as well as login and authentication; operated in the EU region Frankfurt. - Stripe – payment processing via the checkout page hosted by Stripe. - Public authorities and courts, where we are legally obliged to do so.

Insofar as these service providers process data on our behalf and on our instructions, this takes place on the basis of a data processing agreement pursuant to Art 28 GDPR.

Third-country element – plainly stated: Vercel Inc. and Stripe are companies with their seat in the USA, even though they operate infrastructure in Europe. Our database is indeed located in the EU region Frankfurt, but access from the USA – for example in the course of support, maintenance or troubleshooting – cannot be entirely ruled out. We therefore do not claim that there is no third-country element whatsoever. For such transfers we rely on the safeguards under Chapter V GDPR, in particular on the standard contractual clauses of the European Commission pursuant to Art 46(2)(c) GDPR. A residual risk remains in that US authorities can demand access to data under US law and that the legal remedies against this do not correspond to those available in the EEA. You can obtain further information about the safeguards agreed with these providers from us on request.

11. Retention periods and backups

We store personal data only for as long as is necessary for the respective purpose or as long as statutory retention obligations exist:

- Server and platform logs: only for the short period operationally required for troubleshooting and security analysis; technical retention follows the specifications of the Vercel and Supabase platforms. - User account including saved drafts: until you have the account deleted. - Order, invoice and payment data: seven years pursuant to Section 132 BAO (Austrian Federal Fiscal Code), counted from the end of the respective calendar year. During this period the data is restricted in processing and is used only to comply with the retention obligation and to defend against or pursue claims. - Personalisation and production data for an order: until the order has been completed in full and any statutory warranty (Gewährleistung) or complaint handling has ended; parts relevant for tax purposes fall under the period set by Section 132 BAO. - Consent cookie “hdw_consent”: 365 days. Login cookie: only for the duration of your session.

Backups: our service providers may create backups of the database as part of their platform operations. If you delete data, it disappears from live operations immediately; it may remain in any backups for a certain time. Until such backups are overwritten, that data is restricted in processing and is touched only in the event of a restore.

12. Your rights

You have the following rights vis-à-vis us:

- Access to whether and which data we process about you (Art 15 GDPR) - Rectification of inaccurate data or completion of incomplete data (Art 16 GDPR) - Erasure (Art 17 GDPR), unless a statutory retention obligation stands in the way - Restriction of processing (Art 18 GDPR) - Data portability for data you have provided to us and that we process by automated means on the basis of a contract or consent (Art 20 GDPR) - Objection to processing that we base on a legitimate interest – such as log data – on grounds relating to your particular situation (Art 21 GDPR) - Withdrawal of consent you have given, with effect for the future (Art 7(3) GDPR)

How to proceed: a simple message to michaeljoebst87@gmail.com or to our postal address is sufficient; no particular form is required. We generally reply within one month. If we have reasonable doubts about your identity, we may and must request additional information for identification purposes (Art 12(6) GDPR) – this serves your protection.

Right to lodge a complaint: you can lodge a complaint with a supervisory authority at any time (Art 77 GDPR, Section 24 DSG – Datenschutzgesetz, the Austrian Data Protection Act). The authority responsible for us is the Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40-42, 1030 Vienna, Austria, email dsb@dsb.gv.at, www.dsb.gv.at. If your habitual residence, place of work, or the place of the alleged infringement is in another EU or EEA member state – for example Germany – you can also turn to the data protection supervisory authority responsible for you there.

The fact that the controller is an Austrian company does not reduce your rights: the GDPR applies directly throughout the European Union, and the mandatory consumer-protection provisions of your country of habitual residence remain fully available to you.

13. No automated decision-making, no profiling

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art 22 GDPR). We do not create user profiles, do not personalise prices and do not evaluate your behaviour by automated means.

Independently of this, Stripe carries out its own checks in the course of payment processing in order to prevent payment defaults and misuse. These checks take place on Stripe’s systems and lie outside our sphere of influence.

14. Do you have to provide this data?

You can use our information pages without providing personal data.

For a user account we need a valid email address and a password. For an order we need the personalisation details, a billing address, a delivery address within our delivery area (Austria or Germany) and an email address. You are under no statutory or contractual obligation to provide this information – but without it we can neither conclude nor perform the contract (Art 13(2)(e) GDPR). Retention of the invoice and accounting data, by contrast, is required by law (Section 132 BAO).

15. Data security

We take technical and organisational measures pursuant to Art 32 GDPR in order to protect your data. These include in particular: encrypted transmission (HTTPS/TLS), access to the database only via authenticated connections, storage of passwords exclusively in a non-reversible (hashed) form, a Content Security Policy that prevents third-party content from being loaded, and refraining from any collection of data that is not needed. Access to customer and order data is limited to those who need it to process your order and operate the website.

No one can guarantee absolute protection; data transmission over the internet can have security gaps.

16. Changes to this privacy policy

We adapt this privacy policy when our services, the services we use or the legal situation change – for example when payment processing moves from test mode to live operation or a further service provider is added. The version published on the website applies in each case. Where material changes concern consent, we obtain it again via the cookie notice; the version number stored in the “hdw_consent” cookie allows us to distinguish between versions.

Version date: 17 September 2026.