Data Protection Notice – EVIGLARA GmbH

Status: January 2026

EVIGLARA GmbH (FN 674927s, Commercial Court Vienna), Gaullachergasse 33/29, 1160 Vienna ("EVIGLARA", "we", "us") considers the protection of your personal data important. Therefore, compliance with data protection regulations, in particular the General Data Protection Regulation ("GDPR"), the Austrian Data Protection Act ("DSG") and the Telecommunications Act 2021 ("TKG 2021"), is a matter of course for us.

Personal data is information about data subjects (natural persons) whose identity is determined or at least determinable (e.g., name, email address or IP address). This data protection notice informs you about the type, scope, and purposes of the collection and processing of your personal data in connection with your visit to and use of our website.

Controller's Data:

Name: EVIGLARA GmbH

Company Register Number: FN 674927s, Commercial Court Vienna

Address: Gaullachergasse 33/29, 1160 Vienna

Email Address: office@eviglara.com

1. What data do we collect from users of our website?

1.1. Contacting us

Data Categories and Purpose: When you contact us via our email addresses or our contact form, we process your personal data (name, email address or telephone number and content of your inquiry, further correspondence regarding your inquiry; for accreditations, also your profession and company) for the purpose of processing and answering your inquiry.

Legal Basis: The legal basis is the fulfillment of our (pre-)contractual obligations pursuant to Art 6 para 1 lit b GDPR or our legitimate interests pursuant to Art 6 para 1 lit f GDPR in the quick processing and response to any follow-up questions.

Storage Period: We store your data in the context of contacts for a period of six months so that we can adequately respond to follow-up questions. A longer storage period will only occur if a business relationship subsequently arises or due to legal retention obligations or for defense in possible legal disputes.

1.2. Newsletter

Data Categories and Purpose: If you subscribe to our newsletter about our services and offers, we process your email address, the clicked newsletter category, the time of your subscription, and the opening rates of the newsletters.

Legal Basis: The processing for sending the newsletter is based on your voluntary and explicit consent pursuant to Art 6 para 1 lit a GDPR in conjunction with § 174 TKG 2021. You can revoke your consent at any time with effect for the future (e.g., by email to office@eviglara.com or via the unsubscribe link found in every newsletter).

Storage Period: We process your personal data for receiving the newsletter until you revoke your voluntary consent, but no longer than three years from the last contact with us.

1.3. Online Shop and Order for Goods

Data Categories and Purpose: When ordering goods, personal data necessary for processing the order are processed. This includes your first and last name, your email address, and your billing or delivery address. In addition, the goods you have selected and the time of your order are processed to fulfill the order and send you an order confirmation. Depending on the payment method you choose, the data necessary for payment processing will also be processed by the respective payment service. As part of the registration on the website, we also process your salutation, your telephone number, your date of birth, and the (encrypted) password you have set, provided you optionally provide us with this data.

Legal Basis: The processing of your personal data is necessary for the fulfillment of our (pre-)contractual obligations according to Art 6 para 1 lit b GDPR. Without this data, we cannot conclude the contract with you. We also process this data to the extent required by law for the fulfillment of our corporate and tax obligations according to Art 6 para 1 lit c GDPR. The data you optionally provide us with during registration is processed on the basis of our legitimate interests according to Art 6 para 1 lit f GDPR, to be able to reach you by phone if necessary and to provide you with a user account for easier ordering.

Storage Period: We store your personal data for the duration of the contractual relationship and beyond as long as this is necessary to fulfill our legal retention obligations. We store contract, payment, and billing data for seven years (§ 132 BAO, §§ 190 and 212 UGB, § 11 para 2 UStG).

1.4. Social Media

Data Categories and Purpose: You can interact with us on our social media pages by commenting on our posts, reacting to them (e.g., via the "Like" button), sharing them or sending them to other users. We process your interactions, your username, and, if applicable, personal data of invited third parties. This data may also be processed by the platforms in this context. In this case, the respective platform and we are joint controllers according to Art 26 GDPR. We have therefore concluded agreements on joint controllership.

Legal Basis: Data processing serves to answer your questions, to give you the opportunity to express yourself and to comment on your opinions or feedback, and to promote our offer. The processing is therefore based on both our and your legitimate interests pursuant to Art 6 para 1 lit f GDPR and for the fulfillment of our (pre-)contractual obligations pursuant to Art 6 para 1 lit b GDPR.

Further information on data processing by the platforms, including the storage period, can be found at:

1.5. Website Provision and Log File Creation

Data Categories and Purpose: The following technically necessary data within the meaning of § 165 para 3 TKG 2021 are automatically collected during your visit to our website to display the website and ensure its stability and security:

  • Information about the browser type and version used,
  • the user's operating system,
  • the user's Internet service providers,
  • the user's IP address,
  • Date and time of access,
  • Content of the request (specific page),
  • Websites from which the user's system accesses our website.

Legal Basis: All this data is transmitted by your web browser when you access our website. We process this data solely for the provision of the website, for the purpose of operational security, and it is therefore absolutely technically necessary within the meaning of § 165 para 3 TKG 2021. These processing operations are based on our legitimate interests pursuant to Art 6 para 1 lit f GDPR and also include logging system usage, user authorization processes, and evaluating server logs for problem analysis.

Storage Period: We generally store your usage data when visiting the website for a period of one year. This data is not stored together with other personal data of the user.

1.6. Cookies

A complete list of cookies can be found in the cookie banner. The cookie banner appears automatically when you first visit our website. You can also access the cookie banner at any time via the "Cookies" menu item in the footer of the website. Further information on the use of cookies can also be found in our Cookie Policy.

2. Recipients of Personal Data

We naturally treat your personal data confidentially. Therefore, we deliberately keep the circle of recipients of your data small.

To operate our website and app, we use service providers who also have access to personal data in order to provide the contracted services. Our processors are primarily providers of IT services:

  • Software and service providers as well as providers of tools and solutions that support us in providing the website and rendering our services,
  • general IT administration (including support, software and maintenance, data center).

These processors process your data only on our behalf, based on our instructions and to provide the services mentioned above. We have concluded agreements with all our processors in accordance with Art 28 GDPR.

Furthermore, we transmit your personal data to the necessary extent to the following recipients on an ad hoc basis:

  • to external third parties to the necessary extent based on our legitimate interests (e.g., auditors, collection agencies, insurance companies in case of insurance claims, legal representatives in individual cases, etc.);
  • to authorities and other public bodies to the extent legally required (e.g., tax authorities, data protection authority, etc.).

Your personal data will not be passed on to any other third parties for their own purposes without your consent.

3. Storage Period

We generally store your personal data only for as long as we need it to fulfill the purposes described. If we no longer need your personal data, we delete it from our systems or anonymize it so that you can no longer be irrevocably identified.

Information on specific storage periods can be found above for each purpose.

If data processing is carried out in our legitimate interest or that of a third party, your personal data will be deleted as soon as this interest no longer exists, unless legal retention obligations require us to store it for a longer period. This also applies to data processing based on a given consent. As soon as this consent is revoked by you for the future, the personal data will be deleted immediately, unless there is a legal retention obligation that requires longer retention.

In addition, when determining the storage period, we take into account the statutory limitation periods, which, for example, according to the General Civil Code (ABGB), are generally 3 years, and in certain cases up to 30 years (§ 1489 ABGB).

We store your data in connection with the exercise of data subject rights for 18 months as proof of the processing of your request on the basis of our legitimate interests (Art 6 para 1 lit f GDPR).

This applies irrespective of cases where longer retention is required for legal disputes, inquiries from competent authorities or under applicable law.

4. International Data Transfers

Your personal data may be transferred to countries outside the European Union (EU) or the European Economic Area (EEA) that offer an adequate level of data protection, as determined by adequacy decisions of the European Commission (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en).

The transfer of your personal data to countries outside the EU/EEA that do not ensure an adequate level of protection will only take place if the controller and the recipients of the data have concluded the standard contractual clauses of the European Commission (SCCs) as appropriate safeguards for the protection of your personal data, have carried out a transfer impact assessment and have implemented supplementary security measures, or if you have given your explicit voluntary consent.

5. Data Security

We have taken appropriate technical and organizational security measures in accordance with Art 32 GDPR to ensure the confidentiality and security of your personal data.

6. Data Subject Rights

You have a right to information about your personal data processed by us as the controller (Art 15 GDPR). In addition, you have the right to rectification of inaccurate data and erasure of your data ("right to be forgotten") (Art 16 and 17 GDPR). You may also have a right to restriction of processing of your data (Art 18 GDPR) as well as a right to receive the data you have provided in a structured, commonly used and machine-readable format ("data portability", Art 20 GDPR). Furthermore, you can revoke your voluntarily given consent to the processing of personal data at any time with effect for the future, e.g., by email to office@eviglara.com (Art 7 para 3 GDPR).

In addition, you have the right to object to direct marketing measures and at any time for reasons arising from your particular situation, to data processing at any time (Art 21 GDPR). In this case, we will refrain from further processing your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, and if the processing serves the establishment, exercise or defense of legal claims.

If you believe that we are processing your personal data unlawfully, you also have the right to lodge a complaint with the competent supervisory authority or to seek a judicial remedy (Art 77 GDPR). In Austria, this is:

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Wien
E-Mail: dsb@dsb.gv.at

You can also lodge a complaint with the supervisory authority of the EU country in which you have your habitual residence or place of work, or with the supervisory authority of the place where the alleged infringement occurred.

To exercise these rights, you can contact us at any time, for example by email at office@eviglara.com.

7. Changes

The further development of our offer may lead to changes. Of course, we will keep the data protection information up to date and adapt it if necessary. We provide the currently valid version of the data protection information on our website under "Privacy Policy" and will notify you separately of significant changes. We also recommend that you regularly inform yourself about the current version.