Privacy Policy – Your Data at HOLTA

Processed Data

During payment processing, the following data is transmitted to Stripe:

• Name
• Email address
• Billing address
• Payment information (credit card data, bank details)
• Transaction data (amount, currency, time)
• Order data (product, quantity)

Purpose of Data Processing

Data processing is carried out for:

• Processing payments
• Fraud prevention and risk assessment
• Fulfilling legal obligations (e.g., retention requirements)
• Processing refunds and chargebacks
• Customer support

Legal Basis

Processing is based on Art. 6(1)(b) GDPR to fulfill the purchase contract and on Art. 6(1)(c) GDPR to fulfill legal obligations (e.g., retention requirements under commercial and tax law).

Data Sharing

Stripe processes data as a processor on our behalf. Stripe may share data with the following recipients:

• Credit institutions and payment service providers
• Fraud prevention services
• Regulatory authorities (when legally required)
• Stripe subsidiaries (particularly Stripe, Inc. in the USA)

International Data Transfer

Stripe partially processes data in the USA. To ensure an adequate level of data protection, Stripe has implemented Standard Contractual Clauses approved by the European Commission.

Retention Period

Stripe stores data in accordance with statutory retention periods and payment service provider requirements. Transaction data is typically stored for at least 7 years.

Your Rights

You have the right to request information from Stripe about the data stored about you. For more information, please refer to Stripe's privacy policy: https://stripe.com/privacy

Important: Your complete credit card data is not stored on our servers. Payment data is transmitted directly to Stripe and processed securely there.

Right of Access (Art. 15 GDPR)

You have the right to request confirmation as to whether personal data concerning you is being processed by us, and if so, to receive information about this data and additional details.

Right to Rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate personal data concerning you.

Right to Erasure (Art. 17 GDPR)

You have the right to request the erasure of personal data concerning you. Please note, however, that we may not be able to immediately delete certain data due to statutory retention obligations (e.g., for invoices).

Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request the restriction of processing of personal data concerning you.

Right to Data Portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format.

Right to Object (Art. 21 GDPR)

You have the right to object at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR, for reasons arising from your particular situation.

Withdrawal of Consent

If the processing is based on consent, you have the right to withdraw your consent at any time. The lawfulness of the processing carried out on the basis of the consent until the withdrawal remains unaffected.

Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

The competent supervisory authority in Austria is:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at