Privacy policy

This is a translation for your convenience. Only the German version is legally binding.

Last updated: 28 September 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR; German: DSGVO) and the Austrian Data Protection Act (Datenschutzgesetz, DSG) is:

CampBoks GmbH
Wassergasse 17, 3324 Euratsfeld, Austria
Phone: +43 664 78000020
Email: office@campboks.com
Commercial register (Firmenbuch): FN 592529 t, Regional Court (Landesgericht) St. Pölten
VAT ID (UID): ATU78786618
Managing directors: Lothar Gallistl, Paul Schneider

For all questions about data protection and the exercise of your rights, you can reach us at office@campboks.com.

2. Overview of legal bases

We process personal data on the basis of Art. 6(1) GDPR: point (a) (consent), point (b) (contract or pre-contractual measures), point (c) (legal obligation) and point (f) (legitimate interest). For storing information on, or accessing information in, your terminal device, we additionally obtain your consent pursuant to § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), unless this is technically necessary. You may withdraw any consent you have given at any time with effect for the future.

3. Hosting and shop platform (Shopify)

Our shop is operated on the platform of Shopify International Limited (1-2 Victoria Buildings, Haddington Road, Dublin 4, Ireland). Shopify processes all data generated in the shop (order, customer, contact, usage and access data).

Purpose: provision, operation and security of the shop, order processing.
Legal basis: Art. 6(1)(b) and (f) GDPR.
Processing on behalf of the controller (Art. 28 GDPR): shopify.com/legal/dpa. For certain network-related functions (e.g. fraud detection), Shopify also acts as an independent controller.
Transfer to third countries: to Canada (EU adequacy decision) and to US sub-processors on the basis of EU Standard Contractual Clauses.
Privacy policy: shopify.com/legal/privacy

4. Access data / server log files

When you visit the website, the IP address, date and time, page accessed, amount of data, referrer, browser and operating system are processed automatically.

Purpose and legal basis: technical delivery, stability and security (Art. 6(1)(f) GDPR).
Storage period: deletion as soon as no longer required for the purpose; security-relevant logs until the handling of the incident has been completed.

5. Cookies and consent

We use cookies and similar technologies. Technically necessary cookies are set without consent (Art. 6(1)(f) GDPR and § 165(3) TKG 2021). We only set cookies for statistics and marketing after you have given your consent via our cookie banner; you can withdraw this consent at any time.

Certain third-party services (Klaviyo onsite tracking, Google Fonts and an external script) are loaded as soon as the page is accessed and, in doing so, transfer data (including the IP address) to the USA; see sections 8 and 10 for details.

Cookies used (selection):

Necessary (without consent): _shopify_essential, localization, cart_currency, _shop_app_essential (provider: Shopify) – shop functionality, shopping cart, language/currency, checkout.
Statistics (only with consent): _shopify_y, _shopify_s, _shopify_analytics, shopify_client_id, _ga, _ga_*, _clck, _clsk, __kla_id, ph_cb_posthog (local storage) (providers: Shopify, Google, Microsoft, Klaviyo, PostHog) – reach and behaviour analysis.
Marketing (only with consent): _shopify_marketing, _gcl_au (providers: Shopify, Google) – advertising and conversion measurement.

6. Web analytics, reach measurement and session recording

We only use the following services after you have given your consent (Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021). You can withdraw your consent at any time via the cookie settings.

6.1 Google Analytics 4 and Google Tag Manager

Provider: Google Ireland Limited, Dublin (processing also by Google LLC, USA). Purpose: pseudonymous usage analysis; the Tag Manager manages the tags used. Data: online identifiers, device and usage data and the IP address (used by Google only to derive the approximate location, not stored permanently). Transfer to the USA: EU-US Data Privacy Framework or EU Standard Contractual Clauses. Objection: withdraw consent in the cookie settings; browser add-on at tools.google.com/dlpage/gaoptout. Privacy policy: policies.google.com/privacy

6.2 Microsoft Clarity (heatmaps and session recording)

Provider: Microsoft Ireland Operations Limited, Dublin (processing also by Microsoft Corporation, USA). Purpose: analysis by means of heatmaps and pseudonymous, masked session recordings to improve user-friendliness. Data: clicks, scrolling and mouse movements, page interactions, device and browser data. Transfer to the USA: EU-US Data Privacy Framework or EU Standard Contractual Clauses. Objection: withdraw consent in the cookie settings; opt-out at optout.aboutads.info (select Microsoft); the Global Privacy Control signal is respected. Privacy policy: privacy.microsoft.com

6.3 PostHog (web analytics, heatmaps and session recording)

Provider: PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA; the data are processed in PostHog's EU cloud (data centre in Frankfurt am Main). Purpose: pseudonymous usage analysis, heatmaps and session recordings to improve content and usability, for example to understand how the advice chat is used and how many visitors arrange a callback. Data: pages accessed without URL parameters, the domain of the website from which you come to us (e.g. google.com, without path or search term), clicks and page interactions, device and browser data, campaign identifiers (utm_source, utm_medium, utm_campaign, utm_content) and whether you arrived via an advertisement (without click ID), shopping cart and purchase events (product, variant and order identifier, quantity, value of goods and currency; no names, addresses or payment data) and a random identifier in your browser's local storage (ph_cb_posthog). The IP address is not stored. Session recordings show the page content as it is displayed to all visitors (texts, images, layout). All inputs as well as forms, the advice chat, the callback form and the customer account area are masked; form content, chat messages, names, email addresses and telephone numbers are not transferred to PostHog. Link addresses are recorded without URL parameters. We do not create personal profiles and do not link the data to your customer account. Storage period: session recordings 30 days, other analytics data up to one year. Transfer to the USA (access by PostHog, Inc.): EU-US Data Privacy Framework or EU Standard Contractual Clauses. Objection: withdraw consent in the cookie settings; the identifier is then deleted from your browser. Privacy policy: posthog.com/privacy

7. Online marketing and advertising

We likewise only use these services after you have given your consent (Art. 6(1)(a) GDPR).

7.1 Google Ads (conversion tracking and remarketing)

Provider: Google Ireland Limited / Google LLC, USA. Purpose: measuring the success of advertisements and interest-based advertising. Data: online identifiers, cookie data (_gcl_au), conversion data; for conversion and measurement data, Google may in part act as an independent or joint controller. Transfer to the USA: EU-US Data Privacy Framework or EU Standard Contractual Clauses. Objection: withdraw consent in the cookie settings; advertising settings at myadcenter.google.com

7.2 Google Merchant Center / Google Shopping

Provider: Google Ireland Limited / Google LLC, USA. Purpose: provision of the product catalogue for Google Shopping and conversion measurement. Legal basis and transfer as under 7.1.

8. Email marketing, newsletter and reviews (Klaviyo)

For newsletters, email marketing, onsite functions and product reviews, we use Klaviyo, Inc. (125 Summer Street, Boston, MA 02110, USA). The EU representative pursuant to Art. 27 GDPR is the European Data Protection Office (EDPO).

Klaviyo onsite tracking (collection of usage data, embedding of scripts from Klaviyo servers in the USA) is loaded as soon as the page is accessed and, in doing so, transfers among other things your IP address to the USA. The legal basis for this is Art. 6(1)(f) GDPR (legitimate interest in reach analysis and personalisation). The __kla_id cookie itself is only set after you have given your consent.

Newsletter (double opt-in): after signing up, you will receive a confirmation email; we will only add you to the mailing list after you click the confirmation link. Sign-up and confirmation are logged.
Legal bases: consent (Art. 6(1)(a) GDPR) for newsletters and marketing; transactional emails Art. 6(1)(b) GDPR. Email advertising is carried out in accordance with § 174 TKG 2021.
Transfer to the USA: EU-US Data Privacy Framework or EU Standard Contractual Clauses; processing on behalf of the controller: klaviyo.com/legal/data-processing-agreement
Withdrawal and unsubscribing: via the unsubscribe link in every email; withdrawal of consent to tracking via the cookie settings.
Privacy policy: klaviyo.com/legal/privacy

9. Payment processing

Depending on the payment method selected, payment data are transmitted to the respective service provider. Legal bases: performance of the contract (Art. 6(1)(b) GDPR), legal obligations (point (c), e.g. anti-money laundering and tax law) and fraud prevention (point (f)). Payment service providers predominantly act as independent controllers.

Shopify Payments (technical service provider: Stripe): processing of card payments; transfer to the USA based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. Privacy policy: stripe.com/privacy
Klarna (Klarna Bank AB, Stockholm, Sweden): independent controller; processing within the EU/EEA. Privacy policy: klarna.com/at/datenschutz
PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg): independent controller; transfers within the PayPal group (including the USA) on the basis of EU Standard Contractual Clauses and Binding Corporate Rules (BCR). Privacy policy: paypal.com/at/legalhub/paypal/privacy-full
Shop Pay / Shop App (Shopify): accelerated checkout; stores contact and payment data for reuse (_shop_app_essential). Legal basis: Art. 6(1)(b) GDPR or your consent in the case of active use.

10. Fonts and embedded content

Google Fonts: our website loads fonts from Google servers (Google Ireland Limited / Google LLC, USA). In doing so, your IP address is transmitted to Google. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in uniform presentation); transfer to the USA based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. Privacy policy: policies.google.com/privacy
External scripts (CDN): on product pages, a JavaScript library is loaded via unpkg.com (operated by Cloudflare, Inc., USA); in doing so, the IP address and device information are transmitted to the CDN operator. Legal basis: Art. 6(1)(f) GDPR; transfer to the USA based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses.
YouTube videos: where embedded, in privacy-enhanced mode (youtube-nocookie.com); when a video is played, data are transmitted to Google. Legal basis: consent (Art. 6(1)(a) GDPR).

11. Customer account and order processing

To process your order, we process contact, delivery, billing and order data; you may optionally create a customer account.

Legal basis: Art. 6(1)(b) GDPR; for the retention of invoices, point (c).
Recipients: shipping and logistics service providers (UPS Schenker, freight forwarder), payment service providers, tax advisors.
Source of data not collected directly from you (Art. 14 GDPR): in particular creditworthiness, fraud and payment status from payment service providers (Klarna, PayPal, Stripe) as well as contact and payment data pre-filled via the Shop Pay or Shop network.

12. Advice chat and callback service

Our website provides a chat window in which you can ask questions about our products and arrange a telephone callback.

Chat requests. Your messages are transmitted to our own service on servers operated by Railway (Railway Corporation, USA; server location the Netherlands) and passed on from there to OpenAI (OpenAI Ireland Ltd., Dublin, Ireland) and to our own knowledge base in order to be answered. We do not store the conversation history permanently. Questions that our knowledge base cannot answer are recorded without reference to your person in order to improve our content. The legal basis is our legitimate interest in providing functioning advice (Art. 6(1)(f) GDPR). Please do not enter any special categories of personal data within the meaning of Art. 9 GDPR in the chat.

Callback service. If you arrange a callback, we process:

mandatory information: name and telephone number
voluntary: your email address for the confirmation and the last question you asked in the chat, so that we can be prepared when we call
technically necessary: the appointment you have chosen and the time of your consent

The sole purpose is the agreed callback. The legal basis is your consent (Art. 6(1)(a) GDPR) and the implementation of pre-contractual measures (Art. 6(1)(b) GDPR). To manage appointments, we create an entry in a calendar at Google (Google Ireland Limited, Dublin, Ireland). If you have provided an email address, we send the confirmation via Klaviyo (see section 8). We store the booking itself on the above-mentioned server in the Netherlands and delete it no later than twelve months after the conversation, unless a contract is concluded. You may withdraw your consent at any time, without any formal requirements, by email to office@campboks.com; this does not affect the lawfulness of the processing carried out until then.

13. Storage period

Order and invoice data: 7 years due to statutory retention obligations (§ 132 Federal Fiscal Code (BAO), § 212 Commercial Code (UGB)).
Customer account: until deleted by you or until the purpose ceases to apply.
Newsletter and marketing data: until consent is withdrawn or you unsubscribe.
Analytics and marketing cookies: in accordance with the respective cookie lifetime or until consent is withdrawn.

14. Recipients and transfer to third countries

Shopify International Ltd (Ireland; onward transfer to Canada and the USA): processor, in part independent controller – Canada adequacy decision and EU Standard Contractual Clauses.
Google Ireland Limited / Google LLC (Analytics, Ads, Fonts; Ireland/USA): processor, in part controller – EU-US Data Privacy Framework and EU Standard Contractual Clauses.
Microsoft Ireland / Microsoft Corporation (Ireland/USA): see section 6.2 – EU-US Data Privacy Framework and EU Standard Contractual Clauses.
PostHog, Inc. (USA; data processing in the EU cloud, Frankfurt): processor – EU-US Data Privacy Framework and EU Standard Contractual Clauses.
Klaviyo, Inc. (USA; EU representative EDPO): processor – EU-US Data Privacy Framework and EU Standard Contractual Clauses.
Stripe / Shopify Payments (Ireland/USA): processor – EU-US Data Privacy Framework and EU Standard Contractual Clauses.
Cloudflare, Inc. (USA; unpkg CDN): recipient of the script request – EU-US Data Privacy Framework and EU Standard Contractual Clauses.
Klarna Bank AB (Sweden): independent controller – processing within the EU/EEA.
PayPal (Europe) S.à r.l. (Luxembourg): independent controller – EU Standard Contractual Clauses and Binding Corporate Rules (BCR).

Despite appropriate safeguards, residual risks remain in the case of transfers to the USA (such as possible access by authorities).

15. Your rights

You have the right of access (Art. 15 GDPR, including information about the specific recipients of your data), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests and to direct marketing (Art. 21) and withdrawal of consent given with effect for the future (Art. 7(3)). To exercise these rights, a message to office@campboks.com is sufficient.

16. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Wien, phone +43 1 52 152-0, email dsb@dsb.gv.at, www.dsb.gv.at.

17. Automated decision-making and profiling

On the basis of your consent, we analyse usage and purchasing behaviour in order to display recommendations and interest-based advertising (profiling within the meaning of Art. 4(4) GDPR). No decision based solely on automated processing with legal effect within the meaning of Art. 22 GDPR takes place. Credit checks may be carried out by payment service providers (e.g. Klarna) as independent controllers.

18. Data security and changes

We take technical and organisational measures (including TLS encryption) to protect your data. We will adapt this privacy policy if the data processing or the legal situation changes. The version published on campboks.com at the relevant time applies.

Last updated: 28 September 2026