Privacy Policy

1. Controller

ALC Metalltechnik GmbH
Schlachthofstraße 1, 9100 Völkermarkt, Austria
Represented by the management: DI Christian Helmreich
Phone: +43 676 6330344 · E-mail: office@ihrcarport.eu

A data protection officer is not required by law and has not been appointed. Please address data protection enquiries directly to the contact details given above.

2. Hosting and server log files

This website is operated on a server managed by us. Each time a page is accessed, the web server automatically processes: IP address, date and time of access, requested URL, referrer URL, browser and operating system used (user agent) and the HTTP status code. This data is technically necessary to deliver the pages and serves stability, error analysis and defence against attacks.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). Retention period: server log files are deleted after 14 days at the latest, unless a security-relevant incident requires longer retention.

3. Contact and enquiry forms

If you use our contact form, the enquiry form for custom carports, the installation enquiry outside our installation area or the online withdrawal form, we process the data you enter (e.g. name, e-mail address, telephone number, postcode, message text) in order to handle your enquiry.

With the contact form and the enquiry for custom carports, you may additionally upload files voluntarily (e.g. photos or plans of the installation site). We process these uploads exclusively to handle your enquiry; they are stored together with the enquiry and are subject to the same deletion period of twelve months at the latest (see below).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract, e.g. in the case of withdrawal) and Art. 6(1)(f) GDPR (legitimate interest in answering general enquiries). Retention period: we delete enquiries that do not lead to a contract no later than twelve months after the last communication; withdrawal declarations are retained together with the associated order documents (see section 4).

4. Order and customer data

To process your order, we process your name, delivery and billing address, e-mail address, telephone number, the ordered products including configuration, and payment and invoice data. Recipients of this data, insofar as necessary for processing, are: the payment service provider Stripe (section 5), the freight forwarder commissioned with delivery (name, delivery address, telephone number for delivery notification) and our tax advisers in the course of bookkeeping.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory retention obligations). Retention period: order and invoice data are subject to the seven-year retention obligation under § 132 of the Austrian Federal Fiscal Code (BAO); thereafter they are deleted. We delete your customer data that is not subject to a retention obligation earlier on request.

5. Payment processing via Stripe

Payments in the shop are processed via the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Data may also be transferred to the parent company Stripe, Inc. in the USA.

As part of the payment process, Stripe processes: name, e-mail address, billing and delivery address, payment data (e.g. card details or bank account), the amount and currency as well as IP address and device information. Stripe uses the latter in its “Stripe Radar” service for fraud prevention. Your card details are entered directly with Stripe and never touch our server. The Stripe scripts are loaded only on the payment page, not on the rest of the website.

Legal bases: Art. 6(1)(b) GDPR (payment processing as performance of a contract), Art. 6(1)(c) GDPR (statutory obligations, e.g. anti-money-laundering) and Art. 6(1)(f) GDPR (fraud prevention).

Third-country transfer: the transfer to the USA is based on the adequacy decision for the EU-U.S. Data Privacy Framework (Stripe, Inc. is certified) and, in addition, on the Standard Contractual Clauses (SCC) of the European Commission. Details: Stripe privacy policy.

6. Invoicing via hellocash

We create the invoices for your order via the invoicing service hellocash of mRs GmbH, Austria. For this purpose we transmit the data required for the invoice: name, billing address, company name and VAT ID where applicable, and your e-mail address. hellocash processes this data on our behalf and according to our instructions (processing on behalf of a controller, Art. 28 GDPR).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (statutory obligation to issue invoices). Retention period: invoices are subject to the seven-year retention obligation under § 132 BAO; thereafter they are deleted.

7. VAT ID verification via VIES

If you provide a VAT ID as a business customer when ordering, we verify its validity via the VIES system (VAT Information Exchange System) of the European Commission. The VAT ID entered is transmitted to the European Commission; we use the result (valid/invalid, registered company name where applicable) to decide on the VAT-exempt intra-Community supply (reverse charge).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (VAT-law documentation obligations).

8. Cookies

We use technically necessary cookies on the basis of § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) without consent; all other cookies are set only after your consent via the cookie banner (Art. 6(1)(a) GDPR). You can change or revoke your selection at any time via the link “Cookie settings” in the page footer.

Cookie	Purpose	Category	Retention
session	Shopping basket, ordering process, CSRF protection	Necessary	End of session
ihrcarport_consent	Stores your cookie consent	Necessary	6 months
__stripe_sid / __stripe_mid	Payment processing and fraud prevention (payment page only)	Necessary	30 minutes / 1 year
_ga, _ga_*, _gid	Google Analytics 4 – audience measurement	Statistics (only with consent)	up to 2 years

9. Google Analytics 4

If you have given your consent via the cookie banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies (see table above) and processes, among other things, a truncated IP address, pages visited, time spent and approximate region of origin in order to provide us with anonymised statistics on the use of the website. We use Google Consent Mode: without your consent, no analytics cookies are set and no measurement data is transmitted.

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 165(3) TKG 2021. Any transfer to Google LLC in the USA is based on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Revocation: at any time via “Cookie settings” in the page footer, with effect for the future. Details: Google privacy policy.

10. Transactional e-mails

We send order, payment and shipping confirmations as well as the confirmation of a withdrawal via our own mail server. No external newsletter or marketing mailing service is used; we do not currently offer a newsletter.

11. No Google Fonts, no map services

All fonts on this website are stored locally on our server; no connection to Google Fonts or other font CDNs is established when the page is loaded. We also do not embed any external map services (e.g. Google Maps) — maps are shown as static, self-hosted graphics.

12. Your rights

You have the following rights with regard to your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, please contact office@ihrcarport.eu. If you believe that the processing of your data violates data protection law, you may lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

13. Changes

We update this privacy policy when the legal situation or our processing operations change (e.g. new services in the shop). The version published on this page at the relevant time applies.