I. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection provisions is:

KTG Kaufmann GmbH Unterries 1 6850 Dornbirn Austria

E-mail: uk@valentina-philippa.com Website: www.valentina-philippa.com

II. General information on data processing

1. Scope of the processing of personal data Our processing of personal data of our users is limited to those data that are necessary for the provision of a functional website as well as our contents and services. The processing of our users' personal data only takes place for the purposes agreed with you or if another legal basis (within the meaning of the GDPR) exists. Only such personal data are collected that are actually necessary for the performance and processing of our tasks and services or that you have voluntarily made available to us.

2. Your rights (data subject rights) You have the right to request information about your personal data processed by us. In particular, you may request information about the processing purposes, the categories of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, data portability (provided that this does not cause disproportionate effort), the source of your data if they were not collected by us, and the existence of automated decision-making, including profiling.

You also have the right to revoke any consent given for the use of your personal data at any time.

If you are of the opinion that the processing of your personal data by us contradicts the applicable data protection provisions, you have the option of complaining to the Austrian Data Protection Authority or another competent supervisory authority.

III. Description and scope of data processing

1. Hosting via Shopify Our online shop is operated on the "Shopify" platform. The service provider is Shopify International Ltd., Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (parent company: Shopify Inc., 151 O'Connor Street, Ground Floor, Ottawa, Ontario K2P 2L8, Canada).

Shopify provides us with an e-commerce platform through which we can offer our products for sale. Your data is stored on Shopify's servers. It is possible that data may also be transmitted to the parent company Shopify Inc. in Canada or the USA in this context. For Canada, there is an adequacy decision of the EU Commission, which confirms that an adequate level of data protection prevails there.

Every time our website is accessed, the Shopify system automatically collects data and information from the computer system of the accessing computer (server log files). The following data are collected here:

• IP address of the requesting computer

• Date and time of access

• Name and URL of the retrieved file

• Browser and operating system used

• Information about the type of device used

These data are used to ensure the security and stability of the system and to detect abuse. The legal basis for data processing is Art. 6 (1) (f) GDPR.

Further information on data protection at Shopify can be found at: https://www.shopify.de/legal/datenschutz

2. Cookies We use cookies on our website to make our services user-friendly. Cookies are small files that your browser creates automatically and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our site. Some cookies are strictly necessary for the operation of the website (e.g., shopping cart functionality via Shopify), while others serve statistical or marketing purposes.

In our cookie notice (cookie banner), you will find all cookies listed, sorted by function and explained in detail. You can customize your settings and accordingly allow or reject only necessary cookies or all cookies (incl. statistics, marketing, etc.). The legal basis for necessary cookies is Art. 6 (1) (f) GDPR (legitimate interest), and for all other cookies Art. 6 (1) (a) GDPR (consent).

3. Google Analytics "Google Analytics," a web analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is used on our website. Google Analytics uses cookies. The information generated by the cookie about your use of this website is generally transmitted to a Google server in the USA and stored there.

We have activated the IP anonymization function on this website, so that your IP address is anonymized before being transmitted to Google.

You can prevent Google Analytics cookies by selecting the "only necessary cookies" button in the pop-up "Cookie Information" that appears when you visit the website, or by making the appropriate settings in the banner. The legal basis for the data processed by Google Analytics cookies is Art. 6 (1) sentence 1 (a) GDPR ("consent").

4. Microsoft Clarity This website uses the service "Clarity" from Microsoft Corporation. Clarity allows for an analysis of the use of our website (heatmaps, session recordings) in order to derive potential improvements. The collected information is transmitted to and stored by Clarity. According to Microsoft, this can also be used for advertising purposes. Information: https://clarity.microsoft.com Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement Objection option: Via our cookie banner (select "only necessary cookies").

5. Customer account/user account To provide you with the greatest possible convenience, we offer the permanent storage of your personal data in a password-protected customer account. The technical systems for this are provided by Shopify.

Creating a customer account is voluntary and is based on your consent (Art. 6 (1) (a) GDPR). You can view the data stored about you in your customer account at any time. You have the option to delete your customer account at any time. However, please note that this does not simultaneously result in the deletion of order data, provided these are still subject to statutory retention obligations under tax law.

You can also place orders as a guest (without a customer account). In this case, we only process your data for the purpose of processing the order (Art. 6 (1) (b) GDPR).

6. Contact form & e-mail contact If you send us inquiries via the contact form or e-mail, your details will be stored by us for the purpose of processing the inquiry and in the event of follow-up questions. These data are processed in the Shopify system. We do not pass these data on without your consent. The legal basis for processing your inquiry is Art. 6 (1) sentence 1 (b) GDPR (contract initiation/fulfillment) or Art. 6 (1) (f) GDPR (legitimate interest in communication).

7. Online payment transactions To process online payments, we work with various payment service providers. Depending on the selected payment method, we pass the data necessary for payment (name, address, bank details, purchase amount, currency, transaction number) to the respective service provider.

We use, among others:

• Shopify Payments: Payment processing directly via the Shopify platform (in cooperation with Stripe).

• PayPal: (PayPal (Europe) S.à r.l. et Cie, S.C.A.)

• Klarna: (Klarna Bank AB, Sweden)

• Credit card providers

The transmission of your data to the payment service providers takes place on the basis of Art. 6 (1) (b) GDPR (contract processing). The payment service providers process the data on their own responsibility.

8. Logistics service providers/transport companies For the purpose of delivering ordered goods, we work with logistics service providers and shipping partners (e.g., Austrian Post, DHL, DPD). The following data are transmitted to them for the purpose of delivery: first name, last name, postal address, and, if applicable, e-mail address/telephone number for parcel notification. The legal basis for processing is Art. 6 (1) (b) GDPR.

9. Newsletter If you would like to subscribe to the newsletter offered on the website, we require an e-mail address from you. If you subscribe to the newsletter, your e-mail address will be used for our own advertising purposes until you unsubscribe from the newsletter. You can unsubscribe at any time using the link provided in the newsletter. We may use technical service providers for shipping (e.g., Shopify Email or Klaviyo), who act as processors. Legal basis: Art. 6 (1) (a) GDPR (consent).

IV. Data security

1. SSL encryption For security reasons and to protect the transmission of confidential content, such as orders or inquiries, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser's address line changes from "http://" to "https://" and by the lock symbol in your browser line.

2. General security Furthermore, we use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Since our shop is hosted by Shopify, you benefit from the high security standards of the platform operator (e.g., PCI-DSS compliance).

Note on e-mails: We draw your attention to the fact that data transmission on the Internet (e.g., in communication by e-mail) can have security gaps. Complete protection of data against access by third parties is not possible.