Privacy policy

1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1 We appreciate your interest in visiting our website. The following Privacy Policy informs you about the manner in which your personal data is processed when you use our online presence.

“Personal data” refers to any information that can be used to identify you directly or indirectly.

1.2 The controller responsible for data processing in accordance with the General Data Protection Regulation (“GDPR”) is:

EHF Marketing GmbH

Platz des Europäischen Handballs

Baumgasse 60A

1030 Vienna, Austria

Phone: +43 1 80151210

E‑mail: handball@ehfmarketing.com

The controller is the natural or legal person who determines the purposes and means of processing personal data.

2) Data Collection When You Visit Our Website

2.1 Server log files

When you access our website without creating an account or otherwise submitting information, we only collect the data transmitted automatically by your browser to our server (“server log files”). This includes:

This processing is carried out under Art. 6(1)(f) GDPR, based on our legitimate interest in ensuring the technical stability, correct display and secure operation of our website.

We do not transfer this data to third parties unless we are legally required to do so. We reserve the right to review server log files retrospectively if concrete indications of unlawful use emerge.

2.2 Secure connections (SSL/TLS)

For security purposes and to protect confidential content (for instance order details or enquiries), our website uses SSL or TLS encryption.

You can identify an encrypted connection by the “https://” prefix and the lock symbol displayed in your browser.

3) Hosting & Content Delivery Network

3.1 Shopify

Our website is hosted and operated using the services of:

Shopify International Limited

Victoria Buildings, 2nd floor

1–2 Haddington Road

Dublin 4, D04 XN32, Ireland

Data may additionally be processed by Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

All data collected through our website is stored on Shopify’s servers. We have concluded a data processing agreement with Shopify ensuring that all processing complies with GDPR and that personal data is not disclosed to unauthorised third parties.

Transfers to Canada are covered by an adequacy decision of the European Commission, ensuring an appropriate level of protection.

3.2 Cloudflare

For the efficient delivery of website content (such as graphics, scripts and other media), we use the content delivery network of:

Cloudflare, Inc.

101 Townsend St.

San Francisco, CA 94107, USA

The processing takes place on the basis of our legitimate interest in improving the stability, performance and security of our website pursuant to Art. 6(1)(f) GDPR.

We have concluded a data processing agreement with Cloudflare. This agreement ensures that all data of our website visitors is processed strictly in accordance with the GDPR and explicitly prohibits Cloudflare from disclosing personal data to unauthorised third parties.

Cloudflare is actively certified under the EU–US Data Privacy Framework, ensuring an adequate level of protection for personal data transferred to the United States.

In line with Cloudflare’s published GDPR information, only the minimal technically required information (primarily IP‑address–related metadata) is processed for security and performance purposes.

4) Cookies

To enhance the user experience on our website and to enable certain functionalities, we use cookies. Cookies are, in essence, small text files deposited on your end device.

Depending on their type, some cookies are automatically deleted when you close your browser (“session cookies”), while others remain stored for a longer period (“persistent cookies”) to preserve your settings for future visits.

If personal data is processed through cookies used by us, such processing is based on:

Your browser offers settings allowing you to be informed whenever cookies are placed, to accept cookies in individual cases, to restrict the acceptance of certain categories of cookies, or to block them entirely. You may also activate an automatic deletion of cookies upon closing your browser.

Please note that restricting cookies may limit the functionality of our website.

5) Contacting Us

When you contact us—for example by e‑mail or through a contact form—personal data is collected. The type of data processed depends on the information you submit in the respective form or message. We use this data exclusively to respond to your enquiry, establish communication, and carry out the associated administrative processes.

The legal basis for this processing is Art. 6(1)(f) GDPR, reflecting our legitimate interest in answering your request. If your enquiry is directed toward the conclusion or performance of a contract, the processing is additionally based on Art. 6(1)(b) GDPR.

Your data will be erased once the matter has been conclusively resolved, provided no statutory retention obligations apply. This is deemed the case when it is clear from the circumstances that the relevant issue has been fully clarified.

6) Use of Client Data for Direct Advertising

Subscription to our e‑mail newsletter

If you choose to subscribe to our e‑mail newsletter, we will periodically send you information regarding our products, offers, and promotions.

The only mandatory information for receiving the newsletter is your e‑mail address; any additional details you voluntarily provide are used solely to personalise the communication.

We apply the double opt‑in procedure:

you will receive our newsletter only after you have expressly confirmed that you wish to receive it. For this purpose, we send you a confirmation e‑mail requiring you to verify your subscription by clicking the corresponding link.

By activating this confirmation link, you consent to the processing of your personal data for newsletter distribution pursuant to Art. 6(1)(a) GDPR.

When you register, we store your IP address as provided by your internet service provider as well as the date and time of registration. This is carried out under Art. 6(1)(f) GDPR, based on our legitimate interest in being able to document and investigate any potential misuse of your e‑mail address.

Your data is used exclusively for sending the newsletter. You may unsubscribe at any time using the link provided in every newsletter, or by notifying the controller named in section 1. Upon unsubscribing, your e‑mail address will be promptly removed from our distribution list unless you have expressly permitted further use of your data or unless we are legally entitled to continue processing it for another purpose, as outlined in this Privacy Policy.

7) Processing of Data for the Purpose of Order Handling

7.1 To the extent necessary for fulfilling the contract—particularly for handling delivery and payment transactions—we transfer the personal data collected during the ordering process to the transport company responsible for delivery and to the financial institution commissioned to process the payment.

This transfer is carried out pursuant to Art. 6(1)(b) GDPR.

If we are contractually obliged to provide updates for goods with digital elements or for digital products, we will use the contact details you provided at the time of purchase (name, postal address, e‑mail address) to inform you about such updates within the statutory information periods. This processing is based on Art. 6(1)(c) GDPR in fulfilment of our legal duties to inform.

Your data will only be used for this specific purpose to the extent necessary.

For order processing, we may also engage additional service providers who support us—either partially or entirely—in executing the contract. The transfer of personal data to these providers takes place strictly within the parameters set out below.

7.2 Passing on Personal Data to Shipping Service Providers

- Österreichische Post AG

For shipping purposes, we use the services of:

Österreichische Post AG

Rochusplatz 1

1030 Vienna, Austria

If you have expressly given your consent during the ordering process, we will transmit your e‑mail address and/or telephone number to the shipping provider pursuant to Art. 6(1)(a) GDPR, enabling delivery coordination or advance delivery notifications.

If you have not provided such consent, we transmit only the recipient’s name and delivery address, insofar as necessary to fulfil the contract, pursuant to Art. 6(1)(b) GDPR. In this case, pre‑delivery communication by the carrier will not take place.

Your consent can be withdrawn at any time with effect for the future by contacting either the controller named in section 1 or the shipping provider directly.

7.3 Use of Payment Service Providers

- Paypal

We offer online payment methods provided by:

PayPal (Europe) S.à r.l. et Cie, S.C.A.

22–24 Boulevard Royal

L‑2449 Luxembourg

When selecting a PayPal payment method requiring pre‑payment, the payment data you entered during the order process—including your name, address, bank or card details, currency and transaction identifiers—along with information about your order content, is transmitted to PayPal pursuant to Art. 6(1)(b) GDPR, strictly for payment processing purposes.

If you choose a PayPal option involving a PayPal risk or creditworthiness assessment, you may be asked to provide additional personal information (such as full name, address details, date of birth, e‑mail address, telephone number, and—if applicable—alternative payment information).

To safeguard our legitimate interest in assessing customer solvency, we transmit this data to PayPal for the purpose of performing a credit check pursuant to Art. 6(1)(f) GDPR.

PayPal evaluates whether the selected payment method can be granted, taking into account the information you provided as well as other data such as shopping cart contents, invoice amount, ordering history and previous payment behaviour.

Credit checks may incorporate probability values (“scores”). These scores are calculated using recognised mathematical‑statistical methods; address data may be part of the calculation.

You may object to this processing at any time by contacting us or PayPal.

However, PayPal may still remain entitled to process your personal data if necessary to perform contractual payment obligations.

8) Site Functionalities

YouTube Videos

Our website integrates plugins for displaying and playing videos provided by:

Google Ireland Limited

Gordon House

4 Barrow Street

Dublin 4, D04 ESW5

Ireland

Data may also be transferred to Google LLC, USA, as part of this service.

When you access a page on our website that contains such a plugin, your browser establishes a direct connection to Google’s servers to load the video component. During this process, certain information—including your IP address—is transmitted to Google.

If video playback is initiated via the embedded player, Google may store cookies to gather information about user behaviour, compile statistics on video usage and prevent abusive use of the service.

If you are logged into a Google account at the time of interaction, any activity may be directly associated with your account. If you do not wish this to happen, you must log out before activating the video.

All processing activities—especially the placement of cookies for reading information on the device used—take place only with your explicit consent pursuant to Art. 6(1)(a) GDPR.

You may revoke your consent at any time with future effect by disabling this service via the cookie‑consent tool provided on our website.

For data transfers to the USA, Google participates in the EU–US Data Privacy Framework, ensuring an adequate level of data protection based on the corresponding adequacy decision of the European Commission.

9) Rights of the Data Subject

9.1 Statutory rights under data protection law

Under the applicable data protection regulations, you have the following rights with respect to the processing of your personal data by the controller:

9.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR LEGITIMATE INTERESTS ACCORDING TO ART. 6(1)(f) GDPR, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE THIS RIGHT, WE WILL CEASE PROCESSING YOUR PERSONAL DATA, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR WHERE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU MAY OBJECT TO SUCH PROCESSING AT ANY TIME.

IF YOU OBJECT TO PROCESSING FOR DIRECT MARKETING, WE WILL IMMEDIATELY STOP PROCESSING YOUR DATA FOR THESE PURPOSES.

10) Duration of Storage of Personal Data

The period for which personal data is stored depends on the respective legal basis, the purpose of processing and, where applicable, statutory retention obligations.

If processing is based on your express consent pursuant to Art. 6(1)(a) GDPR, the data will be stored until you withdraw this consent.

Where personal data is processed for the fulfilment of contractual obligations or similar purposes under Art. 6(1)(b) GDPR, such data will be deleted once it is no longer required for the performance or initiation of the contract — unless statutory retention periods apply. In this case, deletion takes place after expiry of the legally prescribed retention periods, provided we no longer have a legitimate interest in continued storage.

If processing is based on Art. 6(1)(f) GDPR, data will be retained until you exercise your right to object in accordance with Art. 21(1) GDPR, unless we can demonstrate compelling and legitimate grounds for processing that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.

If personal data is processed for direct marketing purposes based on Art. 6(1)(f) GDPR, storage continues until you make use of your right to object under Art. 21(2) GDPR.

Unless otherwise specified in this Privacy Policy for particular processing activities, personal data is deleted once it is no longer necessary for the purposes for which it was collected or otherwise processed.

Unless stated otherwise in the individual processing descriptions contained in this Privacy Policy, we will erase personal data once it is no longer required for the purposes for which it was collected or otherwise processed.

This Privacy Policy is reviewed periodically to ensure compliance with applicable data protection regulations and to reflect any operational changes. Updated versions will be made available on this website.