Privacy Policy

Last updated: 27 October 2026

1. Controller

Martin Freitag (HAKKWERK)
Mettersdorf 126
8092 Mettersdorf am Saßbach
Austria
Email: info@hakkwerk.com

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). We have not appointed a data protection officer, as we are not legally required to do so. For all privacy questions, simply write to the address above.

2. Overview

We only process personal data where a legal basis allows it, in particular to perform a contract with you (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR), on the basis of our legitimate interests (Art. 6(1)(f) GDPR) or with your consent (Art. 6(1)(a) GDPR). We do not sell your data, we do not use analytics or advertising tools, and we do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.

Service providers who process data on our behalf (hosting, email, production and shipping) are bound by a data processing agreement under Art. 28 GDPR. Where required, we also pass data to our tax advisor and to authorities (e.g. the tax office) to meet legal obligations.

3. Hosting, server logs and encryption

This website, including its database and email server, is hosted by World4You Internet Services GmbH, Hafenstraße 35, 4020 Linz, Austria. When you visit the website, the server automatically records technical data: IP address, date and time of access, requested page, referrer, browser type and operating system. This is necessary to deliver the website and to keep it secure, e.g. to detect attacks (Art. 6(1)(f) GDPR). Log files are deleted by the host after a short period unless they are needed to investigate a security incident.

The website uses TLS encryption (recognisable by "https://" and the lock icon in your browser). Fonts, videos and audio on this website are hosted on our own server; no content is loaded from Google Fonts, YouTube or similar third-party services.

4. Cookies and local storage

We only use cookies and similar technologies that are strictly necessary to provide the shop you requested (§ 165(3) Austrian Telecommunications Act 2021; Art. 6(1)(b) and (f) GDPR). No consent is required for these, which is why there is no cookie banner. We do not use analytics, tracking or advertising cookies.

Name Purpose Duration
wp_woocommerce_session_* Remembers your cart and checkout 2 days
woocommerce_cart_hash, woocommerce_items_in_cart Shows the current cart contents Session
wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie Keeps you logged in to your customer account; checks that cookies are enabled Session, or 14 days with "Remember me"
wc_cart_hash, wc_fragments (browser storage) Speeds up display of the cart Session
hkw-entered (browser storage) Remembers that you have opened the intro and whether sound is on Until you close the tab

When you choose to pay with Stripe or PayPal, these providers may set their own cookies on the checkout for security and fraud prevention (see section 10).

5. Contacting us

If you contact us by email, we process your email address, your name (if provided) and the content of your message to answer your enquiry (Art. 6(1)(b) GDPR for questions about orders, otherwise Art. 6(1)(f) GDPR). We delete this correspondence when it is no longer needed, at the latest after 3 years, unless statutory retention obligations apply (e.g. if it concerns an order).

6. Orders

You can order as a guest or with a customer account. When you place an order, we process your name, billing and shipping address, email address, optional phone number, the ordered items, the payment method and payment status, in order to perform the contract (Art. 6(1)(b) GDPR). Fields marked as required are needed to process the order; without them we cannot accept it.

Order and invoice data are retained for 7 years from the end of the calendar year of the order, as required by Austrian tax law (§ 132 BAO; Art. 6(1)(c) GDPR), and longer if they are needed for ongoing proceedings. After that period they are deleted or anonymised.

7. Customer account

You can optionally create a customer account to view your orders and save your addresses (Art. 6(1)(b) GDPR). We store the data you provide until you delete the account or ask us to delete it, unless statutory retention obligations apply to order data. Inactive accounts are deleted automatically after 24 months.

8. Product reviews

If you write a product review, we publish it together with the name you enter. We also store your email address (not published) and the IP address and time of submission, so that we can contact you about your review and defend against abuse (Art. 6(1)(a) and (f) GDPR). The review remains online until you ask us to remove it.

9. Production and shipping (Printful)

Our products are made to order and shipped by Printful: AS "Printful Latvia", Ojāra Vācieša iela 6B, Riga, LV-1004, Latvia, and Printful Inc., 11025 Westlake Dr., Charlotte, NC 28273, USA. To fulfil your order, we transmit your name, shipping address, email address, phone number (if provided) and the ordered items to Printful (Art. 6(1)(b) GDPR). Printful passes your name, shipping address and, where required for delivery, your phone number or email address to the shipping carrier (e.g. DHL, DPD, GLS or national postal services). Printful processes this data on our behalf under a data processing agreement. Where data is transferred to the USA, this is based on the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses (see section 13).

10. Payment providers

Depending on the payment method you choose, your payment is processed by:

We pass the data needed for the payment (name, billing address, email address, amount, order number) to the provider you select (Art. 6(1)(b) GDPR). Card details are entered directly in the provider's payment form and never reach our server. To make the payment form and buttons work, the Stripe and PayPal scripts are loaded on the cart and checkout pages; in doing so, your IP address and device information are transmitted to the provider, which uses them, among other things, to prevent fraud (Art. 6(1)(f) GDPR). The payment providers act partly as independent controllers under their own privacy policies and may transfer data to their group companies in the USA (see section 13).

11. Order emails

We send you transactional emails about your order (order confirmation, invoice, shipping updates) to perform the contract (Art. 6(1)(b) GDPR). Emails are sent via our own mail server at World4You. For troubleshooting delivery problems, a log of sent emails (recipient, subject, time) is kept for 14 days and then deleted automatically (Art. 6(1)(f) GDPR).

12. Newsletter ("Notify me")

If you sign up on our website, we will send you emails about the launch of our shop, new products ("drops") and offers. We only send these emails with your consent (Art. 6(1)(a) GDPR, § 174 Austrian Telecommunications Act 2021).

Double opt-in: After signing up you will receive an email asking you to confirm your address. Only after confirming are you added to our list. Unconfirmed sign-ups are deleted automatically after 48 hours.

What we store: your email address, the time and IP address of your sign-up and of your confirmation, and the wording of the consent you gave. We store the time and IP address to be able to prove your consent (Art. 7(1) and Art. 6(1)(f) GDPR).

Where: The data is stored on our web server at World4You Internet Services GmbH, Linz, Austria, which processes it on our behalf, and the emails are sent via our World4You mail server. We do not pass your data on to third parties.

Withdrawal: You can withdraw your consent at any time with effect for the future by clicking the unsubscribe link in every email or by writing to info@hakkwerk.com. Your data is then deleted.

Storage period: until you unsubscribe.

13. Transfers outside the EU

We host and process your data in the EU. Some of our service providers (Printful, Stripe, PayPal) belong to groups based in the USA and may transfer data there. The USA has an adequacy decision of the European Commission for companies certified under the EU–US Data Privacy Framework (Art. 45 GDPR); otherwise transfers are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

14. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent at any time with effect for the future (Art. 7(3)). To exercise these rights, write to info@hakkwerk.com.

Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds. You can object to direct marketing at any time without giving reasons.

You also have the right to lodge a complaint with a supervisory authority, in Austria the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

15. Changes

We update this privacy policy when our services or legal requirements change. The current version is always available on this page.

Back