FROM STYRIA. DIRECT FROM OUR FARM.Self-service farm shop · Delivery within Austria
GOOD THINGS FROMThurner-Hof

Privacy policy

1. Controller and contact details

The controller responsible for processing personal data on this website is:

Siegfried Thurner
Stang 1
8361 Hatzendorf
Austria
E-Mail: kontakt@thurner.st
Phone: +43 680 2330667

For questions about data protection or to exercise your rights, please contact us using the details above.

2. Website provision and hosting

Our website, including the online shop and database, is hosted by ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The hosting provider processes the data necessary to operate these services.

When you visit our website, technically necessary connection and access data is processed. This may include your IP address, the date and time of access, the requested page or file, access status, the volume of data transferred and, where sent by your browser, referrer, browser and operating system information. This processing enables us to deliver the website, maintain technical stability, analyse errors and ensure IT security. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and uninterrupted operation of our services.

For the web server access logs configured by us in our ALL-INKL customer account, IP addresses are truncated before storage. These log files are deleted after 14 days. We do not have access statistics generated from these logs. Processing the IP address remains necessary to establish the connection when the website is transmitted. Separate, technically necessary security and error logs may also be generated by the shop application; these are processed only for their respective security and troubleshooting purposes.

3. Basket and technically necessary browser storage

For the basket, we store your selected products and quantities and the delivery country locally in your browser (Local Storage). This keeps your product selection available on subsequent visits. Delivery addresses and payment details are not stored there. You can remove this data by emptying your basket or using the storage or website settings in your browser.

This storage supports the basket function you request. It is not used for audience measurement or advertising. Where personal data is processed to provide and use the basket, the legal basis is Article 6(1)(b) GDPR (steps prior to entering into a contract) or Article 6(1)(f) GDPR (providing a functioning shop).

4. Orders, payments and invoices

When you order, we process the details you enter, such as your name, email address and delivery address, as well as the items ordered, quantities, prices, shipping costs, order number, payment method and payment status. Payment references and transaction data may also be stored to match payments to orders. We process this data to accept your order, allocate payments, dispatch goods, communicate with you and issue invoices. The legal basis is Article 6(1)(b) GDPR. Where invoices and business records must be retained by law, the legal basis is Article 6(1)(c) GDPR.

There is no customer registration or public customer account facility. In the internal administration area, orders may be grouped by email address so that we can associate enquiries with previous orders.

For payment in advance, we use the payment receipt details to match your bank transfer to your order. The bank processes the payment data required for the transfer under its own privacy policy. Orders paid by bank transfer are processed after receipt of payment.

5. PayPal

If you choose PayPal, we use PayPal to process your payment. We transmit the information necessary for this purpose, in particular the order reference, payment amount, currency, name and delivery address, to PayPal. When you use its payment service, PayPal may process additional personal data, such as account, transaction, device or connection data, as an independent controller. We receive the payment status and transaction references from PayPal to confirm receipt of payment and fulfil your order.

The legal basis for the data transfer initiated by us is Article 6(1)(b) GDPR. The payment service provider for Austrian PayPal accounts is PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. For details of PayPal’s processing and possible international data transfers, see https://www.paypal.com/at/legalhub/paypal/privacy-full .

6. Shipping with DPD

We use DPD to deliver your order. We manually provide DPD with the necessary shipping data, in particular the recipient’s name, delivery address and shipment information. This is necessary to perform the contract; the legal basis is Article 6(1)(b) GDPR. DPD processes the data required for its delivery service under its own privacy information: https://www.dpd.com/at/de/datenschutz/ .

7. Email and contacting us

We send order and payment confirmations, invoices and confirmations of receipt of withdrawals by email through the SMTP mailbox configured for the shop. The recipient address, message content and the PDF attachments required for invoices are processed for this purpose. Delivery attempts and delivery errors may be logged in the shop so that messages can be sent again if technical problems occur. The legal bases are Article 6(1)(b) GDPR for contract performance and Article 6(1)(c) GDPR for legally required notifications and records.

If you contact us by email or telephone, we use your details to deal with your enquiry and, where relevant, continue processing an existing order. Depending on the circumstances, processing is based on Article 6(1)(b) or (f) GDPR. Our legitimate interest is handling enquiries appropriately.

8. Withdrawals, returns and refunds

If you exercise your right of withdrawal, we process the contact details and order reference you provide, the content of your declaration, the time and scope of the withdrawal and, where relevant, internal processing notes. We need this information to confirm receipt, handle the reversal of the contract and demonstrate compliance with our legal obligations. The legal bases are Article 6(1)(b) and (c) GDPR. Article 6(1)(f) GDPR may also apply where necessary to defend or enforce claims.

Refunds are made through the relevant payment service or bank in accordance with the payment method selected. The processing status is recorded in the internal administration area; changing a status does not itself trigger an automatic refund.

9. Technical security, administration area and logging

To protect our shop against abusive requests, requests may be counted over a limited period and technical identifiers derived from IP addresses using a secret key. The internal administration area uses a technically necessary, protected session cookie for login and form protection. Administrative actions may be logged for security and traceability. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is IT security and protecting customer and order data.

10. External content and audience measurement

Fonts and images in our shop are served from our own web server. We do not use Google Analytics, Meta Pixel or comparable audience measurement or advertising trackers. Merely displaying a link to an external service, such as Google Maps, does not establish a connection to that service. If you follow an external link or move to PayPal, the respective provider’s privacy information also applies there.

11. Retention periods

We store personal data only for as long as necessary for the relevant contract performance, communication, reversal of a contract or protection of legitimate claims. Books, records, supporting documents and invoices relevant for tax purposes are generally retained for seven years after the end of the relevant calendar year; pending proceedings or other applicable legal obligations may require longer retention. Other order, email and withdrawal data is deleted or restricted to what is necessary once its purpose no longer applies, unless there is a retention obligation or a specific need to pursue legal claims. The web server access logs configured in the ALL-INKL customer account are deleted after 14 days. Separate internal application security and error logs are subject to purpose-specific retention periods.

12. Your rights

Subject to the statutory requirements, you have rights including access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests. Where processing is based on your consent, you may withdraw it at any time with effect for the future. Consent is not a prerequisite for the necessary order processing described here.

To exercise your rights, please contact kontakt@thurner.st. You also have the right to complain to a data protection supervisory authority; in Austria, this is the Austrian Data Protection Authority, https://www.dsb.gv.at/ . Statutory retention obligations may prevent compliance with a request for erasure.

13. Required information

Certain details, particularly your name, delivery address, email address and order information, are required to place an online order. Without them, we cannot process your order or deliver the goods. Other information is required only if you use the relevant additional function.