Privacy Policy

Information pursuant to Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and § 24 of the Austrian Media Act. Last updated: 2026.

1. Controller

2. General Information

We process personal data exclusively in accordance with the GDPR and the Austrian Data Protection Act (DSG). Personal data is only stored for as long as necessary for the respective purposes or as required by law.

3. Website Access (Server Log Files)

When you visit our website, the hosting provider automatically collects data (e.g. IP address, date and time of access, pages visited, browser, operating system). This data is processed to ensure operation, troubleshoot errors and protect against attacks.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
• Storage period: generally up to 30 days.

4. Online Orders & Payment Processing

When you place an online order, we process the data you provide (first name, last name, phone number, email address, delivery address if applicable, order details, notes) for contract performance.

• Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (statutory retention obligations, in particular § 132 BAO – 7 years).
• Recipients: Payment service provider Stripe (Stripe Payments Europe Ltd., Ireland) for the secure processing of card payments. Stripe processes payment data on its own responsibility – privacy notice: stripe.com/at/privacy.
• Storage period: until the expiry of statutory retention periods (typically 7 years).

5. Contacting Us

If you contact us by email, phone or through reservation requests, your details will be processed to handle your enquiry. They are stored for the duration of processing and beyond, where required for evidentiary or retention reasons.

Legal basis: Art. 6(1)(b) and (f) GDPR.

6. Cookies

Our website uses only technically necessary cookies (e.g. to store your cart during your visit). We do not use marketing or tracking cookies that require consent.

You can disable cookies in your browser at any time. Some functions of the website may be limited as a result.

7. Processors & Recipients

To operate the website and fulfil orders, we work with selected service providers under data processing agreements pursuant to Art. 28 GDPR, including:

• Hosting / website delivery (e.g. Vercel Inc., USA – with EU Standard Contractual Clauses)
• Stripe Payments Europe Ltd. (payment processing)

8. Your Rights

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7 GDPR) with effect for the future

To exercise your rights, an informal message to saigonista.vienna@gmail.com is sufficient.

9. Right to Lodge a Complaint

If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).