Privacy Policy

Last updated: 1 October 2026

1. Who is responsible for your information

ROSELUNO is operated by E. Syla, Gutenbergstrasse 7, 4052 Ansfelden, Austria. This operator is the controller of the personal information processed for our store, orders and customer service as described below.

Email: info@estkshop.com
Telephone: +43 677 624 36241
Website: https://roseluno.com

This policy applies when you visit our website, place an order, contact us or receive a delivery arranged by a purchaser.

2. Information we collect and where it comes from

You provide information when you complete checkout, contact us, use an available customer account or subscribe to communications. This can include your name, billing and delivery addresses, email address, telephone number, account details, order selections and correspondence.

We receive transaction references, payment status, delivery updates and information needed to investigate payment or delivery problems from the services involved in your order. Payment details are handled by the payment service selected at checkout; the information visible to us depends on that service.

If someone orders for delivery to another person, we receive that person's name, delivery address and necessary delivery contact details from the purchaser. Receiving an order does not subscribe the recipient to marketing.

Where an order includes an individual request, we process the information you provide to carry it out. Please provide only what is necessary and do not send unrelated sensitive information.

Our website also processes technical information, including IP address, browser and device information, request times, pages requested, shopping-cart information, consent choices and security records. Optional technologies may process additional online identifiers, browsing interactions and purchase events if you consent where required.

3. Why we use your information

Orders and customer service: We use identity, contact, order, payment and delivery information to take steps you request before purchase, perform your purchase contract, provide order updates and handle returns and complaints. The legal basis is Article 6(1)(b) GDPR.

Legal obligations: We process information for accounting, taxation, statutory customer obligations and legally required disclosures. The legal basis is Article 6(1)(c) GDPR.

Security, general enquiries and administration: We process necessary information to operate and protect the store, prevent misuse, investigate errors, respond to general correspondence and establish or defend legal claims. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are a secure and functioning business, appropriate customer support and protection of our legal rights, balanced against your interests and rights.

Delivery to someone other than the purchaser: We process the recipient's necessary delivery information to carry out and support the requested delivery. The legal basis is Article 6(1)(f) GDPR, based on our and the purchaser's legitimate interests in completing that delivery.

Optional marketing and tracking: Where consent is required, newsletters, optional analytics, advertising and related technologies rely on Article 6(1)(a) GDPR and the applicable rules for electronic communications and device access. Consent can be withdrawn at any time for the future. It is not a condition of purchasing.

Information identified as necessary at checkout is needed to process your order. If it is not provided, we may be unable to conclude the contract or complete delivery.

4. Our store platform

We use Shopify for our online storefront, hosting, checkout and order-management infrastructure. Shopify processes information on our instructions for these services. It may also act as a separate controller for services and purposes it determines itself.

If you choose a Shopify-operated feature, such as an accelerated checkout, the information needed for that feature is processed under the relevant Shopify terms and privacy information. If Shopify enhanced services are enabled, Shopify may also use information about interactions with our store alongside interactions with other merchants and its services for personalisation, improvement and advertising, subject to applicable consent requirements and privacy choices.

Shopify's Consumer Privacy Policy describes its own processing and privacy controls: https://www.shopify.com/legal/privacy/consumers. Its data-processing terms are available at https://www.shopify.com/legal/dpa.

5. Suppliers, production partners and delivery services

ROSELUNO works with different European suppliers and production partners to source and offer products selected with a focus on quality. Depending on the order, we also use fulfilment providers. Depending on the order, a partner may prepare or dispatch the goods directly.

The partner responsible for fulfilling an order receives only the information needed for its part of the service. This may include the recipient's name, delivery address, necessary delivery contact details, order reference, selected goods and options, and any individual instructions needed to fulfil the order. A supplier that only supplies stock does not automatically need your customer details.

Carriers and logistics providers receive information needed to transport and deliver a parcel. Necessary information may also be shared to investigate a delivery problem, organise a return or resolve a complaint.

Where a partner processes information on our instructions, the data-processing requirements applicable to that role apply. Some recipients, including carriers, act as independent controllers for parts of their operations. Sharing information for fulfilment does not authorise unrelated marketing.

6. Payments and other recipients

The payment method you select at checkout determines which payment provider processes the transaction. That provider receives the identity, contact, payment, order and technical information needed to authorise payment, prevent fraud and meet its legal obligations. It may act as an independent controller for those activities. We use transaction information and payment status to administer your order.

Necessary information may also be processed by providers of business email, technical maintenance, customer support and other services used to run the store. Where used, newsletter, analytics and advertising services are described below. Accountants, legal advisers, insurers, banks, courts and public authorities receive information where required by law or necessary for a particular matter.

7. Optional analytics, advertising and newsletters

Where you subscribe to a newsletter, we use your contact details for the communications you requested. You can unsubscribe using the link in the message or by emailing info@estkshop.com. Transactional messages needed for an order or enquiry are separate from marketing.

Optional tracking can include online identifiers, page views, shopping interactions and purchase events. The relevant consent information explains which services operate, what they do and how to change your choices. Our Cookie Preferences information provides further details.

8. Processing outside the European Economic Area

Our store platform, payment services and other providers can use international infrastructure, affiliates or service providers. Depending on the service or fulfilment arrangement, information may be processed outside the European Economic Area.

Where GDPR transfer restrictions apply, a transfer requires a valid legal mechanism. This may be a European Commission adequacy decision covering the recipient and processing, or appropriate safeguards such as Standard Contractual Clauses together with any necessary supplementary measures. A provider's location or certification is assessed for the particular transfer rather than assumed to cover every operation.

You can request information about the countries, recipients and safeguards applicable to your information, including how to obtain a copy of relevant safeguards, by emailing info@estkshop.com. Copies may be redacted where lawfully necessary to protect confidential information or other people's rights.

9. How long we keep information

We keep information for the purposes described above and delete or anonymise it when it is no longer needed, unless a legal requirement or justified legal claim requires continued retention.

Austrian accounting and invoice records are generally retained for seven years after the end of the relevant calendar year. Longer periods can apply to particular records or ongoing proceedings.

Order, return and complaint records are kept while the matter is being handled and where necessary for applicable warranty, limitation or statutory record periods. Material supplied for an individual order is kept only as needed to fulfil and support the order or deal with a justified related claim.

Technical and security records are retained as needed to operate and protect the service, investigate errors or resolve incidents. Cookie and optional-service lifetimes are stated in the applicable technology information. Active newsletter use ends when you unsubscribe; limited consent and suppression records may be retained to demonstrate compliance and avoid further unwanted messages.

10. Your rights

Subject to the conditions of the GDPR, you can request access, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your situation. You may object to direct marketing at any time.

You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before it was withdrawn.

Send requests to info@estkshop.com. We may ask for information reasonably necessary to verify your identity. We normally respond within one month; where a lawful extension is necessary, we explain it within that initial period.

11. Automated checks

Payment and security services may use automated tools to assess transactions or fraud risks. Depending on the provider, this can lead to additional verification or a payment being declined. An independent provider's privacy information explains its processing.

If a decision concerning you is based solely on automated processing and has legal or similarly significant effects, the protections of Article 22 GDPR apply where relevant. Contact us for assistance with a decision affecting your order and, where applicable, to request human intervention, express your position or challenge the decision.

12. Complaints and changes

You can complain to a supervisory authority, particularly in your country of habitual residence, place of work or the place of the alleged infringement. In Austria, the supervisory authority is the Österreichische Datenschutzbehörde. Current contact and complaint information is available at https://dsb.gv.at.

We update this policy when our services, processing or legal requirements change. Where additional notice or consent is required, we provide it. For privacy questions, email info@estkshop.com.