Privacy Policy

1. Data Controller

The data controller for data processing on this website, in the sense of the General Data Protection Regulation (GDPR), is:

UP Industry Solutions GmbH
Greyledergasse 24/1
1230 Vienna, Austria

Further details about our company can be found in our Imprint.

2. General Information on Data Processing

We generally process personal data of our users only to the extent necessary to provide a functional website and our content and services. The processing of personal data regularly occurs only with the user's consent (Art. 6 para. 1 lit. a GDPR), for the fulfillment of a contract with the user or for the implementation of pre-contractual measures (Art. 6 para. 1 lit. b GDPR), for the fulfillment of a legal obligation to which we are subject (Art. 6 para. 1 lit. c GDPR, e.g., tax and corporate law retention obligations), or on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR).

If consent is obtained for the processing of personal data, Art. 6 para. 1 lit. a GDPR serves as the legal basis. Consent can be revoked at any time with future effect.

Personal data will be deleted as soon as the purpose of storage ceases to apply, unless their retention is required to fulfill legal retention obligations (in particular, commercial and tax law retention periods of up to 7 years according to § 132 BAO, § 212 UGB).

3. Provision of the Website and Creation of Log Files

Each time our website is accessed, our hosting and platform provider Shopify automatically collects data and information from the computer system of the accessing computer (including IP address, date and time of the request, browser type, operating system used, referrer URL). This data is stored in log files and serves the technical provision, stability, and security of the website. The legal basis is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in the smooth and secure operation of the online shop.

4. Cookies

Our website exclusively uses technically necessary cookies that are required for the operation of the online shop — in particular for the shopping cart, the checkout process, logging into the customer or dealer account, and for fraud prevention. These cookies are set by our shop platform Shopify.

The legal basis for these technically necessary cookies is Art. 6 para. 1 lit. f GDPR or § 165 para. 3 TKG 2021 (legitimate interest in the functionality of the shop). Separate consent is not required for these cookies, as they are absolutely necessary for the use of the shop.

We currently do not use any analytics, marketing, or tracking cookies (e.g., Google Analytics, Meta-Pixel). Should this change in the future, we will update this privacy policy and, if necessary, obtain your prior consent via a cookie consent banner.

5. Registration and Dealer/Customer Account

Business partners have the option to create a company account (B2B account) to order under dealer conditions and manage orders. In doing so, we collect the data necessary for account management (including company name, contact person, address, email address, phone number, order history). Processing is carried out for the fulfillment of the user agreement for the customer account (Art. 6 para. 1 lit. b GDPR).

6. Order Processing

In the context of an order, we process the data you provide (name, billing and shipping address, email address, if applicable phone number, order content) for contract fulfillment, in particular for processing, invoicing and — if pickup at the dealer is selected — for transmitting the necessary order and contact data to the selected dealer for preparation of the pickup. The legal basis is Art. 6 para. 1 lit. b GDPR.

To fulfill tax and corporate law obligations, we are obliged to retain order and invoice data for a period of up to 7 years (Art. 6 para. 1 lit. c GDPR in conjunction with § 132 BAO, § 212 UGB).

7. Payment Processing

For payment processing, we use Shopify Payments, the integrated payment service of our shop provider Shopify. When this payment method is selected, the data necessary for payment processing (including payment method, card data or corresponding transaction data) are transmitted directly to Shopify or its payment service provider and processed there according to their own data protection provisions. The legal basis is Art. 6 para. 1 lit. b GDPR (contract fulfillment).

8. Contact via Email

If you contact us by email, your information (email address, if applicable name and content of the message) will be stored by us to process your request and for possible follow-up questions. The legal basis is our legitimate interest in responding to your request (Art. 6 para. 1 lit. f GDPR) or, if the request serves to initiate or fulfill a contract, Art. 6 para. 1 lit. b GDPR.

9. Disclosure of Data to Third Parties

Your personal data will only be transmitted to third parties to the extent described below:

Shopify Inc. — Operator of the technical platform on which our online shop is hosted (order processing, customer accounts, payment processing, storage of shop and order data). A data processing agreement (Data Processing Addendum) in accordance with Art. 28 GDPR exists with Shopify.

Dealers in our sales network — in the case of a selected pickup, the respective dealer receives the order and contact data necessary for processing the pickup.

Tax advisors and authorities — insofar as this is necessary to fulfill legal obligations (e.g., in the context of an audit).

No disclosure for advertising purposes without your express consent takes place.

10. Data Transfer to Third Countries

Our platform provider Shopify Inc. is based in Canada and may also process personal data outside the EU/EEA as part of its service provision. Insofar as personal data is transferred to countries without an adequate level of data protection determined by the EU Commission, this is done on the basis of EU standard contractual clauses or comparable suitable guarantees in accordance with Art. 46 GDPR.

11. Your Rights as a Data Subject

You have the following rights regarding your personal data:

Right of access (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR), right to data portability (Art. 20 GDPR), and right to object to processing (Art. 21 GDPR).

Furthermore, you have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority for us in Austria is:

Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Wien
www.dsb.gv.at

12. Data Security

We take precautions within the scope of reasonable technical and organizational measures (including encryption of data transmission via TLS/SSL through our platform provider Shopify) to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties.

13. Topicality and Amendment of this Privacy Policy

This privacy policy is currently valid and was last updated in September 2026. Due to the further development of our website and offers or due to changed legal or official requirements, it may become necessary to amend this privacy policy.