Privacy policy

1. Controller

Matador Spielwaren GmbH, Außervillgraten 41, 9931 Außervillgraten, Austria; phone: +43 676 5555 315; e-mail: shop@matador.at. No data protection officer has been appointed, as there is no legal obligation to do so.

2. General information

We process personal data exclusively on the basis of the applicable legal provisions (GDPR, Austrian Data Protection Act, Telecommunications Act 2021). Below we inform you about the nature, scope and purpose of processing in connection with our online shop.

3. Shop platform and hosting (Shopify)

Our online shop runs on the e-commerce platform Shopify (Shopify International Limited, 2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify processes all data arising in the shop (e.g. order, customer and access data) on our behalf on the basis of a data processing agreement (Art. 28 GDPR).

When you access our shop, technically necessary access data (e.g. IP address, date and time, page accessed, browser type) is processed in server log files. The legal basis is our legitimate interest in providing the shop securely (Art. 6(1)(f) GDPR).

In the course of using Shopify, personal data may be transferred to companies of the Shopify group in third countries (in particular Canada and the USA). Such transfers are based on adequacy decisions of the EU Commission or on EU standard contractual clauses.

4. Order and contract processing

To process your order, we process the data you provide (name, address, delivery address, e-mail address, telephone number, order and payment data). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) as well as compliance with legal obligations, in particular retention obligations under tax and company law (Art. 6(1)(c) GDPR).

We retain invoicing and accounting data for seven years in accordance with the statutory retention obligation (section 132 of the Austrian Federal Fiscal Code, BAO), and beyond that only as long as this is necessary for any legal disputes.

5. Enterprise resource planning and accounting (Odoo)

For order processing, inventory management and accounting we use the business software Odoo (Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium; hosted in the EU). Order and customer data is transferred to and processed there. A data processing agreement is in place with Odoo.

6. Payment processing

For payment processing we use the following payment service providers, which process your payment data under their own data protection responsibility:

  • Shopify Payments (credit/debit card, Apple Pay, Google Pay, Shop Pay) — processed via Shopify Payments and its acquiring partners (including Stripe).
  • PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg).
  • Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden).
  • eps transfer — the payment is processed through your bank; the scheme is operated by PSA Payment Services Austria GmbH, Handelskai 92, 1200 Vienna, Austria.

We ourselves neither receive nor store complete card or account details. The legal basis for the transfer of data is the performance of the contract (Art. 6(1)(b) GDPR).

7. Shipping

For delivery we transmit your name, delivery address and — where necessary for delivery — your e-mail address or telephone number to the shipping company engaged. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

8. Content from third-party servers (Netlify)

Product images and building instruction PDFs are currently delivered via the hosting service Netlify (Netlify Inc., 512 2nd Street, San Francisco, CA 94107, USA). When this content is loaded, your IP address is transmitted to Netlify. The transfer to the USA is based on the EU-U.S. Data Privacy Framework or on standard contractual clauses; the legal basis is our legitimate interest in delivering media content efficiently (Art. 6(1)(f) GDPR).

9. Cookies and consent

Our shop uses technically necessary cookies (e.g. shopping cart, language setting, fraud prevention). Cookies and comparable technologies beyond these that are not strictly necessary and serve statistics and marketing purposes — in particular Google Analytics (section 10) and the Meta pixel (section 11) — are only used with your consent via the cookie banner (Art. 6(1)(a) GDPR, section 165(3) of the Austrian Telecommunications Act 2021).

Without your consent these services are not loaded and no data is transmitted to Google or Meta. You can withdraw your consent at any time with effect for the future via the cookie settings in the shop.

10. Audience measurement (Google Analytics)

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It is integrated via the Google & YouTube app for Shopify; our measurement ID is G-VK9PDCLCL7.

Google Analytics helps us understand how our shop is used — for example which pages are viewed, how visitors find us, and at which point a purchase is abandoned. The data processed includes in particular a truncated IP address, device and browser information, the source of the visit, the pages viewed, and details of the events triggered, including order values.

The legal basis is your consent (Art. 6(1)(a) GDPR, section 165(3) of the Austrian Telecommunications Act 2021). Data may be transferred to Google LLC in the USA; such transfers are based on the EU-U.S. Data Privacy Framework and on EU standard contractual clauses. The retention period for event data is determined by the settings in our Google Analytics account.

In addition to withdrawing your consent via the cookie settings, you can also prevent collection by Google Analytics using Google’s browser add-on: tools.google.com/dlpage/gaoptout

11. Meta pixel and Conversions API

We use the Meta pixel and the Conversions API provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Our pixel ID is 1238595134310681.

This allows us to measure the success of our advertising on Facebook and Instagram and to show you ads there that match your interests. Events such as viewing a product page, adding an item to the cart and completing a purchase are recorded, in each case together with device and browser information and details of the shopping cart.

We use advanced matching: details such as your e-mail address, telephone number or name are encrypted (hashed) in your browser before transmission and passed on to Meta in that form only, so that events can be attributed more reliably. Via the Conversions API, Shopify additionally transmits the same events server-side.

The legal basis is your consent (Art. 6(1)(a) GDPR, section 165(3) of the Austrian Telecommunications Act 2021). For the collection and transmission of the data we are joint controllers together with Meta (Art. 26 GDPR); Meta’s further processing takes place under its sole responsibility. Data may be transferred to Meta Platforms, Inc. in the USA on the basis of the EU-U.S. Data Privacy Framework and EU standard contractual clauses.

In addition to withdrawing your consent via the cookie settings, you can object to the use of your data for advertising in the settings of your Meta account: facebook.com/adpreferences

12. Newsletter

If you subscribe to our newsletter (e.g. via the sign-up form in the shop), we process your e-mail address for the purpose of sending the newsletter on the basis of your consent (Art. 6(1)(a) GDPR). Sign-up uses the double opt-in procedure. You can unsubscribe from the newsletter at any time via the unsubscribe link or by e-mail to us.

13. Customer account

If you create a customer account, we process the data stored there in order to manage your account and your orders (Art. 6(1)(b) GDPR). The account can be deleted at any time; statutory retention obligations remain unaffected.

14. Your rights

You have the right to access, rectification, erasure and restriction of processing, the right to data portability, and the right to object to processing based on legitimate interests. You may withdraw any consent given at any time with effect for the future.

To exercise your rights, an informal message to shop@matador.at is sufficient.

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the Austrian Data Protection Authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

15. Status and changes

Last updated: 30 August 2026. We will amend this privacy policy if data processing in the shop changes (e.g. a new shipping partner, new marketing tools, migration of media files to our own domain).

Cannon on wheels, built from MATADOR wooden building parts