Privacy Policy
Last updated: 15 October 2026
1. Controller
The controller responsible for processing personal data on this website is:
flenit e.U.
Fabian Scharf
Haushamerstrasse 2
8054 Seiersberg-Pirka
Austria
Email: contact@flenit.com
Commercial Register Court: Landesgericht für Zivilrechtssachen Graz
Commercial Register Number: FN 688613 t
2. General information
We process personal data only to the extent necessary to operate this website, provide our online shop, process orders, arrange delivery, provide customer accounts, communicate with customers and protect our services.
We do not sell personal data and do not use personal data for behavioural advertising or marketing profiling.
Further information about cookies and similar technologies is available in our Cookie Policy.
3. Personal data we process
Depending on how you use the website, we may process the following categories of personal data:
- name and contact details;
- email address;
- billing and delivery address;
- order details and purchased products;
- shipping information, tracking information and delivery status;
- payment status and payment-related identifiers;
- customer account and login information;
- messages and information you send to us by email;
- technical information required to operate and secure the website;
- information required to prevent fraud, abuse and unauthorised access.
We do not store complete payment card details on our own servers.
4. Visiting the website
When you visit the website, technical data may be processed to deliver, secure and maintain the website.
This may include:
- IP address;
- date and time of access;
- requested page or resource;
- browser and device information;
- operating system;
- referrer information;
- technical request and security information.
This processing is necessary to provide the website, maintain its security and prevent abuse.
The legal basis is our legitimate interest in operating a secure and reliable website and, where applicable, taking steps at your request before entering into a contract.
5. Shopping cart and checkout
When you use the shopping cart or start the checkout process, we process the information necessary to provide the requested shopping function and prepare or process your order.
This may include:
- products and quantities in your shopping cart;
- selected product variants;
- email address;
- delivery and billing information;
- shipping option;
- order total and currency;
- technical information required to maintain the checkout session.
The legal basis is the performance of a contract or taking steps at your request before entering into a contract.
6. Orders and contract performance
When you place an order, we process the information necessary to accept, fulfil and document the order.
This may include:
- name;
- email address;
- delivery address;
- billing information;
- purchased products;
- order value and currency;
- payment status;
- shipping method;
- FedEx tracking information;
- refund or warranty information;
- communications relating to the order.
We use this information to:
- process and confirm your order;
- send order-related emails;
- arrange delivery;
- provide tracking information;
- process refunds;
- handle returns, withdrawal requests and warranty claims;
- maintain accounting and legally required business records.
The legal bases are contract performance and compliance with legal obligations.
7. Stripe and payment processing
Payments are processed through Stripe.
The available payment methods include card payments and Google Pay. PayPal is not currently offered.
Stripe may process information such as:
- payment and transaction details;
- email address;
- billing and delivery information;
- order details;
- payment identifiers;
- fraud-prevention and security information.
Payment card details are entered on Stripe's payment page and are not stored as complete card details by flenit.
Stripe may process personal data under its own privacy terms and may act as an independent controller for certain processing activities.
More information is available in the Stripe Privacy Center.
8. Delivery through FedEx
For delivery, we may provide FedEx with the information necessary to deliver your order.
This may include:
- recipient name;
- delivery address;
- contact details provided for delivery purposes;
- order or shipment reference;
- tracking information.
FedEx processes this information for transport, delivery, tracking, security and customer service purposes in accordance with its own privacy information.
9. Customer accounts
Customer accounts use passwordless email authentication.
If you request access to a customer account, we process your email address to send a one-time sign-in link. After successful verification, a session is maintained through a necessary session cookie.
We do not store customer account passwords.
The legal basis is the performance of a contract or taking steps at your request before entering into a contract.
10. Emails and Cloudflare
We send transactional emails such as order confirmations and customer account emails from:
noreply@flenit.com
These emails are sent through the Cloudflare email service configured for the minshop application.
Incoming messages sent to contact@flenit.com may be forwarded using Cloudflare Email Routing.
Cloudflare may process email addresses, message content and technical delivery information in order to route or deliver emails.
Cloudflare is also used for hosting, infrastructure, traffic delivery and security.
Further information is available in Cloudflare's Privacy Policy.
11. Cloudflare Turnstile
We use Cloudflare Turnstile for bot protection on the administration login and customer account sign-in pages.
Turnstile may process technical information about your browser, device and connection, including information required to determine whether a request is likely to come from a human user or an automated system.
Turnstile is used for security purposes only. We do not use Turnstile for advertising, analytics or behavioural profiling.
Further information is available in Cloudflare's Turnstile Privacy Addendum.
12. Administration area
The administration area is used to manage products, orders, pages, customers, shipping and store settings.
For authorised administration users, we may process:
- administrator email address;
- authentication and session information;
- security and access information;
- actions performed in the administration area;
- information entered or managed through the administration area.
This processing is necessary to operate and secure the administration area and to manage the business.
The legal basis is our legitimate interest in operating and protecting the business and, where applicable, compliance with legal obligations.
13. Cookies and browser storage
We use technically necessary cookies and browser storage for functions such as:
- shopping cart operation;
- customer account sessions;
- administration sessions;
- security functions;
- displaying requested status messages.
We currently do not use Google Analytics, Meta Pixel, advertising cookies, behavioural tracking cookies or similar marketing technologies.
Further information is available in our Cookie Policy.
14. Legal bases
Depending on the purpose, we process personal data on the following legal bases:
- performance of a contract or taking steps before entering into a contract;
- compliance with legal obligations;
- our legitimate interests in operating, securing and improving the website and business;
- consent, where consent is legally required and has been obtained.
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
15. Data recipients
Personal data may be disclosed to service providers where necessary for the purposes described in this Privacy Policy, including:
- Cloudflare, for hosting, infrastructure, security, email and Turnstile;
- Stripe, for payment processing and hosted checkout;
- FedEx, for delivery and shipment tracking;
- professional advisers, accounting providers or legal advisers where necessary;
- public authorities where disclosure is required by law.
Service providers may process personal data only for the relevant purposes and in accordance with applicable data protection requirements.
16. International data transfers
Some service providers may process personal data in countries outside the European Economic Area.
Where personal data is transferred outside the European Economic Area, we rely on an applicable legal transfer mechanism, such as an adequacy decision, standard contractual clauses or another mechanism permitted by applicable data protection law.
Further details may be available in the privacy information of the relevant service provider.
17. Data retention
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy.
Order, payment, accounting and business records may be retained for statutory retention periods.
Information relating to warranties, returns, refunds, disputes and legal claims may be retained for as long as necessary to establish, exercise or defend legal claims.
Email enquiries are retained for as long as necessary to handle the enquiry and any related follow-up, unless a longer retention period is required by law or justified by a legal claim.
Session and security information is retained only for as long as necessary for authentication, security and abuse prevention.
18. Your rights
Subject to applicable legal conditions, you have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete data;
- request deletion of your personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- request data portability;
- withdraw consent where processing is based on consent; and
- lodge a complaint with a data protection supervisory authority.
To exercise your rights, please contact:
We may ask for information necessary to verify your identity before responding to a request.
19. Right to lodge a complaint
You have the right to lodge a complaint with the competent data protection supervisory authority.
In Austria, this is:
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at
20. Automated decision-making and profiling
flenit does not use personal data for automated decision-making or profiling that produces legal effects or similarly significant effects on you.
Payment and security providers may carry out their own fraud-prevention or security checks under their own privacy policies.
21. Third-party websites
This website may contain links to websites operated by third parties.
We are not responsible for the privacy practices or content of third-party websites. Please review the privacy information of those websites before providing personal data.
22. Changes to this Privacy Policy
We may update this Privacy Policy if our website, services, service providers or applicable legal requirements change.
The current version is always published on this page.
23. Contact
If you have any questions about this Privacy Policy or the processing of your personal data, please contact:
flenit e.U.
Fabian Scharf
Haushamerstrasse 2
8054 Seiersberg-Pirka
Austria
Email: contact@flenit.com