PRIVACY POLICY (GDPR)

Last updated: 20.01.2026

1. Controller

The controller responsible for processing personal data on this website is:

ANVI BRUSHES
Anna Podgorova
Stuwerstraße 4/26, 1020 Vienna, Austria
Email: support@anvibrushes.com
Phone: +43 680 4017155

2. Scope

This Privacy Policy explains how we process personal data when you:

• visit our website,
• contact us, and/or
• purchase products via our external payment provider (Stripe Checkout).

3. Personal data we process

3.1 Website access (server log data)

When you visit our website, our hosting provider processes technical data that your browser transmits, in particular:

• IP address,
• date and time of access,
• requested page/URL,
• referrer URL,
• browser type/version and device information,
• operating system information,
• (where applicable) error logs.

3.2 Contact requests

If you contact us (e.g., by email), we process:

• your name (if provided),
• your email address,
• the content of your message,
• any information you share in your communication.

3.3 Purchases via Stripe Checkout (external payment link)

If you click “buy brush set” / “order” you will be redirected to a Stripe Checkout page (buy.stripe.com) to complete payment.
During checkout, Stripe processes the data necessary to complete the purchase (e.g., contact details, payment details, and—if required—billing/shipping details).

Depending on the configuration and the purchase, we receive from Stripe information necessary to fulfill the contract and for accounting purposes, such as:

• your name and email address,
• order details (product, price, currency),
• billing address and/or shipping address (if applicable),
• payment status/confirmation,
• invoice/receipt information,
• transaction identifiers.

We do not receive full card numbers; payment card details are processed by Stripe.

4. Purposes and legal bases

4.1 Operating and securing the website

Purpose: website delivery, IT security, troubleshooting, preventing abuse.
Legal basis: legitimate interests (Art. 6(1)(f) GDPR) and/or necessity to provide the service you request.

4.2 Responding to inquiries

Purpose: handling customer support and other requests.
Legal basis: necessity for pre-contractual steps / contract (Art. 6(1)(b) GDPR) and/or legitimate interests (Art. 6(1)(f) GDPR).

4.3 Processing purchases and fulfilling orders

Purpose: contract performance, delivery (if applicable), customer service, handling returns/complaints.
Legal basis: contract performance (Art. 6(1)(b) GDPR).

4.4 Accounting and invoicing

Purpose: invoicing, bookkeeping, tax compliance, retention of accounting records.
Legal basis: legal obligation (Art. 6(1)(c) GDPR) and contract performance (Art. 6(1)(b) GDPR), as applicable.

5. Cookies and similar technologies (technical cookies only)

We use only strictly necessary cookies (and/or similar technologies) that are required for the website to function and to remember your privacy settings. These cookies cannot be switched off without affecting core functionality.

Typical strictly necessary cookies may include:

• Privacy preference cookie: stores your selection/acknowledgement from the cookie notice (“Privacy Preferences” / “I AGREE”).
• Security/session cookies (if and when required by our hosting/security setup): help protect the website and enable essential functions.

Cookie names and retention periods can vary due to technical updates. You can view the cookies currently stored by our website in your browser settings.

We do not use analytics cookies or advertising cookies.

6. Recipients / processors

To operate this website and provide our services, we may use service providers (processors) that process personal data on our behalf, in particular:

• website hosting / infrastructure providers,
• IT/security providers (where applicable),
• payment provider: Stripe (for checkout and payment processing).

7. Stripe Checkout (external provider)

We use Stripe for payment processing via an external Stripe Checkout page. When you proceed to payment, Stripe processes your personal data under its own responsibility for the payment transaction and related services.

Please review Stripe’s Privacy Policy for details on Stripe’s processing, cookies, and international transfers.

8. International data transfers

Some service providers (in particular Stripe) may process data outside the European Economic Area (EEA). Where such transfers occur, they are carried out using appropriate safeguards (e.g., Standard Contractual Clauses) as described by the provider.

9. Data retention

We store personal data only as long as necessary for the purposes described above, and in line with statutory retention obligations:

• Website/server log data: retained for a limited period for security and troubleshooting, then deleted or anonymized.
• Inquiries: retained for as long as needed to handle the request and for follow-up, then deleted unless longer retention is required.
• Contract, invoice and accounting data: retained for the legally required period (generally 7 years after the end of the relevant calendar year) and longer if required for the assertion, exercise, or defense of legal claims.

10. Your rights

If the GDPR applies to you, you have the right to:

•  access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection (Art. 21 GDPR), in particular where processing is based on legitimate interests.

To exercise your rights, contact us using the details in Section 1.

11. Right to lodge a complaint

You also have the right to lodge a complaint with a supervisory authority. In Austria, the competent authority is the Austrian Data Protection Authority (Datenschutzbehörde).

12. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, and misuse. However, no online transmission is completely secure.

13. Changes to this Privacy Policy

We may update this Privacy Policy to reflect legal, technical, or business changes. The current version is published on this page.