Privacy notice for orders on online marketplaces

1. Controller

Hummingbird FlexCo (brands “Luft & Liebe” and “Edition Colibri”), Postgasse 8b, 1010 Vienna, Austria. Company register FN 630860 k, VAT ATU80883037. E-mail: info@hummingbird.at.

Privacy contact: Dr. Satyanarain Rengarajan, Managing Director, info@hummingbird.at. No data protection officer under Art. 37 GDPR is appointed, as none is legally required.

2. Scope

We also sell the cards of our brands Luft & Liebe and Edition Colibri on online marketplaces. Most marketplace orders are shipped by the marketplace itself, and we receive no address. This notice mainly covers personalised card sets that we fulfil ourselves: you enter names, a date and a message when ordering, we print exactly that text on our design, and our print partner ships the cards directly to you.

3. Data we process

The marketplace you ordered on sends us, via its seller interface, only:

• order ID, item, quantity and price,
• shipping address (name, street, postcode, city, country),
• your personalisation (the names, date and message you entered).

We receive no payment data, password or phone number. All communication with you runs through the marketplace.

4. Purpose and legal basis

We use this data only to fulfil your order: create the print file, have it printed, ship it, report the tracking number to the marketplace and answer questions about the order. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); statutory retention of accounting records (Art. 6(1)(c) GDPR).

We do not use your data for advertising, newsletters, profiling or automated decisions, and we do not sell it.

5. Recipients

• FLYERALARM PRO GmbH, Würzburg, Germany (Würzburg Local Court, HRB 16253) — prints and ships your cards; receives your shipping address and the print file with your text, as a processor under Art. 28 GDPR.
• The print partner's carrier (currently UPS) — receives name and shipping address for delivery.
• The marketplace you ordered on — receives the tracking number.
• Technical service providers (processors): Render Services, Inc. (database and application, data centre in Frankfurt am Main); a cloud storage provider (encrypted file storage and logs); Microsoft Ireland Operations Ltd. (e-mail and device management). Render Services, Inc. is based in the USA and certified under the EU-U.S. Data Privacy Framework (EU adequacy decision), with the EU Standard Contractual Clauses in Render's data processing addendum as fallback.

We do not share your data with anyone else.

6. Retention

• Shipping address: deleted automatically 30 days after shipment confirmation.
• Print file with your text: deleted automatically 90 days after shipping.
• Backups: expire within 35 days.
• Invoices are issued by the marketplace on our behalf and made available in your customer account.
• Accounting records (order ID, item, price and VAT reports) are kept for seven years as required by Austrian tax law (§ 132 BAO).

7. Security

• Transfer only encrypted (HTTPS/TLS).
• Storage only in the EU, encrypted (AES-256); shipping addresses additionally encrypted field by field.
• Only two named, authorised people can access addresses, each with a personal account and two-factor sign-in; every access is logged.
• No addresses on laptops, USB drives or personal devices; testing uses invented data only.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Write to info@hummingbird.at or use the marketplace's messaging function.

You may also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at, or with the authority in your country of residence.

9. Data breaches

If, despite all measures, a personal-data breach occurs, we inform the marketplace operator within 24 hours, the supervisory authority within 72 hours, and you where there is a high risk to you.

10. Changes

We update this notice when our processes change. The version published here applies.