Privacy Policy
1. Controller and scope
The controller responsible for processing your personal data is COOPH Cooperative of Photography GmbH, Felderstraße 12, 5330 Fuschl am See, Austria ("COOPH", "we", "us"). Full company details are available in our Imprint.
For all questions about data protection, contact us at privacy@cooph.com.
This Privacy Policy applies to our websites www.cooph.com and store.cooph.com, including our online shop and newsletter. It explains which personal data we process, for what purposes, on which legal basis, and which rights you have.
We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).
2. Overview: purposes and legal bases
We only process personal data where a legal basis under Art. 6 GDPR applies. The table below summarises the main processing activities; details follow in the sections below.
|
Purpose |
Data |
Legal basis |
|---|---|---|
|
Providing and securing the website |
IP address, browser and device data, access times, referrer URL |
Legitimate interest, Art. 6(1)(f) GDPR |
|
Strictly necessary cookies (cart, checkout, security, consent storage) |
Cookie IDs, cart content, consent status |
§ 165(3) TKG 2021; Art. 6(1)(b) and (f) GDPR |
|
Processing orders, payment, shipping, customer account |
Name, addresses, email, phone, order and payment data |
Performance of a contract, Art. 6(1)(b) GDPR |
|
Fraud prevention in the shop |
Order, payment and device data |
Legitimate interest, Art. 6(1)(f) GDPR |
|
Accounting and tax retention |
Invoices, order data |
Legal obligation, Art. 6(1)(c) GDPR |
|
Optional cookies: preferences, statistics, marketing |
Online identifiers, usage and interaction data |
Consent, Art. 6(1)(a) GDPR and § 165(3) TKG 2021 |
|
Newsletter |
Email address, sign-up data, opens and clicks |
Consent, Art. 6(1)(a) GDPR |
|
Customer service and enquiries |
Contact data, content of your message |
Art. 6(1)(b) or (f) GDPR |
You are not obliged to provide personal data. Without the data required for an order, however, we cannot conclude or fulfil a purchase contract.
3. Visiting our website
When you visit our website, your browser automatically transmits technical data. We need this data to display the website, ensure its stability and security, and detect misuse.
This includes your IP address, date and time of access, the pages visited, the referrer URL, browser type and version, operating system and screen size.
Hosting and shop platform. Our online shop runs on Shopify, provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes this data as our processor. Shopify may transfer data to Shopify Inc. in Canada and other countries (see section 9).
Bot protection. Some integrated services use Cloudflare (Cloudflare, Inc., USA) to distinguish humans from bots and protect against attacks. Cloudflare processes the IP address and technical browser data for this purpose.
The legal basis is our legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR).
4. Cookies and consent management
We only use optional cookies and similar technologies (such as local storage or pixels) after you have given your consent. Strictly necessary cookies, for example for the shopping cart, checkout and storing your cookie choice, are used without consent.
Cookiebot. We use the consent management platform Cookiebot, provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot shows the consent banner and stores your choice, a consent ID, the date and time of consent and technical browser data. This allows us to prove your consent. Your choice is also passed on to Shopify and the apps in our shop, so they respect your settings.
You can choose between four categories: necessary, preferences, statistics and marketing. All optional categories are switched off by default.
Changing or withdrawing consent. You can change or withdraw your consent at any time via the Cookie Settings in our Cookie Policy. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Our Cookie Policy lists all cookies used on our website, including provider, purpose, category and storage duration. It is updated automatically by Cookiebot.
5. Analytics and advertising
With your consent, we use analytics and advertising services to understand how our shop is used and to measure and improve our advertising. The legal basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021).
Google Tag Manager. We manage our tracking tags with Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Tag Manager itself sets no cookies; it only loads other tags according to your consent.
Google Consent Mode. We use Google Consent Mode to pass your consent choices to Google services. If you do not consent, Google tags may still send limited signals without cookies or identifiers stored on your device, for example that a page was viewed or a purchase was made. Google uses these signals in aggregated form to model conversions. Your IP address is transmitted for technical reasons in this case.
Google Analytics 4 (category: statistics). Google Analytics analyses how visitors use our website, for example which pages and products are viewed. Google Analytics uses pseudonymous identifiers and does not store full IP addresses. Data is deleted after 14 months.
Google Ads conversion tracking and remarketing (category: marketing). We measure which ads lead to purchases and show ads to visitors of our website on other Google services. After a purchase, we may transmit your email address and phone number in hashed (pseudonymised) form to Google to measure ad conversions more accurately (Enhanced Conversions).
Server-side tagging. Some tracking data is routed through our own server-side tag container, operated by Stape Europe OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia (registry code 16564377, privacy@eu.stape.io). This gives us more control over which data is passed to third parties.
Meta Pixel (category: marketing). We use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, integrated via the app Trackify X (REDretarget). It measures the effectiveness of our ads on Facebook and Instagram and allows us to show ads to visitors of our shop (retargeting). For the collection and transmission of data via the pixel, we and Meta are joint controllers under Art. 26 GDPR. Meta's Controller Addendum applies; Meta is responsible for further processing.
TikTok Pixel (category: marketing). We use the TikTok Pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. It measures the effectiveness of our ads on TikTok and allows retargeting.
6. Online shop, payment and shipping
When you place an order or create a customer account, we process the data required to conclude and fulfil the contract (Art. 6(1)(b) GDPR). This includes your name, billing and delivery address, email address, phone number, order details and payment information.
Shopify. Orders and customer accounts are processed via Shopify (see section 3). If you use Shop Pay or "Sign in with Shop", Shopify also processes your data under its own privacy policy.
Payment. Payments are processed via Shopify Payments, provided by Shopify International Limited (see section 3) together with its payment processor Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. We only pass on the data required for the payment. Card data is processed directly by the payment provider; we do not store full card numbers.
Depending on your choice, you can pay by credit or debit card (Visa, Mastercard, American Express, Maestro, UnionPay), Shop Pay, Apple Pay, Google Pay or local payment methods such as EPS, Bancontact, BLIK, iDEAL | Wero, MobilePay and Klarna. If you use Apple Pay or Google Pay, Apple Distribution International Ltd. (Cork, Ireland) or Google Ireland Limited also process your data under their own privacy policies. If you pay with Klarna, your data is passed to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, which may carry out an identity and credit check under its own responsibility.
If you pay with PayPal, you are redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. We pass on the data required for the payment, such as the order amount and your contact and delivery details. PayPal processes your data under its own privacy policy and may carry out a credit check under its own responsibility.
Fraud prevention. Shopify checks orders for signs of fraud. If an order appears suspicious, one of our employees reviews it and decides individually. You can ask for the reasons for a rejected order at privacy@cooph.com. The legal basis is our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).
Shipping. To deliver your order, we pass your name, delivery address and, where needed for delivery notifications, your email address and phone number to the shipping provider. Depending on the destination and shipping method, this is DHL, DPD (DPD Austria, DPD Germany or the DPD company in your country), UPS, Österreichische Post AG or FedEx. Orders are packed and shipped by our logistics partner LKV Logistik GmbH, Salzachtalstraße 47, 5400 Hallein, Austria, which processes order and delivery data on our behalf.
7. Newsletter and pop-ups
You can subscribe to our newsletter on our website. We use your email address to send you information about our products, offers and photography content. The legal basis is your consent (Art. 6(1)(a) GDPR).
Double opt-in. After signing up, you receive an email asking you to confirm your subscription. We store the time of sign-up and confirmation as proof of your consent.
Klaviyo. We send our newsletter with Klaviyo (Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA). Klaviyo stores your email address and measures whether newsletters are opened and which links are clicked, so we can improve our content. With your consent, Klaviyo can also record which products you view in our shop, for example to send reminders about an abandoned cart.
Personizely. We use Personizely, provided by Personizely S.R.L., Valea Trandafirilor 18, Office 105, MD-2001 Chișinău, Moldova, to display pop-ups and sign-up forms on our website, for example newsletter sign-ups with a welcome discount or cart reminders. Personizely forwards newsletter sign-ups to Klaviyo and measures how our pop-ups perform.
Unsubscribe. You can unsubscribe at any time via the link at the end of every newsletter or by email to privacy@cooph.com.
8. Other services on our website
|
Service |
Provider |
Purpose |
Legal basis |
|---|---|---|---|
|
Swym Wishlist Plus |
Swym Corporation, 107 Spring St, 2nd Floor, Seattle, WA 98104, USA |
Saving products to your wishlist |
Consent (preferences) |
|
Judge.me |
Judge.me Ltd, c/o Buckworths, 2nd Floor, 1-3 Worship Street, London, EC2A 2AB, United Kingdom |
Displaying and collecting product reviews |
Art. 6(1)(f) GDPR |
|
Weglot |
Weglot SAS, 7 cité Paradis, 75010 Paris, France |
Translating the website into your language |
Art. 6(1)(f) GDPR |
|
YouTube |
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland |
Embedded videos (where used) |
Consent (marketing) |
|
Vimeo |
Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA |
Embedded videos (where used) |
Consent (marketing) |
Videos. Product videos in our shop are hosted directly by Shopify (see section 3). We may also embed videos from YouTube or Vimeo. These videos only load after you have consented to marketing cookies. Once a video loads, the provider receives your IP address and may set cookies; Vimeo may transfer data to the USA (see section 9).
Contact by email. If you contact us by email, we process your details and the content of your message to answer your enquiry (Art. 6(1)(b) or (f) GDPR). Our emails are processed by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
9. Recipients and international transfers
We only share personal data where this is necessary for the purposes described above. Recipients include:
- Processors acting on our behalf: Shopify (shop platform), Usercentrics (Cookiebot), Klaviyo (newsletter), Personizely (pop-ups), Stape (server-side tagging), Microsoft (email), and our digital agency zooom productions GmbH, Felderstraße 12, 5330 Fuschl am See, Austria (website development and support). We have concluded data processing agreements under Art. 28 GDPR with them.
- Independent controllers or joint controllers: Google, Meta and TikTok (for advertising, see section 5), payment providers and shipping providers (see section 6).
- Advisors and authorities: tax advisors, auditors, lawyers and public authorities, where required by law.
Transfers outside the EU/EEA. Some recipients are based in, or transfer data to, countries outside the EU/EEA, in particular the USA. For the USA, the European Commission adopted an adequacy decision on 10 July 2023 for companies certified under the EU-U.S. Data Privacy Framework. Where no adequacy decision applies, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Shopify may also transfer data to Canada, for which an adequacy decision exists.
You can request a copy of the appropriate safeguards at privacy@cooph.com.
10. Storage periods
We store personal data only as long as necessary for the respective purpose or as required by law.
|
Data |
Storage period |
|---|---|
|
Order, invoice and accounting data |
7 years from the end of the calendar year (§ 132 Austrian Federal Fiscal Code, BAO), longer in case of legal disputes or warranty claims |
|
Customer account |
Until you delete your account, subject to the retention periods above |
|
Newsletter subscription |
Until you unsubscribe; proof of consent for up to 3 years afterwards |
|
Cookie consent |
12 months, after which we ask for your consent again |
|
Cookies and similar technologies |
As listed in our Cookie Policy |
|
Enquiries by email |
Until your enquiry is resolved, then up to 3 years in case of follow-up questions |
|
Analytics data (Google Analytics) |
14 months (Google Analytics 4) |
11. Your rights
You have the following rights regarding your personal data:
- Access to the data we hold about you (Art. 15 GDPR)
- Rectification of incorrect data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interest (Art. 21 GDPR). You can object to direct marketing at any time without giving reasons.
- Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR). For cookies, use the Cookie Settings in our Cookie Policy.
To exercise your rights, contact us at privacy@cooph.com or COOPH Cooperative of Photography GmbH, Felderstraße 12, 5330 Fuschl am See, Austria.
Right to complain. You can lodge a complaint with a supervisory authority. In Austria, this is the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.
Age. By giving your consent, you confirm that you are at least 14 years old or that your legal guardian has consented (§ 4(4) DSG).
No automated decisions. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
12. Data security and changes
We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Our website is encrypted via TLS (HTTPS). Please do not send sensitive data such as payment details by email.
We update this Privacy Policy when our services, the technologies we use or legal requirements change. The current version is always available on our website.
COOPH Privacy Policy 2026-10, Fuschl am See, 23 October 2026