Privacy policy

Privacy Policy

Last updated: October 2026

1. Who we are (Controller)
Umut Collection is operated by:
Ümit Cakmak (individual seller)
Hans Steger Gasse 6/26, 1220 Vienna, Austria
Email: info@umutcollection.com

We are the controller responsible for the processing of your personal data under the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). Because we are based in Austria, this policy and the GDPR apply to all our customers, wherever they live.

2. What data we collect

  • Order data: name, shipping and billing address, email address, phone number (if provided), ordered products, and order history.
  • Payment data: payments are processed by our payment providers. We do not see or store your full card number.
  • Communication data: the content of emails or messages you send us.
  • Technical and usage data: IP address, browser and device type, pages viewed, and similar information collected through cookies and similar technologies (see section 6).

3. Why we use your data and on what legal basis

  • To process and deliver your order, including order and shipping confirmations (Art. 6(1)(b) GDPR, performance of a contract).
  • To answer your questions and handle returns or complaints (Art. 6(1)(b) GDPR).
  • To meet our legal obligations, such as accounting and tax record-keeping (Art. 6(1)(c) GDPR).
  • To operate and secure our store and prevent fraud (Art. 6(1)(f) GDPR, our legitimate interest in a safe, working store).
  • To measure and improve our advertising with the Meta Pixel, only with your consent via our cookie banner (Art. 6(1)(a) GDPR).

4. Who we share your data with
We only share your data where needed for the purposes above:

  • Shopify (Shopify International Limited, Dublin, Ireland), our e-commerce platform, which hosts our store and processes data on our behalf.
  • Shopify Network Intelligence: Shopify may also use certain store data, such as order and interaction data, in combination with data from other Shopify stores to improve products, ad targeting and personalisation. For this purpose, Shopify acts as an independent controller. We share this data based on our legitimate interest in improving our store and marketing (Art. 6(1)(f) GDPR). You can object to this at any time by contacting us. More information: www.shopify.com/legal/privacy
  • Payment providers, to process your payment.
  • Our fulfilment partners: to deliver your order, we share your name, shipping address and, where needed, phone number with our product suppliers and their shipping partners, some of whom are located outside the EU.
  • Shipping carriers, to deliver your parcel and provide tracking.
  • Meta Platforms Ireland Limited (Facebook/Instagram), only if you consent to marketing cookies.
  • Authorities, tax advisors or legal advisors, where required by law.

We do not sell your personal data.

5. Transfers outside the EU

  • Fulfilment partners: some of our fulfilment partners are located outside the EU, including in China. Sharing your delivery details with them is necessary to fulfil your order (Art. 49(1)(b) GDPR). We only share the minimum data needed for delivery.
  • United States: Shopify and Meta may process data in the US. These transfers are based on the EU-U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

6. Cookies and tracking
We use cookies that are necessary to run the store (for example, your shopping cart and checkout). These do not require consent.

With your consent, we also use the Meta Pixel to measure the performance of our ads on Facebook and Instagram and to show relevant ads. You can accept, decline, or change your choice at any time via our cookie banner. Declining does not affect your ability to shop.

For the collection and transmission of data via the Meta Pixel, we and Meta Platforms Ireland Limited are joint controllers (Art. 26 GDPR). Meta is responsible for any further processing. More information: www.facebook.com/privacy/policy

7. How long we keep your data

  • Order and invoice data: 7 years, as required by Austrian tax law (§ 132 BAO).
  • Customer messages: as long as needed to handle your request, and up to 3 years afterwards in case of legal claims.
  • Marketing cookie data: until you withdraw consent, or according to the cookie’s set lifetime.

After these periods, we delete your data.

8. Is providing your data required?
Providing your name, address and email is necessary to complete a purchase. Without this data, we cannot process or deliver your order.

9. Automated decision-making
We do not use automated decision-making, including profiling, that produces legal or similarly significant effects for you.

10. Your rights
You have the right to:

  • access the personal data we hold about you
  • correct inaccurate data
  • have your data deleted
  • restrict processing
  • receive your data in a portable format
  • object to processing based on legitimate interests
  • withdraw your consent at any time, without affecting earlier processing

To exercise these rights, email info@umutcollection.com. We will respond within one month.

You also have the right to lodge a complaint with a data protection authority. In Austria, this is:
Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at

11. Security
Our store uses SSL encryption. Payments are processed through secure, certified payment providers.

12. Changes to this policy
We may update this policy from time to time. The current version is always available on this page.

Free worldwide shipping

Free delivery on every order, no minimum.

14-day returns

Changed your mind? Return within 14 days.

Secure payment

Encrypted checkout with trusted payment methods.