Privacy notice

Last updated: 6 November 2026

1. Controller and scope

FIBIZ GmbH, FN 661555a, Peter-Behrens-Platz 10, Factory300, 4020 Linz, Austria, is responsible for the processing described in this notice. Contact for privacy questions and your rights: support@fibiz.tech.

This notice covers fibiz.tech, our Shopify store, related orders, enquiries and business administration. It also covers marketplace data we import to fulfil your order. The own privacy notices of marketplaces, payment providers and Shopify additionally apply to their independent processing. This notice explains processing; visiting the website does not constitute consent to optional advertising or tracking.

2. Information we process and its sources

·       Contact and delivery details: name, email, billing and shipping address and, where relevant, phone number, business and VAT details.

·       Order and payment information: products, quantities, prices, order references, payment method and status, transaction references, delivery status, returns and refunds. Payment providers process the payment details needed for your chosen method.

·       Account and communication data: details and settings of a customer account you use, enquiries, correspondence, reviews and content you choose to submit.

·       Technical and usage data: IP address, browser, device, online identifiers and interactions such as page views, product views, cart and purchase events, depending on the features used and any required consent.

We receive information from you, technically when you visit the store, and from providers or marketplaces where needed for the relevant operation. Order data imported from eBay originate from your order there. Publicly submitted reviews may be visible to other people.

3. Purposes and legal bases

Purpose	Legal basis / interest
Orders and delivery	GDPR Article 6(1)(b) for steps before a contract, payment, delivery and returns; Article 6(1)(c) for legal obligations.
Enquiries and support	Article 6(1)(b) for contractual matters, otherwise Article 6(1)(f). Our interest is handling your enquiries reliably.
Accounting and evidence	Article 6(1)(c), particularly under Austria’s BAO and UGB.
Security and administration	Article 6(1)(f). Our interests are secure systems, orderly administration, error checking and establishing or defending claims; Article 6(1)(c) where legally required.
Optional advertising and measurement	Article 6(1)(a) where consent is required. Email advertising is also subject to section 174 TKG 2021; storage on or access to your device is subject to section 165(3) TKG 2021.

We need the information marked as required in checkout to process your order. Without it, we may be unable to enter into or perform the contract. You can omit optional information and decline marketing consent.

Privacy notice: store and services

4. Shopify, Network Intelligence and Shop

Our store runs on Shopify, which processes information about visits, orders and other interactions to provide the store and related features. Information is shared with Shopify and, where relevant, other providers, including in other countries.

We use Shopify Network Intelligence for enhanced services. It may combine information about interactions with our store, other merchants and Shopify to provide services such as protecting, improving and developing commerce offerings. Shopify acts as a controller for certain of these purposes and handles the corresponding privacy requests itself.

Where consent is required for activity-based advertising or other optional processing, you can give or withdraw it through the cookie/privacy settings. Information about Shopify’s processing and your rights: https://www.shopify.com/legal/privacy/consumers. Shopify’s privacy portal: https://privacy.shopify.com/en.

Shop may send eligible Shop users email or push reminders about carts or products and notices about availability or prices based on their activity. These communications are separate from our own email automations. Your settings with Shopify and its privacy notices also apply to Shopify’s own services and communications.

The Shopify-provided Meta Growth Agent Service App is connected to our store for Meta-related marketing and measurement features. It can access contact, device and activity data for those features. Where consent is required, processing relies on your consent. Where data are shared with Meta, its privacy notice also applies: https://www.facebook.com/privacy/policy/. Section 10 applies to international transfers.

5. Google Analytics and Google Ads

We use Google Analytics 4 to analyse use of our store, and Google Ads and Shopify’s Google & YouTube integration to measure advertising performance. Processing may include IP address, device/browser information, online identifiers, page and product views, cart and purchase events and order values, which may be sent to Google. Analytics cookies such as _ga distinguish visitors and sessions. We rely on your consent for optional analytics and advertising measurement. You can withdraw it through the cookie settings.

When enhanced conversions are enabled, contact information you provide, such as an email address, may be sent to Google in hashed form to attribute a conversion. Hashing does not make these data anonymous. Information about Google’s processing is available at https://policies.google.com/privacy. Recipients outside the European Economic Area may be involved; section 10 applies accordingly.

6. Reviews and review requests

We use Judge.me for product reviews and related review requests. Necessary order, product, contact and fulfilment-status data and technical information for operation and abuse prevention may be processed. If you submit a review, we process its content, your chosen public display name and any images you upload. This information may be publicly visible in the store.

We send email review requests only where the necessary consent is in place. You can unsubscribe using the link in the email. We process voluntarily submitted reviews on the basis of our legitimate interest in authentic customer feedback and product information, unless another legal basis is required in the circumstances. Judge.me processes information on our behalf for the review function. Its own privacy notice applies to its independent services: https://judge.me/privacy.

Privacy notice: communications and recipients

7. Newsletters, cookies and your choices

If you subscribe to our newsletter, we process your email address, subscription and necessary consent evidence to send news and offers. A confirmation email may be sent to verify a subscription. You can withdraw consent at any time using the unsubscribe link or by contacting support@fibiz.tech. Purchases and support do not depend on subscribing. Necessary order and service messages remain separate.

Cookies and similar technologies may support the cart, sign-in, security and other necessary functions. Storage on or access to your device that is not strictly necessary requires your prior consent. A legitimate-interest assessment does not replace this consent. Further personal-data processing for measurement or advertising is also assessed under the GDPR.

You can decline optional purposes and later change your choices using “Cookie preferences” in the footer’s policies menu. Cookie and measurement-data lifetimes depend on the service and configuration. Shopify describes its technologies at https://www.shopify.com/legal/cookies; Google provides further information at https://policies.google.com/technologies/cookies. You can also manage cookies in your browser, which may affect necessary store functions.

8. Marketplace integration and AI-assisted administration

For eBay orders, we use the DPL integration to import necessary order and customer data into Shopify and synchronise fulfilment and shipping. We rely on necessary performance of the purchase contract. eBay’s own privacy notices additionally apply to its independent processing.

We use IT, email, document and accounting services for business administration. AI tools such as OpenAI assist in checking records and business correspondence and preparing drafts. Where personal information is needed, we limit it to the specific task, such as necessary contact, invoice or correspondence details. Our basis is our legitimate interest in efficient, controlled administration and error checking.

We review the results. The AI assistance described here is not used to make solely automated decisions about you with legal or similarly significant effects. The recipient and transfer information below applies to the relevant services.

9. Who receives information

Depending on the operation, Shopify and integrated technical providers, payment providers, shipping and fulfilment providers, review and communication services, and necessary IT, document and AI providers receive the data they need. Tax and, where relevant, legal advisers, banks, insurers or public authorities may also receive information where required for the relevant operation, a legal obligation or a specific legal claim. A purchase does not by itself permit unrelated uses of order information.

Depending on their task, providers process information on our behalf or as independent controllers. Publicly submitted content is accessible to others to the extent it is published. Necessary information may be disclosed to participants in a lawful business transfer, subject to applicable data-protection requirements.

10. International transfers

Some providers use international infrastructure or staff outside the EEA, particularly in the United States. Such transfers must meet applicable legal requirements, for example through a relevant adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses, supplemented where necessary by further protection. Contact support@fibiz.tech for details of the safeguards used for a particular transfer and, where applicable, a copy. Providers’ privacy notices also explain their independent processing.

Privacy notice: retention and your rights

11. How long we retain information

We retain personal data only for as long as needed for its purpose or required by a legal obligation or justified legal claim. We then delete or anonymise the data.

·       Austrian accounting records and business records subject to retention duties: generally seven years from the end of the relevant calendar year; longer where a legal exception or pending proceedings require it. Different statutory periods may apply to foreign tax records.

·       Other order and support data: where still needed for performance, returns, warranty matters or specific legal claims. Working copies no longer needed are deleted or minimised.

·       Customer accounts: while needed for the account and its use. Deleting an account does not automatically remove statutory retention duties for invoices or other necessary evidence.

·       Marketing data: until withdrawal or earlier expiry of the purpose. Necessary consent and objection records may be kept afterwards to defend legal claims and honour your choice.

·       Reviews and technical data: according to the purpose and function. Review content is needed to provide and substantiate the review; technical data only for the relevant operational, security or permitted measurement purposes. Providers may have their own statutory retention duties.

12. Your rights

Subject to the legal conditions, you have rights of access and a copy, correction, erasure, restriction and data portability. Contact support@fibiz.tech to make a request. Where there are reasonable doubts about identity, we may ask for appropriate additional information to verify it.

Where we rely on consent, you can withdraw it at any time for the future. This does not affect the lawfulness of processing before withdrawal. We will explain any restriction of your rights where a statutory exception applies.

Objection to processing and direct marketing

You can object to processing based on legitimate interests for reasons relating to your particular situation. You can object to direct marketing at any time without giving a reason, including associated profiling. We will then stop using the relevant data for that marketing purpose.

We normally respond within one month. We will notify you within that period of any legally permitted extension. You can complain to a supervisory authority, particularly where you live or work or where an alleged infringement occurred. In Austria: Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, https://dsb.gv.at. You do not have to contact us first.

13. Security, external services and changes

We apply technical and organisational safeguards appropriate to the risk. Complete security of every transmission or storage operation cannot be guaranteed. Do not send unnecessary sensitive information or complete payment-card details in an ordinary message.

Our offering is not specifically directed at children. Contact us if you believe a child’s information was provided without the necessary basis. External linked services have their own privacy notices; a link does not by itself constitute consent to processing.

We update this notice and its date when our processing or legal requirements change. We notify you of material changes where legally required. Current contact address: support@fibiz.tech.