Privacy policy

This privacy policy was last updated on 30 May 2026.

Avida Cosmetics e.U. takes the protection of your personal data seriously. In accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG), this privacy policy explains which personal data we process when you visit our website kabuto.at, shop there or contact us, for what purposes and on what legal basis, and which rights you have.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Avida Cosmetics e.U.
Owner: David Golub
Freiung 15/1
4632 Pichl bei Wels
Upper Austria, Austria
VAT ID: ATU 82927638 · Commercial Register no. FN 671932k (Regional Court Wels)
E-mail: service@kabuto.at
Phone: +43 676 649 80 21

We have not appointed a data protection officer, as there is no legal obligation to do so. For any data protection enquiries please contact us at service@kabuto.at.

2. What data we process and for what purpose

Depending on how you use our website, we process the following categories of personal data:

  • Order and contract data: first and last name, delivery and billing address, e-mail address, phone number, items ordered, order number and order history – to process your order, deliver it, issue invoices and handle enquiries.
  • Payment data: payment method and the data required to process it. Full card or bank details are processed exclusively by our payment service providers and are not stored by us.
  • Customer account: if you create an account, your login and master data as well as your stored addresses and orders.
  • Communication data: the content and metadata of your enquiries by e-mail, contact form, phone or WhatsApp.
  • Newsletter data: e-mail address and, where applicable, name, if you subscribe to the newsletter.
  • Product reviews: name (or pseudonym) and review text, if you submit a review.
  • Usage and device data: IP address, browser type, operating system, referrer URL, pages viewed, time of access and cookie and similar identifiers – for secure operation, reach measurement and, with your consent, marketing.

3. Legal bases of processing

We process personal data on the following legal bases pursuant to Art. 6 GDPR:

  • Art. 6(1)(b) GDPR (performance of a contract): processing orders, delivery, payment, managing your customer account and handling returns and enquiries.
  • Art. 6(1)(c) GDPR (legal obligation): compliance with retention and record-keeping obligations under tax and commercial law.
  • Art. 6(1)(f) GDPR (legitimate interest): secure and stable operation of the website, fraud prevention and answering general enquiries.
  • Art. 6(1)(a) GDPR (consent): sending the newsletter and the use of non-essential cookies and marketing, analytics and tracking services (e.g. the TikTok pixel and other web pixels). You may withdraw any consent at any time with effect for the future.

4. Recipients and processors

To provide our services we use carefully selected providers, some of which act as processors (Art. 28 GDPR) on our behalf:

  • Shopify International Ltd. / Shopify Inc. – operation of the shop and hosting platform, storage of order, account and usage data.
  • Payment service providers (e.g. Shopify Payments / Stripe, PayPal and other providers offered at checkout) – processing of payments.
  • Shipping and logistics providers – delivery of your order (name and delivery address).
  • TikTok (TikTok Technology Limited / ByteDance) – marketing, reach measurement and conversion tracking via the TikTok pixel and related web pixels. Used only with your consent.
  • Other web-pixel and analytics services – reach and marketing analysis within the Shopify platform. Used only with your consent.
  • Judge.me – collection, management and display of product reviews.

Where data is transferred to recipients in third countries outside the EEA (e.g. the USA), we base such transfers on appropriate safeguards pursuant to Art. 46 GDPR, in particular the EU Commission’s Standard Contractual Clauses, or on an adequacy decision.

5. Cookies and comparable technologies

We use technically necessary cookies to enable the operation of the website, the shopping cart and the checkout process. These are required for the website to function (Art. 6(1)(f) GDPR and § 165(3) of the Austrian Telecommunications Act 2021). We use non-essential cookies and marketing, analytics and tracking services only if you have given your consent via our consent banner. You can adjust or withdraw your settings at any time via the banner.

6. Storage period

We store personal data only for as long as is necessary for the respective purposes. We retain order and invoice data for generally seven years due to statutory retention obligations (in particular § 132 BAO, § 212 UGB). Data that we process on the basis of your consent (e.g. the newsletter) is deleted after you withdraw your consent, unless there is another legal basis.

7. Your rights

Under the GDPR you have the following rights:

  • right of access (Art. 15 GDPR),
  • right to rectification (Art. 16 GDPR),
  • right to erasure (Art. 17 GDPR),
  • right to restriction of processing (Art. 18 GDPR),
  • right to data portability (Art. 20 GDPR),
  • right to object to processing based on a legitimate interest (Art. 21 GDPR),
  • right to withdraw consent at any time (Art. 7(3) GDPR), without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, a message to service@kabuto.at is sufficient.

8. Right to lodge a complaint

If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. The competent authority in Austria is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

9. Changes to this privacy policy

We will amend this privacy policy whenever changes to our processing activities or the legal framework require it. The current version published on this page always applies.