Customize Your Suspension
Suspension Tech

Privacy Policy

Controller

The controller for the processing of personal data on this website is:

ST Tech GmbH, Auweg 74, 4820 Bad Ischl, Austria. Managing Director: Ing. Norbert Stadlbauer. Commercial register number 489958b, Landesgericht Wels (Regional Court of Wels). VAT identification number ATU73297602.

Telephone: +43 664 858 77 40. Email: office@suspension.at

We are not required to appoint a data protection officer under Art. 37 GDPR and have not appointed one. For any questions concerning data protection, you can reach us using the contact details above.

Principles

We process personal data only to the extent necessary for the respective purpose, and only on one of the following legal bases:

  • Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures, for example in the case of an order or an enquiry about a service.
  • Art. 6(1)(c) GDPR — compliance with legal obligations, for example the retention obligation under tax law for invoices.
  • Art. 6(1)(f) GDPR — legitimate interests, for example in the secure and uninterrupted operation of the website.
  • Art. 6(1)(a) GDPR — consent, where we expressly obtain it.

We do not sell personal data and do not use it for third-party advertising. Automated decision-making or profiling within the meaning of Art. 22 GDPR does not take place.

Accessing the website

When you access this website, your browser transmits technically necessary data to our server, without which the page could not be delivered:

  • the address accessed and the time of access
  • the volume of data transferred and the delivery status
  • the referring page, where the browser transmits one
  • browser and operating system
  • IP address

The legal basis is our legitimate interest in secure and uninterrupted operation (Art. 6(1)(f) GDPR). Where such data is recorded in server logs — for example in the event of errors or to defend against attacks — these logs are deleted automatically after 30 days. Where data has to be retained in order to investigate a specific incident, it remains stored until the matter has been resolved.

The website runs on servers of Amazon Web Services (AWS) in Frankfurt am Main (eu-central-1 region). Images and files are delivered via the content delivery network Amazon CloudFront, a network of servers at locations in many countries; CloudFront determines which location answers a request on the basis of the network connection, and this may also be a location outside the EU (see "Transfers to third countries"). Our contractual partner is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. AWS's data processing terms pursuant to Art. 28 GDPR form part of this contract.

Cookies and local storage

This website does not use cookies for advertising, analytics or tracking purposes. A consent banner is therefore not required.

The following storage in your browser is also technically necessary: the contents of your shopping cart — the products selected, their configuration and quantity — are held in your device's local storage (localStorage) so that the cart is retained as you move between pages. As long as you do not place an order, it is not transmitted to us. Only when you place the order at checkout does your browser transmit the product and configuration data, together with the details entered at checkout, to our server, and we pass them on to Stripe for payment (see "Orders in the online shop" and "Payment processing"). Once an order has been completed, the cart is emptied; you can also delete the local storage at any time via your browser settings.

We set two cookies: the "NEXT_LOCALE" cookie remembers whether you read the site in German or English — without it you would be returned to the default language on every visit. A login cookie is created solely for staff members who sign in to the administration area of the website, not for visitors to the shop. Both are required for operation and therefore do not require consent (§ 165(3) Austrian Telecommunications Act 2021).

Contacting us

If you contact us via the contact form, by email, by telephone or via WhatsApp, we process the data you provide — name, email address, telephone number where applicable, and the content of your message — solely in order to handle your enquiry.

The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns a contract or is aimed at entering into one, and otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).

Messages sent through the contact form are delivered to our mailbox as email. Our email service is Microsoft 365 provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; Microsoft's data processing terms pursuant to Art. 28 GDPR form part of this contract. We retain enquiries for as long as is necessary to handle them and to answer any follow-up questions. Where an enquiry leads to an order or the matter is subject to a statutory retention obligation, the relevant period applies.

If you use WhatsApp, the terms of WhatsApp Ireland Limited apply in addition. We have no influence over the processing of connection data and metadata by WhatsApp. If you wish to avoid this, you can reach us by telephone, by email or through the contact form.

Orders in the online shop

To place an order, we need the information required to process it. There are no customer accounts; every order is a guest order. We process:

  • first and last name
  • email address
  • delivery address and, where applicable, billing address
  • telephone number, if provided
  • the services ordered, including the configuration selected
  • amount, payment method and payment status
  • a voucher or discount code redeemed, if used
  • the VAT identification number in the case of business customers

The legal basis is Art. 6(1)(b) GDPR. The order data is stored in our database at Amazon Web Services in Frankfurt am Main and is accessible only to us and to our technical support. We send the order confirmation, the invoice and other messages about the order by email via Microsoft 365.

We create the order as soon as you are forwarded from the checkout to Stripe's payment page, i.e. before payment. At that point we store the products selected, including their configuration, the amounts, the country of delivery, the shipping method, the language and, if you have provided it, your email address. If payment is not completed or fails, the order remains stored as abandoned, together with the details available up to that point, so that we can trace the process and answer any questions (Art. 6(1)(f) GDPR). We delete abandoned orders no later than twelve months after they were abandoned.

We retain invoices, the associated records and the order data for seven years from the end of the calendar year in which the order was placed, and beyond that for as long as they are relevant to pending tax proceedings; we are required to do so under § 132 Bundesabgabenordnung (Austrian Federal Fiscal Code, BAO) (Art. 6(1)(c) GDPR). We erase this data only after that period has expired, even if you request erasure earlier.

Payment processing

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Depending on which methods are enabled, credit card, PayPal, eps bank transfer, Klarna or digital wallets, for example, are available.

You enter your payment details — such as your card number or the credentials for a payment service — exclusively on Stripe's payment page. We do not receive this data at any time. We transmit to Stripe the products ordered including the configuration selected, the amounts, our order number and your email address. You enter your name, address and telephone number in our checkout; we do not transmit them to Stripe. From Stripe we receive back whether the payment was successful, the amount, the payment method and the details held there for the payment (such as the cardholder name). For the invoice and delivery we use the details from our checkout.

Stripe processes the data as a controller in its own right in order to carry out the payment and to comply with its own legal obligations, in particular the prevention of money laundering. In doing so, Stripe may also transfer data to Stripe, Inc. in the USA (see "Transfers to third countries"). Details can be found at https://stripe.com/at/privacy.

If you choose PayPal, Stripe forwards the payment to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The PayPal privacy policy applies in addition.

If you choose Klarna, Stripe transmits the data required for the payment to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna processes it as a controller in its own right and, depending on the payment option chosen, for example deferred payment or payment by instalments, may carry out a credit check. The Klarna privacy policy applies in addition. If you pay by eps bank transfer, you are forwarded to your bank's online banking; your bank's terms apply there.

The legal basis is Art. 6(1)(b) GDPR. We ourselves do not carry out any credit checks.

Shipping and collection

For shipping, we pass on your name, the delivery address and, where necessary for delivery, your telephone number or email address to the transport company commissioned. The legal basis is Art. 6(1)(b) GDPR.

If you collect your components from the workshop yourself, this disclosure does not take place.

Recipients of your data

Apart from the bodies already named, we disclose personal data only where this is necessary for the performance of a contract or where we are required to do so by law. Recipients may include:

  • Amazon Web Services EMEA SARL (Luxembourg) — operation of the website, database and file storage in Frankfurt am Main and delivery of images and files via Amazon CloudFront, processor
  • Microsoft Ireland Operations Limited (Ireland) — e-mail service, processor
  • Stripe Payments Europe, Ltd. (Ireland) and, depending on the payment method chosen, PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) or Klarna Bank AB (publ) (Sweden) — payment processing, acting as controllers in their own right
  • the transport company engaged in each case — delivery
  • our tax advisors as well as public authorities, insofar as we are required by law to transmit data

No analytics, no tracking

This website uses no analytics services such as Google Analytics, no advertising networks and no social media plugins. No cross-device recognition takes place.

The references to our profiles on Facebook, Instagram and YouTube are simple links. Only when you click on such a link is a connection to the respective network established, and the privacy policy of the respective provider then applies. No data is transferred there before you click.

Fonts are served from our own server; no fonts are loaded from Google or other providers.

Transfers to third countries

We operate the website, database and file storage at Amazon Web Services in Frankfurt am Main, i.e. within the EU. However, some of the services we use may also process data outside the EU:

  • Amazon CloudFront (delivery of images and files): requests may also be answered from locations outside the EU, for example in the USA; in that case your IP address in particular is processed there.
  • Amazon Web Services and Microsoft 365 in general: according to its EU Data Boundary commitments, Microsoft processes the data within the EU as a matter of principle. Both providers may, in individual cases — for example for maintenance, support or to prevent abuse — draw on group companies or service providers in third countries, in particular in the USA.
  • Stripe (payment processing): Stripe Payments Europe, Ltd. may transfer data to Stripe, Inc. in the USA. According to its own information, Stripe, Inc. is certified under the EU-US Data Privacy Framework and additionally uses standard contractual clauses. PayPal and Klarna may likewise process data outside the EU in accordance with their own privacy policies.

Where our processors Amazon Web Services and Microsoft transfer data to the USA, they rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 (Art. 45 GDPR), insofar as the receiving company is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Stripe, PayPal and Klarna are themselves responsible for their transfers; details can be found in their privacy policies.

Retention period

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention periods:

  • server logs: 30 days
  • shopping cart in your browser's local storage: until the order is completed or until you empty it or clear your browser's storage
  • enquiries via the contact form or by e-mail: until the matter has been dealt with and for as long as follow-up questions may arise; where an enquiry leads to an order, the periods for orders apply
  • abandoned orders (checkout without completed payment): no longer than twelve months after they were abandoned
  • orders, invoices and receipts: seven years from the end of the calendar year in which the order was placed, and beyond that for as long as they are relevant to pending tax proceedings (§ 132 BAO)
  • data we require in order to defend against or enforce legal claims: until the expiry of the applicable limitation period

Your rights

As a data subject, you have the following rights in relation to us:

  • access to information about which data we process about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure, unless a retention obligation precludes it (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • receipt of your data in a commonly used format (Art. 20 GDPR)
  • objection to processing operations that we base on a legitimate interest (Art. 21 GDPR)
  • withdrawal of a consent you have given, with effect for the future (Art. 7(3) GDPR)

An informal message to office@suspension.at is sufficient for all of this. We will respond within one month. For security reasons, we may first verify your identity if there is any doubt.

You also have the right to lodge a complaint with a supervisory authority. The competent authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, telephone +43 1 52 152-0, e-mail dsb@dsb.gv.at, https://www.dsb.gv.at

Security

The transmission between your browser and our server is encrypted throughout with TLS, recognisable by the padlock symbol in the address bar. The database and file storage are encrypted, and access is restricted to a narrowly limited group of people.

Changes to this policy

If our services or the services we use change, we will adapt this policy. The version published on this page applies in each case. Last updated: September 2026.