Protecting your personal data matters to us. This policy informs you, in line with Articles 13 and 14 of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG), about which data we process, what we use it for, who receives it and which rights you have.
1. Controller
muxx.io FlexCo
Towerstraße 3/VAC5, 1300 Vienna, Austria
Company register no. FN 652197p, Regional Court Korneuburg
Email: info@muxx.io · Phone: +43 1 280 54 51-0
We have not appointed a data protection officer because we are not required to under Article 37 GDPR. For any privacy question, please use the contact details above.
If you order through an online marketplace (for example Amazon or Kaufland), the marketplace is a separate controller for processing your data in connection with your customer account and payment. We are responsible for handling your order with us.
2. Our business model in brief
muxx.io is an online retailer. We offer branded products from European manufacturers on online marketplaces (in particular Amazon, Kaufland, Conrad, Völkner, Fruugo and Shöpping) and, in future, in our own webshop. We sell to consumers (B2C) and to businesses (B2B).
We mostly work on a drop-shipping basis: after you order, we buy the goods from an authorised retailer or manufacturer, who ships them directly to you on our behalf. To make delivery possible, we have to pass the necessary data on to that supplier and to the carrier (see section 9).
3. Orders via marketplaces
Which data we process
- Name and delivery address, where applicable billing address and company name,
- phone number, where the marketplace passes it on for delivery,
- email address (often a relay address issued by the marketplace),
- order data (marketplace, order number, items, quantity, prices, shipping method, order date, order status),
- shipment and delivery data (carrier, tracking number, delivery status),
- messages, returns, withdrawals and complaints.
For marketplace orders we do not receive payment data (for example card or bank account details). The marketplace handles the payment.
Where the data comes from
We receive the data from the marketplace you ordered through, and from you if you contact us.
Purposes and legal bases
- Fulfilling your order (sourcing, shipping, invoicing, returns, withdrawal, warranty, customer service): performance of the sales contract, Art. 6(1)(b) GDPR.
- Accounting and tax obligations (invoicing, record keeping, VAT): legal obligation, Art. 6(1)(c) GDPR, in particular under Austrian tax and commercial law (BAO, UGB, UStG).
- Establishing, exercising and defending legal claims and preventing abuse and fraud: legitimate interest, Art. 6(1)(f) GDPR. In cases of proven abuse (for example repeated return fraud) we may block customer data internally for future orders.
Purpose limitation for marketplace data. We use customer data received through marketplaces only to fulfil the respective order and to meet our legal obligations. We do not use it for advertising, do not pass it on for advertising purposes and do not sell it. We contact marketplace customers outside the marketplace only where necessary to fulfil the order. We comply with the marketplaces' rules on the handling of customer data.
For how the marketplace itself processes your data, please see the privacy policy of the respective marketplace.
4. Orders in our webshop
When our own webshop opens, the following additional provisions apply. Until then they are not relevant to you.
- Ordering as a guest or with a customer account: we process title, name, address, email address, where applicable phone number, company name and VAT number (business customers), order and invoice data and, for a customer account, your password (stored only as a hash) and your order history. The legal basis is performance of the contract (Art. 6(1)(b) GDPR), and for retaining invoices the legal obligation (Art. 6(1)(c) GDPR).
- Payment: payment is handled by payment service providers that we name during checkout. We only receive the result of the payment from them, not full card or account details. The payment providers process your data under their own responsibility and privacy policies.
- Shipping and delivery: we pass your name, address and, for delivery notifications, your email address or phone number on to the carrier and, where applicable, to the supplying retailer.
- Transactional emails: we send order confirmations, shipping notices and invoices as part of the contract. These are not advertising.
- Newsletter and advertising: we send promotional emails only with your explicit consent (Art. 6(1)(a) GDPR, section 174 of the Austrian Telecommunications Act 2021), confirmed by double opt-in. You can withdraw your consent at any time with effect for the future, for example via the unsubscribe link in every email. Under the conditions of section 174(4) of that Act we may point existing customers to similar products of our own. You can object to this at any time.
- Cookies in the webshop: see section 8. We set non-essential cookies only with your consent.
- Withdrawal and returns: to handle them we process the order and contact data required (Art. 6(1)(b) GDPR).
5. Business customers, suppliers and partners
If you order from us or work with us as a business, we process the data of your contact persons (name, business email address and phone number, role), company and tax data (company name, VAT number, address, bank details) and order, delivery and invoice data. The purposes are initiating and performing the contractual relationship (Art. 6(1)(b) GDPR), meeting tax and corporate law obligations (Art. 6(1)(c) GDPR) and our legitimate interest in a smooth business relationship (Art. 6(1)(f) GDPR).
6. Visiting this website
When you open this website, our web server automatically records technical data in a log file: IP address, date and time of access, page requested, referrer URL, status code, amount of data transferred and browser and operating system details (user agent). We use it to deliver the website, keep it running and defend against attacks (legitimate interest, Art. 6(1)(f) GDPR). Log files are rotated daily and deleted after seven days, unless a security incident requires longer retention.
This website is operated on servers of IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany). IONOS is our processor.
This website uses no analytics or tracking services and loads no fonts, scripts or maps from third parties. All fonts are served from our own server, so visiting the website does not transmit any data to Google or other third parties.
This website links to LinkedIn. Merely visiting our page does not transmit any data to LinkedIn. LinkedIn's privacy terms apply only once you click the link.
7. Contacting us
If you contact us by email or phone, we process your details (name, contact data, content of the enquiry) to handle the enquiry and for any follow-up questions. The legal basis is performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR) or our legitimate interest in answering efficiently (Art. 6(1)(f) GDPR). We delete the enquiry once it is resolved and no statutory retention duty applies, after three years at the latest.
8. Cookies and similar technologies
This website uses no cookies and stores no information on your device.
Once it opens, our webshop will use technically necessary cookies, for example for the shopping cart, login and security. Under section 165(3) of the Austrian Telecommunications Act 2021 no consent is needed for these (legal basis: Art. 6(1)(f) GDPR). Cookies that are not technically necessary (for example statistics or marketing) are used only if you consent beforehand via our cookie banner (Art. 6(1)(a) GDPR, section 165(3) TKG 2021). You can change or withdraw your choice at any time in the cookie settings.
9. Recipients and processors
We pass personal data on only where this is necessary for the purposes stated or required by law.
| Recipient | Purpose | Role |
|---|---|---|
| Suppliers, retailers and manufacturers (EU) | Shipping the goods directly to you (drop shipping): name, delivery address, phone or email for delivery where needed | separate controller or recipient |
| Carriers, for example Österreichische Post, GLS, Gebrüder Weiss | Delivering the shipment, tracking, returns | separate controller or processor, depending on the service |
| Xentral ERP Software GmbH, Augsburg (Germany) | Order, customer and invoice management (ERP) | processor |
| IONOS SE, Montabaur (Germany) | Hosting and operation of our servers and website | processor |
| Microsoft Ireland Operations Ltd. | Internal email and team communication (Microsoft 365) | processor |
| Tax advisers, auditors, banks | Accounting, annual accounts, payments | separate controller or processor |
| Marketplaces (Amazon, Kaufland and others) | Reporting shipping and tracking data for your order, handling returns and refunds | separate controller |
| Payment service providers (webshop only) | Processing the payment | separate controller |
| Authorities, courts, legal representatives | Meeting legal obligations, enforcing or defending claims | separate controller |
We have contracts under Art. 28 GDPR with our processors. We do not pass your data on to third parties for advertising purposes.
10. Transfers to third countries
We process your data in principle within the European Union and the European Economic Area. Where individual providers (for example Microsoft) process or can access data in third countries such as the USA, we rely on an adequacy decision of the European Commission (EU-US Data Privacy Framework) or on the EU standard contractual clauses (Arts. 45, 46 GDPR). On request we will provide you with a copy of the safeguards.
11. Retention periods
- Order, invoice and accounting data: 7 years from the end of the calendar year of invoicing (section 132 BAO, section 212 UGB), in individual cases longer while official or court proceedings are pending.
- Data for defending and enforcing claims (for example correspondence, warranty): until the limitation periods expire, generally 3 years after performance of the contract.
- Delivery address and contact data of marketplace customers: as long as needed for order handling, returns and warranty. After that we delete or anonymise them, unless they form part of invoice records that must be retained.
- Webshop customer account: until the account is deleted, subject to statutory retention duties.
- Newsletter: until you withdraw your consent.
- Server log files: 7 days.
12. Data security
We take appropriate technical and organisational measures to protect your data. These include encrypted transmission (TLS), system access only for authorised persons with personal accounts and on a need-to-know basis, securing server access through a private network (VPN) and key-based authentication, encrypted storage of credentials, separate development and production environments, regular backups and logging of security-relevant events.
If, despite these measures, a personal data breach occurs, we report it to the competent authorities and, where there is a high risk to you, also to you, within the statutory deadlines (Arts. 33, 34 GDPR).
13. Your rights
Under the GDPR you have the following rights:
- access to the data we store about you (Art. 15),
- rectification of inaccurate data (Art. 16),
- erasure (Art. 17), unless a retention duty applies,
- restriction of processing (Art. 18),
- data portability (Art. 20),
- objection to processing based on legitimate interests (Art. 21). You can object to direct marketing at any time without giving reasons.
- withdrawal of consent given, with effect for the future (Art. 7(3)). The lawfulness of earlier processing remains unaffected.
To exercise your rights, write to us at info@muxx.io. We answer requests within one month. We may ask for proof of identity. For marketplace orders, please include your order number.
If you believe the processing of your data infringes data protection law, you have the right to lodge a complaint with a supervisory authority. The authority competent for us is the Austrian Data Protection Authority: Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, email dsb@dsb.gv.at, www.dsb.gv.at. You can also contact the supervisory authority at your place of residence in the EU.
14. Automated decisions
We make no decisions based solely on automated processing that have legal effect for you within the meaning of Art. 22 GDPR, and we do not carry out profiling. Orders are processed automatically (for example capture, invoice creation, triggering shipment), but our staff always review anything unusual.
Providing your data is necessary to process your order. Without it we cannot perform the contract. For marketplace orders the marketplace transmits the data; when using this website, providing data is voluntary.
15. Changes to this policy
We update this policy when our offering or the legal situation changes, for example when the webshop opens or when we use new service providers. The version published here applies. The date of the last change is at the top of the page.