Privacy Policy
We, UKO Microshops AG, Urstein Süd 9, A-5412 Puch bei Hallein, email: office@uko-microshops.com, tel.: +43 5 90 88 – 400, take our responsibility for processing your personal data very seriously. We process your personal data exclusively in compliance with legal requirements, in particular the EU General Data Protection Regulation ("GDPR"), the Data Protection Act ("DSG"), and the Telecommunications Act ("TKG").
This privacy information is intended for our customers, investors, applicants, and users of our website www.uko-microshops.com
1. Processing of personal data
1.1. Customer, supplier, and investor data:
We process your personal data that is necessary for the preparation, execution, and processing of our legal business relationships and for the legal obligations to which we are subject. This concerns data that you provide to us or that we collect directly from you. This includes, for example, master data, contact details, contract data, billing data, sales data, bank information, delivery data, and communication data. (Legal basis for contract initiation or performance: Article 6(1)(b) of the GDPR).
1.2. User data:
When visiting websites, certain information is automatically created and stored, including on our website.
When you visit our website, our web server (the computer on which this website is stored) automatically saves data such as
• the address (URL) of the website visited
• browser and browser version
• the operating system used
• the address (URL) of the previously visited page (referrer URL)
• the hostname and IP address of the device from which access is being made
• date and time
in files (web server log files).
As a rule, web server log files are stored for the duration required to ensure trouble-free operation and are then automatically deleted. We do not pass this data on, but we cannot rule out the possibility that this data may be viewed in the event of unlawful conduct. The legal basis, in accordance with Article 6(1)(f) of the GDPR (lawfulness of processing), is that there is a legitimate interest in enabling the error-free operation of this website by recording web server log files.
Personal data that you transmit to us electronically on this website, such as your name, email address, or other personal details provided when submitting a form—such as your master data, contact details, correspondence, or applicant data—will be used by us, along with the time and IP address, only for the stated purpose, kept secure, and not passed on to third parties. We therefore only use your personal data to communicate with visitors who have explicitly requested contact (legal basis for consent: Article 6(1)(a) of the GDPR) and to process the services and products offered on this website.
1.3. Applicant data:
We process your personal data based on your application for the purpose of carrying out pre-contractual measures in the context of a potential employment relationship, as well as, where applicable, for the protection of legitimate interests. This includes, for example, master data, contact details, and bank information. (Legal basis for contract initiation or performance: Article 6(1)(b) of the GDPR).
Your application documents and data may be viewed by authorized personnel and relevant managers. All persons entrusted with data processing are obligated to maintain confidentiality.
Applications via our online form: If you apply using the application form on our website, we process the data you provide (salutation, first and last name, email address, telephone number, message) as well as the application documents you upload exclusively for the purpose of conducting the application process (legal basis: Article 6(1)(b) of the GDPR).
The files you upload are stored in the Cloudflare R2 storage service provided by our processor, Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Storage takes place exclusively on servers within the European Union (EU jurisdiction). We have a data processing agreement with Cloudflare in accordance with Article 28 of the GDPR, which includes the EU Standard Contractual Clauses. The form data itself is also processed via our website service provider, Webflow (see the "Web Hosting" section).
Your application documents will be automatically deleted no later than seven months (210 days) after receipt. This retention beyond the end of the application process is based on Article 6(1)(f) of the GDPR; our legitimate interest is the establishment, exercise, or defense of legal claims, particularly with regard to the six-month period under the Equal Treatment Act (GlBG). If you are hired, we will transfer the necessary documents into your personnel file.
2. Duration of data processing
Unless otherwise specified in this privacy policy, the following applies:
As a general rule, we only store your personal data for as long as is necessary for the purposes for which it is processed (principle of storage limitation).
Once the purpose has been achieved, we check whether the data is still required or if a legal retention period (usually 7 years) prevents deletion or anonymization. If this is the case, data will be processed for the duration of the retention period. Apart from this, data may also be required and processed for the defense and assertion of legal claims within the statutory or contractual warranty and liability periods (claims for damages generally expire 3 years after knowledge of the damage and the damaging party, but in any case after 30 years).
If data processing is based on your consent, we process the data for the duration of its validity.
We delete or anonymize data of rejected applicants no later than seven months (210 days) after receipt of the application (automatic deletion of uploaded documents, see section "Applicant data"), unless consent for processing beyond this period has been granted. In that case, we will process your data for as long as your consent remains valid.
3. Consent and the right to withdraw
If data processing is based on your consent, you may withdraw it at any time, e.g., by sending an email to office@uko-microshops.com. In such a case, the data previously stored about you will be deleted or anonymized and subsequently used only for statistical purposes without personal reference. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
4. Your rights under the General Data Protection Regulation
Under certain legal conditions, you have the right to access your personal data (Art. 15 GDPR), the right to rectify your personal data (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restrict processing (Art. 18 GDPR), and the right to data portability (Art. 20 GDPR).
In particular, you have the right to object at any time to the processing of your personal data if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (Art. 6(1)(e) GDPR) or if the processing is necessary for the purposes of our legitimate interests (Art. 6(1)(f) GDPR), unless there are compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims. If your data is processed for direct marketing purposes, you have the right to object at any time.
The legal provisions regarding these data subject rights can be found here:
http://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32016R0679
Furthermore, you have the right to lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40-42, 1030 Vienna, email: dsb@dsb.gv.at; https://www.dsb.gv.at/).
Please notify us if your personal data changes.
5. Data disclosure
Unless otherwise specified in this privacy policy, the following applies:
If necessary for the stated purposes and provided there is a corresponding legal basis, data will be passed on to external recipients.
External companies (see section "Web hosting, forms, and spam protection") are commissioned for web hosting, web administration, and website maintenance, providing services in electronic data processing and information technology. In doing so, they may gain access to personal data.
Contracts required under the GDPR are concluded with data processors (cf. Art. 28 GDPR).
Recipients based in the USA have entered into appropriate standard contractual clauses for data protection with us or are certified under the EU-U.S. Data Privacy Framework (adequacy decision by the EU Commission pursuant to Art. 45 GDPR).
To fulfill our contractual and legal obligations, we share data with service providers (e.g., IT support, cloud service providers), subcontractors, suppliers, banks, authorities, courts, tax advisors, and legal representatives as necessary.
6. Web hosting, forms, and spam protection
6.1. Web Hosting (Webflow)
Our website is hosted by Webflow, Inc., 398 11th Street, Floor 2, San Francisco, CA 94103, USA ("Webflow"). When you access our website, Webflow, acting as our data processor, processes the data described in the "User Data" section (in particular IP address, page visited, referrer, browser and operating system, date and time) in web server log files. The website is delivered via a Content Delivery Network (Fastly, Amazon CloudFront); the respective provider receives your IP address.
Processing is carried out to provide and securely operate the website (legal basis: legitimate interest, Article 6(1)(f) GDPR). Webflow is based in the USA. Data transmission is based on the EU-U.S. Data Privacy Framework (adequacy decision by the EU Commission pursuant to Art. 45 GDPR), under which Webflow is certified, as well as the EU Standard Contractual Clauses pursuant to Art. 46 GDPR within the framework of the data processing agreement concluded with Webflow. Further information: https://webflow.com/legal/eu-privacy-policy
6.2. Forms
Our website provides forms for contact, product inquiries, support requests, and job applications. The data you enter, along with the time and your IP address, is received by Webflow, stored in our Webflow account, and transmitted to us via email. We use this data exclusively to process your request (legal basis: initiation or fulfillment of a contract, Article 6(1)(b) GDPR; for general inquiries, consent: Article 6(1)(a) GDPR). We delete form entries from our Webflow account as soon as processing is complete and no retention obligations prevent deletion.
6.3. Form Spam Protection (Cloudflare Turnstile)
To protect our forms from automated input (spam, bots), we use Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA ("Cloudflare"). Turnstile checks technical characteristics of your browser and your interaction in the background (e.g., IP address, browser information, behavioral signals) and decides whether an input comes from a human. You do not need to solve any tasks for this. Cloudflare processes this data as our data processor exclusively for bot detection.
Processing is carried out to ensure operation and to prevent abusive input (legal basis: legitimate interest, Article 6(1)(f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework; in addition, the EU Standard Contractual Clauses apply within the framework of the data processing agreement. Further information: https://www.cloudflare.com/turnstile-privacy-policy/
7. Cookies, Web Analytics, and Web Tracking
7.1. Cookies
Our website uses HTTP cookies to store user-specific data.
A cookie is a short data packet exchanged between a web browser and a web server. It is meaningless to them on its own and only gains significance for the web application, such as an online shop, for example, to store the contents of a virtual shopping cart.
There are two types of cookies: first-party cookies are created by our website, while third-party cookies are created by other websites (e.g., Google Analytics).
There are three categories of cookies: strictly necessary cookies to ensure basic website functions, functional cookies to ensure website performance, and targeting cookies to improve the user experience.
We use cookies to make our website more user-friendly. Some cookies remain stored on your device until you delete them. They allow us to recognize your browser on your next visit.
Our cookie banner distinguishes between three categories: Essential (always active), Analytics, and Marketing.
A list of all cookies used can be found here (Cookie List):
Essential (always active):
fs-consent-* – Cookie, Consent Pro (Finsweet), 365 days: stores your consent decision by category and the signals for Google Consent Mode.
colorThemes_data, colorThemes_publishDate – Local Storage, UKO Microshops, persistent: Temporary storage for the website's color and display settings.
intellimize_tracking_policy, intellimize_data_tracking_type – Local Storage, Webflow Analyze, 18 months: stores your tracking decision (consent or refusal).
Analytics (only with consent):
_ga – Cookie, Google Analytics, 2 years: Distinguishing visitors.
_ga_* – Cookie, Google Analytics, 2 years: Session status.
intellimize_user_*, intellimize_attributes_*, intellimize_*, intellimize_integrations_* – Local Storage, Webflow Analyze, 18 months: Visitor ID, attributes, and event log for visitor analysis and optimization.
LOCAL_STORAGE_ID_VIMEO_PLAYER – Local Storage, Vimeo, 2 years: Player ID for playback statistics.
LOCAL_STORAGE_ID_PICOX_ID, PLAYER_PICOX_SAMPLING_SEED – Local Storage, Vimeo, persistent: ID and sampling value for aggregated playback telemetry.
Marketing (only with consent):
_fbp – Cookie, Meta, 3 months: Browser ID for ad delivery and conversion measurement.
lastExternalReferrer, lastExternalReferrerTime – Local Storage, Meta, persistent: stores which external address you used to reach the website.
li_adsId – Local Storage, LinkedIn, 30 days: Visitor ID for conversion measurement and audience matching.
bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory, li_sugr – Third-party cookies, LinkedIn, up to 2 years: Browser ID, load balancing, and ad matching in accordance with the LinkedIn cookie policy.
View cookie settings, delete cookies, and cookie consent
If you would like to see which cookies have been stored in your browser, change cookie settings, or delete cookies, you can find this in your browser settings:
- Safari: Manage cookies and website data with Safari
- Firefox: Delete cookies to remove data that websites have placed on your computer
- Chrome: Delete, enable, and manage cookies in Chrome
- Internet Explorer: Delete and manage cookies
If you do not wish for data to be stored in cookies, you can configure your browser to inform you about the setting of cookies and only allow them on a case-by-case basis. You can delete cookies already on your computer or deactivate cookies at any time. The procedure for this varies by browser; it is best to search for instructions on Google using the search term "delete cookies Chrome" or "deactivate cookies Chrome" for the Chrome browser, or replace the word "Chrome" with the name of your browser, e.g., Edge, Firefox, or Safari.
If you generally do not allow us to use cookies, i.e., you deactivate them via your browser settings, some functions and pages may not work as expected.
For cookies that affect your privacy, your consent is obtained in advance (legal basis for consent: Article 6(1)(a) GDPR). This is done by you actively providing your explicit consent via the cookie banner after being informed about the type and purpose of the cookies being used. When using cookies that are essential for the proper functioning of the website or for activities you explicitly request, no explicit consent is required (legal basis for legitimate interest: Article 6(1)(f) GDPR).
7.2. Cookie Banner and Consent Management (Consent Pro)
To obtain and manage your consent, we use the consent management solution Consent Pro from Finsweet Inc., 1732 Pettit Avenue, Unit A, Merrick, New York 11566, USA ("Finsweet"). When you visit our website, the banner script is loaded from Finsweet's servers, during which your IP address is transmitted. Your decision is stored in first-party cookies (fs-consent-*) on your device for 365 days so that the banner does not reappear on every visit and your selection applies to all pages. To verify your consent, the banner also transmits a pseudonymized identifier, the time, and the scope of your decision to Finsweet; these logs are stored in the European Union. Finsweet processes this data as our data processor.
Storing your consent decision is technically necessary and serves to fulfill our obligation to provide evidence (legal basis: Article 6(1)(c) in conjunction with Article 7(1) GDPR, as well as Article 6(1)(f) GDPR). You can change or revoke your selection at any time via the "Cookie Settings" link at the bottom of the page. Further information: https://consentpro.com/legal/cookie-policy
7.3. Google Tag Manager
We use the Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google") on this website. Google Tag Manager is a tool that allows us to centrally manage and integrate website tags (e.g., for Google Analytics, Meta Pixel, and LinkedIn Insight Tag). The Tag Manager itself does not set cookies or create user profiles; however, your IP address and technical browser data are transmitted to Google when the container is loaded. The services integrated via this tool are only executed once you have provided the corresponding consent via our cookie banner (Google Consent Mode).
The integration of the Tag Manager is based on our legitimate interest in the efficient and secure management of the services used on the website (Article 6(1)(f) GDPR). Google may transfer data to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, and the EU Standard Contractual Clauses also apply. Further information: https://policies.google.com/privacy
7.4. Google Analytics
We use Google Analytics from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google") on this website to statistically evaluate visitor data. Google Analytics uses targeting cookies for this purpose.
We only use Google Analytics if we have obtained your prior consent.
Deactivating data collection by Google Analytics
Google Analytics uses the _ga and _ga_* cookies on your device (each with a storage duration of 2 years) to distinguish visitors and sessions. You can revoke your consent at any time via the cookie settings at the bottom of the page with effect for the future. Additionally, Google offers a browser add-on to deactivate Google Analytics.
You can prevent Google from collecting and processing the data generated by the cookie regarding your use of the website by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en
Further information on terms of use and data protection can be found at http://www.google.com/analytics/terms/en.html or https://support.google.com/analytics/answer/6004245?hl=en.
7.5. Meta Pixel (Facebook Pixel)
We also use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta") on our website. The Meta Pixel allows us to track user activity on our website after they have been redirected here by clicking on a Meta advertisement (Facebook/Instagram). This enables us to evaluate the effectiveness of our advertising for market research purposes and to optimize future advertising campaigns.
Personal data is processed, in particular IP addresses, information about the browser and device used, and interactions on our website (e.g., page views, product views, inquiries). If you are logged into Facebook or Instagram, a link to your Meta user profile is also established. Meta may use this data for its own advertising purposes in accordance with its Data Policy to control the targeted display of advertisements on Facebook, Instagram, and outside of Meta.
The use of Facebook Pixel is based exclusively on your explicit consent pursuant to Art. 6(1)(a) GDPR. You may revoke your consent at any time via our cookie settings with effect for the future.
We are joint controllers with Meta for the collection of your data via Meta Pixel and its transmission to Meta. Meta is the sole controller for the subsequent processing of the transmitted data.
Your data is transferred to Meta Platforms, Inc. in the USA. This transfer is based primarily on the EU-U.S. Data Privacy Framework (adequacy decision by the EU Commission pursuant to Art. 45 GDPR), under which Meta is certified, and additionally on the EU Standard Contractual Clauses pursuant to Art. 46 GDPR.
Further information on data processing by Meta, as well as your rights and settings options, can be found in Meta's Data Policy at: Meta Privacy Policy – How Meta collects and uses user data | Privacy Center | Manage your privacy on Facebook, Instagram, and Messenger | Facebook Privacy
7.6. LinkedIn Insight Tag
We use the LinkedIn Insight Tag from LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn") on our website. The Insight Tag allows us to measure the success of our LinkedIn advertisements and to create target audiences for ads. Personal data is processed, in particular IP addresses, information about your browser and device, pages visited, timestamps, and identifiers from ad clicks. If you are logged into LinkedIn, LinkedIn can associate this data with your member account. We only receive aggregated, non-personally identifiable reports from LinkedIn. LinkedIn stores an identifier (li_adsId, 30 days) on your device, as well as cookies in accordance with the LinkedIn Cookie Policy.
The use of the LinkedIn Insight Tag is based exclusively on your explicit consent in accordance with Article 6(1)(a) GDPR, which you provide via our cookie banner (Marketing category) and can revoke at any time with future effect via the cookie settings. We are jointly responsible with LinkedIn for the collection of data and its transmission to LinkedIn; LinkedIn is solely responsible for the subsequent processing. Data is transmitted to the LinkedIn Corporation in the USA; this is based on the EU-U.S. Data Privacy Framework and, additionally, on the EU Standard Contractual Clauses. You can also object to the use of your data for advertising purposes directly at LinkedIn: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out – Further information: https://www.linkedin.com/legal/privacy-policy
7.7. Webflow Analyze
We use Webflow Analyze on this website, an analysis tool provided by our hosting provider, Webflow, Inc. (see the "Web Hosting" section), to statistically evaluate user behavior on our site and improve our website. For this purpose, identifiers are stored in your browser's local storage on your device (intellimize_user_* and others, storage duration 18 months), and data such as your IP address, pages visited, time spent, interactions, and browser and device information are transmitted to Webflow servers in the USA.
The use of Webflow Analyze is based exclusively on your explicit consent in accordance with Article 6(1)(a) GDPR (Analysis category in the cookie banner). Without your consent, only your choice is saved; no usage data is collected. Data transfer to the USA is based on the EU-U.S. Data Privacy Framework, under which Webflow is certified, as well as the EU Standard Contractual Clauses. Further information: https://webflow.com/legal/eu-privacy-policy
7.8. Vimeo
On certain pages of our website (references, telemetry), we embed videos from the service Vimeo, provided by Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA ("Vimeo"). The videos are only loaded once you have given your consent via our cookie banner; until then, you will see a placeholder. We embed the Vimeo player in a privacy-friendly mode ("Do Not Track"), meaning Vimeo does not set session cookies or perform analytics tracking. When a video is loaded, your IP address and technical browser data are still transmitted to Vimeo, and the player stores technical identifiers in your browser's local storage.
Integration is based on your consent in accordance with Article 6(1)(a) GDPR, which you provide via our cookie banner and can revoke at any time. Vimeo is certified under the EU-U.S. Data Privacy Framework; in addition, the EU Standard Contractual Clauses apply. Further information: https://vimeo.com/privacy
8. Contact
If you have further questions, wish to contact us, or would like to exercise your data subject rights, please reach out to us using the contact details provided, e.g., office@uko-microshops.com
9. Data Security
Your personal data is protected by appropriate organizational and technical measures. These measures specifically address protection against unauthorized, unlawful, or accidental access, processing, loss, use, and manipulation.
9.1. TLS encryption with https:
We use https to transmit data securely over the internet (data protection by design, Article 25(1) GDPR). By using TLS (Transport Layer Security), an encryption protocol for secure data transmission on the internet, we can ensure the protection of confidential data. You can recognize this security measure by the small lock icon in the top left of your browser and the use of the https scheme (instead of http) as part of our web address.
Since the privacy of our users is important to us, user data is pseudonymized.
Despite our efforts to maintain a consistently high standard of care, it cannot be ruled out that information may be viewed or used by other persons. We therefore advise against sending us confidential or sensitive data unencrypted via email.
10. Changes to the Privacy Policy
New legal requirements, business decisions, or technical developments may necessitate changes to our privacy policy. The privacy policy will be updated accordingly. You can always find the current version on our website.
11. Disclaimer
Please note that we assume no liability of any kind for the disclosure of information due to errors in data transmission and/or unauthorized access by third parties that are not caused by us (e.g., hacker attacks on email accounts or telephones, interception of faxes).
As of: October 2026