Privacy policy

The controller responsible for data processing is:

horntools GmbH
Wallenmahd 23
6850 Dornbirn
Austria
info@horntools.com

Thank you for your interest in our online shop. Protecting your privacy is very important to us. Below, we provide detailed information about how we handle your data.

Access data and hosting

You can visit our websites without providing personal information. Each time a website is accessed, the web server automatically stores only a server log file containing, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data), thereby documenting the access.

This access data is evaluated exclusively to ensure trouble-free operation of the site and to improve our offering. Pursuant to Art. 6(1), first sentence, point (f) GDPR, this serves to safeguard our legitimate interests in the correct presentation of our offering, which prevail in the context of a balancing of interests.

Hosting

Our online shop is operated on the Shopify platform. The provider is Shopify International Limited (Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland), which provides hosting and presentation of our shop on our behalf as a processor (Art. 28 GDPR). Where personal data is transferred to a third country, in particular the USA, where Shopify Inc. is based, we rely on an adequacy decision (EU-US Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses.

Pursuant to Art. 6(1), first sentence, point (f) GDPR, the engagement serves to safeguard our legitimate interests in secure and efficient hosting of our offering.

Data collection and use for contract processing and creation of a customer account

We collect personal data when you provide it to us in connection with an order or when contacting us, for example via a contact form or email. Mandatory fields are identified as such because we require the data to process the contract or your enquiry, and you cannot submit the order or enquiry without providing it. The data collected is evident from the relevant input forms. We use the data you provide pursuant to Art. 6(1), first sentence, point (b) GDPR to process the contract and your enquiries.

If you choose to open a customer account, we process your data on the basis of your consent pursuant to Art. 6(1), first sentence, point (a) GDPR for the purpose of managing the account. The customer account enables you, among other things, to manage several shipping addresses, track orders, view your order history, submit product reviews, create wish lists and receive exclusive offers.

After the contract has been fully processed or your customer account has been deleted, further processing of your data will be restricted and the data will be deleted after expiry of the tax and commercial-law retention periods, generally seven years under Austrian law unless longer periods apply, unless you have expressly consented to further use or we reserve the right to use the data further as permitted by law. You may delete your customer account at any time by sending a message to the contact details below or using the function provided in the account.

Data processing as part of the online withdrawal function

If you exercise your right of withdrawal using our online withdrawal function (“withdrawal button”), we process the data entered in the withdrawal form, in particular your name, order or invoice number and email address. We require this data to process the withdrawal, send you the legally required confirmation of receipt on a durable medium and reverse the contract.

The legal basis is Art. 6(1), first sentence, point (b) GDPR (performance of contractual measures or measures serving to reverse the contract) and Art. 6(1), first sentence, point (c) GDPR (compliance with our legal obligation to provide a withdrawal function and send a confirmation of receipt).

We use a service provider to make the withdrawal function technically available; the provider acts on our behalf as a processor (Art. 28 GDPR). Once the withdrawal has been fully processed, further processing of the data collected will be restricted and the data will be deleted after expiry of the statutory retention periods.

Data disclosure for contract performance

To perform the contract pursuant to Art. 6(1), first sentence, point (b) GDPR, we disclose your data to the shipping company commissioned with delivery to the extent necessary to deliver the goods ordered.

Depending on your selection during checkout, we use the following payment service providers:

Shopify Payments, a service of Shopify International Limited (Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify processes the payment data required for this purpose as an independent controller within the meaning of the GDPR, not as our processor.
PayPal, a service of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
Alma, a buy-now-pay-later instalment payment service of Alma SAS, 176 Avenue Charles de Gaulle, 92200 Neuilly-sur-Seine, France (RCS Nanterre 839 100 575).

The respective providers collect and process the data required for payment processing, for example name, billing/delivery address and payment or creditworthiness data, on the basis of Art. 6(1), first sentence, point (b) GDPR (contract performance). The privacy policy of the provider selected by you also applies.

The same applies to data disclosed to our manufacturers or wholesalers where they handle shipping on our behalf (drop shipping).

Data disclosure to shipping service providers

If you have given us your express consent during or after your order, we disclose your email address and telephone number to the selected shipping service provider on the basis of Art. 6(1), first sentence, point (a) GDPR so that it can contact you before delivery to announce or coordinate delivery.

Consent may be withdrawn at any time by sending a message to the contact details below. Following withdrawal, we will delete the data provided for this purpose unless you have expressly consented to further use.

Affiliate marketing (UpPromote)

We operate an affiliate programme using UpPromote: Affiliate Marketing by SECOMUS TECHNOLOGY JOINT STOCK COMPANY (Secomapp), Home City, 4th Floor, V4 Building, 177 Trung Kính, Yên Hòa, Hà Nội 100000, Vietnam. If you reach our website via an affiliate link, a tracking cookie is placed which attributes a subsequent order to the relevant affiliate so that the affiliate can receive a commission. A pseudonymous cookie ID and referrer information are processed.

The legal basis is your consent pursuant to Art. 6(1), first sentence, point (a) GDPR, which you can give via our cookie banner. You may withdraw it at any time with effect for the future through the cookie settings.

As Secomapp is based in Vietnam and the European Commission has not issued an adequacy decision for Vietnam, we base the transfer on the European Commission’s Standard Contractual Clauses pursuant to Art. 46(2), point (c) GDPR. A data processing agreement, including the Standard Contractual Clauses, has been concluded with Secomapp pursuant to Art. 28 GDPR.

If you register as an affiliate partner for our programme, we additionally process the data you provide, for example your name, email address and payment or bank details, to administer the affiliate agreement and pay commissions. The legal basis is Art. 6(1), first sentence, point (b) GDPR (performance of the contract with you as an affiliate).

Email newsletter

If you subscribe to our newsletter, we use the data required for this purpose or separately provided by you to send you our email newsletter regularly on the basis of your consent pursuant to Art. 6(1), first sentence, point (a) GDPR.

You can unsubscribe at any time by sending a message to the contact details below or using the unsubscribe link included in every newsletter. After you unsubscribe, we will delete your email address unless you have expressly consented to further use.

The newsletter is sent on our behalf by the processor Klaviyo, Inc. (USA), to which we disclose your email address for this purpose. Where data is transferred to the USA, we rely on an existing adequacy decision of the European Commission (EU-US Data Privacy Framework) or on Standard Contractual Clauses.

Cookies and consent

To make your visit to our website attractive and enable the use of certain functions, we use cookies on various pages. Cookies are small text files stored on your device. Some are deleted at the end of the browser session (session cookies), while others remain on your device and enable us to recognise your browser on your next visit (persistent cookies).

We use technically necessary cookies required to operate the website and provide functions requested by you, such as the shopping cart, on the basis of our legitimate interest pursuant to Art. 6(1), first sentence, point (f) GDPR.

We use all non-essential cookies and services, particularly analytics, marketing and third-party embedding services, only if you have first given your express consent via our cookie banner pursuant to Art. 6(1), first sentence, point (a) GDPR in conjunction with section 165(3) TKG 2021. You may withdraw your consent at any time with effect for the future via the cookie settings.

Our cookie banner is technically provided by Consentmo, a service of iSense Ltd., 4 Prof. Georgi Bradistilov St., Entrance A, 4th Floor, 1700 Sofia, Bulgaria. Consentmo processes technical data, such as your IP address and the time of your consent decision, to document whether consent was given or refused. The legal basis is Art. 6(1), first sentence, point (c) GDPR in conjunction with our documentation obligation under Art. 7(1) GDPR. A processing agreement pursuant to Art. 28 GDPR has been concluded with iSense Ltd.

You may also configure your browser to notify you when cookies are placed, decide individually whether to accept them or exclude cookies generally. Refusing cookies may restrict the functionality of our website.

Web analytics and online marketing

Where the following services place cookies or transmit data to third parties, they are activated only after your consent via the cookie banner.

Google Analytics 4

For website analysis, this website uses Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) or Google LLC (USA). Google Analytics uses methods that enable an analysis of your use of the website, such as cookies. Information collected about your use of this website is generally transmitted to and stored on a Google server; IP addresses are processed in truncated form. The retention period for user data is set to 14 months (Google’s default setting for event and user data).

The legal basis is your consent pursuant to Art. 6(1), first sentence, point (a) GDPR. Where data is transferred to the USA, Google LLC is certified under the EU-US Data Privacy Framework; a current certificate can be viewed at https://www.dataprivacyframework.gov.

Hotjar

To analyse user behaviour on our website, including heat maps, click and scrolling behaviour and, where applicable, session recordings and surveys, we use Hotjar, a service of Hotjar Ltd. (part of the Contentsquare group), Level 2, St Julian’s Business Centre, 3 Elia Zammit Street, St Julian’s STJ 1000, Malta.

Technical data such as your truncated IP address, device and browser information and your interaction behaviour on the website are processed.

The legal basis is your consent pursuant to Art. 6(1), first sentence, point (a) GDPR, which you can provide via our cookie banner. You may withdraw it at any time with effect for the future through the cookie settings.

Hotjar Ltd. is based in Malta (EU/EEA), so no transfer to a third country takes place in this respect. A processing agreement pursuant to Art. 28 GDPR has been concluded with Hotjar/Contentsquare. Further information: https://www.hotjar.com/legal/policies/privacy/

Google Ads remarketing

We use Google Ads to advertise this website in Google search results and on third-party websites. When you visit our website, Google places a remarketing cookie which uses a pseudonymous cookie ID and the pages you visit to enable interest-based advertising. The remarketing cookie remains valid for up to 540 days.

The legal basis is your consent pursuant to Art. 6(1), first sentence, point (a) GDPR. The provider is Google Ireland Limited or Google LLC (USA, certified under the EU-US Data Privacy Framework). You can withdraw consent to cookies at any time through the cookie settings and through your Google account settings at https://adssettings.google.com.

Meta (Facebook/Instagram) Pixel

Our website uses the Meta Pixel of Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) or Meta Platforms, Inc. (USA). The Meta Pixel enables us to track actions taken by users after they reach our website via a Facebook or Instagram advertisement (conversion tracking) and to create audiences for advertising purposes (remarketing).

Data such as your IP address, browser and device information and your interactions on our website are processed and transmitted to Meta. The retention period is determined by Meta’s data policy; we do not configure a separate retention period on our side.

The provider is Meta Platforms Ireland Limited or Meta Platforms, Inc. (USA). Where data is transferred to the USA, we rely on an adequacy decision (EU-US Data Privacy Framework); Meta is certified under this framework. Further information: https://www.facebook.com/privacy/policy/

Google Maps

This website uses Google Maps to present geographical information visually. The provider is Google Ireland Limited or Google LLC (USA). When Google Maps is used, data concerning use of the Maps functions is processed, which may include your IP address and location data.

The legal basis is your consent pursuant to Art. 6(1), first sentence, point (a) GDPR. Google LLC is certified under the EU-US Data Privacy Framework. Further information is available in Google’s privacy policy: https://policies.google.com/privacy

Google reCAPTCHA

To protect our web forms against misuse and spam, we use Google reCAPTCHA, a service of Google Ireland Limited or Google LLC (USA). Checking the input prevents automated software (bots) from carrying out abusive activities. For this purpose, reCAPTCHA evaluates various information, such as the IP address, time spent on the site and mouse movements. It does not read the content entered in the fields of the relevant form.

The legal basis is our legitimate interest in protecting our website against misuse pursuant to Art. 6(1), first sentence, point (f) GDPR. Google LLC is certified under the EU-US Data Privacy Framework. Further information: https://policies.google.com/privacy

Google Tag Manager

We use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), on our website.

What is Google Tag Manager?

Google Tag Manager is a tag-management system that allows us to centrally manage and integrate code snippets and scripts (“tags”) into our website without directly modifying the source code. It controls tools including Google Analytics, Google Ads, the Meta Pixel and other tracking services. Google Tag Manager itself does not store personal data or place cookies. However, when the Tag Manager script is loaded, the website visitor’s IP address is transmitted to Google servers.

What data is processed?

When our website is accessed, loading the Google Tag Manager script transmits the following technical data to Google: IP address, date and time of access and browser and device information.

Legal basis

Google Tag Manager is used exclusively on the basis of your express consent pursuant to Art. 6(1), point (a) GDPR, which you can provide via our cookie banner. You may withdraw your consent at any time with effect for the future by changing your cookie settings through the corresponding link on our website.

Transfer to third countries

Google is certified under the EU-US Data Privacy Framework (DPF). Transfers to the USA are based on the European Commission’s adequacy decision of 10 July 2023 and are therefore permissible under data protection law.

Processing on our behalf

A data processing agreement pursuant to Art. 28 GDPR has been concluded with Google. Further information about data protection at Google is available at: https://policies.google.com/privacy

Fonts

To ensure a consistent display, this website loads fonts locally from our own server. No connection is established to third-party servers, such as Google Fonts, and your IP address is not transmitted to third parties.

Judge.me – Product reviews

We use the Judge.me review service of Judge.me Ltd., c/o Buckworths, 2nd Floor, 1–3 Worship Street, London, England EC2A 2AB, United Kingdom, to allow our customers to write and view product reviews.

What data is processed?

When Judge.me is used, the following personal data is processed: name, email address, order number, order date, review text and, where applicable, review images. Technical data such as IP address and browser data may also be collected to verify the authenticity of reviews.

We reserve the right not to publish reviews or to remove them later if they contain insulting, unlawful or clearly irrelevant content, disclose third-party personal data or cannot be matched to an actual order. The necessary review is based on our legitimate interest in a trustworthy and lawful presentation of customer reviews pursuant to Art. 6(1), first sentence, point (f) GDPR.

Review reminders by email

If you have given us your express consent after your order pursuant to Art. 6(1), point (a) GDPR, we transmit your email address, order number and order date to Judge.me so that it can send you a review reminder by email. Consent may be withdrawn at any time with effect for the future by contacting us at info@horntools.com or Judge.me directly.

Display of reviews

The Judge.me widget is integrated into our website to display customer reviews on the basis of our legitimate interest in transparently presenting product quality pursuant to Art. 6(1), point (f) GDPR.

Data storage and transfer to third countries

Judge.me operates its infrastructure using Heroku and Amazon Web Services (AWS) technology, with physical infrastructure hosted in Amazon’s secure data centres. Data is processed primarily in the United Kingdom but may also be stored on servers in the USA. For transfers to the USA, Judge.me has joined the EU-US Data Privacy Framework, which ensures an adequate level of protection on the basis of a European Commission adequacy decision. A European Commission adequacy decision also applies to transfers to the United Kingdom. See https://help.judge.me/en/articles/8364277-gdpr-compliance.

Processing on our behalf

A data processing agreement pursuant to Art. 28 GDPR has been concluded with Judge.me, ensuring the protection of your data and prohibiting unauthorised disclosure to third parties.

Your rights

You have the right to access, rectify and erase your data stored by Judge.me and to restrict its processing. Further information is available at: https://judge.me/privacy

HubSpot Live Chat

We use HubSpot’s live chat service, provided by HubSpot Ireland Limited, One Sir John Rogerson’s Quay, Dublin 2, Ireland (“HubSpot”), on our website. The live chat allows you to contact us directly with questions or requests for support.

When you use live chat, personal data is processed, in particular the content of your messages, voluntarily provided contact details such as name and email address, your IP address and technical information about your device and browser. HubSpot also places cookies to associate the chat history with your visit and recognise it if you return to our website.

Processing is based on your consent (Art. 6(1), point (a) GDPR) where the chat uses cookies and you consented via our cookie banner, or on our legitimate interest (Art. 6(1), point (f) GDPR) in efficient, direct communication with website visitors. If the chat is used for pre-contractual enquiries or support, processing may also be based on Art. 6(1), point (b) GDPR (pre-contractual measures or contract performance).

HubSpot processes data partly on servers in the EU and partly in the USA. For transfers to the USA, HubSpot has implemented EU Standard Contractual Clauses (Art. 46(2), point (c) GDPR) to ensure an adequate level of data protection. A data processing agreement exists with HubSpot.

Further information is available in HubSpot’s privacy policy: https://legal.hubspot.com/privacy-policy

HubSpot forms

We also use forms provided by HubSpot Ireland Limited, One Sir John Rogerson’s Quay, Dublin 2, Ireland (“HubSpot”), to receive enquiries, newsletter subscriptions and contact requests from you.

When you complete a form, the data you enter is processed, in particular your name, email address and any other information provided voluntarily, such as telephone number, company and message text, as well as technical data including your IP address and information about your device and browser. HubSpot may also use cookies to associate form submissions with your visit and trigger follow-up actions, such as sending a confirmation email.

The legal basis depends on the purpose of the form: newsletter subscriptions are processed on the basis of consent (Art. 6(1), point (a) GDPR); contact and support requests on the basis of pre-contractual measures or contract performance (Art. 6(1), point (b) GDPR) or our legitimate interest in processing your enquiry (Art. 6(1), point (f) GDPR).

Data collected through forms is stored in the HubSpot database and may be linked with further information about your interaction with our website, such as pages visited, if you have consented to the relevant cookies. HubSpot processes data partly on servers in the EU and partly in the USA. For transfers to the USA, HubSpot has implemented EU Standard Contractual Clauses (Art. 46(2), point (c) GDPR). A data processing agreement exists with HubSpot.

Further information is available in HubSpot’s privacy policy: https://legal.hubspot.com/privacy-policy

Social media plugins

Our website uses plugins from social networks (Facebook, Instagram, X/Twitter, Pinterest and YouTube). They are loaded only after your consent via the cookie banner (a two-click or consent solution).

When you access a page with an activated plugin, your browser establishes a direct connection to the relevant provider’s servers. The provider is thereby informed that your browser has accessed the page, even if you have no profile or are not logged in. If you are logged in, the provider may associate your visit with your profile. Interactions such as clicking a “Like” or “Share” button are also transmitted to the provider.

The legal basis is your consent pursuant to Art. 6(1), first sentence, point (a) GDPR. Please refer to the providers’ privacy policies for the purpose and scope of data collection and your rights and settings:

Facebook/Instagram (Meta): https://www.facebook.com/policy.php
X/Twitter: https://twitter.com/privacy
Pinterest: https://about.pinterest.com/de/privacy-policy
YouTube/Google: https://policies.google.com/privacy

Embedded YouTube videos

Videos from YouTube (Google Ireland Limited or Google LLC) are embedded on this website using privacy-enhanced mode. YouTube does not collect information about you unless you play a video. Activation occurs only after your consent pursuant to Art. 6(1), first sentence, point (a) GDPR.

Our online presence on social networks

Our presence on social networks and platforms serves to communicate with customers and interested parties and provide information about our products and promotions. When you visit our profiles, the platform operators may process your data for market-research and advertising purposes, generally using cookies and creating pseudonymous user profiles.

The legal basis is Art. 6(1), first sentence, point (a) GDPR where you have given consent to the platform operator, and otherwise our legitimate interest in effective communication pursuant to Art. 6(1), first sentence, point (f) GDPR. Please consult the relevant provider’s privacy policy for detailed information and your objection and settings options.

Contact options and your rights

As a data subject, you have the following rights:

under Art. 15 GDPR, the right to request access to the personal data concerning you that we process;
under Art. 16 GDPR, the right to request rectification of inaccurate data or completion of data stored by us;
under Art. 17 GDPR, the right to request erasure of your data stored by us, unless statutory retention obligations or other legal grounds prevent this;
under Art. 18 GDPR, the right to request restriction of processing;
under Art. 20 GDPR, the right to data portability;
under Art. 7(3) GDPR, the right to withdraw consent at any time with effect for the future;
under Art. 77 GDPR, the right to lodge a complaint with a supervisory authority. In Austria, this is the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at).

For questions regarding the collection, processing or use of your personal data or to exercise your rights, please contact:

horntools GmbH
Wallenmahd 23
6850 Dornbirn
Austria
info@horntools.com

Right to object

Where we process personal data to safeguard our overriding legitimate interests, you may object to this processing with effect for the future. If processing takes place for direct marketing purposes, you may exercise this right at any time. If processing takes place for other purposes, you have a right to object only on grounds relating to your particular situation.

After you exercise your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.

Last updated: 24 July 2026