At VIONNE MAGAZINE, we value your trust and take data protection seriously. Using our website is generally possible without submitting personal data. However, if you choose to access certain features or submit content (e.g. for publication), processing of personal data—such as your name, email, or contact information—may become necessary.

In compliance with the General Data Protection Regulation (GDPR) and other applicable privacy laws, we only collect and process your data when legally permitted or with your explicit consent.

This Privacy Policy explains the type, scope, and purpose of personal data we collect, use, and process. It also informs you about your rights as a data subject.

As the controller, VIONNE MAGAZINE (operated by Manuel Essl Design e.U.) has implemented strong technical and organizational measures to ensure your data is protected. Please note, however, that internet-based data transmission may have security gaps. If you prefer, you’re welcome to contact us via alternative means, such as telephone.

This Privacy Policy uses terms defined by the General Data Protection Regulation (GDPR). We aim to make this policy transparent and understandable for our readers, contributors, and business partners. Below are key terms we refer to throughout this document:

a) Personal Data
Personal data refers to any information that relates to an identified or identifiable individual. This may include a name, identification number, location data, online identifiers, or attributes specific to physical, psychological, genetic, mental, economic, cultural, or social identity.

b) Data Subject
A data subject is any individual whose personal data is collected and processed.

c) Processing
Processing means any operation performed on personal data, whether automated or not. This includes collecting, recording, storing, altering, retrieving, using, disclosing, restricting, deleting, or destroying data.

d) Restriction of Processing
This refers to marking stored personal data to limit its future processing.

e) Profiling
Profiling involves the automated analysis of personal data to evaluate aspects such as preferences, behavior, location, or movements of an individual.

f) Pseudonymisation
Pseudonymisation is the modification of data in such a way that it can no longer be linked to a specific person without additional information, which is kept separately and securely.

g) Controller
The controller is the entity (natural or legal person) that determines the purpose and means of processing personal data. For VIONNE MAGAZINE, this is Manuel Essl Design e.U..

h) Processor
A processor is any third party who processes personal data on behalf of the controller.

i) Recipient
A recipient is anyone to whom personal data is disclosed, whether or not they are a third party.

j) Third Party
A third party refers to individuals or organizations other than the data subject, controller, or processor who are authorized to process personal data.

k) Consent
Consent is a voluntary, informed, and unambiguous indication that the data subject agrees to the processing of their personal data.

The controller, as defined by the General Data Protection Regulation (GDPR) and other applicable data protection laws within the European Union, is:

Manuel Essl Design e.U.
Hörnesgasse 5/14
1030 Vienna
Austria

Telephone: +436644567264
Email: hello@vionnemag.com
Website: https://www.vionnemag.com

Each time the website of VIONNE MAGAZINE is accessed—whether by a data subject or an automated system—a series of general data and information is collected and stored in server log files. This may include:

1. Browser type and version

2. Operating system used

3. Referring website (referrer URL)

4. Sub-pages visited

5. Date and time of access

6. IP address

7. Internet service provider

8. Similar data for technical diagnostics or security analysis

This data is collected anonymously and is not used to draw conclusions about the individual user. Instead, it is used to:

• Ensure proper delivery of website content

• Optimize our site and marketing efforts

• Guarantee long-term technical stability and security

• Support law enforcement in the event of a cyberattack

Personal data, such as your name, email address, or postal address, is only collected when you voluntarily provide it—e.g., by submitting an order, using a contact form, or subscribing to updates. This data is processed lawfully, either on the basis of your consent or for the performance of a contract.

When placing an order, the personal information you provide (such as name, shipping address, email, and payment details) will be used solely for processing and fulfilling your purchase. This data is treated confidentially, transmitted securely via encryption, and only shared with third parties involved in the order, delivery, or payment process.

When you contact us—via email or form—your data is stored to process your request and respond to any follow-up inquiries.

We implement strict technical, organizational, and contractual safeguards to ensure your personal data is protected against unauthorized access, alteration, or disclosure, in accordance with applicable data protection laws.

User data will only be shared with third parties when permitted by law or if the user has given consent. This includes situations such as when data is needed to fulfill contractual obligations to the user, such as sharing a postal address with a shipping company after a purchase. Data may also be shared with responsible bodies like law enforcement authorities when required by law.

Under no circumstances will users' personal data be sold to third parties for advertising purposes or used to create user profiles for such purposes.

If the processing of personal data is based on Article 6 (1) (f) of the GDPR, our legitimate interest lies in conducting business in a way that benefits the well-being of our employees and shareholders.

4.1. California Consumer Privacy Act (CCPA)

For California residents: WE NEVER SELL your data!

Your rights under the California Consumer Privacy Act (CCPA)

The CCPA provides California residents with specific rights regarding their personal data. According to this law, you have the right to opt out of the "sale" of your personal information to third parties. Under the CCPA, the term "sale" refers to the collection of personal data for the purpose of creating ads or other marketing communications.

VIONNE MAGAZINE uses cookies on its website. Cookies are small text files stored on your computer system via your internet browser.

Many websites and servers use cookies. These cookies often contain a so-called cookie ID, which is a unique identifier for each cookie. The cookie ID consists of a string of characters that websites and servers use to recognize the specific internet browser in which the cookie was stored. This allows visited websites and servers to distinguish a user's browser from others that have different cookies stored. In this way, a specific internet browser can be recognized and identified via its unique cookie ID.

By using cookies, VIONNE MAGAZINE can offer users more user-friendly services that would not be possible without the use of cookies.

Cookies help us optimize the content and offers on our website based on user preferences. For example, cookies allow us to recognize a user, so they do not need to enter login details each time they visit. Another example is the shopping cart cookie in an online shop, which remembers the items a customer has added to their cart.

Users can prevent the setting of cookies at any time by adjusting the settings in their internet browser, thus permanently disabling cookies. Additionally, previously set cookies can be deleted at any time through the browser or other software programs. This can be done in all common browsers. If users choose to disable cookies, some features of our website may not function fully.

Users have the option to register on the VIONNE MAGAZINE website by providing personal data. The personal data transmitted during registration is determined by the input fields used for registration. The data provided is collected and stored exclusively for internal use by VIONNE MAGAZINE and for our own purposes. We may share this data with one or more processors (e.g., a shipping company) that use the personal data for purposes related to our services.

When registering on our website, the IP address assigned to the user by the internet service provider (ISP), as well as the date and time of registration, are also stored. This data is necessary to prevent misuse of our services and to investigate any potential illegal activities. The storage of this data is essential for the protection of VIONNE MAGAZINE. Generally, this data will not be shared with third parties unless required by law or for the purpose of criminal prosecution.

Registration with the voluntary provision of personal data allows VIONNE MAGAZINE to offer content or services that can only be provided to registered users due to the nature of the service. Registered users are free to update their personal data at any time or request its deletion from our database.

VIONNE MAGAZINE will provide users with information upon request regarding the personal data we store about them. Additionally, we will correct or delete personal data upon request from the user, unless this conflicts with statutory retention requirements. Our team is available to assist users in this matter.

7.1. Subscription to Our Newsletter

On the VIONNE MAGAZINE website, users have the opportunity to subscribe to our newsletter. The personal data transmitted when subscribing is determined by the input fields used for registration.

VIONNE MAGAZINE regularly informs its subscribers about updates, exclusive offers, and news via our newsletter. To receive our newsletter, users must (1) have a valid email address and (2) register for the newsletter. For legal reasons, a confirmation email will be sent to the email address entered by the user as part of the double opt-in procedure. This confirmation email ensures that the email address owner has authorized the receipt of the newsletter.

When registering for the newsletter, we also store the IP address assigned to the user by the internet service provider (ISP) and the date and time of registration. This data is necessary for security reasons and to prevent misuse of the provided email address.

The personal data collected for newsletter registration will only be used to send the newsletter. Additionally, subscribers may be contacted via email if there are important updates regarding the newsletter service, such as changes to the newsletter offer or technical updates.

The personal data collected will not be shared with third parties. Users can unsubscribe from the newsletter at any time. Consent for storing personal data for newsletter purposes can be revoked at any time. To unsubscribe, users can follow the link provided in every newsletter or unsubscribe directly on the VIONNE MAGAZINE website, or notify us via other communication channels.

7.2. Newsletter Tracking

VIONNE MAGAZINE newsletters may contain tracking pixels. A tracking pixel is a tiny graphic embedded in the email, sent in HTML format, which helps record and analyze log files. This enables us to statistically assess the effectiveness of our online marketing campaigns. By using the tracking pixel, VIONNE MAGAZINE can determine whether and when an email was opened and which links in the email were clicked by the recipient.

Personal data collected via tracking pixels is stored and analyzed by VIONNE MAGAZINE to improve the delivery and content of future newsletters, tailoring them to the interests of our subscribers. This data will not be shared with third parties. Subscribers can revoke their consent to tracking at any time by unsubscribing from the newsletter. Once consent is revoked, the personal data will be deleted.

The VIONNE MAGAZINE website provides information that enables quick electronic contact with our company, including a general email address for direct communication. If a user contacts VIONNE MAGAZINE by email or via a contact form, the personal data transmitted by the user will be automatically stored. This personal data, voluntarily provided by the user, will be stored for the purpose of processing the inquiry or contacting the user.

This personal data will not be shared with third parties unless explicitly stated or required by law.

VIONNE MAGAZINE processes and stores personal data of users only for as long as necessary to fulfill the purpose of storage, or as required by European or other applicable legal regulations to which we are subject.

Once the storage purpose is no longer applicable, or the retention period prescribed by European or other relevant legislation expires, the personal data will be routinely blocked or deleted in accordance with legal requirements.

10.1. Right of Confirmation
Every data subject has the right to obtain confirmation from the controller as to whether or not personal data concerning them are being processed. If a data subject wishes to exercise this right of confirmation, they may contact any employee of the controller at any time.

10.2. Right of Access
Every data subject has the right to obtain free information about the personal data concerning them and a copy of this information. Furthermore, the data subject has the right to obtain information about:

• The purposes of processing.

• The categories of personal data concerned.

• The recipients or categories of recipients to whom the personal data have been or will be disclosed.

• The envisaged period for which the personal data will be stored.

• The existence of a right to rectification or erasure of personal data or restriction of processing.

• The right to lodge a complaint with a supervisory authority.

• If personal data are not collected from the data subject, all available information about their source.

• The existence of automated decision-making, including profiling.

The data subject also has the right to information about transfers of personal data to third countries or international organizations.

10.3. Right to Rectification
Every data subject has the right to obtain the immediate rectification of inaccurate personal data concerning them. Taking into account the purposes of processing, the data subject has the right to have incomplete personal data completed. To exercise this right, they may contact any employee of the controller at any time.

10.4. Right to Erasure (Right to be Forgotten)
Every data subject has the right to obtain the immediate erasure of personal data concerning them. The controller is obliged to erase personal data if:

• The data are no longer necessary for the purposes for which they were collected.

• The data subject withdraws consent, and no other legal basis for the processing exists.

• The data subject objects to processing and there are no overriding legitimate grounds for the processing.

• The personal data have been processed unlawfully.

• The erasure of personal data is required to fulfill a legal obligation.

10.5. Right to Restriction of Processing
Every data subject has the right to request the controller to restrict processing if:

• The accuracy of the personal data is contested by the data subject.

• The processing is unlawful and the data subject opposes erasure, requesting restriction instead.

• The controller no longer needs the data for processing, but they are required by the data subject to assert legal claims.

• The data subject has objected to processing.

10.6. Right to Data Portability
The data subject has the right to receive personal data in a structured, commonly used, and machine-readable format and transmit it to another controller without hindrance. This applies when processing is based on consent or contract, and is done by automated means.

10.7. Right of Objection
Every data subject has the right to object to processing of their personal data, particularly when processing is based on public interest or legitimate interest. If personal data is used for direct marketing, the data subject has the right to object at any time.

10.8. Automated Decision-Making, Including Profiling
The data subject has the right not to be subject to automated decision-making, including profiling, that produces legal effects or significantly affects them unless necessary for entering into or performing a contract or authorized by law.

10.9. Right to Withdraw Consent to Data Protection
Every data subject has the right to withdraw consent to the processing of their personal data at any time. To exercise this right, they may contact any employee of the controller at any time.

The controller has integrated components of Facebook on this website. Facebook is a social network.

A social network is an online platform for social interactions where users can communicate with each other and share content. Facebook allows users to create profiles, upload photos, and connect with others via friend requests.

The operating company of Facebook is Facebook, Inc., located at 1 Hacker Way, Menlo Park, CA 94025, USA. For users outside the USA or Canada, the controller is Facebook Ireland Ltd., located at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

When accessing pages on this website that include a Facebook component (such as a Facebook plugin), the user's web browser automatically retrieves and displays the relevant Facebook component from Facebook. As a result of this technical process, Facebook becomes aware of which specific sub-page of our website the data subject is visiting.

If the data subject is logged into Facebook during their visit, Facebook recognizes which sub-page the user is viewing and tracks their activity on our website during their session. This information is collected by Facebook and linked to the user’s Facebook account. If the data subject interacts with the Facebook features, such as by clicking the "Like" button or leaving a comment, this information is also associated with their Facebook user account and stored.

Facebook receives information about the visit to our website, even if the data subject does not click on the Facebook components, as long as they are logged into Facebook during their visit. To prevent this data transmission, the user can log out of their Facebook account before visiting our website.

For more details about Facebook’s data collection, processing, and usage, please refer to their privacy policy, which is accessible at Facebook Privacy Policy. This policy provides information about the data collection practices of Facebook and the privacy settings that can be used to control what data is shared.

The controller has integrated components of Instagram on this website. Instagram is an audiovisual platform that allows users to share photos and videos and disseminate such data across other social networks.

The operating company of Instagram is Instagram LLC, located at 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, United States.

When visiting pages on this website that include an Instagram component (such as the Instagram button), the user's web browser automatically retrieves and displays the corresponding Instagram component. This process allows Instagram to know which specific sub-page of our website the data subject is visiting.

If the data subject is logged into Instagram at the same time, Instagram identifies which sub-page of the website is being visited and tracks this information throughout the session. The collected data is linked to the user’s Instagram account. If the data subject interacts with the Instagram component, such as by clicking the Instagram button, Instagram associates this information with their personal Instagram account and stores this data.

Instagram receives information that the data subject visited our website as long as the user is logged into Instagram during their visit. This information is transmitted regardless of whether the data subject clicks on the Instagram button. To prevent this data from being sent to Instagram, the data subject can log out of their Instagram account before visiting our website.

For further details, including Instagram’s data protection policies, please refer to their privacy guidelines available at Instagram Help Privacy Policy and Instagram Legal Privacy Policy.

The controller has integrated components of YouTube on this website. YouTube is an internet video portal that allows video publishers to upload video clips for free, and users to view, rate, and comment on these videos without charge. YouTube offers a wide range of video content, including full films, television programs, music videos, trailers, and user-generated content.

The operating company of YouTube is YouTube, LLC, located at 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043-1351, USA.

When a user visits any page of this website that includes a YouTube component (such as a YouTube video), the user's internet browser automatically retrieves and displays the corresponding YouTube component. Further details about YouTube can be found at YouTube About Page. Through this process, YouTube and Google learn which specific subpage of our website the user visited.

If the data subject is logged into YouTube at the time of accessing the website, YouTube recognizes which specific subpage of the website the user is visiting with each call-up to a subpage containing a YouTube video. This information is collected by YouTube and Google and is linked to the respective YouTube account of the user.

YouTube and Google will always receive information that the data subject visited our website, provided that the user is logged into YouTube while accessing the website, regardless of whether the data subject clicks on the YouTube video or not. If the data subject does not want this information to be transmitted to YouTube and Google, they can prevent it by logging out of their YouTube account before accessing the website.

For more details about the collection, processing, and use of personal data by YouTube and Google, please refer to YouTube’s privacy policy available at Google Privacy Policy.

The controller has integrated PayPal components on this website. PayPal is an online payment service provider that processes payments through PayPal accounts, which are virtual private or business accounts. If a user does not have a PayPal account, PayPal can also process payments via credit cards. A PayPal account is managed through an email address, meaning no traditional account numbers are required. PayPal facilitates online payments to third parties and also offers buyer protection and escrow services.

PayPal's European operating company is PayPal (Europe) S.à.rl & Cie. SCA, located at 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

When the data subject selects "PayPal" as a payment option during the ordering process in the online shop, the data subject's data is automatically transmitted to PayPal. By selecting this payment option, the data subject consents to the transmission of personal data required for payment processing.

The personal data transmitted to PayPal typically includes the data subject's first name, last name, address, email address, IP address, telephone number, mobile number, and other data necessary for payment processing. Personal data related to the respective order is also required for processing the purchase contract.

The transmission of data serves the purposes of payment processing and fraud prevention. The controller will transmit personal data to PayPal particularly when there is a legitimate interest in the transmission. The personal data exchanged between PayPal and the controller may also be transmitted by PayPal to credit reporting agencies for identity and credit checks.

PayPal may share personal data with affiliated companies, service providers, or subcontractors if necessary to fulfill contractual obligations or for processing on behalf of PayPal. The data subject may revoke their consent to the processing of personal data at any time. However, revocation does not affect personal data that must be processed, used, or transmitted for contractual payment processing.

For further details on PayPal's privacy policy, please visit PayPal Privacy Policy.

Article 6 (1) (a) GDPR serves as the legal basis for processing operations where consent is obtained for a specific processing purpose. If the processing of personal data is necessary for the fulfillment of a contract to which the data subject is a party, such as when processing operations are required for the delivery of goods or to provide other services, the processing is carried out based on Article 6 (1) (b) GDPR. The same applies to processing operations that are necessary to carry out pre-contractual measures, for example, in cases of inquiries about our products or services.

If our company is subject to a legal obligation that requires the processing of personal data, such as fulfilling tax obligations, the processing is based on Article 6 (1) (c) GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or another natural person. This could occur, for example, if a visitor were injured on our premises, and their name, age, health insurance details, or other vital information had to be provided to a doctor, hospital, or other third parties. In such cases, the processing would be based on Article 6 (1) (d) GDPR.

Finally, processing operations may be based on Article 6 (1) (f) GDPR. This legal basis applies to processing operations not covered by the aforementioned legal grounds, if processing is necessary to protect the legitimate interests of our company or a third party, unless these interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data. We are permitted to carry out such processing operations in particular because they were specifically mentioned by the European legislator, who assumed that a legitimate interest could be presumed if the data subject is a customer of the controller (Recital 47, Sentence 2 GDPR).

The criterion for the duration of storage of personal data is the respective statutory retention period. After the expiration of this period, the corresponding data will be routinely deleted, unless it is no longer required for the fulfillment or initiation of a contract.

We would like to point out that the provision of personal data may be required by law (e.g. tax regulations) or may result from contractual provisions (e.g. information about the contractual partner). In some cases, it may be necessary for a contract to be concluded that the data subject provides us with personal data, which must subsequently be processed by us. For example, the data subject is obliged to provide us with personal data when our company concludes a contract with them. Failure to provide such personal data would mean that the contract with the data subject could not be concluded.

Before providing personal data, the data subject may contact one of our employees. The employee will clarify whether the provision of personal data is required by law or contract, or is necessary for the conclusion of a contract, whether there is an obligation to provide the personal data, and what the consequences of not providing the data would be.

As a responsible company, we do not use automated decision-making or profiling.

This privacy policy was created using the privacy policy generator of the DGD – Your External Data Protection Officer, developed in cooperation with the German law firm WILDE BEUGER SOLMECKE, Cologne.

The provider reserves the right to update or modify this Privacy & Cookies Policy at any time, in order to comply with current legal requirements or to reflect changes in our data processing practices or services.

This page was last updated on June 22, 2026.