Privacy Policy

Last updated: 4 August 2026

This Privacy Policy explains which personal data are processed when you visit www.piatnik.com and use the functions provided there. It does not apply to the separately operated online shop at www.piatnik-individual.com.

1. Controller

Wiener Spielkartenfabrik Ferd. Piatnik & Söhne GmbH & Co KG

Robert Hayes

Hütteldorfer Straße 229-231
1140 Vienna, Austria
Telephone: +43 1 914 41 51
Email: robert.hayes@piatnik.com

2. Principles and legal bases

We process personal data only to the extent necessary to operate the website, respond to enquiries, send the newsletter, measure website reach or comply with legal obligations.

Depending on the processing activity, we rely in particular on the following legal bases:

• consent pursuant to Article 6(1)(a) GDPR, in particular for analytics cookies and newsletters;
• performance of a contract or steps taken prior to entering into a contract pursuant to Article 6(1)(b) GDPR, where your enquiry relates to a possible contract;
• compliance with a legal obligation pursuant to Article 6(1)(c) GDPR;
• legitimate interests pursuant to Article 6(1)(f) GDPR, in particular our interest in the secure, stable and user-friendly operation of the website and in efficient communication.

3. Website operation and server log files

When you access the website, technically necessary data are automatically transmitted to the web server. These may include, in particular, your IP address, date and time of access, the page or file requested, referrer URL, browser type, operating system, volume of data transferred and HTTP status code.

The processing is carried out to deliver the website, ensure its stability and security, and detect and prevent misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and uninterrupted operation of our online services.

Server log files are stored only for as long as necessary for these purposes and are then deleted or anonymised, unless longer retention is required to investigate a security incident.

4. Cookies and consent management

Our website uses cookies and similar technologies. Strictly necessary cookies are required for the website and the settings you select to function. They are stored on the basis of Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021); any related processing of personal data is based on Article 6(1)(f) GDPR.

Non-essential cookies, in particular those used for Google Analytics, are placed only after you have given your consent via the cookie banner. The legal basis is Article 6(1)(a) GDPR.

We use a consent management system to manage your choices. It may store, in particular, your consent decision, the time and scope of your consent, a pseudonymous identifier, and technical device and browser information. This is necessary to implement your choice and demonstrate that consent was obtained.

You may change or withdraw your choice at any time with effect for the future via the cookie settings provided on the website. Processing carried out before withdrawal remains lawful.

5. Google Analytics 4

With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics helps us statistically evaluate the use of the website and improve our services. Depending on how you use the website, the following data in particular may be processed:

• pages viewed, events and interactions;
• time, frequency and duration of use;
• approximate location information;
• browser, device and operating system information;
• referrer and campaign information;
• IP address and technical online identifiers.

Google processes the data on our behalf. We must use the privacy-friendly settings provided by Google and enter into a data processing agreement with Google.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR. Google Analytics is not activated without your consent. You may withdraw your consent at any time in the cookie settings.

Processing by Google companies or service providers outside the European Economic Area, in particular in the United States, cannot be ruled out. Where required, such transfers take place on the basis of an adequacy decision, in particular the EU-US Data Privacy Framework, and/or the European Commission's Standard Contractual Clauses.

Further information is available in Google's Privacy Policy at policies.google.com/privacy.

6. Contacting us

When you contact us by email, telephone or contact form, we process the information you provide, in particular your name, contact details, the content of your message and, where applicable, technical metadata, in order to handle your enquiry and communicate with you.

Where your enquiry relates to a contract or steps taken prior to entering into a contract, the legal basis is Article 6(1)(b) GDPR. In all other cases, processing is based on our legitimate interest in efficiently handling enquiries pursuant to Article 6(1)(f) GDPR. Where we expressly request consent, Article 6(1)(a) GDPR applies.

The data are deleted once the enquiry has been fully dealt with and provided that no statutory retention periods or warranty, liability or evidence-preservation interests require further storage.

7. Newsletter

You may subscribe to our newsletter on our website. We process at least your email address and, where provided by you, additional information such as your name or title.

Subscription generally takes place using a double opt-in procedure. The subscription and confirmation are logged. For evidentiary purposes, the time of subscription and confirmation and the IP address used may be stored.

The legal basis for sending the newsletter is your consent pursuant to Article 6(1)(a) GDPR. You may withdraw this consent at any time with effect for the future, in particular by using the unsubscribe link contained in each newsletter or by contacting us.

After unsubscribing, your data are removed from the active mailing list. Where necessary, we may retain your email address and evidence of consent for an appropriate period in a suppression or evidence list on the basis of Article 6(1)(f) GDPR in order to defend against possible claims. The address will not be used for further newsletters.

If we use an external newsletter service provider for distribution and administration, that provider processes the data as a processor acting on our instructions.

8. Social media links

Our website contains icons or links to our profiles on social networks. These are simple external links; no social media plugins or feeds are automatically loaded through these icons.

As long as you do not click the link, the link itself generally does not transmit data to the respective platform. Once you open the external page, the privacy policy of the relevant platform operator applies. If you are logged in there, the operator may associate your visit with your user account.

9. External online shop

Our website contains a link to the separately operated online shop at www.piatnik-individual.com. The shop is not integrated into piatnik.com. Merely visiting piatnik.com therefore does not involve processing order or payment data for that shop.www.piatnik-individual.com

When you follow the link, you leave piatnik.com. The privacy policy published on the shop website applies to the processing of your data there, in particular in connection with orders, customer accounts, payments and delivery.

10. Recipients and international data transfers

We disclose personal data only where this is necessary for the purposes described above, where we are legally required to do so, or where you have given your consent. Recipients may include hosting, IT, analytics, communications and newsletter service providers.

Processors are contractually required to process personal data only on our instructions and in compliance with the GDPR.

For transfers to countries outside the European Economic Area, we ensure an adequate level of data protection. Relevant safeguards may include adequacy decisions of the European Commission, the EU-US Data Privacy Framework and Standard Contractual Clauses.

11. Retention periods

We store personal data only for as long as necessary for the relevant purpose. The data are then deleted or anonymised unless statutory retention obligations or legitimate interests require longer storage. Statutory retention periods, in particular under corporate and tax law, remain unaffected.

12. Your rights

Subject to the applicable legal requirements, you have in particular the right to:

• access your personal data (Article 15 GDPR);
• rectification of inaccurate data or completion of incomplete data (Article 16 GDPR);
• erasure (Article 17 GDPR);
• restriction of processing (Article 18 GDPR);
• data portability (Article 20 GDPR);
• object to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR);
• withdraw consent with effect for the future (Article 7(3) GDPR).

To exercise your rights, please use the contact details stated above. You also have the right to lodge a complaint with a data protection supervisory authority.

Austrian Data Protection Authority
Barichgasse 40-42, 1030 Vienna
Telephone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

13. Data security

We implement appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration or disclosure. Data transmitted between your browser and our website are encrypted using HTTPS/TLS.

14. Changes to this Privacy Policy

We update this Privacy Policy when our website, the services used or legal requirements change. The version published on piatnik.com at the relevant time is authoritative.