Last updated: November 2026
Data controller
ZENstore.at is responsible for the processing of personal data on zenstore.at. You can reach us by email: [email protected]
Hosting and delivery of the website
The website is run by a hosting provider with servers located in the European Union. On every page request the server processes technically necessary connection data: IP address, date and time, the address requested, the referring website, and browser and operating system. This data is used to run the website securely and is not combined with other data.
To deliver the site quickly and protect it from attacks, all page requests pass through the Cloudflare network (Cloudflare, Inc., USA). The connection data above is therefore also processed in the USA. Cloudflare is certified under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in a stable and secure website.
On product pages the image gallery (Fancybox) is loaded from the jsDelivr content delivery network. Your IP address is transmitted to jsDelivr in the process.
Orders
When you place an order, we process the details from the order form:
- first and last name
- email address and phone number
- delivery address (country, state, postcode, city, street, house number, staircase/door)
- items ordered, prices, the chosen payment method and the tracking number
We use this data to process your order, send you confirmations and shipping information by email and answer your questions. No customer account is created.
We pass the data needed for delivery to Österreichische Post AG, and for cash on delivery also the amount to be collected. For payment by bank transfer, the banks involved process the payment data.
We keep order and invoice data for seven years because tax law requires it.
Product reviews
After an order we may email you a personal link for reviewing the items you bought. The link is valid for 120 hours. To confirm, you enter your email address and postcode; both are only matched against the order and never published.
We publish the star rating, your optional text and the name you enter, or "Customer" if you prefer. Leaving a review is voluntary. If you do not want to receive review requests, a short email is enough.
Cookies
We only set technically necessary cookies: a session cookie so that the cart and checkout work, plus one cookie each for the chosen language and currency. The shop cannot work without them, so no consent is required. We do not use advertising or tracking cookies.
Web analytics
To analyse how the shop and our online tools (I Ching oracle, Tarot) are used we rely solely on Umami, an open-source tool that runs under our own domain (stats.zenstore.at). The analytics data is not passed on to advertising networks.
Visitor statistics (always on)
The statistics work without cookies and without user profiles; your IP address is not stored. We record:
- the pages viewed, the time of the visit and the referring website
- browser, operating system, device type, screen size and language
- the approximate origin of the visit (country or region)
- shop events: item added to the cart, cart viewed, checkout started and purchase completed (with order number, amount and currency)
- in the I Ching oracle: the numbers of the hexagrams cast and the casting method chosen
The legal basis is our legitimate interest in improving the shop and the tools based on anonymous usage figures.
Session recording and heatmap (optional)
In addition, individual visits can be recorded: mouse movements, clicks, scrolling and the page content shown at the time. This produces replays of single sessions and heatmaps that help us find usability problems in the shop.
This feature is switched off by default and only becomes active if you switch it on yourself, here or in the notice box. The legal basis is your consent. You can withdraw it at any time with this switch; the visitor statistics keep running regardless.
Your choice is stored in this browser only (local storage, not a cookie), so it applies per device and browser.
YouTube videos
Some product pages embed videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you open such a page, your browser loads the video player from YouTube servers. Your IP address and details about your device are transmitted to Google in the process, also to the USA, and YouTube may set cookies. Google is certified under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in presenting products clearly.
Details on how Google processes data: Google privacy policy
Links to social networks
The footer links to our profiles on Medium, Pinterest, Trustpilot and YouTube. These are plain links: no data is sent to these services until you click one.
Your rights
You have the right to:
- access the data stored about you
- rectification of inaccurate data
- erasure, unless a statutory retention period applies
- restriction of processing
- data portability
- object to processing based on legitimate interests
- withdraw consent with effect for the future
Please send requests to: [email protected]