PRIVACY POLICY
MARO GmbH – maro-bidet.com
Version: 30 September 2026
1. Controller
The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation ("GDPR") is:
MARO GmbH
Klagenfurter Str. 34
9170 Ferlach
Austria
Email: info@maro-bidet.com
Personal data means any information relating to an identified or identifiable natural person.
The previous privacy policy must not be retained as-is because it still contains the former Bahnhofplatz address and even the incorrect email address info@bmaro-bidet.com. Pasted markdown
2. Hosting and Website Platform – Squarespace
This website and online shop are operated using services provided by:
Squarespace Ireland Limited
Squarespace House
Ship Street Great
Dublin 8
D08 N12C
Ireland
Squarespace provides website hosting, commerce functionality, checkout infrastructure, customer and contact management, subscriber management and related technical services.
In connection with these services, Squarespace processes personal data on our behalf to the extent necessary to provide the website and online-shop functions.
The legal basis for processing necessary for the performance of contracts and pre-contractual measures is Article 6(1)(b) GDPR. Where processing is necessary for the secure, reliable and efficient operation of our website, the legal basis is Article 6(1)(f) GDPR.
Squarespace may use sub-processors and may transfer personal data outside the European Economic Area. Squarespace states that transfers to Squarespace, Inc. in the United States may be based on the EU-U.S. Data Privacy Framework and, where necessary, the European Commission's Standard Contractual Clauses. Squarespace
3. Data Collected When Visiting the Website
When you access our website, technical information necessary to provide and secure the website may be processed. This can include, in particular:
the page requested, date and time of access, browser and device information, operating system, referrer information and IP address.
The processing is carried out for the purpose of delivering the website, maintaining technical security, detecting errors and preventing misuse.
The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in operating a secure, stable and functional website.
4. Squarespace Activity Log
The Squarespace Activity Log is currently enabled on this website.
The Activity Log may record individual visits and associated technical information, such as the visited page, approximate location, referring source and operating-system information.
Squarespace currently makes individual visit information in the Activity Log available for the preceding seven days. Squarespace Help
The processing is based on Article 6(1)(f) GDPR and our legitimate interest in understanding technical website activity and detecting problems or misuse.
5. Cookies and Similar Technologies
We use cookies and similar technologies required for the operation of the website, checkout, security and other functions expressly requested by the visitor.
Where storage of or access to information on a visitor's device is technically necessary for the provision of the service expressly requested by the visitor, such processing is carried out in accordance with the applicable requirements of Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).
Non-essential cookies and comparable technologies are restricted until the visitor has made the relevant consent choice.
Where consent is required, processing is based on Article 6(1)(a) GDPR and Section 165(3) TKG 2021.
Visitors can use the cookie banner to:
Accept, Decline or Manage cookies.
Consent may be withdrawn at any time with effect for the future by changing the cookie preferences.
Squarespace provides the cookie-consent functionality used by this website. Your current configuration restricts non-essential cookies pending the visitor's consent choice. Squarespace Help
6. Orders and Contract Processing
When you place an order through our online shop, we process the personal data required to conclude and perform the contract.
This may include:
name, billing and delivery address, email address, telephone number where provided or required, ordered products, order value, payment status, shipping information and correspondence relating to the order.
The legal basis is Article 6(1)(b) GDPR.
We use this information to process and fulfil your order, communicate with you about the transaction, arrange delivery, process returns, handle warranty or service matters and comply with applicable accounting and tax obligations.
7. Payment Processing – Stripe
Online card payments on maro-bidet.com are currently processed using Stripe.
Depending on the payment method and processing context, payment information may be transmitted to and processed by companies within the Stripe group.
Stripe explains that for users and transactions outside the Americas, relevant Irish Stripe entities may act as controllers or processors depending on the particular Stripe service and processing activity. Stripe
Payment information may include, as necessary:
name, billing information, payment-card or payment-method information, transaction amount, currency, transaction identifiers and technical fraud-prevention information.
We receive from Stripe the information required to determine whether a payment has succeeded and to administer the transaction.
The legal basis for processing necessary to complete the payment and contract is Article 6(1)(b) GDPR.
Additional processing required by Stripe for fraud prevention, regulatory compliance or payment-security purposes may be carried out by Stripe under its own applicable legal bases.
PayPal, Square and Amazon Associates are not currently connected to this shop and are therefore not listed as active processing services in this Privacy Policy.
8. Delivery and Logistics Providers
To deliver orders, we disclose personal data to the transport or logistics provider selected for the relevant shipment.
The information transferred is limited to the data necessary for delivery and may include:
the recipient's name, delivery address, telephone number and/or email address where required for delivery coordination or notification, and information necessary to identify the shipment.
The specific transport provider varies depending on the destination, product, shipping method and logistical requirements.
The legal basis for information required to fulfil the delivery contract is Article 6(1)(b) GDPR.
This use of a provider category rather than naming one carrier for every order follows the implementation position previously agreed in response to Georg: where the recipient genuinely varies according to the transaction, an appropriate recipient category can be retained. Pasted markdown (3)(2)
9. Customer Communications
If you contact us by email or through functionality provided on the website, we process the personal data you provide for the purpose of answering and administering your request.
The legal basis is Article 6(1)(f) GDPR where the communication concerns a general inquiry and our legitimate interest is responding to customer communications.
Where the inquiry relates to a contract, order, quotation or pre-contractual request, the legal basis is Article 6(1)(b) GDPR.
Correspondence may be retained for as long as necessary to deal with the relevant matter and thereafter where required by statutory retention obligations or where reasonably necessary to establish, exercise or defend legal claims.
10. Newsletter and Marketing Email Signup at Checkout
Customers may voluntarily choose during checkout to subscribe to marketing emails.
Subscription is optional and is not required to place an order.
Where a customer actively chooses the newsletter option, the subscriber's contact information is stored in the Squarespace Contacts/subscriber system and may be used to send MARO GmbH marketing communications.
Squarespace confirms that customers who select the marketing option during checkout are stored as subscribers in its Contacts system. Squarespace Help
The legal basis is the subscriber's consent under Article 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future by using the unsubscribe link contained in marketing emails or by contacting:
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
We do not state that checkout subscriptions use Google reCAPTCHA or a double-opt-in confirmation procedure because Squarespace's checkout newsletter option does not use the separate subscriber-verification settings applicable to newsletter blocks and promotional pop-ups. Squarespace Help
11. YouTube Content
Some pages may contain embedded YouTube video content.
YouTube is a service of Google. Where an embedded YouTube component results in non-essential data being transferred to Google or information being stored on or accessed from the visitor's device, the relevant content should only be activated after the required consent has been given.
The legal basis for such optional processing is Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.
Data may be transferred to Google entities outside the EEA. Google is responsible for its own processing in accordance with its applicable privacy terms and transfer mechanisms.
Simple links from our website to external social-media or YouTube pages do not, by themselves, mean that those services receive personal data from us before you follow the link.
12. Google Analytics and Other Marketing Tracking
Google Analytics is currently not configured through Squarespace's Google Analytics integration on this website.
We therefore do not currently describe Google Analytics, Google Tag Manager, Meta/Facebook Pixel or similar marketing-tracking technologies as active processing services.
If such tools are introduced in the future, we will review and update this Privacy Policy and the consent configuration before activation.
This follows Georg's express recommendation that analytics or marketing tools which are not actually used should not be described as if they were active. Pasted markdown (3)(2)
13. Recipients of Personal Data
Depending on the relevant processing activity, recipients of personal data may include:
Squarespace as website, commerce and customer-data platform provider; Stripe for payment processing; the transport/logistics provider used for a particular order; professional advisers, accountants or authorities where disclosure is required by law or necessary for the establishment, exercise or defence of legal claims.
We identify stable recipients by name where reasonably possible. Where the recipient varies according to the individual transaction, such as the shipping carrier, the relevant category of recipient is described.
14. International Data Transfers
Some service providers or their sub-processors may process data outside the European Economic Area.
Where personal data is transferred to a country for which the European Commission has adopted an adequacy decision, the transfer may be based on that decision.
Where no adequacy decision applies, transfers are made subject to an appropriate transfer mechanism where required, such as the European Commission's Standard Contractual Clauses.
Squarespace states that Squarespace, Inc. participates in the EU-U.S. Data Privacy Framework and that its DPA also provides Standard Contractual Clauses where the Data Privacy Framework does not apply. Squarespace
The particular safeguards applicable to processing by Stripe depend on the relevant Stripe entity and service.
15. Retention of Personal Data
We retain personal data only for as long as necessary for the purposes for which it was collected and thereafter where retention is required by law or justified for the establishment, exercise or defence of legal claims.
Order, invoice and accounting documentation subject to Austrian statutory accounting and tax retention requirements is generally retained for seven years, subject to longer retention where required in relation to pending proceedings or other statutory requirements.
Squarespace Activity Log individual-visit information is currently available for approximately seven days. Squarespace Help
Newsletter subscription data is retained while the subscription remains active. After a subscriber withdraws consent or unsubscribes, their address will no longer be used for marketing. Limited information may continue to be retained where necessary to document the withdrawal of consent and ensure that marketing is not sent contrary to that withdrawal.
Customer-service and other correspondence is retained for as long as necessary to resolve the relevant matter and thereafter where statutory retention requirements or legitimate legal interests require further retention.
Where a precise retention period cannot reasonably be specified in advance, the applicable period is determined by the purpose of the processing, statutory retention obligations and the need to establish, exercise or defend legal claims.
This reflects Georg's instruction to state concrete periods where they can reasonably be determined and otherwise provide sufficiently clear criteria. Pasted markdown (3)(2)
16. Your Rights
Subject to the applicable statutory requirements, you have the following rights under the GDPR:
right of access under Article 15 GDPR; right to rectification under Article 16 GDPR; right to erasure under Article 17 GDPR; right to restriction of processing under Article 18 GDPR; right to information under Article 19 GDPR; right to data portability under Article 20 GDPR; right to object under Article 21 GDPR; and, where processing is based on consent, the right to withdraw consent at any time under Article 7(3) GDPR.
Where personal data is processed on the basis of Article 6(1)(f) GDPR, you have the right to object to processing on grounds relating to your particular situation.
Where personal data is processed for direct marketing purposes, you may object to such processing at any time.
17. Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data protection supervisory authority.
For MARO GmbH, the Austrian supervisory authority is:
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria
18. Security
We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
This website uses encrypted HTTPS/TLS connections for the transmission of information between your browser and the website.
19. Changes to this Privacy Policy
We may update this Privacy Policy where the website, the services we use, our processing activities or the applicable legal requirements change.
Before introducing new non-essential analytics, marketing or comparable tracking technologies, we will review the corresponding privacy information and consent configuration.