Privacy Policy

Last updated: 25 July 2026

1. Data controller

The controller of your personal data is:

Kräutergarten Lenz
Jakominiplatz 14, 8010 Graz, Austria
Email: [email protected]
Phone: +43 316 82 45 17

We have not appointed a Data Protection Officer. For privacy enquiries, contact us at the email above.

2. Legal framework

We process personal data in accordance with:

• Regulation (EU) 2016/679 (GDPR);
• the Austrian Data Protection Act (Datenschutzgesetz — DSG);
• the Austrian Telecommunications Act and e-commerce rules where applicable.

The supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde — DSB):

Barichgasse 40-42, 1030 Vienna, Austria
Website: www.dsb.gv.at
Email: [email protected]
Phone: +43 1 52 152-0

3. What data we collect

• Contact form data: name, email, phone (optional), topic and message;
• Communication data: emails and phone enquiries;
• Technical data: IP address, browser type and pages visited (via cookies — see our Cookie Policy);
• Order / visit data: information you provide when ordering plants, herb baskets or visiting the nursery.

4. Purposes and legal bases

• Responding to enquiries — Art. 6(1)(b) or 6(1)(f) GDPR;
• Fulfilment of contracts and orders — Art. 6(1)(b) GDPR;
• Legal obligations (accounting and tax) — Art. 6(1)(c) GDPR and applicable Austrian tax and accounting rules;
• Analytics — Art. 6(1)(a) GDPR (consent via cookie banner);
• Marketing — only with consent (Art. 6(1)(a) GDPR).

5. Retention

Enquiry data is kept as long as needed to handle your request and for a reasonable follow-up period, then deleted or anonymised unless longer retention is required by law (for example invoices). Cookie consent records remain until you clear them or update preferences.

6. Recipients

We do not sell your data. Hosting and email providers may process data on our behalf under appropriate agreements. Transfers outside the EEA occur only with suitable safeguards if ever required.

7. Your rights

Under GDPR you may request access, rectification, erasure, restriction, portability and object to certain processing. Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing. You may lodge a complaint with the DSB (details above).

8. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse.

9. Changes

We may update this policy periodically. The date at the top reflects the latest revision.