Privacy Policy

Last updated: 31 August 2026

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Maximilian Ecker
Culture Drops (sole proprietorship)
Kreuzgasse 18/11
1180 Vienna, Austria
Email: accounts@free-agents.io

We have not appointed a data protection officer, as we are not legally required to do so.

2. What we process, why, and on what legal basis

a) Visiting the shop

When you open our website, your browser automatically transmits data that is technically necessary to display the site: IP address, date and time of the request, browser type and version, operating system, referring page. This data is processed to deliver the site securely and reliably.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning, secure website).
Retention: Server log data is stored for a maximum of 30 days.

b) Orders and payment

To process an order we require your name, email address, billing and delivery address, and the details of the items ordered. Payment details (card number, account data) are entered directly with the payment provider and are not visible or stored by us.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (statutory retention obligations under tax and commercial law).
Retention: Order and invoice data is retained for seven years in accordance with § 132 of the Austrian Federal Fiscal Code (BAO).

c) Customer account

You can order as a guest. If you create a customer account, we store the data you enter there so you can access your order history and addresses.
Legal basis: Art. 6(1)(b) GDPR.
Retention: Until you delete the account, subject to statutory retention periods.

d) Contact and withdrawal form

If you write to us via the contact form, the withdrawal form, or by email, we process the data you provide in order to answer your request.
Legal basis: Art. 6(1)(b) GDPR for contractual enquiries, otherwise Art. 6(1)(f) GDPR.
Retention: Until the request is settled; withdrawal declarations are retained in line with the statutory periods.

e) Newsletter

If you subscribe to our newsletter, we process your email address to send you information about new drops. You can unsubscribe at any time using the link in every email or by writing to us.
Legal basis: Art. 6(1)(a) GDPR (consent), which you may withdraw at any time with effect for the future.
Retention: Until you unsubscribe.

f) Cookies, analytics and advertising

We use cookies and comparable technologies. Cookies that are strictly necessary for the shop to work — session, cart, security — are set on the basis of Art. 6(1)(f) GDPR. All other cookies, in particular for reach measurement and advertising, are only set once you have given your consent via our cookie banner.
Legal basis: Art. 6(1)(a) GDPR in conjunction with § 165(3) of the Austrian Telecommunications Act (TKG 2021).
You can change or withdraw your choice at any time via the cookie settings on this website.

3. Recipients and processors

We only pass on personal data where this is necessary to fulfil the contract or where you have consented. The following service providers process data on our behalf under data processing agreements pursuant to Art. 28 GDPR:

• Shopify International Ltd., Dublin, Ireland — shop system, hosting, checkout and payment processing.
• Printful (Printful Latvia SIA / Printful B.V.) — production and dispatch of the ordered items. Printful receives your name and delivery address.
• Shipping service providers commissioned by Printful — delivery of your parcel and, where applicable, dispatch tracking.
• Payment service providers shown at checkout (including Shopify Payments/Stripe, Apple Pay, Google Pay, Shop Pay) — payment processing. These providers are independently responsible for their own processing.
• Google Ireland Ltd. — reach measurement and advertising via the Google & YouTube sales channel, only after you have given consent.

4. Transfers to third countries

Some of the providers listed above process data outside the European Economic Area, in particular in the United States. In those cases the transfer is based on the European Commission's Standard Contractual Clauses or on the provider's certification under the EU-US Data Privacy Framework. Despite these safeguards, we cannot rule out that authorities in the recipient country may access the data.

5. Your rights

You have the right to request access to your personal data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object to processing based on legitimate interests at any time (Art. 21 GDPR), and you may withdraw any consent you have given at any time with effect for the future.

To exercise your rights, write to accounts@free-agents.io. We will respond within one month.

6. Right to lodge a complaint

If you believe that our processing of your data infringes data protection law, you may lodge a complaint with the supervisory authority:

Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna, Austria
Email: dsb@dsb.gv.at
www.dsb.gv.at

7. Obligation to provide data

Providing your contact and delivery data is necessary to conclude and perform a purchase contract. Without this data we cannot process an order. There is no obligation to provide any other data.

8. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

9. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our processing activities or in the legal framework. The current version always applies, and is available on this page.

Contact: accounts@free-agents.io