As of: September 2026
1. General Information
The protection of your personal data is important to us. We process your data exclusively on the basis of the General Data Protection Regulation (GDPR) and the applicable Austrian provisions (DSG, TKG 2021). In this privacy policy, we inform you about the data we process when you visit our online shop, place orders, and contact us, for what purposes, on what legal basis, and what rights you are entitled to.
2. Controller
Mag. Tanja Jakob-Tomazi
TOMAZONAS – Nahrungsergänzungsmittel (sole proprietorship)
Pudexing 33
5273 St. Veit im Innkreis, Austria
Phone: +43 660 7739 288
Email: tomazonas@gmx.at
For all questions regarding data protection and the exercise of your rights, please contact the email address above. A data protection officer has not been appointed, as there is no legal obligation to do so.
3. Hosting
This online shop is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Hostinger processes the data generated when the shop is accessed and when orders are placed on our behalf, based on a data processing agreement (Art. 28 GDPR). The servers are located in Brazil and therefore outside the European Union. The transfer is carried out on the basis of the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR) as well as supplementary technical protection measures (including TLS encryption). The legal basis is our legitimate interest in the secure and reliable provision of the shop (Art. 6(1)(f) GDPR) and/or the performance of a contract (Art. 6(1)(b) GDPR).
4. Server Log Files
When you visit the website, technically necessary information is automatically collected: IP address, date and time, page accessed, amount of data transferred, referrer URL, as well as browser and operating system. This data is used for operation, security, and error analysis, is not combined with other data, and is deleted after no more than 30 days, unless longer retention is required to investigate a security incident. The legal basis is Art. 6(1)(f) GDPR.
5. Cookies and Consent Management
This website uses cookies and similar technologies. We use technically necessary cookies on the basis of Section 165(3) of the Telecommunications Act 2021 (TKG 2021) and Art. 6(1)(f) GDPR. All other cookies and services (statistics and marketing, including embedded maps and videos) are only loaded after you have given your explicit consent via the cookie banner (Art. 6(1)(a) GDPR, Section 165(3) of the Telecommunications Act 2021 (TKG 2021)).
We use the WordPress plugin WP Consent to manage your consent. Your choice is stored in a cookie in your browser so that we can take it into account during future visits. We use Google Consent Mode (v2) in basic mode: as long as you have not given your consent, no Google services for statistics or advertising will be loaded.
You can revoke or change your consent at any time with effect for the future by reopening the cookie settings via the “Cookie Settings” icon or link. An overview of all cookies used, including provider, purpose, and storage duration, can be found in our Cookie Policy.
6. Orders and Customer Account
When you place an order in our online shop, we process the data required to do so: name, billing and delivery address, email address, phone number (optional), products ordered, payment method, as well as order and payment status. We need this data to process the purchase contract, for delivery, for invoicing, and for handling returns and warranty claims. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).
If you create a customer account, we also store your data in this account so that you can process future orders more easily and view your order history (Art. 6(1)(b) GDPR). You may have your account deleted at any time.
For delivery purposes, we transmit your name and delivery address to the shipping company we have commissioned; in the case of cash on delivery, we also transmit the amount to be collected. We only pass on a phone number or email address where this is necessary for delivery notifications (Art. 6(1)(b) GDPR). We retain invoices and accounting records for seven years in accordance with Section 132 of the Bundesabgabenordnung (Austrian Federal Fiscal Code); beyond this, order data is deleted as soon as it is no longer required for contract processing and any potential claims.
7. Payment with PayPal
If you choose to pay with PayPal, you will be redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, for payment processing. In doing so, we transmit the data required for payment (e.g. name, address, email address, order amount, and order number). PayPal may collect its own data for fraud prevention and creditworthiness checks; PayPal is solely responsible for this. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). Further information: https://www.paypal.com/at/legalhub/privacy-full
When paying by cash on delivery, payment is made upon handover to the shipping company; no data is passed on to payment service providers in this case.
8. Newsletter and Mailchimp
We use Mailchimp (The Rocket Science Group LLC d/b/a Mailchimp, 405 N Angier Ave. NE, Atlanta, GA 30308, USA; Intuit Inc.) to send our newsletter and manage our customer communications. You will only receive the newsletter if you have expressly subscribed to it and confirmed your registration (double opt-in); the legal basis is your consent (Art. 6(1)(a) GDPR, Section 174 TKG 2021). You can unsubscribe at any time via the unsubscribe link in each email.
Through the shop integration “Mailchimp for WooCommerce,” order and customer data may also be synchronized with Mailchimp in order to tailor communication with newsletter subscribers to their interests. Scripts from Mailchimp on our website are only loaded after you have given your consent in the “Marketing” category. Mailchimp is certified under the EU-U.S. Data Privacy Framework, and the transfer to the USA is based on this certification (Art. 45 GDPR). Further information: https://www.intuit.com/privacy/statement/
9. Affiliate Program (SliceWP)
We operate an affiliate program, which is implemented using the WordPress plugin SliceWP on our own web server. If you register as an affiliate, we process your details (e.g. name, contact details, payment information for commissions) to carry out the affiliate agreement (Art. 6(1)(b) GDPR).
If you reach our shop via an affiliate’s link, a cookie is stored in your browser that identifies the referring affiliate, so that any commission can be attributed in the event of an order. This cookie is only set after you have given your consent in the “Marketing” category (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). We do not share any customer data with the affiliate, only whether and in what amount a commission has been earned.
10. Contact (Form, Email, Phone)
If you contact us via the contact form, by email, or by phone, we process the data you provide (e.g. name, email address, phone number, your message) in order to process your inquiry. The legal basis is Art. 6(1)(b) GDPR (inquiries about orders or products) or Art. 6(1)(f) GDPR (general inquiries). Inquiries are deleted once they have been fully processed and no statutory retention obligations apply.
11. Contact via WhatsApp
You can also contact us via WhatsApp using a link (WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland). WhatsApp only opens once you click the link, and your message is transmitted via WhatsApp/Meta’s servers; this may involve a transfer to the USA (EU-U.S. Data Privacy Framework). The legal basis is Art. 6(1)(b) or (f) GDPR. Please note that WhatsApp is not intended for the transmission of sensitive health data; for this purpose, please use the phone or arrange a personal appointment instead.
12. Adobe Fonts
We use Adobe Fonts (Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland) to ensure a consistent display of fonts. When you access a page, your browser loads the fonts from Adobe’s servers; in doing so, technical data such as your IP address is transmitted to Adobe, and possibly also to Adobe Inc. in the USA (EU-U.S. Data Privacy Framework). According to Adobe, no cookies are set in this process. The legal basis is our legitimate interest in a consistent and appealing presentation of our online shop (Art. 6(1)(f) GDPR). Further information: https://www.adobe.com/privacy/policies/adobe-fonts.html
13. Google Tag Manager
We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Tag Manager is a tool for managing website tags; it does not itself set cookies or analyze data, but it may transmit technical data such as the IP address to Google when loaded. Services integrated via Tag Manager are only activated after your consent. The legal basis is Art. 6(1)(f) GDPR or, insofar as services are triggered, your consent (Art. 6(1)(a) GDPR).
14. Google Analytics 4
With your consent, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to statistically analyze the use of our website and improve it. This involves processing data such as pages visited, time spent on the site, approximate location (without storing the full IP address), and device and browser data, as well as setting cookies. Data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. The data is deleted after 14 months. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can revoke at any time in the cookie settings. Further information: https://policies.google.com/privacy
15. Links to External Platforms
Our website contains links to external platforms (e.g. doctor review and appointment portals or social networks). Data is only transmitted to the respective provider once you follow a link; that provider is solely responsible for any processing carried out there.
16. Your Rights
You generally have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR). You may revoke any consent you have given at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before the revocation. Please direct your request to the email address stated above.
If you believe that the processing of your data violates data protection law, you may lodge a complaint with a supervisory authority, in particular in the member state where you reside or work. The authority responsible for us is: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.
17. Data Security and Changes
For security reasons, this website uses TLS encryption (recognizable by the padlock icon and “https://”). We will update this privacy policy if the services we use or the legal situation changes; the version published here at any given time shall apply.