1. Data Controller
The person or business responsible for processing personal data on this website is:
Leah Maryline Okumu
Sippa Tea
Alte Poststraße 122
8020, Graz
Austria
Telephone: +43 650 2026108
Email: office@sippa.at
Website: sippa.at
If you have any questions regarding data protection or the processing of your personal data, you can contact us using the details above.
2. General Information About Data Processing
Protecting your personal data is important to us. We process personal data in accordance with applicable data-protection laws, particularly the EU General Data Protection Regulation (GDPR) and applicable Austrian data-protection legislation.
Personal data means any information relating to an identified or identifiable natural person. This may include, for example, your name, postal address, email address, telephone number or IP address.
We only collect and process personal information where there is a lawful reason to do so.
3. Website Hosting and Server Log Files
When you visit our website, technical information may automatically be collected and stored by our web server or hosting provider.
This information may include:
- IP address
- Date and time of access
- Pages or files accessed
- Browser type and browser version
- Operating system
- Referring website or URL
- Technical information relating to the request
This information may be processed to ensure the secure, reliable and technically correct operation of our website and to identify technical problems or unauthorised access.
Where applicable, the legal basis for this processing is our legitimate interest under Article 6(1)(f) GDPR in maintaining the security and proper functioning of our website.
Hosting provider: [name of hosting provider]
Location: [country/address where applicable]
4. Contacting Us and Contact Form
If you contact us through our website contact form, by email or by telephone, we process the information you provide in order to respond to your enquiry.
This may include:
- Your name
- Email address
- Telephone number, if provided
- Subject of your enquiry
- The content of your message
- Any additional information you voluntarily provide
Where your enquiry relates to an existing or potential contract, processing is generally based on Article 6(1)(b) GDPR.
For general enquiries, processing may be based on our legitimate interest in responding to customer and business enquiries under Article 6(1)(f) GDPR.
We retain this information only for as long as reasonably necessary to deal with your enquiry, unless legal retention requirements apply.
5. Online Shop and Orders
When you place an order through our online shop, we process personal information necessary to process and fulfil your purchase.
This may include:
- Full name
- Billing address
- Delivery address
- Email address
- Telephone number
- Products ordered
- Order value
- Payment status
- Delivery information
- Order history
The legal basis for processing this information is the performance of a contract or steps taken before entering into a contract under Article 6(1)(b) GDPR.
Certain business, accounting and tax information may also have to be retained in order to comply with legal obligations. In such cases, processing is based on Article 6(1)(c) GDPR.
We may share relevant information with payment providers, shipping companies and other service providers where necessary to fulfil your order.
6. Customer Accounts
Our website may allow customers to create an account.
When you create or use a customer account, we may process information such as:
- Your name
- Email address
- Billing address
- Delivery address
- Account details
- Order history
This information is processed to provide your customer account and facilitate your orders.
The legal basis is generally Article 6(1)(b) GDPR.
You may request deletion of your customer account. However, information relating to completed transactions may need to be retained where required by tax, accounting or other legal obligations.
7. Payment Processing
When you make a purchase, information required to process your chosen payment method may be provided to the relevant payment service provider.
The information transmitted depends on the payment method you choose.
Payment providers used by Sippa:
[Add your actual providers here — for example WooPayments, Stripe, PayPal, Klarna, bank transfer, etc.]
Payment information is processed primarily for the purpose of completing your purchase under Article 6(1)(b) GDPR.
Payment providers may process information under their own privacy policies and legal responsibilities.
8. Shipping and Delivery
To deliver your order, we may provide the necessary information to our delivery and logistics providers.
This may include:
- Customer name
- Delivery address
- Email address where necessary
- Telephone number where necessary
- Information required to arrange delivery
The legal basis is the performance of your purchase contract under Article 6(1)(b) GDPR.
Shipping/logistics providers used by Sippa:
[For example: Packlink, Austrian Post, DPD, GLS, DHL, etc.]
Only list companies that you actually use.
9. WooCommerce
Our online shop is operated using WooCommerce.
WooCommerce enables us to manage products, shopping carts, customer accounts, orders and checkout functions.
During the shopping process, technically necessary cookies or similar technologies may be used to maintain your shopping cart, customer session and checkout information.
Information processed through WooCommerce may include customer details, order details, account information and information necessary to complete your purchase.
10. Cookies and Similar Technologies
Our website may use cookies and similar technologies.
Cookies are small files stored on your device when you visit a website.
Some cookies are technically necessary for the website to function. These may be used for features such as:
- Shopping cart functionality
- Customer login
- Checkout
- Website security
- Session management
- Saving certain website preferences
Other cookies, such as analytics or marketing cookies, may require your consent before they can be used.
Where legally required, we obtain your consent before placing non-essential cookies.
You can manage your choices through our cookie-consent system where available.
Cookie consent provider/plugin:
[Complianz / Real Cookie Banner / CookieYes / other]
If you do not use one, this section should be adjusted accordingly.
11. Website Analytics and Statistics
Keep this section only if you use analytics or statistics tools.
We may use analytics tools to understand how visitors use our website and to improve our services.
Depending on the service used, information such as IP address, device information, browser information, pages visited and interaction data may be processed.
Analytics services used:
[Google Analytics / Matomo / Jetpack Statistics / other]
Where consent is legally required, analytics services are activated only after you have provided consent.
If Sippa does not use website analytics, you can remove this section.
12. Newsletter and Email Marketing
Keep this section only if you offer a newsletter or promotional email subscription.
If you subscribe to our newsletter, we use your email address to send you information about our products, offers, tea collections and company news.
Where required, we process your information on the basis of your consent under Article 6(1)(a) GDPR.
You can withdraw your consent at any time for future communications, for example by clicking the unsubscribe link contained in our newsletters.
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
Newsletter provider:
[MailPoet / Brevo / Mailchimp / other]
13. Recipients of Personal Data
Where necessary for the operation of our business and fulfilment of our services, personal information may be shared with appropriate service providers.
These may include:
- Website hosting providers
- IT service providers
- Payment providers
- Shipping and logistics companies
- Accounting or tax advisers
- Email or newsletter providers
- Website analytics providers
- Other service providers necessary to operate our business
Personal information is only disclosed where there is an appropriate legal basis for doing so.
14. International Data Transfers
Some service providers may process personal information outside Austria or outside the European Economic Area.
Where personal information is transferred to a country outside the European Economic Area, we take appropriate measures where required by law to ensure an adequate level of data protection.
Depending on the provider and destination country, these safeguards may include an adequacy decision by the European Commission or appropriate contractual safeguards.
This section should be adjusted according to the actual service providers used on sippa.at.
15. How Long We Keep Your Information
We retain personal information only for as long as necessary for the purposes for which it was collected.
Information may be retained for longer where required by legal obligations, including accounting, tax or commercial record-keeping requirements.
Once personal information is no longer required and there is no legal reason to continue storing it, it will be deleted or anonymised where appropriate.
16. Your Data Protection Rights
Subject to the conditions provided by the GDPR, you may have the right to:
- Request information about personal data we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information
- Request restriction of processing
- Object to certain processing
- Receive certain personal information in a portable format
- Withdraw consent where processing is based on consent
If you withdraw consent, the withdrawal applies to future processing and does not affect processing that was lawful before the withdrawal.
To exercise any of these rights, please contact us using the contact details provided at the beginning of this Privacy Policy.
17. Right to Lodge a Complaint
If you believe that your personal data has been processed in violation of data-protection law, you have the right to lodge a complaint with a competent supervisory authority.
In Austria, the responsible authority is:
Austrian Data Protection Authority
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria
18. Changes to This Privacy Policy
We may update this Privacy Policy when our website, business activities, service providers or legal requirements change.
We therefore recommend reviewing this Privacy Policy from time to time.
Last updated: September 2026