As of: June 2026. Legal framework: General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
1. Controller
Responsible for data processing on this website:
NUI – Genossenschaft für Gesundheit und Wohlbefinden eG
Schulgasse 70, 6850 Dornbirn, Austria
Phone: +43 5572 721040 · Email: hello@nui-vital.com
Authorised managing board member: Enrico Mandl · Commercial register: FN 605146x, Landesgericht Feldkirch · VAT: ATU79569557
2. General information on data processing
We process personal data only insofar as this is necessary to provide a functional website as well as our content and services, or where you have given your consent. The legal bases are in particular:
- Art. 6(1)(a) GDPR – consent (e.g. newsletter, non-essential cookies, chatbot)
- Art. 6(1)(b) GDPR – performance/initiation of a contract (order processing, customer account)
- Art. 6(1)(c) GDPR – legal obligation (e.g. retention obligations)
- Art. 6(1)(f) GDPR – legitimate interest (secure, optimised operation of the website)
A transfer to third countries (in particular the USA) takes place only on the basis of adequacy decisions (EU-U.S. Data Privacy Framework), standard contractual clauses (SCC) or your explicit consent. Data processing agreements (DPA) pursuant to Art. 28 GDPR have been concluded with all processors.
3. Hosting
Our website is hosted by ALL-INKL.COM – Neue Medien Münnich (Hauptstraße 68, 02742 Friedersdorf, Germany). The server location is Germany (EU). The provider processes inventory, contact, content, usage and metadata on our behalf (Art. 6(1)(f) GDPR). Email is also sent via the host’s mail server (EU).
4. Server log files
The hosting provider automatically collects server log files transmitted by your browser (browser type/version, operating system, referrer URL, host name, time of the request, IP address). These data are not merged with other data sources and are deleted or anonymised after a short time. Legal basis: Art. 6(1)(f) GDPR.
5. Cookies & consent management
We use cookies and comparable technologies. We set technically necessary cookies on the basis of Art. 6(1)(f) GDPR or § 165(3) TKG 2021. We set all non-essential cookies only with your consent (Art. 6(1)(a) GDPR), which you can revoke at any time with effect for the future. For management we use Borlabs Cookie (Borlabs GmbH, Hamburg). Your consent settings are stored locally; you can adjust them at any time via the “Cookie settings” link.
6. SSL/TLS encryption
For security reasons, this page uses SSL/TLS encryption, recognisable by “https://” and the padlock symbol in the address bar.
7. Order processing & customer account
The shop is operated with WooCommerce (incl. WooCommerce Germanized). When you place an order, we process the data required to perform the contract (name, address, billing/delivery address, email, phone if applicable, order and payment data) on the basis of Art. 6(1)(b) GDPR. We only pass on these data insofar as this is necessary to process the contract (payment service provider, shipping service provider, ERP, tax advisor if applicable) or where we are legally obliged to do so. Tax and commercial retention periods (usually 7 years) remain unaffected. A customer account is optional and can be deleted at any time.
8. Payment methods
Payment data are processed for the performance of the contract (Art. 6(1)(b) GDPR).
- Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) is our payment service provider; it handles credit card, Stripe Link, Klarna, Amazon Pay and Sofort. Also applicable is the Stripe privacy policy. Stripe can transfer data to the USA (SCC/DPF).
- Klarna / Sofort: Klarna Bank AB (publ.), Stockholm, Sweden – Klarna privacy notice.
- Amazon Pay: Amazon Payments Europe S.C.A., Luxembourg.
- PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) – PayPal privacy notice.
- Prepayment/bank transfer, SEPA direct debit, purchase on account, cash on delivery – processing of the respectively required payment data.
9. Shipping
For delivery, we transmit the name and delivery address to the commissioned shipping service provider (Art. 6(1)(b) GDPR). For shipping notifications, the email address may also be transmitted.
10. Contacting us
When you contact us by email or form, we process your details to handle the request (Art. 6(1)(b) or (f) GDPR). The data are deleted as soon as they are no longer required and no retention obligations apply.
11. Newsletter / email marketing (Klaviyo)
For sending newsletters we use Klaviyo (Klaviyo Inc., Boston, USA). Registration takes place using the double opt-in procedure; the legal basis is your consent (Art. 6(1)(a) GDPR), which you can revoke at any time via the unsubscribe link. Processed in particular are the email address, registration data as well as open/click data. Klaviyo processes data in the USA (SCC/DPF).
12. ERP integration (Odoo)
For order, purchasing and inventory management, we transmit order and customer data to our ERP system Odoo (Art. 6(1)(b) GDPR; DPA pursuant to Art. 28 GDPR).
13. Remote website maintenance
For the technical maintenance of the website, we use iThemes/Solid Sync (StellarWP, USA) (Art. 6(1)(f) GDPR). In doing so, technical status/access data may be transferred to the USA (SCC).
14. Data backup
For data backup we use UpdraftPlus. The backups are stored locally at the host (EU).
15. Spam protection
To protect against spam, we use Antispam Bee (pluginkollektiv, Germany). The plugin works in a data-efficient manner and by default does not transmit any IP addresses to third parties.
16. Reviews (ProvenExpert)
For customer reviews we use ProvenExpert (Expert Systems AG, Berlin). Also applicable is the ProvenExpert privacy policy.
17. AI product advisor “Professor Nuno”
On the website we offer an AI chatbot (“Professor Nuno”) for product advice. When you use the chat, your inputs are transmitted, in order to generate the response, to Anthropic, PBC (San Francisco, USA) and processed there (Art. 6(1)(a)/(b) GDPR; transfer via SCC, data processing addendum). Please do not enter any sensitive personal data in the chat.
18. Your rights
You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) as well as objection (Art. 21). You can revoke consents given at any time with effect for the future. Contact: hello@nui-vital.com.
19. Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority, in Austria with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, DSB), Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at.
20. Storage period
We store personal data only for as long as is necessary for the respective purpose or as long as statutory retention periods (usually 7 years) exist. The data are then deleted.
