Privacy Policy

Datenschutzerklärung pursuant to the EU General Data Protection Regulation (GDPR/DSGVO) and the Austrian Datenschutzgesetz (DSG). Last updated: October 2026.

1. Controller

CARTON e.U. (Tokiol), Noriyuki Ito, Arsenal Objekt 3, Top 64, 1030 Vienna, Austria, contact@tokiol.io.

2. What data we process and why

Visiting the website. When you visit tokiol.io, technical data (IP address, browser type, date and time, pages viewed) are processed by our hosting provider to deliver the website securely. Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR). Server logs are deleted after a short period.

Orders and enquiries. When you order, request a price or contact us, we process your name, address, e-mail address, telephone number (optional), order details and payment status to conclude and perform the contract and to answer your enquiry. Legal basis: Art. 6(1)(b) GDPR. Invoices and accounting records are retained for 7 years under § 132 BAO (Art. 6(1)(c) GDPR).

Payment. Payments are processed by payment service providers; we do not receive your full card details. Depending on the method you choose, your data are processed by Shopify Payments (Shopify International Ltd., Dublin, Ireland, and its affiliates), PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, or the provider shown at checkout, each as an independent controller for the payment itself.

Shipping. To deliver your order we pass your name, address and, where required for delivery notifications, your e-mail address or telephone number to the carrier (e.g. Österreichische Post, DHL, UPS or a specialised art transport company). Legal basis: Art. 6(1)(b) GDPR.

Newsletter and invitations. If you sign up for our mailing list, we use your e-mail address to send news about exhibitions, fairs and new works. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link or by e-mail.

3. Hosting and e-commerce platform

This website is operated on the e-commerce platform of Shopify International Ltd., Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland, acting as our processor under a data processing agreement. Data may be transferred to Shopify Inc., Canada (adequacy decision of the European Commission) and to service providers in the United States on the basis of the EU–US Data Privacy Framework or standard contractual clauses. Our e-mail is operated with Google Workspace (Google Ireland Ltd.) under a data processing agreement.

4. Cookies

We use cookies that are strictly necessary for the shop to function (shopping cart, checkout, security, language). Analytics or marketing cookies are only set with your consent, which you can give or withdraw via the cookie banner.

5. Recipients and transfers

We share data only with the processors and independent controllers named above, with our tax adviser and accountant where required by law, and with authorities where legally obliged. We do not sell personal data.

6. Retention

We keep personal data only as long as necessary for the purposes described above or as required by statutory retention periods (in particular 7 years for accounting records). Enquiry data that do not lead to a contract are deleted after 12 months.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and the right to withdraw consent at any time with effect for the future. To exercise your rights, contact contact@tokiol.io. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).