Privacy Policy

Section 1 — Purpose, Scope and Data Protection Principles

1.1 Purpose

This Privacy Policy explains the fundamental principles governing the processing of personal data within the DaDa Design Platform, including the purposes and legal bases of processing, recipients, retention, and the rights of data subjects.

1.2 Applicable Law

Personal data are processed in accordance with Regulation (EU) 2016/679 (GDPR), the Austrian Data Protection Act (Datenschutzgesetz – DSG), applicable electronic communications and privacy rules, and other mandatory data protection laws.

1.3 Scope

This Policy applies to Platform visitors, account holders, purchasers, support users, rights holders, persons using contact forms, and other natural persons who communicate electronically with the Platform.

1.4 Data Controller

The controller is TRAFO e.U., operator of the DaDa Design brand and Platform, Werkhalle 2.2, Krautfeldweg 13, 6406 Oberhofen im Inntal, Tyrol, Austria. Website: dadadesign.at. Email: info@dadadesign.at. VAT ID (UID): ATU 83535818. Austrian Business Register Number (Firmenbuchnummer / FN): 683400 a.

1.5 Related Legal Documents

This Policy forms part of DaDa Design’s integrated legal framework together with the Terms of Use, Distance Sales and Digital Collectible Delivery Agreement, Cookie Policy, Payment Policy, Intellectual Property and Licence Policy, Digital Certificate and Ownership Policy, and Master Foundation.

1.6 Data Protection Principles

TRAFO e.U. applies the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.

1.7 Data Security

Appropriate technical and organisational measures are applied according to risk to protect personal data against unauthorised access, unlawful processing, alteration, loss, deletion, disclosure and misuse.

1.8 Digital Collectible Asset Data Management

After digital delivery is completed, the delivered original high-resolution file may be removed from operational systems in accordance with security, data-minimisation and intellectual-property policies. Limited verification records may remain, including low-resolution thumbnails, unique asset identifiers, certificate data, ownership records, transaction records and technical verification data.

1.9 Payment Data

Payments are processed through licensed payment service providers. Unless expressly stated otherwise, TRAFO e.U. does not store full payment-card numbers, CVV/CVC codes, online-banking passwords or comparable sensitive payment credentials. Limited transaction records may be processed for payment verification, fraud prevention, chargebacks, accounting and legal compliance.

1.10 Updates

This Policy may be updated because of legal, technological, service, processing or information-security changes. Material changes will be communicated where required by law.

Section 2 — Categories of Personal Data Processed

2.1 General

Only personal data necessary for Platform services, contractual obligations, information security, legal compliance and legitimate business interests are processed.

2.2 Identity and Account Data

Name, surname, username, account number, User ID, account creation date, account status, verification information and membership preferences may be processed.

2.3 Contact Data

Email address, telephone number if provided, correspondence, support requests and information submitted through contact forms may be processed.

2.4 Order and Contract Data

Order number and date, purchased Digital Collectible Asset, delivery records, electronic consents and acceptances, contract-version information, invoice information and transaction history may be processed.

2.5 Payment Transaction Data

Payment status and method, transaction number, confirmation information, date, currency and limited information received from the payment service provider may be processed.

2.6 Digital Collection and Ownership Records

Collection ID, Digital Certificate Number, Ownership ID, Asset ID, unique product identifier, delivery status and time, and verification records may be processed.

2.7 Technical System Records

IP address, device and browser information, operating system, session data, Session ID, access and system logs, timestamps, error logs and security records may be processed for security, administration and legal compliance.

2.8 Security and Fraud-Prevention Data

Unusual login records, failed login attempts, suspicious transaction records, security-verification results, risk-analysis records, device-verification information and transaction-security records may be processed.

2.9 Support Records

Support correspondence, emails, ticket numbers, technical explanations and documents or information supplied by users may be processed.

2.10 Technical Records Relating to Digital Files

The original high-resolution file is not ordinarily archived on behalf of the user after delivery. Necessary low-resolution thumbnails, asset identifiers, certificate information, delivery records, transaction records, timestamps and verification data may remain.

2.11 Automated Security Systems

Automated systems may be used for fraud detection, unusual-transaction analysis, multiple-account detection, account security, cyberattack prevention and system security, subject to applicable data protection law.

2.12 Data Minimisation

Data that are unrelated or unnecessary for a defined purpose are not intentionally collected or retained and are deleted, anonymised or otherwise rendered unavailable when no longer necessary, subject to legal obligations.

Section 3 — Purposes and Legal Bases of Processing

3.1 General

Each processing activity is based on at least one lawful basis under applicable data protection law and is limited to specified, explicit and legitimate purposes.

3.2 Contract Performance — Article 6(1)(b) GDPR

Data may be processed to create accounts, receive orders, perform digital delivery, create ownership records, operate the Digital Certificate system, issue invoices, provide support and fulfil user requests.

3.3 Legal Obligations — Article 6(1)(c) GDPR

Data may be processed for tax and accounting obligations, statutory retention, court orders, lawful authority requests and other compliance duties.

3.4 Legitimate Interests — Article 6(1)(f) GDPR

Data may be processed for Platform and information security, cyberattack and fraud prevention, account security, electronic records, protection of legal rights, dispute resolution, service improvement and system-performance monitoring, after appropriate balancing where required.

3.5 Consent — Article 6(1)(a) GDPR

Where consent is legally required, processing is based on freely given consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

3.6 Digital Collectible Technical Records

Asset IDs, certificate records, delivery and transaction records, low-resolution verification thumbnails, timestamps and verification data may be processed on the basis of contract performance, legal obligations, information security and legitimate interests, as applicable.

3.7 Payment Processing

Licensed payment providers process payments. TRAFO e.U. may process payment status, transaction number and limited order-linked transaction data, but does not ordinarily process or store full card numbers or CVV/CVC data.

3.8 Security and Fraud Prevention

Necessary personal data may be processed to detect suspicious transactions, unusual logins, multiple accounts, unauthorised access and misuse, and to preserve electronic evidence.

3.9 Legal Claims

Necessary data may be processed for dispute resolution, legal proceedings, establishment, exercise or defence of legal claims and preservation of evidence.

3.10 Further Processing

Where personal data are to be further processed for a materially different purpose, information required by applicable law will be provided before such further processing.

Section 4 — Sharing and Transfers of Personal Data

4.1 General

Personal data are not sold, rented or marketed to third parties for independent commercial gain. They are shared only where necessary and lawful.

4.2 Service Providers

Necessary data may be shared with payment, hosting, cloud, email, security, technical-support, analytics and backup providers. Processors acting on behalf of TRAFO e.U. are required to act on documented instructions and apply appropriate safeguards.

4.3 Payment Service Providers

Payment providers are responsible for their own processing where they act as independent controllers. Their privacy notices may apply separately.

4.4 Accounting and Tax

Necessary data may be disclosed to accountants, tax advisers and other financial professionals as permitted or required by law.

4.5 Legal Advisers

Necessary data may be shared with lawyers, legal advisers and experts for prevention or resolution of disputes and protection of legal rights.

4.6 Public Authorities and Courts

Data may be disclosed to courts, prosecutors, law-enforcement bodies, administrative authorities, data protection authorities and other competent bodies where lawfully required.

4.7 Business Reorganisation

In a merger, restructuring, transfer of the business or relevant business activity, personal data may be transferred to a legal successor in accordance with applicable law and appropriate safeguards.

4.8 International Transfers

Where data are transferred outside the European Economic Area, appropriate safeguards are used where required, including European Commission adequacy decisions, Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms.

4.9 Digital Collection Records

Certificate, Ownership ID, Asset ID, thumbnail, transaction and delivery records are not transferred to third parties for independent commercial sale; they may be used or shared only as necessary for verification, legal obligations, security, fraud prevention and disputes.

4.10 Transfer Information

Where required by Articles 13–14 GDPR, data subjects will be informed about third-country transfers and the applicable safeguards.

Section 5 — Retention, Retention Periods and Secure Deletion

5.1 General

Personal data are retained only for as long as necessary for the relevant purpose and as required or permitted by law. Data needed for disputes, claims, audits or legal retention may be retained for the applicable period.

5.2 Retention Criteria

Retention is determined by processing purpose, contractual duties, statutory retention requirements, tax and accounting law, potential disputes, security needs and data-minimisation principles.

5.3 Digital Collectible Files

Unless expressly promised otherwise in writing, delivered original high-resolution files are not archived indefinitely for users and may be removed from operational systems after delivery.

5.4 Technical Records Retained

Necessary Digital Certificate records, Ownership IDs, Asset IDs, unique product identifiers, low-resolution verification thumbnails, transaction and delivery records, timestamps, security logs and evidence relevant to disputes may remain.

5.5 Redelivery and Archiving

TRAFO e.U. does not guarantee indefinite storage, renewed download availability or redelivery of the original high-resolution file unless expressly agreed or legally required. Users are responsible for securely storing and backing up delivered files.

5.6 Secure Deletion

When retention is no longer necessary and no legal obligation applies, personal data are securely deleted, anonymised or irreversibly rendered unavailable using measures appropriate to the risk.

5.7 Legal Holds

Where a dispute, official investigation or legal obligation is pending, relevant data may be retained for as long as reasonably necessary for that matter.

Section 6 — Rights of Data Subjects

6.1 General

Subject to the conditions and limitations of applicable law, data subjects have rights concerning their personal data.

6.2 Information and Access

Data subjects may request information about whether their data are processed and may exercise the right of access under Article 15 GDPR.

6.3 Rectification

Incorrect or incomplete personal data may be corrected under Article 16 GDPR.

6.4 Erasure

Erasure may be requested under Article 17 GDPR. The request may be limited where processing remains necessary for legal obligations, tax/accounting requirements, legal claims, fraud prevention, security, certificate integrity or verification records.

6.5 Restriction

Restriction of processing may be requested under Article 18 GDPR where the statutory conditions are met.

6.6 Data Portability

Where Article 20 GDPR applies, eligible data may be provided in a structured, commonly used and machine-readable format.

6.7 Objection

Data subjects may object to processing under Article 21 GDPR where the statutory conditions apply.

6.8 Withdrawal of Consent

Consent may be withdrawn at any time where processing is based on consent, without affecting prior lawful processing.

6.9 Automated Decisions

Data subjects have the rights provided by Article 22 GDPR in relation to solely automated decisions producing legal or similarly significant effects.

6.10 Requests and Identity Verification

Requests may be submitted to info@dadadesign.at. Reasonable additional information may be requested where necessary to verify identity.

6.11 Response Period

Requests are handled within the periods required by GDPR, ordinarily within one month, subject to lawful extensions in complex cases.

6.12 Complaint

Data subjects may lodge a complaint with the competent supervisory authority, including the Austrian Data Protection Authority (Österreichische Datenschutzbehörde – DSB), without prejudice to other administrative or judicial remedies.

Section 7 — Information Security and Personal Data Protection

7.1 General

TRAFO e.U. applies risk-appropriate technical and organisational measures to preserve confidentiality, integrity and availability.

7.2 Technical Measures

Measures may include access controls, authentication, encryption where appropriate, firewalls, security logging, updates, backups, intrusion detection, malware protection and security monitoring.

7.3 Organisational Measures

Measures may include access limitation, separation of duties, personnel authorisation, confidentiality obligations, security procedures and internal reviews.

7.4 Digital Collectible Security

Special procedures may be used to protect unique Digital Collectible Assets. Original high-resolution files may be removed after delivery while limited verification records remain.

7.5 User Responsibilities

Users are responsible for protecting account credentials, delivered files, devices and backups and for taking reasonable steps against unauthorised access.

7.6 Security Incidents

Security incidents affecting personal data are assessed and managed. Where legally required, breaches are notified to competent authorities and affected persons in accordance with GDPR.

7.7 Third-Party Security

TRAFO e.U. considers reasonable security and data-protection standards when selecting relevant service providers, without excluding any liability that cannot lawfully be excluded.

Section 8 — Cookies and Similar Technologies

8.1 General

The Platform may use cookies and similar technologies for secure, efficient and user-friendly operation in accordance with applicable privacy and electronic-communications rules.

8.2 Categories

Cookies may include strictly necessary, security, session, preference, performance/analytics and functionality cookies.

8.3 Necessary Cookies

Necessary cookies may support session management, login verification, security controls, order continuity, payment processing and server security.

8.4 Analytics and Preferences

Analytics or other non-essential cookies requiring consent are activated only after the required consent has been obtained. Preference cookies may remember language and display settings.

8.5 Cookie Management

Users may manage preferences through browser settings or Platform cookie controls. Disabling necessary cookies may impair Platform functionality.

8.6 Third-Party Technologies

Third-party services may use their own cookies or similar technologies and their own privacy/cookie notices may apply.

8.7 Separate Cookie Policy

More detailed information, including specific technologies where applicable, should be provided in the separately published Cookie Policy and consent interface.

Section 9 — International Data Transfers

9.1 General

Transfers outside the EEA take place only where permitted by applicable law and subject to required safeguards.

9.2 Providers

International transfers may arise from payment, cloud, hosting, email, CDN, security, analytics or other technical services.

9.3 Safeguards

Where required, safeguards may include adequacy decisions, SCCs, Binding Corporate Rules or other mechanisms recognised by applicable law.

9.4 Transfer Security

Appropriate measures may include encryption, access controls, contractual safeguards, minimisation and security reviews.

9.5 Original Digital Files

TRAFO e.U. does not retain or transfer delivered original high-resolution files internationally on behalf of users merely for archival purposes, subject to mandatory legal requirements.

Section 10 — Automated Processing, Ai-assisted Systems and Security Analysis

10.1 General

Automated technical systems and AI-assisted technologies may be used for Platform security, service quality and misuse prevention in accordance with applicable data protection law.

10.2 Purposes and Data

Such systems may support fraud detection, suspicious-payment analysis, account security, unusual-behaviour analysis, multiple-account detection, abuse prevention, performance improvement, error analysis and cyberattack prevention. Relevant technical data may include IP, session, device/browser, timestamps, security logs, order information, payment status and verification records.

10.3 Solely Automated Decisions

TRAFO e.U. does not intend to make decisions based solely on automated processing that produce legal effects or similarly significantly affect a person, except where lawfully permitted with the safeguards required by Article 22 GDPR.

10.4 Human Review

Automated security outputs may be supported by human review where appropriate. Where Article 22 applies, applicable rights to human intervention, expression of the data subject’s view and contesting a decision are respected.

10.5 AI-Assisted Design

AI-assisted tools may be used in creating or developing Digital Collectible Assets. This does not by itself change contractual rights, licence terms or ownership records.

10.6 Temporary Security Measures

Where objective security indicators exist, order processing may be paused, digital delivery reasonably delayed, additional verification requested or a transaction subjected to security review, only to the extent necessary and lawful.

Section 11 — Data Protection Requests and Contact Procedure

11.1 Contact

Data protection requests may be sent to TRAFO e.U. at info@dadadesign.at or through other official contact channels published on dadadesign.at.

11.2 Identity Verification

Reasonable additional information may be requested where necessary to confirm the requester’s identity and prevent unauthorised disclosure.

11.3 Manifestly Unfounded or Excessive Requests

Where permitted by Article 12 GDPR, manifestly unfounded or excessive requests may be refused or a reasonable fee may be charged, subject to the statutory conditions.

11.4 Protection of Third Parties

Responses will not unlawfully disclose third-party personal data, trade secrets, intellectual property or information-security details.

11.5 Records

Electronic transaction records, timestamps, consents, delivery records, security logs, certificate records, Ownership IDs, Asset IDs and technical verification records may be reviewed where necessary to handle a request and comply with law.

Section 12 — Supervisory Authority and Right to Complain

12.1 Right to Complain

A data subject who considers that personal data have been processed unlawfully may contact TRAFO e.U. and may lodge a complaint with a competent supervisory authority.

12.2 Austrian Data Protection Authority

For processing subject to Austrian supervision, the competent authority may include the Österreichische Datenschutzbehörde (Austrian Data Protection Authority – DSB), Barichgasse 40–42, 1030 Vienna, Austria. Data subjects may also have the right to complain to another competent supervisory authority under GDPR.

12.3 Judicial Remedies

A complaint to a supervisory authority does not exclude other administrative or judicial remedies available under applicable law.

12.4 Cooperation

TRAFO e.U. cooperates with competent data protection authorities to the extent required by applicable law.

Section 13 — Children’s Personal Data and Age Restrictions

13.1 General

The Platform is designed for persons legally capable of carrying out the relevant transactions. TRAFO e.U. does not intentionally offer services directed at children or knowingly collect children’s personal data except where permitted by law.

13.2 Age and Authority

Users are expected to be legally authorised under applicable law to create an account, purchase Digital Collectible Assets and enter into related legal transactions. Reasonable age or identity verification may be requested where necessary.

13.3 Detection of Child Data

If TRAFO e.U. becomes aware of unlawful processing of a child’s data, it may investigate the account, request verification, restrict processing, delete data where required and suspend relevant transactions.

13.4 Parent or Legal Representative Requests

A person who proves parental responsibility or legal representation may exercise applicable data protection rights concerning a child, subject to verification and applicable law.

13.5 Necessary Records

Actions under this section do not automatically invalidate or require deletion of certificate, Ownership ID, Asset ID, delivery or legally relevant evidence records where continued retention is lawful and necessary.

Section 14 — Policy Updates, Effective Date and Final Provisions

14.1 Updates

This Policy may be updated to reflect legal developments, changes in processing, technology, services or security requirements.

14.2 Effective Date

The current version becomes effective on the date stated or published on the Platform, subject to any mandatory advance-notice or consent requirements.

14.3 Material Changes

Material changes will be communicated by appropriate means where required by applicable law.

14.4 Previous Versions

Previous versions may be retained where necessary for legal compliance, audit, evidence and dispute resolution.

14.5 Electronic Records

Electronic records relating to policy versions, notices and consents may be retained and used as evidence to the extent permitted by law.

14.6 Relationship with Other Documents

This Policy must be read consistently with the other DaDa Design legal documents. More specific provisions may govern specific processing activities, subject always to mandatory law.

14.7 Contact and Controller Details

Controller: TRAFO e.U., Werkhalle 2.2, Krautfeldweg 13, 6406 Oberhofen im Inntal, Tyrol, Austria. Brand/Platform: DaDa Design. Website: dadadesign.at. Email: info@dadadesign.at. VAT ID (UID): ATU 83535818. Firmenbuchnummer / FN: 683400 a.

Recipients and Sub-Processors

The following section supplements the policy text above. The service providers referred to only by category in Section 4 are named here individually; the list reflects the services actually used on this site, as verified in the source code. It is updated on the same day the list of recipients changes.

Recipient	Data processed	Purpose	Where
Stripe — payment service provider (European contracting entity: Stripe Payments Europe, Limited, Ireland)	Email address, user ID, order number and order ID, amount and currency. The card number, expiry date and security code are entered directly on Stripe’s own payment page; those data never reach the Business’s systems.	Initiating, completing and verifying the payment; refunds and chargeback handling; prevention of fraud.	The European contracting entity is established in Ireland. Processing within Stripe’s own infrastructure is governed by Stripe’s privacy policy.
Cloudflare — hosting, content delivery network (CDN) and bot protection (Turnstile)	Connection data processed at infrastructure level on every request (IP address, browser and device information, request and security logs), together with the Platform data stored on that infrastructure: account, order and delivery records, file storage and the delivery queue. Turnstile assesses whether a form submission was made by an automated tool.	Publishing and serving the site; hosting the data; information security and the prevention of cyber-attacks and form abuse.	Where a transfer leaves the European Economic Area, the safeguards described in Section 9 apply.
Resend — transactional email delivery	The recipient’s email address and the subject and content of the message: account verification, password reset, welcome and account notices, bank-transfer instructions and reminders, delivery notices and the download link.	Delivery of the transactional emails required for performance of the contract and for account security.	Sending is configured for the provider’s EU region (eu-west-1).

This list covers the technical service providers that process personal data on behalf of the Business. The tax advisers, legal advisers and public authorities referred to in Sections 4.4, 4.5 and 4.6 are not processors; they are involved only to the extent necessary in a given case and within the framework described in those sections.

No third-party service is used on the Platform for marketing, advertising, profiling or visitor analytics. The role of these providers with regard to cookies and browser storage is explained separately in the Cookie Policy.