Privacy Policy

Last updated: 1 July 2026

Notice — Machine/Automatic Translation: This English version is provided for convenience only and was produced as an automatic translation of the original German-language Datenschutzerklärung. It is not a certified or legally binding translation. In the event of any discrepancy, ambiguity, or conflict between this English translation and the German original, the German-language version shall prevail and is the sole legally binding text. This Privacy Policy is governed by Austrian and EU data protection law (GDPR).

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Ilara Noir
Bargetzweg 7b
6800 Feldkirch
Austria

E-mail: contact@ilaranoir.com

Referred to below as “we” or “the Provider”.

2. General Information on Data Processing

We generally only process personal data of our users to the extent necessary to provide a functioning website and our content and services. Personal data is generally only processed with the consent of the user, or where permitted by law. Where consent is obtained for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis. For processing that is necessary for the performance of a contract, Art. 6(1)(b) GDPR serves as the legal basis. For processing necessary to comply with a legal obligation, Art. 6(1)(c) GDPR serves as the legal basis. Where processing is necessary to safeguard our or a third party’s legitimate interests, and the interests, fundamental rights, and freedoms of the data subject do not override those interests, Art. 6(1)(f) GDPR serves as the legal basis.

3. Your Rights as a Data Subject

As a data subject, you have the following rights against us:

  • the right to access your personal data stored by us (Art. 15 GDPR)
  • the right to rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR)
  • the right to erasure of data stored by us (Art. 17 GDPR)
  • the right to restriction of the processing of your data (Art. 18 GDPR)
  • the right to data portability, if you have consented to data processing or concluded a contract with us (Art. 20 GDPR)
  • the right to object to the processing, where it is based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
  • the right to withdraw any consent given, with effect for the future (Art. 7(3) GDPR)
  • the right to lodge a complaint with a supervisory authority (see Section 12)

To exercise these rights, an informal notification to contact@ilaranoir.com is sufficient.

4. Provision of the Website and Creation of Server Log Files

When you visit our website, our system automatically collects data and information from the computer system of the accessing device. The following data is collected in this process:

  • information about the browser type and version used
  • the user’s operating system
  • the user’s IP address
  • date and time of access
  • websites from which the user’s system reaches our website

This processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring the smooth operation of the website and the security of our information technology systems. This data is not combined with other data sources and is automatically deleted after 7 days at the latest, unless there is a legal obligation to retain it for longer.

5. Cookies

Our website only uses technically necessary cookies that are required for the operation of the website, in particular to keep users logged into their account and to enable the bidding function in auctions. These cookies process personal data only to the extent necessary for this purpose.

The legal basis is § 165(3) of the Austrian Telecommunications Act 2021 (TKG) in conjunction with Art. 6(1)(b) and (f) GDPR. No separate consent is required for technically necessary cookies.

We currently do not use any analytics, tracking, or marketing cookies. Should this change in the future, we will update this Privacy Policy accordingly and, where required, obtain your consent.

6. Registration and Subscription

Registration is required to access the digital content (photographs) provided on our website as part of a subscription. During registration we collect the following data:

  • name
  • e-mail address
  • username

This data is processed to establish, structure, and modify the subscription agreement and to provide the content. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

7. Payment Processing

Payment processing for subscriptions and auction purchases is carried out via the payment service provider PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). As part of payment processing, the data required for the transaction (e.g., name, payment amount, account information) is transmitted to PayPal.

The legal basis is Art. 6(1)(b) GDPR. Processing by PayPal itself is subject to PayPal’s own privacy policy, available at https://www.paypal.com/de/webapps/mpp/ua/privacy-full. As PayPal may also transfer data to the USA, this takes place on the basis of Standard Contractual Clauses issued by the European Commission as an appropriate safeguard under Art. 46 GDPR.

8. Participation in Online Auctions

For participation in our online auctions, we process the following personal data:

  • registration data (name, e-mail address, username, date of birth)
  • bid data (bid amount, time of bid)
  • upon acceptance of a bid: delivery address and payment data

The date of birth is collected for age verification purposes. The legal basis for this processing is Art. 6(1)(b) GDPR (performance of a contract).

9. Photographic Documentation of Sealed Goods

For the purpose of preserving evidence in the event of any disputes concerning the right of withdrawal, we create photographic documentation of the sealed goods and shipping packages prior to dispatch. This documentation is retained for a period of 3 years.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in being able to prove the proper condition of the goods at the time of shipment in the event of a dispute.

10. Contacting Us

If you contact us by e-mail (e.g., to contact@ilaranoir.com), the data you provide (your e-mail address, and if applicable your name, telephone number, and the content of your message) will be stored by us in order to process your inquiry.

The legal basis is Art. 6(1)(b) GDPR, where the inquiry relates to the initiation or performance of a contract, or otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

11. Newsletter

We currently do not offer a newsletter or e-mail marketing. Should we introduce a newsletter in the future, we will update this Privacy Policy accordingly. In that case, your data will be processed exclusively on the basis of your express consent under Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future.

12. Disclosure of Data to Third Parties

Your personal data is only disclosed to third parties where this is necessary for the performance of the contract or where we are legally required to do so. Recipients may include, in particular:

  • the payment service provider PayPal (see Section 7)
  • shipping providers engaged by us to deliver auctioned goods
  • our hosting provider, checkdomain, acting as a processor under Art. 28 GDPR
  • our tax advisor, in connection with statutory retention and reporting obligations
  • public authorities, where we are legally obliged to provide information

13. Transfer of Data to Third Countries

A transfer of data to countries outside the European Union or the European Economic Area (third countries) only takes place in connection with payment processing via PayPal (see Section 7). In this case, we ensure an adequate level of data protection through appropriate safeguards (Standard Contractual Clauses issued by the European Commission).

14. Retention Period

We generally only store personal data for as long as necessary to fulfil the respective purposes, or as required by law. In particular:

  • contract and subscription data: for the duration of the contractual relationship plus the statutory commercial and tax retention periods, generally 7 years (§ 132 Federal Fiscal Code (BAO), § 212 Austrian Commercial Code (UGB))
  • bid and auction data: for the duration of the auction, and, in the event of a successful bid, plus the statutory retention periods referred to above
  • photographic documentation of sealed goods: 3 years (see Section 9)
  • server log files: max. 7 days
  • e-mail inquiries: until final processing, thereafter in accordance with statutory retention periods

15. Data Security

We take appropriate technical and organizational measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

16. No Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

17. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy so that it continues to comply with current legal requirements, or to reflect changes to our services. The new Privacy Policy will then apply to your next visit.

18. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. The supervisory authority responsible for us is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria
Telephone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at
Website: https://www.dsb.gv.at