Privacy Policy

Last updated: 3 October 2026

This Privacy Policy explains how ILVIE LITTLE & FRIENDS GmbH (“we”, “us” or “our”) collects, uses, stores and shares personal data when you visit our website and online store, purchase our products, contact us, subscribe to our communications or otherwise interact with us.

This Privacy Policy applies to our website and online store. Separate privacy information may apply to individual apps or other services, such as the Luna Octopus App.

1. Controller

The controller responsible for the processing of personal data through this website is:

ILVIE LITTLE & FRIENDS GmbH
Rechte Wienzeile 37/3/3a
1040 Vienna
Austria

Email: ilvie@ilvielittle.com

2. Personal Data We Process

Depending on how you use our website and services, we may process the following categories of personal data:

Website and device data
This may include your IP address, browser type, device information, operating system, time zone, language, pages viewed, referring pages, interactions with the website and cookie or consent information.

Order and customer data
When you place an order, we may process your name, billing and shipping address, email address, telephone number, order details, purchased products, payment status, shipping information and information required to process returns or refunds.

Payment data
Payments are processed by Shopify and/or the payment provider selected during checkout. Depending on the payment method, the relevant payment provider may process payment details directly. We generally do not receive or store complete payment card details.

Contact and customer service data
If you contact us, we process the information you provide, such as your name, email address, order number, message and any documents or images you send us.

Newsletter and marketing data
If you subscribe to our newsletter or other marketing communications, we process your email address and information relating to your subscription and consent.

Withdrawal information
If you use our online withdrawal function, we process the information necessary to receive, document and process your withdrawal, including your name, email address, order number, information about the relevant items and the content and time of your withdrawal declaration.

Consent information
When you make choices through our cookie consent system, information about your consent or refusal may be recorded, including a consent identifier, date and time, consent preferences, device type, country or region and a shortened or masked IP address.

3. Why We Process Personal Data and Our Legal Bases

We process personal data only where we have a legal basis to do so.

Orders and fulfilment

We process order, customer, payment and shipping information in order to accept and fulfil orders, process payments, deliver products, communicate about orders and handle returns, refunds and complaints.

The legal basis is primarily Article 6(1)(b) GDPR, where processing is necessary to perform a contract or take steps at your request before entering into a contract.

Legal obligations

We process and retain certain information where required by law, including information necessary for accounting, tax, consumer protection, product safety and withdrawal obligations.

The legal basis is Article 6(1)(c) GDPR.

Customer service and communication

When you contact us, we process the information you provide in order to answer your request and provide customer service.

Depending on the nature of your request, processing is based on Article 6(1)(b) GDPR or our legitimate interest in communicating with customers and responding to enquiries under Article 6(1)(f) GDPR.

Newsletter and marketing communications

Where required, we send newsletters and marketing communications on the basis of your consent under Article 6(1)(a) GDPR.

You can withdraw your consent at any time, for example by using the unsubscribe link contained in our emails. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Website security and fraud prevention

We may process technical, device, transaction and order information to protect our website, customers and business against fraud, misuse, security incidents and other unlawful activity.

Processing may be based on our legitimate interests under Article 6(1)(f) GDPR and, where applicable, on legal obligations under Article 6(1)(c) GDPR.

Cookies, analytics and similar technologies

Technically necessary cookies and technologies may be used where required to provide the website, shopping cart, checkout, security, consent management and other services expressly requested by you.

Where consent is legally required, in particular for non-essential analytics, marketing or similar technologies, these technologies are used only after you have given your consent.

The legal basis for subsequent processing of personal data is generally Article 6(1)(a) GDPR.

4. Shopify

Our online store is operated using Shopify.

Shopify processes personal data on our behalf where necessary to provide the online store, checkout, order management, hosting, security and related services. In certain circumstances, Shopify may also process personal data as an independent controller in accordance with its own privacy information.

This may include customer and order information, device and usage information, IP addresses and information required for payments, security and fraud prevention.

For merchants in Europe, Shopify's primary contracting entity is Shopify International Limited in Ireland. Shopify may use affiliated companies and service providers in other countries.

5. Payment, Shipping and Fulfilment Providers

To process purchases and deliver orders, personal data may be transmitted to payment providers, banks, shipping companies, postal services and other fulfilment providers where this is necessary to complete your order.

Only the information required for the relevant service is transmitted.

The legal bases are Article 6(1)(b) GDPR and, where applicable, Article 6(1)(c) GDPR.

6. Online Withdrawal Function

We provide an electronic function that allows consumers to declare their withdrawal from a contract online.

For this purpose we use the Shopify app EU Widerrufs-Button & Formular, provided by:

401layers UG (haftungsbeschränkt)
Dorothea-Erxleben-Str. 1a
40721 Hilden
Germany

When you use the withdrawal function, information such as your name, email address, order number, information about the relevant items and your withdrawal declaration is processed. Technical information such as IP address, browser, device information and the date and time of submission may also be processed.

The information is used to receive, document, confirm and process your withdrawal and to send the required confirmation.

Processing is based primarily on our legal obligations under Article 6(1)(c) GDPR and, where applicable, on the processing necessary to reverse or administer the contractual relationship under Article 6(1)(b) GDPR.

401layers processes information on our behalf in connection with providing the withdrawal service.

7. Cookie Consent Management – Pandectes

We use Pandectes GDPR Compliance to manage and document cookie and privacy choices on our website.

Pandectes may process information relating to your consent choices, including a randomly generated consent identifier, date and time of consent, consent status and preferences, device type, country or region and a masked IP address.

This processing allows us to remember and document your privacy choices and demonstrate compliance with applicable privacy and consent requirements.

Where processing is necessary to document consent and comply with legal obligations, the legal basis is Article 6(1)(c) GDPR. Where necessary for the secure and effective operation of our consent management system, processing may also be based on our legitimate interests under Article 6(1)(f) GDPR.

8. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Some technologies are strictly necessary for the operation of the website and online store. These may be required, for example, for navigation, shopping cart functions, checkout, security, customer accounts and storing your privacy choices.

Other technologies may be used for analytics, functionality, embedded content or marketing. Where legally required, these technologies are activated only after you have given your consent.

You can accept, reject or customise optional technologies through our cookie consent tool. You can also change or withdraw your consent later through the privacy or cookie settings provided on the website.

Individual cookies and technologies may have different storage periods. Current information about available categories and consent options is provided through our consent management tool.

9. Embedded Video Content – Vimeo

We use videos hosted by Vimeo.com, Inc. and may embed Vimeo's video player on our website.

When Vimeo content is loaded, technical information such as your IP address, device and browser information and information about your interaction with the video may be transmitted to Vimeo. Vimeo may also use cookies or similar technologies.

Where loading Vimeo content or related non-essential technologies requires consent, the content or technologies are activated only after you have provided the relevant consent.

Vimeo is based in the United States and may process data in the United States and other countries.

10. Recipients of Personal Data

Where necessary for the purposes described in this Privacy Policy, personal data may be shared with categories of recipients including:

• Shopify and its service providers;
• payment service providers and financial institutions;
• shipping, postal and fulfilment providers;
• IT, hosting and security service providers;
• email and communication service providers;
• consent management providers;
• providers of embedded media and website functionality;
• professional advisers such as accountants, tax advisers or legal advisers;
• public authorities, courts or other bodies where disclosure is legally required.

We disclose only the personal data necessary for the respective purpose.

11. International Data Transfers

Some of our service providers operate internationally. As a result, personal data may be processed outside Austria or the European Economic Area.

For example, Shopify may transfer personal data between its European operations, affiliated companies and service providers in other countries, including Canada and the United States. Vimeo is based in the United States.

Where personal data is transferred to a country outside the EEA, appropriate safeguards are used where required by law. These may include an adequacy decision of the European Commission, the EU Standard Contractual Clauses or another legally recognised transfer mechanism.

12. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected or for as long as required by applicable law.

Order, invoice and accounting information is generally retained for the statutory retention period applicable under Austrian tax and accounting law, which is generally seven years, and may be retained longer where required in connection with pending proceedings or other legal obligations.

Customer service and correspondence data is retained for as long as necessary to deal with the relevant request and, where appropriate, for the establishment, exercise or defence of legal claims.

Newsletter information is retained until you unsubscribe or withdraw your consent, unless continued storage is required for evidence of consent or another legal reason.

Withdrawal information is retained for as long as necessary to process and document the withdrawal and to comply with applicable statutory retention obligations.

Consent records may be retained for the period necessary to demonstrate compliance with privacy and consent requirements.

When personal data is no longer required, it is deleted or anonymised unless continued retention is legally permitted or required.

13. Automated Fraud Prevention

Shopify and payment providers may use automated systems and risk indicators to identify potentially fraudulent transactions and protect the online store and payment systems.

Depending on the services used, this may involve analysis of transaction, device, network, IP address, payment and order information.

Where an order is identified as potentially suspicious, it may be reviewed before fulfilment.

14. Your Rights

Subject to the conditions of applicable data protection law, you may have the right to:

• obtain information about whether and how we process your personal data;
• obtain access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data;
• request restriction of processing;
• receive certain personal data in a structured, commonly used and machine-readable format and request data portability;
• object to processing based on legitimate interests;
• object at any time to processing for direct marketing purposes;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a competent data protection authority.

To exercise your rights, contact us at ilvie@ilvielittle.com.

We may need to verify your identity before responding to a request.

15. Children

Our stories and products are created for children and families, but our online store, purchasing functions, newsletter and customer service channels are intended to be used by adults.

We do not knowingly request personal data directly from children through these services.

If you are a parent or guardian and believe that a child has provided us with personal data without appropriate authorisation, please contact us at ilvie@ilvielittle.com.

16. External Links

Our website may contain links to third-party websites, services or social media platforms.

When you follow an external link, the third party may process personal data under its own responsibility and according to its own privacy policy. We are not responsible for the privacy practices of third-party websites.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, services, service providers or legal requirements.

The date of the latest version is shown at the top of this Privacy Policy.

18. Contact and Complaints

If you have questions about this Privacy Policy, our processing of personal data or wish to exercise your data protection rights, please contact:

ILVIE LITTLE & FRIENDS GmbH
Rechte Wienzeile 37/3/3a
1040 Vienna
Austria

Email: ilvie@ilvielittle.com

You also have the right to lodge a complaint with the competent supervisory authority.

For Austria:

Austrian Data Protection Authority
(Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at