Privacy policy

Privacy Policy of ROIA MOTO OG · Last updated: 26 October 2026

We take the protection of your personal data seriously. This policy explains which personal data we process when you visit roiamoto.com, place an order, create an account, contact us, request our free PDF guide or subscribe to our emails, on which legal basis we do so, how long we keep the data and which rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Controller

ROIA MOTO OG
Solothurner Strasse 31/Top 3, 6300 Wörgl, Austria
Email: office@roiamoto.com · Phone: +43 664 9208544

We are not required to appoint a data protection officer. For all questions about data protection, please contact us at the address above.

2. Legal bases and general principles

We process personal data only where one of the following applies:

  • Contract (Art. 6(1)(b) GDPR): processing is necessary to fulfil a contract with you or to take steps at your request before entering into one, for example to process your order.
  • Legal obligation (Art. 6(1)(c) GDPR): we must keep certain data, for example under Austrian tax and commercial law.
  • Legitimate interests (Art. 6(1)(f) GDPR): for example the secure operation of our shop, fraud prevention and limited direct marketing to existing customers.
  • Consent (Art. 6(1)(a) GDPR): for example for marketing emails, cookies and tracking that are not strictly necessary. You can withdraw consent at any time with effect for the future.

We do not use your data for automated decisions with legal effect on you. We do not sell your personal data.

3. Shop system and hosting: Shopify

Our online shop runs on the platform of Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland (“Shopify”). Shopify hosts the shop, processes orders, payments and customer accounts on our behalf and provides the tools described in this policy (checkout, customer accounts, email marketing, forms, automations, analytics). Shopify acts as our processor under a data processing agreement. Shopify stores data on servers of its parent company Shopify Inc. (Canada, for which an EU adequacy decision exists) and of service providers in the USA. Transfers to the USA are based on the EU–US Data Privacy Framework and the EU standard contractual clauses.

When you visit our shop, Shopify automatically processes technical data for security and to deliver the pages: IP address, date and time, pages visited, referrer, browser type and version, operating system, device and screen information. Legal basis: legitimate interest in a secure, functioning shop (Art. 6(1)(f) GDPR). Server logs are deleted by Shopify after a short period.

Shopify enhanced features: to protect, grow and improve our business we use certain Shopify features (for example optimised payment methods at checkout, the Shop app, Shopify Email and Shopify search) that draw on data and insights Shopify obtains from your interactions with our shop, with other Shopify merchants and with Shopify itself. For this processing Shopify is the controller and responds to your requests to exercise your rights. Details: Shopify Consumer Privacy Policy; you can exercise your rights at privacy.shopify.com.

Details: Shopify privacy policy, https://www.shopify.com/legal/privacy

4. Orders and contract fulfilment

When you order, we process the data you enter at checkout: name, shipping and billing address, email address, phone number (for delivery notifications), the items ordered, prices, the payment method chosen and your order history. We use this data to conclude and fulfil the contract, to ship the goods, to send order and shipping confirmations, to handle returns, withdrawals and warranty claims, and to answer your questions about the order. Legal basis: Art. 6(1)(b) GDPR.

Invoices and order data are kept for seven years under Austrian tax and commercial law (§ 132 BAO, § 212 UGB), legal basis Art. 6(1)(c) GDPR, and beyond that only as long as claims may still be asserted.

Order data is also stored in our internal order management system, which is hosted for us by Cloudflare, Inc. (USA; certified under the EU–US Data Privacy Framework), and we use Microsoft 365 (Microsoft Ireland Operations Ltd.) for email and document handling. Both act as processors.

5. Payment

Payment is processed by the payment service provider you choose at checkout. The provider receives the data required for the payment (name, amount, currency, order reference and, where required, your card or account data and address). We do not store full card numbers ourselves.

  • Shopify Payments (credit and debit cards, Apple Pay, Google Pay, Shop Pay, eps, Bancontact, Bizum, MB Way, UnionPay): operated by Shopify International Limited, Ireland, with Stripe Payments Europe Ltd., Ireland, as payment processor. Shopify Payments also performs fraud checks on payments.
  • Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For “pay later” options Klarna carries out an identity and credit check; Klarna is the controller for this. Privacy notice: https://www.klarna.com/international/privacy-policy/
  • Revolut Pay: Revolut Payments UAB, Konstitucijos ave. 21B, Vilnius, Lithuania. Privacy notice: https://www.revolut.com/legal/privacy/
  • Bank transfer: we see your name and bank details on the incoming payment.

Legal basis: Art. 6(1)(b) GDPR (contract) and, for fraud prevention, Art. 6(1)(f) GDPR. Payment records are kept for seven years (Art. 6(1)(c) GDPR).

6. Shipping

To deliver your order we pass your name, delivery address, email address and phone number to the carrier, so that it can deliver the parcel and inform you about the delivery status. Depending on the destination we ship with Österreichische Post AG (Austria), FedEx Express (Federal Express Europe Inc. and its affiliates) and other carriers. Shipping labels are created with the shipping software Sendcloud B.V., Stationsplein 8-K, 5611 AC Eindhoven, Netherlands, and the FedEx shipping app, both acting as processors. Legal basis: Art. 6(1)(b) GDPR. For shipments outside the EU, customs authorities and the carrier receive the data required for customs clearance (Art. 6(1)(c) GDPR).

7. Customer account

You can create a customer account (Shopify customer accounts, sign-in with a one-time code sent to your email address, optionally via “Sign in with Shop”). In the account we store your contact details, addresses and order history so that you can see your orders and check out faster. Legal basis: Art. 6(1)(b) GDPR. You can delete the account at any time by contacting us; order data we must keep by law remains stored for the statutory period.

8. Contact

If you contact us by email, phone or through the contact form on our website, we process the data you provide (name, email address, phone number, your message, order number) to handle your request. The contact form is protected against spam by hCaptcha (see section 12). Legal basis: Art. 6(1)(b) GDPR where the request relates to a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). We delete enquiries once the matter is settled, unless we must keep them for longer, for example as part of order records.

9. Free PDF guide and email newsletter

On our website you can request a free PDF tool guide for your motorcycle. To send it we need your first name, last name, email address and the motorcycle model you select. In return you subscribe to our email newsletter: with the request you consent to receive marketing emails from ROIA MOTO (news, tips, product information and occasional offers). Legal basis: your consent, Art. 6(1)(a) GDPR and § 174 TKG 2021 (Austrian Telecommunications Act). The guide itself is delivered by email as a PDF link.

We send the emails with Shopify Email and automate the sequence with Shopify Flow (both Shopify, see section 3). We store the motorcycle model as a tag on your customer profile so that we can send you the right guide and information that fits your bike. Our emails contain a tracking pixel that tells us whether an email was opened and which links were clicked; we use this to measure and improve our emails (legal basis: consent as above).

You can unsubscribe at any time with the link at the end of every email or by writing to office@roiamoto.com. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. After you unsubscribe we keep your email address on a suppression list so that we do not contact you again (Art. 6(1)(f) GDPR). We document the consent (time, IP address, form) to be able to prove it (Art. 7(1) GDPR).

Existing customers: after a purchase we may send you occasional emails about our own similar products, as permitted by § 174(4) TKG 2021 and Art. 6(1)(f) GDPR. You can object at any time, free of charge, via the unsubscribe link or by email.

Back-in-stock notifications: if you ask to be notified when a product is available again, we store your email address and the product for this purpose only, using the app STOQ (Artos Software). Legal basis: Art. 6(1)(a) GDPR; the data is deleted after the notification has been sent or when you revoke the request.

Cart reminders: if you have subscribed to our emails or use the Shop app, you may receive reminders about products you left in your cart. Legal basis: consent (Art. 6(1)(a) GDPR). You can unsubscribe as described above.

10. Product reviews

Judge.me: after a purchase we send you an email asking you to review the product you bought. The review function is provided by Judge.me Limited, 71-75 Shelton Street, London WC2H 9JQ, United Kingdom (an EU adequacy decision exists for the UK), which processes your name, email address, order and product details and the content of your review on our behalf. Legal basis for the review request: Art. 6(1)(f) GDPR (our interest in genuine customer feedback) and § 174(4) TKG 2021; you can object at any time via the link in the email. If you submit a review, it is published on our website with the name or initials you choose and, if you add them, your photos (Art. 6(1)(a) GDPR). Reviews are marked as “verified” only when Judge.me has confirmed the purchase. The Judge.me widgets and pixel on our site load review content and record review events; details: https://judge.me/privacy

Trustpilot: we display a link to our Trustpilot profile and, after a purchase, invite you by email to review us on Trustpilot. For this invitation Trustpilot receives your name, email address and order reference on our behalf; legal basis: Art. 6(1)(f) GDPR and § 174(4) TKG 2021, and you can object at any time via the link in the email. Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark, is the controller for the reviews you submit there. Privacy notice: https://legal.trustpilot.com/end-user-privacy-terms

11. Cookies, consent and tracking

Our shop uses cookies and similar technologies (local storage, pixels). We distinguish between:

  • Strictly necessary technologies, which are needed to run the shop: shopping cart, checkout, login, language and country selection, security and fraud prevention, load balancing and your cookie choices. Legal basis: Art. 6(1)(f) GDPR and § 165(3) TKG 2021. These cannot be switched off.
  • Analytics and marketing technologies, which we use only with your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). You give or refuse this consent in the cookie banner that appears on your first visit from the EU, EEA, UK or Switzerland, and you can change your choice at any time via the “Cookie settings” link in the footer or by deleting the cookies in your browser.

With your consent we use the following services:

  • Shopify Analytics (Shopify, see section 3): visit and conversion statistics for our shop.
  • Google Analytics 4 and Google Ads conversion tracking: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics measures how visitors use our shop (pages, source, device, approximate location based on a shortened IP address); Google Ads conversion tracking tells us whether an ad led to a purchase. Data may be transferred to Google LLC in the USA (EU–US Data Privacy Framework). Retention of analytics data: 14 months. Privacy: https://policies.google.com/privacy · Opt-out: https://tools.google.com/dlpage/gaoptout
  • Meta Pixel: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. The pixel lets us measure the success of our Facebook and Instagram ads and show you relevant ads; Meta may link the data to your Meta account. Data may be transferred to Meta Platforms, Inc. in the USA (EU–US Data Privacy Framework). Privacy: https://www.facebook.com/privacy/policy
  • Microsoft Clarity: Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records anonymised usage sessions (mouse movements, clicks, scrolling) and creates heat maps so that we can improve our pages. Form entries are masked. Data may be transferred to Microsoft Corporation in the USA (EU–US Data Privacy Framework). Privacy: https://privacy.microsoft.com/privacystatement

Country and language detection (Orbe): to show you the right currency, language and shipping country, the app Orbe (Orbe Apps S.L., Spain) determines your approximate location from your IP address when you first visit and stores your choice in a cookie. The IP address is not stored. Legal basis: Art. 6(1)(f) GDPR.

Product recommendations (Selleasy): the app Selleasy (Logbase, India) shows matching add-ons in the cart and on product pages. It processes the cart contents and a session identifier, not your name or address. Legal basis: Art. 6(1)(f) GDPR.

12. Third-party content

YouTube videos: our homepage and some product pages embed videos from YouTube (Google Ireland Limited). When a video is loaded, YouTube receives your IP address and may set cookies and link the visit to your Google account if you are signed in. Legal basis: Art. 6(1)(a) GDPR (consent via the cookie banner) and, for the display of the video itself, Art. 6(1)(f) GDPR. Privacy: https://policies.google.com/privacy

hCaptcha: Shopify protects our contact and sign-up forms against bots with hCaptcha, a service of Intuition Machines, Inc., 2211 Elliott Ave, Seattle, WA 98121, USA (EU–US Data Privacy Framework). hCaptcha analyses browser and interaction data (IP address, device information, mouse movements, time spent) to distinguish humans from bots. Legal basis: Art. 6(1)(f) GDPR (protection against spam and abuse). Privacy: https://www.hcaptcha.com/privacy

Shop app / Shop Pay: if you use Shop Pay or “Sign in with Shop”, Shopify processes your data as described in its own privacy policy; Shopify is the controller for the Shop app.

Social media: our website links to our Instagram and YouTube profiles. These are plain links; no data is transferred to the networks until you click them.

13. Recipients and international transfers

We pass personal data only to the recipients named in this policy: Shopify and the apps that run on it, payment providers, carriers, our email, hosting and administration tools, and authorities where required by law. Service providers that process data on our behalf are bound by data processing agreements under Art. 28 GDPR. Where data is transferred to countries outside the EU/EEA, this is based on an EU adequacy decision (Canada, United Kingdom, EU–US Data Privacy Framework for certified US companies) or on the EU standard contractual clauses, with additional safeguards where needed. We also use Anthropic’s Claude via a connector to administer our shop; Anthropic, PBC (USA) acts as processor and does not use the data to train its models.

14. Retention

We keep personal data only as long as necessary for the purposes described: order, invoice and payment data for seven years (§ 132 BAO, § 212 UGB) and for the duration of warranty and limitation periods; newsletter data until you unsubscribe; enquiries until they are settled; analytics data according to the periods stated above; consent records for as long as the consent is relevant plus three years.

15. Your rights

You have the right to:

  • access the personal data we hold about you (Art. 15 GDPR),
  • rectification of inaccurate data (Art. 16),
  • erasure (Art. 17) and restriction of processing (Art. 18),
  • data portability (Art. 20),
  • object to processing based on legitimate interests, and at any time to direct marketing (Art. 21),
  • withdraw any consent you have given, with effect for the future (Art. 7(3)).

To exercise these rights, email office@roiamoto.com. You can also lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at. You may also contact the authority of the EU member state in which you live.

16. Data security

Our website and checkout are encrypted with TLS (https). Access to customer data is limited to the people and service providers who need it to perform the tasks described here.

17. Changes

We update this policy when our services or the law change. The current version is always available at roiamoto.com/policies/privacy-policy.