Legal
Privacy Policy
Also: Datenschutzerklärung · Last updated: 29 July 2026
1. Who is responsible
The controller for data processing on this website is:
Vienna Cookie Crave Concept GmbH, trading as BURST
Fendigasse 13
1050 Vienna, Austria
Commercial register: FN 660617x, Commercial Court of Vienna
Email: contact@bursthoops.com
Phone: +43 660 143 03 14
We have not appointed a data protection officer, as we are not required to do so. For any question about your data, write to the address above and we will answer you directly.
2. The short version
This site sets no cookies, uses no analytics, no advertising pixels and no social plugins. Fonts are hosted on our own server, so no request goes to Google. Nothing is transmitted about you unless you actively submit the signup form.
3. Server log files
When you open this site, our hosting provider automatically records technical data your browser sends. This is unavoidable in operating a website and includes:
- IP address of the requesting device
- Date and time of the request
- Page or file requested, and the amount of data transferred
- Browser type and version, and operating system
- Referring URL, where your browser sends one
Purpose and legal basis: operating the site securely and stably, and detecting misuse. This is our legitimate interest under Art. 6(1)(f) GDPR. This data is not merged with other sources and is not used to identify you.
Hosting provider: Vercel Inc., 440 N Barranca Ave #4133,
Covina, CA 91723, USA, acting as our processor under a data processing
agreement pursuant to Art. 28 GDPR. Because Vercel is based in the United
States, serving this site involves a transfer of your IP address to a third
country. That transfer is covered by the safeguards set out in Vercel's data
processing agreement, which relies on the EU Standard Contractual Clauses pursuant
to Art. 46(2)(c) GDPR. The agreement is public and available at
vercel.com/legal/dpa;
we will also send you a copy on request.
Retention: Vercel keeps request logs only for a short period —
a few hours to a few days depending on the plan — and we do not export or
store them ourselves. Details are set out in Vercel's
privacy notice
and data processing agreement.
4. Waitlist signup
If you enter your email address in the signup form, we process the following:
| Email address | The address you enter — the only thing you type |
|---|---|
| Colorway viewed | Which colorway (Hero White or Core Black) was selected on the page when you signed up. Helps us plan quantities for the first production run. |
| Signup position | Which of the two forms on the page you used |
| Browser language | The language your browser reports, e.g. “de-AT” |
| Time zone | The time zone your browser reports, e.g. “Europe/Vienna”. We use it as a rough regional indicator and to send at a sensible hour. We do not request your precise location and do not perform IP-based lookups. |
| Campaign parameters | utm_source, utm_medium, utm_campaign, utm_content, utm_term — only if such parameters were present in the link you followed |
| Referrer | The page you came from, if your browser sends one and it is not our own site |
Purpose: to inform you about the launch of Grip Sock 01, early access and founder conditions, and to understand which channels and which colorway resonate.
Legal basis: your consent under Art. 6(1)(a) GDPR, given by submitting the form. You can withdraw it at any time with effect for the future — via the unsubscribe link in every email, or by writing to contact@bursthoops.com. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Retention: until you withdraw consent or object, after which your data is deleted from our mailing list. We keep a record of the consent itself for as long as necessary to demonstrate compliance.
Is providing this data required? No. Entering your email address is entirely voluntary — there is no statutory or contractual obligation to do so. The only consequence of not providing it is that we cannot put you on the waitlist and cannot tell you when Grip Sock 01 drops.
Automated decision-making: we do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. The attributes listed above are used to group recipients — for example by colorway or by campaign — so that emails are relevant. No decision with legal effect for you is made on that basis.
5. Email delivery via Klaviyo
We use Klaviyo for our mailing list and email delivery. Provider: Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. Klaviyo acts as our processor under a data processing agreement pursuant to Art. 28 GDPR and processes the data listed in section 4 on our behalf.
Transfer to a third country: this involves transferring personal data to the United States. The safeguards required by Chapter V GDPR are set out in our data processing agreement with Klaviyo. They rest on Klaviyo's certification under the EU-US Data Privacy Framework and, where that certification does not or no longer covers a transfer, on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, which apply as a fallback. The agreement is public and available at klaviyo.com/legal/data-processing-agreement; we will also send you a copy on request at contact@bursthoops.com. Despite these safeguards, we must point out that US authorities may have access rights that do not fully correspond to European standards, and that enforcing your rights may be harder there than within the EU.
Klaviyo may record whether emails we send are opened and whether links in them are clicked, in order to measure delivery and interest. If you do not want this, you can unsubscribe at any time. Further information: klaviyo.com/legal/privacy-notice.
6. Cookies and tracking
This site sets no cookies and stores nothing in your browser’s local or session storage. We use no analytics tools, no advertising or conversion pixels, no heatmaps and no social media plugins. That is why you see no cookie banner — there is nothing to consent to.
7. Fonts
The Anton and Inter typefaces are hosted on our own server and delivered from this domain. No connection is made to Google servers, and your IP address is not transmitted to Google. Both fonts are licensed under the SIL Open Font License 1.1.
8. Your rights
Under the GDPR you have the following rights regarding your personal data:
- Access (Art. 15) — what we hold about you
- Rectification (Art. 16) — correction of inaccurate data
- Erasure (Art. 17) — deletion of your data
- Restriction (Art. 18) — limiting how we use it
- Portability (Art. 20) — receiving your data in a machine-readable format
- Objection (Art. 21) — to processing based on legitimate interests
- Withdrawal of consent (Art. 7(3)) — at any time, with effect for the future
To exercise any of these, write to contact@bursthoops.com. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority. In Austria that is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna (dsb.gv.at). In Germany, the authority of the federal state in which you reside is competent.
9. Data security
This site is delivered over TLS encryption (HTTPS), recognisable by the lock icon in your browser’s address bar. This protects the data you send us in transit against being read by third parties.
10. Children
This site is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has given us personal data, please contact us and we will delete it.
11. Changes to this policy
We will update this policy when our processing changes — for example when the shop goes live. The current version always applies, with the date shown at the top.
← Back to BURST