Privacy policy
Privacy policy
This page explains which personal data we process when you visit our website, shop online or in our store and use our other services, for what purposes and on what legal basis.
1. Controller
ITNS GmbH – Warlock's Warehouse, Kaltenleutgebnerstraße 14/3/14, 1230 Vienna, Austria
Telephone +43 1 418 00 09 · Email office@warlocks-warehouse.com
You can reach us at this email address for all questions about data protection and to exercise your rights.
2. Visiting the website
When you access our website, our server processes technically necessary data: IP address, date and time, requested address, browser and operating system. This serves the operation and security of the website (legitimate interest, Art. 6(1)(f) GDPR). The logs are deleted after 14 days unless we need them to investigate an attack.
The website and database run on servers of ITNS GmbH in Austria. Fonts are hosted on our own server; no data is transferred to Google or other font providers when you load a page.
3. Cookies
We only set cookies that are technically necessary for the shop (§ 165(3) Austrian Telecommunications Act 2021):
| Name | Purpose | Duration |
|---|---|---|
| ww_session | sign-in to your customer account | until you sign out or the session expires |
| ww_cart | shopping cart | 30 days |
| ww_consent | your choice in the cookie notice | 12 months |
| ww_wishlist | wishlist without sign-in (browser storage) | until you delete it |
| Stripe, PayPal | only during payment: secure payment and fraud prevention | as set by the payment provider |
We currently use no statistics or advertising services. If we add such a service, we will only load it with your consent (Art. 6(1)(a) GDPR), which you give in the cookie notice and can withdraw there at any time ("Cookie settings" at the bottom of every page).
4. Customer account
For the customer account we store name, email address, password (encrypted only), telephone number and addresses if provided, language, membership number, loyalty points and customer discount, your orders, gaming table bookings, reminders and wishlist. The legal basis is the contract for the customer account (Art. 6(1)(b) GDPR). You can delete your account at any time under "Account & data" and request a copy of your data there; we then keep order and invoice data only as long as required by law (see section 13).
5. Orders, payment and shipping
For orders in the online shop, requests and reservations we process the necessary data: name, email address, telephone number, billing and delivery address, ordered items, payment method and status and the history of the order (Art. 6(1)(b) GDPR; for invoices and retention Art. 6(1)(c) GDPR).
- Payment: For online payment we pass the data required for the payment (amount, order number, email address, name and address if applicable) to the payment service you choose: Stripe Payments Europe, Ltd. (Ireland) for card, Apple Pay, Google Pay, Klarna and EPS — for Klarna additionally Klarna Bank AB (Sweden) — or PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). You enter card details directly with the payment service; we do not see them. The payment services also process the data under their own responsibility, e.g. for fraud prevention.
- Shipping: For delivery we pass name, delivery address and — for delivery notifications — email address or telephone number to the carrier: Österreichische Post AG or DPD.
- Till in our store: Orders for pickup are available at our till; if you pay in the store, the till books the purchase to your order.
6. Pre-order service
If you use the pre-order service, we store since when it has been activated, when you accepted the rules, whether you receive preview emails, your reservations and any strikes with the reason. This serves to provide the service (Art. 6(1)(b) GDPR) and to distribute scarce new releases fairly (legitimate interest, Art. 6(1)(f) GDPR). We only send preview emails if you have switched them on (Art. 6(1)(a) GDPR); you can switch them off in your account at any time.
7. Loyalty programme and membership card
With your membership number or card we assign purchases online and in the store to your account in order to calculate loyalty points, membership level and customer discount (Art. 6(1)(b) GDPR).
8. Gaming tables and events
For gaming table bookings we store date, table, game and your customer account and send you a confirmation and reminder by email (Art. 6(1)(b) GDPR). For Magic tournaments we use the EventLink tournament system of Wizards of the Coast LLC (USA); you register there with your Wizards account, for which their privacy terms apply. To organise the tournament we transfer the list of participants (name, placing) from EventLink to our internal system (Art. 6(1)(b) or (f) GDPR).
9. "Notify me when available"
If you want to know when an item is back, we store your email address with the item. Without signing in, you confirm the reminder via a link in an email. We send one message as soon as the item is available; then the reminder ends. You can end it at any time via the link in the email or in your account (Art. 6(1)(a) GDPR).
10. Newsletter
You only receive the newsletter if you subscribe and confirm the subscription via the link in our email (Art. 6(1)(a) GDPR). We use Brevo (Sendinblue SAS, France) as processor for sending; it stores your email address, language and, if provided, your name. You can unsubscribe at any time via the link in every newsletter or in your customer account.
11. Contact and withdrawal
If you write to us via the contact form or by email, we process your details in order to answer your enquiry (Art. 6(1)(b) or (f) GDPR). If you withdraw from a contract using our withdrawal function, we store your declaration with date and time in order to process the withdrawal and to be able to prove it (Art. 6(1)(c) GDPR).
12. Emails
We send emails about orders, accounts and bookings via Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland) as processor. A transfer to the USA cannot be ruled out; it takes place on the basis of the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.
13. Retention
We only store data as long as necessary for the respective purpose. We keep order, invoice and accounting data for seven years (§ 132 Austrian Federal Fiscal Code), longer in case of pending proceedings. We delete account data when you delete your account, and newsletter and reminder data when you unsubscribe or the reminder ends.
14. Links to other services
Our pages link to Google Maps, Instagram, Facebook, WhatsApp and Discord. These are plain links: only when you click them do you leave our website, and the privacy terms of the respective provider apply.
15. Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests. You can withdraw consent at any time with effect for the future. Please contact office@warlocks-warehouse.com.
If you believe that we do not process your data lawfully, you can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
As of October 2026