Privacy Policy

Table of contents

(Status: September 2026)


Preamble

Huber Holding AG, company number 061259m, Exerzierplatz 1, 6841 Mäder, HUBER Digital GmbH, company number 552053v, Exerzierplatz 1, 6841 Mäder, and all group companies of Huber Holding AG (hereinafter ‘HUBER’), take the protection of your personal data very seriously and use your personal data exclusively in accordance with the applicable legal provisions.  

This privacy policy applies to the following online portals and services, as well as their mobile applications, operated by HUBER 

  • SKINY.com 

  • HANRO.com 

  • HUBER-bodywear.com 

  • Gossard.com/eu 

  • HOM.com 

  • Woh-underwear.com 

  • hubershop.com 

The manner in which data is processed is similar across most of our services. This privacy policy therefore applies to all services and offerings we provide to our customers in Europe. Unless otherwise expressly stated, the contracting party and data controller within the meaning of the GDPR is HUBER Digital GmbH (hereinafter referred to as ‘HUBER’), company registration number 552053v, Exerzierplatz 1, 6841 Mäder. 


1. General information

The protection of personal data is a top priority at HUBER. We therefore comply with legal provisions such as the General Data Protection Regulation (GDPR) and the Data Protection Act (DSG) when collecting, using and processing personal data. Below, we explain the scope and purpose of our data processing, as well as your rights in this regard. 

  • Where we have obtained the data subject’s consent for the processing of personal data, Article 6(1)(a) of the GDPR serves as the legal basis.
  • If the processing of personal data is necessary for the performance of a contract with the data subject or for pre-contractual measures initiated by the data subject, Article 6(1)(b) of the GDPR serves as the legal basis.
  • Where the processing of personal data results from a legal obligation to which we are subject, we rely on Article 6(1)(c) of the GDPR as the legal basis.
  • Where the processing of personal data is necessary to safeguard the legitimate interests of the controller or a third party – without compromising the interests, fundamental rights or fundamental freedoms of the data subject – Article 6(1)(f) serves as the legal basis. 


2. Data collection and processing

As a general rule, we collect and use our customers’ personal data only to the extent necessary to carry out the relevant data processing. We use your personal data to provide the information and products we offer, to answer your enquiries, to fulfil orders, and to operate and improve our websites and applications. 

You may also visit our site without providing any personal details. We only store non-personal access data, such as the name of your internet service provider, the page from which you visit us, or the name of the file requested. This data is analysed solely for the purpose of improving our services and does not allow any conclusions to be drawn about your identity. 


1. Personal data

 

Personal data is only collected if you voluntarily provide it to us when placing an order, opening a customer account, making an enquiry via the contact form, or registering for our newsletter, vouchers, text messages, direct mail or other electronic communications, or by consenting to optional cookies. We use the data you provide without your consent solely to fulfil and process your order or to respond to your enquiry. Personal data is any information relating to an identified or identifiable natural person.  


2. Use of personal data for the fulfilment of the contract 

 

For the purposes of contract fulfilment, we store the following data – provided you have supplied it to us – and, where necessary, pass it on to third parties for the provision of services:  

  • Name 

  • (if applicable) Date of birth  

  • Gender 

  • Address 

  • Delivery address 

  • Billing address 

  • Email address 

  • Telephone number 

  • Bank details, credit card number and issuer (note that these are processed exclusively by the payment provider and, in the context of payment processing, HUBER is not the controller within the meaning of the GDPR) 

  • Information about the order (order, confirmation message, dispatch confirmation)  

  • IP address and cookie IDs 

  • Device identifiers and browser used 

  • Network connection or other unique identifiers or device information, where applicable Profile picture 

The data you provide is necessary for the performance of the contract or for the implementation of pre-contractual measures. Without this data, we cannot enter into a contract with you. We therefore use this data for the purposes of order and contract processing (including payment processing), for handling enquiries and for analysis.  

The legal basis for this is Article 6(1)(b) of the GDPR.  

If you open a customer account, your orders and saved items will also be stored collectively with your customer account. You give your consent for this (Article 6(1)(a) of the GDPR). 

 

3. Shopify

 

We use Shopify, a software programme provided by Shopify International Limited (hereinafter also referred to as ‘Shopify’), a company registered in Ireland, to process orders. A data processing agreement has been concluded between HUBER and Shopify for this purpose. At the same time, other applications are used in the shop via Shopify. You will also find these listed under the heading ‘Data Processors’ at . For the sake of completeness, please also take note of their respective privacy policies. You will find the relevant links below.  

 

4. Use of personal data for marketing and information purposes (newsletters, text messages, direct mail or other electronic mail) 

4a. Sending newsletters, text messages, direct mail or other electronic mail 

 

When you subscribe to the newsletter, your name and email address will be used, with your consent, for our own advertising purposes until you unsubscribe from the newsletter or the email address provided is clearly incorrect. You can unsubscribe from the newsletter at any time, either by sending a message via the contact details provided below or via a link provided for this purpose in the newsletter.  

You may also subscribe, under the same conditions, to text messages, other electronic mail (e.g. push notifications in apps) or direct mailings so that you receive all the latest news and information about our company and products at regular intervals. 

With your consent, we will transfer the data within the group and to our partner locations for the purpose of analysing user behaviour and, based on this, for sending information for advertising purposes.  

We also use your data to display or send you – including by email – promotional codes, vouchers and personalised product recommendations based on the products you have ordered or viewed and your wishlist details. 

Data that we have collected from prospective customers and customers for marketing and information purposes, or for sending a newsletter or surveys, as well as for advertising products that may be of interest to you, is processed – subject to your consent – until such consent is withdrawn; otherwise, it is processed on the basis of our legitimate interest for marketing purposes for a period of, in principle, three years from the date of your last purchase or from the date of contact initiated by the prospective customer. 

Provided that you have given us your explicit consent to do so during or after placing your order, or where this is permitted on another legal basis in accordance with Article 6 of the GDPR, we will send you a reminder by email asking you to leave a review of your order. Any consent  given for this purpose may be withdrawn at any time by sending a message via the contact details provided below.   

 

4b. Analysis of interaction with electronic communications 

 

Where you have consented to receiving electronic marketing communications, or where we are permitted to send you information about our products and services on another legal basis, we may analyse your interaction with these messages. 

To this end, our emails or other electronic messages may contain technical features that enable us to determine 

  • whether a message has been opened, 

  • when a message has been opened, 

  • which links within the message have been clicked, 

  • whether and which content was accessed, and 

  • technical information about the device used, the email client or browser used, and the IP address, insofar as this is technically necessary for the respective processing. 

This information is analysed solely for the purpose of 

  • to ensure the technical deliverability of our messages, 

  • to analyse the usage and reach of our communication activities, 

  • to improve the content of our communications, 

  • to better understand our customers’ interests, 

  • to optimise the frequency and relevance of our marketing communications, and 

  • to provide you with information, offers and product recommendations that are as relevant as possible. 

Data processing is carried out on the basis of the statutory provisions of Section 165(3) of the Telecommunications Act 2021 (TKG 2021) in conjunction with Section 174(3) of the TKG 2021, as well as Article 6(1)(a) (consent) and (f) (legitimate interest) of the General Data Protection Regulation (GDPR). The exemption from the requirement to obtain consent for email marketing is set out in Section 174(4) of the TKG 2021 and relates to direct marketing in connection with existing customer relationships. Under this provision, prior consent to email marketing is not required; instead, the customer has the option to opt out of receiving email marketing. Your data will be deleted immediately upon complete unsubscription from the newsletter service, upon withdrawal of consent, or upon a request for erasure. 

You may withdraw any consent you have given at any time with future effect. Furthermore, you may object at any time to the processing of your personal data for the purposes of direct marketing or the analysis of your interaction with our marketing communications, provided that a legal right to object exists in this regard. You can access the relevant options in particular via the unsubscribe link in every marketing communication or via the contact details provided in this privacy policy. 

 

5. Use of personal data for competitions

 

We regularly run competitions on our website to make our site more appealing and to encourage greater interaction from visitors.  

We use the personal data provided in connection with a competition solely for the purpose of administering the competition and not for marketing purposes. If, when registering for the competition, you give your express and voluntary consent to receive a newsletter or other marketing communications from us, this will be taken into account within the scope of your consent. 


5. Use of personal data for customer service

 

If you contact us via the contact form on the website or by email, the data you provide will be stored by us for 24 months for the purpose of processing your enquiry and in the event of follow-up enquiries .  

If you register on our website and/or create a customer account, or place an order, the purpose of processing your data is the technical operation of this website, the management and administration of your customer account, the fulfilment of your order(s) and keeping you informed about current promotions (in particular via electronic newsletters or email). We use the personal data you provide exclusively to the extent that your data is necessary to fulfil the respective purpose (e.g. registering as a customer, sending the newsletter, processing an order, sending information material, organising a prize draw, answering a question), and/or where this is permitted by law.


7. Use of personal data for job applications

 

We collect data from applicants for job vacancies with us for the purpose of establishing a potential employment relationship in accordance with Article 6(1)(b) of the GDPR or, where applicable, on the basis of the applicants’ explicit consent for record-keeping purposes. Further information on data protection relating to application processes can be found here.


8. Use of affiliate programmes

 

We use affiliate programmes from various providers. With your consent, your data may be transferred to, stored and processed by the relevant affiliate programme provider when you use an affiliate programme. This means that as soon as you interact with the products and services of an affiliate programme, that provider (separately from us) will also collect data from you (in particular your IP address, location, etc.). Exactly which data is stored depends on the individual providers. In particular, we participate in the AWIN affiliate programme. Data processing is carried out in accordance with this privacy policy and that of AWIN:

https://www.awin.com/de/datenschutzerklarung.

In this case, the information stored includes user behaviour, IP address, device information and the URL.


9. Processing of customer data via the Customer Data Platform (CDP) and the consolidation of this data 

 

Your customer data, which is lawfully processed by a HUBER company for the reasons set out above, may, under certain circumstances, be merged with the data systems (CRM, etc.) of the entire HUBER Group. This takes place either i) because other group companies act exclusively as data processors, or ii) because you have given your consent to the consolidation and processing of your personal data within the HUBER Group.  

Consent to the processing of your customer data by the CDP serves the purpose of gaining comprehensive insights into customer behaviour and preferences. This enables us to provide personalised marketing campaigns and enhanced customer experiences. Customer data is consolidated from various sources and databases belonging to HUBER, including our internal systems, website interactions, social media and other data sources with which we have a business relationship. You consent to the processing and consolidation of personal data within the HUBER Group.  

We also use klaviyo Inc., based in the USA, as a data processor for this purpose. This involves the transfer of your personal data to the USA. Klaviyo has adopted the European Commission’s Standard Contractual Clauses and is bound by them. Further information on this can also be found here:

https://www.klaviyo.com/legal/privacy.  


10. Processing of customer data via a data warehouse  

 

We process personal data in a central data warehouse in order to consolidate data from various internal systems and make it available for, evaluation and data enrichment. Processing is carried out exclusively for legitimate business purposes, in particular to optimise our internal processes, to improve our services and to produce anonymised or aggregated analyses. 

Data is combined only to the extent necessary for the aforementioned purposes and is based on a valid legal basis in accordance with Article 6 of the GDPR (in particular, legitimate legal interest). Personal data is protected in the data warehouse by appropriate technical and organisational measures and – where possible – pseudonymised or anonymised. Access to the data is restricted to authorised persons, who are bound by a duty of confidentiality. 

 

3. Data processors 

We use several data processors. A corresponding data processing agreement is always concluded with them. The data processors we use include: 

 

4. Personalised service and product recommendations

Developing and providing personalised features and services is our top priority. Examples of our personalised services include: 

  • When you add a product to your basket or wish list, we can provide recommendations on choosing the right clothing size based on your previous orders and returns
  • If you have subscribed to our newsletter, we can show you products that match your previous orders
  • We also take your previous orders into account when suggesting products that match your shopping preferences 

Furthermore, even without subscribing to our newsletter, you may receive marketing communications from HUBER brands, either on the basis of your consent or where this is legally permissible without your consent. These include personalised recommendations based on your shopping behaviour. As part of our services, we provide you with information and offers based on your interests. You will receive a limited number of product recommendations, surveys and requests for product reviews from us, even if you have not subscribed to a newsletter. When selecting these personalised product recommendations, we primarily use data from your previous orders in compliance with legal requirements. 

If you do not wish to receive personalised product recommendations from us by email, you can opt out at any time by clicking on the unsubscribe link provided in every email. 

In order to offer you more personalised content, we collect data based on your previous user behaviour and your use of our services.  


5. Deletion of personal data and retention period

Personal data processed in connection with purchase transactions is retained for as long as required by legal provisions (retention obligations, etc.).  

If you register on our website and/or create a customer account or make a purchase, and have provided us with personal data in this regard under our terms of use, we generally store this data until three years have elapsed since your last contact with us, unless you request deletion at an earlier date and there are no mandatory legal requirements necessitating longer data retention. Furthermore, deletion may occur at a later date for technical reasons beyond our control (e.g. subsequent deletion by Shopify).  

If you contact us via the contact form on the website or by email, the data you provide will be stored by us for 24 months for the purpose of processing your enquiry and in case of any follow-up questions. Personal data that we have received as a result of surveys will be anonymised after 12 months.   

If you have given your consent to the use of your personal data and we subsequently carry out ongoing activities (e.g. sending the newsletter), we will only delete your data once you have withdrawn your consent.   


6. Disclosure of data

Your personal data will be disclosed to third parties where this is necessary for the purpose of contract fulfilment or to provide customers with information, to comply with legal obligations, or where you have consented to such disclosure, or where the disclosure is based on other legal grounds. Where necessary, we may also use service providers to assist us with advertising and information that may be of interest to you, as well as with conducting surveys that help us improve our services. The service providers we use (e.g. payment service providers to process payments, courier companies to handle deliveries, providers for dispatch communications, and IT companies for technical support with order processing and for email marketing) receive the data in order to fulfil the contracts concluded with you or to assist us with advertising or surveys as described above. Our service providers may only use the data to fulfil their specific tasks. 


7. Transfer of data to third countries

 

We use services, in the course of which data is or may be transferred abroad. Such transfers may take place if the European Commission has confirmed that the third country in question offers an adequate level of data protection, or if other suitable data protection safeguards are in place (e.g. binding corporate rules or EU Standard Data Protection Clauses).  

The European Commission has adopted a new adequacy decision pursuant to Article 45 of the GDPR for the USA. This adequacy decision applies to those data importers in the USA who are registered on the Data Privacy Framework List (https://www.dataprivacyframework.gov/s/participant-search).

We check for each of our service providers whether they are registered on the Data Privacy Framework List or whether the legal requirements for data transfers to third countries are met in some other way . Where necessary, your consent is required for this (Article 49(1)(a) of the GDPR).  

1. Shopify and other data processors 

Our data processor, Shopify, relies on the European Commission’s adequacy decision for Canada when Shopify transfers personal data to its parent company, Shopify Inc., which is registered in Canada.  

Furthermore, Shopify uses comprehensive data processing agreements (DPAs) that incorporate the latest version of the Standard Contractual Clauses (SCCs) approved by the European Commission to regulate the following: 

Shopify carries out thorough checks to ensure that its (sub-)processors have appropriate technical and organisational measures in place to protect personal data and conduct appropriate data protection impact assessments for data transfers.  

Both the Adequacy Decision and the SCCs are regarded by data protection authorities in the EEA and the UK as legally valid and sufficient transfer mechanisms. As an additional measure, Shopify has also applied for binding corporate rules to further regulate transfers within the Shopify Group. This application was submitted to the Irish Data Protection Commission, which is the lead supervisory authority for Shopify under the GDPR. These will serve as an additional legal transfer mechanism to safeguard transfers within the Shopify Group.  

Certain data protection laws in jurisdictions other than the EEA and the United Kingdom also require specific safeguards for international transfers of personal data. To meet these requirements, Shopify’s Standard Contractual Clauses (SCCs) governing transfers within the Shopify Group, and the SCCs governing onward transfers to Shopify sub-processors, include appropriate safeguards to ensure compliance with the applicable data protection laws in Canada, the United States (US) and Singapore.  

 

Shopify dynamically distributes storage across multiple regions of the Google Cloud Platform to ensure a reliable and scalable infrastructure capable of handling unpredictable volumes across the merchant database. Shopify has put in place mechanisms to carry out transfers of data storage in accordance with applicable laws and regulations, including the GDPR. 

Shopify now stores certain personal data relating to merchants and customers in Europe (namely in the EEA, the United Kingdom and/or Switzerland), as follows: 

Shopify utilises this new infrastructure in relation to HUBER, and its shop data, order data and customers’ personal data are now stored at rest in Europe by default. Even though customers’ personal data is stored by merchants in Europe, we will rely on international data transfers for the processing of this personal data. 

Shopify limits the use of its sub-processors to technical services: cloud hosting, error logging, load balancing, content delivery, card processing, data analysis and internal logging (log files). The transfer takes place on an ongoing and secure basis. No sensitive or special categories of personal data are intentionally processed. 

We have no direct influence over access by US authorities to personal data transferred to service providers in the US when using these services. Although we assume that the level of protection is guaranteed, access by US authorities to data processed in the US is nevertheless conceivable. 

Where we transfer your personal data to a destination outside the EEA, the United Kingdom or Switzerland, this is done in accordance with applicable law. 

 

8. Use of Cookies

To make visiting our website an enjoyable experience and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your device. Some of the cookies we use are deleted once your browser session ends, i.e. once you close your browser (so-called session cookies). Other cookies remain on your device and enable us or our partner companies to recognise your browser the next time you visit (persistent cookies). You can configure your browser so that you are notified when cookies are set and can decide on a case-by-case basis whether to accept them, or you can block the acceptance of cookies in specific cases or generally. If you do not accept cookies, the functionality of our website may be restricted.  

As the cookies used in this process also change regularly, we have set out the information regarding the cookies we use in a separate Cookie Policy, which can be viewed here and forms an integral part of this Privacy Policy. 


9. Use of Google services

We use Google Analytics, a web analytics service provided by Google Inc. (www.google.com). Google Analytics uses so-called ‘cookies’, which are text files stored on your device and which enable an analysis of your use of the website. The information generated by the cookie regarding your use of this website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymisation is enabled on this website, your IP address will first be truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. IP anonymisation is enabled on this website. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with further services relating to website and internet usage. The IP address transmitted by your browser as part of Google Analytics is not merged with other data held by Google. You can prevent the storage of cookies by adjusting your browser settings accordingly; however, we would like to point out that, in this case, you may not be able to make full use of all the functions of this website. 
 
You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

As an alternative to the browser plug-in, you can click this link to prevent Google Analytics from collecting data on this website in future. This will place an opt-out cookie on your device. If you delete your cookies, you will need to click the link again. 

We also use Google Maps on our website. If you are logged in to Google, the data will be directly associated with your account. Google uses your data for the purposes of advertising, market research and tailoring the website to your needs. Further information on the purpose and scope of data collection, as well as your right to object, can be found at http://www.google.de/intl/de/policies/privacy.

Google may process your data in the USA. Before you consent to the storage of cookies through the use of Google Analytics, please read the relevant information in the privacy policy. Google LLC is registered on the Data Privacy Framework List. 


10. Use of social media plugins 

We are also active on various social media platforms. Data processing takes place to some extent in this context. Further information on data protection can be found in their respective privacy policies:   

Please refer to the providers’ privacy policies for details of the purpose and scope of data collection, as well as the further processing and use of the data by the providers, and your rights in this regard and the settings available to protect your privacy. 

If you do not wish the data collected via our website to be directly linked to your profile on the relevant service, you must log out of that service before visiting our website.  


11. Loyalty program

1. Use of personal data in connection with the loyalty programme 

When you place your first order, you will be enrolled in the TBD loyalty programme.  

As part of this process, your name and email address, as well as your date of birth (optional), will be stored. To calculate and manage your status, we also process your order number, the order value, returns information, the device you are using, details of that device and your IP address. The legal basis for this processing is your consent . This data processing serves the purpose of operating the Loyalty Programme. You may opt out of the Loyalty Programme at any time by sending an email to service@wohunderwear.com .

With your consent, we transfer the data within the HUBER Group and to the sites cooperating with us for the purpose of analysing user behaviour and, based on this, for the transmission of information for advertising purposes.  

We also use your data to display vouchers and personalised product recommendations to you – based on the products you have ordered or viewed and your wishlist data – and to send these to you, including by email. We process data collected from customers as part of the loyalty programme, subject to your consent, until such consent is withdrawn. 

F or the operation of the Loyalty Programme, we use the ‘Influence.io’ programme provided by Reviews.io 2020 GmbH, Skalitzer Str. 104, 10997 Berlin, Germany (see also https://www.influence.io/privacy-policy or https://www.reviews.io/legal/user-privacy-policy). Against this background, personal data is also processed in the USA. Please also see Section VII: Processing of data abroad. 

If you were already a customer and therefore a member of our loyalty programme prior to January 2026, your data was processed by our previous software provider, Yotpo Ltd., New York, 400 Lafayette St, New York, USA. You can find the privacy policy here https://www.yotpo.com/privacy-policy/ ).

 

11. Data security

We use HTTPS (Hypertext Transfer Protocol Secure) to transmit data over the internet in a way that is secure against eavesdropping. In doing so, we have introduced an additional layer of security and are implementing data protection by design. By using TLS (Transport Layer Security), an encryption protocol for secure data transmission over the internet, we can ensure the protection of confidential data. You can recognise the use of this data transmission security by the small padlock icon in the top left-hand corner of the browser, to the left of the web address, and by the use of the ‘https’ scheme (instead of ‘http’) as part of our web address.  


12. Changes to the privacy policy

We reserve the right to amend this privacy policy at any time to bring it into line with changes in legal requirements or technical developments. The current version of the privacy policy is always available on our website. If you have any questions regarding data protection or wish to exercise your rights in relation to your personal data, you may contact us at any time. 


13. Your rights

Under the GDPR, you are considered a data subject if we process personal data relating to you. For this reason, you may exercise various data subject rights enshrined in the General Data Protection Regulation. These include the right of access (Article 15 of the GDPR), the right to rectification (Article 16 of the GDPR), the right to erasure (Article 17 of the GDPR), the right to restriction of processing (Article 18 of the GDPR), the right to object (Article 21 of the GDPR), the right to lodge a complaint with a supervisory authority (Article 77 of the GDPR) and the right to data portability (Article 20 of the GDPR).  

If you believe that the processing of your data contravenes data protection law or that your data protection rights have otherwise been infringed, you may lodge a complaint with the supervisory authority. In Austria, this is the Data Protection Authority.  


14. Contact person

If you have any questions regarding the collection, processing or use of your personal data, or if you wish to request information, rectification, restriction or erasure of data, or to withdraw any consent you have given, please contact:

HUBER DIGITAL GmbH
Exerzierplatz 1
6841 Mäder, Austria

E-Mail: datenschutzbeauftragter@huberholding.com