Privacy Policy (Datenschutzerklärung)
Last updated: 29 September 2026
1. Data Controller and Contact
This privacy policy informs you in accordance with Art. 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (GDPR) about which personal data we process, for what purposes and on what legal basis, and what rights you have. Personal designations are to be understood as gender-neutral.
The data controller responsible for data processing is Label Up GmbH, operator of the platforms Label Up and Labelizer.
Company: Label Up GmbH
Data Protection Contact: Peter Pick
Email: dataprotection@labelup.io
Address and company register details: see Imprint
2. Scope
This privacy policy applies to all personal data that we or processors commissioned by us process in the following areas:
our websites, in particular labelup.io
our platforms Label Up and Labelizer, including associated app integrations (e.g. the Shopify app)
our social network appearances
communication via email
Personal data refers to all information within the meaning of Art. 4 No. 1 GDPR relating to an identified or identifiable person, such as name, email address or physical address. If we contact you outside of these channels, we will inform you separately where applicable.
3. Legal Bases for Processing
We process personal data only if at least one of the following legal bases applies:
Consent (Art. 6 para. 1 lit. a GDPR): You have consented to the processing for a specific purpose, e.g. the placement of analytical and marketing cookies. You can withdraw your consent at any time with future effect.
Contract (Art. 6 para. 1 lit. b GDPR): The processing is necessary for the performance of a contract with you or for pre-contractual measures, e.g. for creating a quote.
Legal obligation (Art. 6 para. 1 lit. c GDPR): We are legally obliged to carry out the processing, e.g. to retain invoices.
Legitimate interests (Art. 6 para. 1 lit. f GDPR): The processing is necessary to protect our legitimate interests and your interests or fundamental rights do not override them, e.g. for the secure and stable operation of our website.
For the storage of information on your end device and access to it (e.g. through cookies), Section 165 Paragraph 3 of the Telecommunications Act 2021 (TKG 2021) additionally applies. Unless this is technically strictly necessary, we will obtain your consent for this.
4. Retention Period
We store personal data only for as long as is necessary for the respective purpose. If the purpose no longer applies, we delete the data, provided that there is no statutory retention obligation, such as for accounting documents (usually seven years pursuant to Section 132 BAO).
If you withdraw consent or request the deletion of your data, we will delete it as quickly as possible, provided there is no obligation to retain it. Specific retention periods for individual processing operations can be found in the respective sections.
5. Your Rights
Under the GDPR, you have the following rights. To exercise these, an informal message to dataprotection@labelup.io is sufficient.
Information (Art. 15): You can request information as to whether we process data about you. If so, you will receive a copy of the data as well as information on purposes, categories of data, recipients (including transfers to third countries and the guarantees in place for this), storage period, origin of the data and the existence of automated decision-making including profiling.
Rectification (Art. 16): You can request the rectification of incorrect data or the completion of incomplete data.
Erasure (Art. 17): You can request the deletion of your data ("right to be forgotten").
Restriction (Art. 18): You can request that we only store your data but do not use it any further.
Data portability (Art. 20): You can request that we provide you with your data in a structured, commonly used and machine-readable format.
Objection (Art. 21): If processing is based on Art. 6 para. 1 lit. e or f GDPR, you can object for reasons arising from your particular situation. We will then check as quickly as possible whether we must comply with the objection. You can object to processing for the purposes of direct marketing, including any associated profiling, at any time without giving reasons; we will then no longer use your data for these purposes.
No automated individual decision-making (Art. 22): Under certain circumstances, you have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.
Withdrawal of consent (Art. 7 para. 3): You can withdraw consent once given at any time with future effect. The lawfulness of processing carried out up to the time of withdrawal remains unaffected.
Right to lodge a complaint (Art. 77): If you believe that the processing of your data violates data protection law, you can lodge a complaint with a supervisory authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Email: dsb@dsb.gv.at, www.dsb.gv.at.
6. Visiting our Website
Every time you visit our website, we process technical data that your browser transmits automatically. We collect further data via the services described in Section 8 or when you provide data to us yourself.
6.1 Processed Data
Automatically collected data
Date and time of the page view
IP address, truncated so that unique assignment is not possible
Name and version of the browser, end device, screen resolution and internet service provider
Referrer URL, i.e. the website or advertising medium through which you reached us
Approximate location (country and city)
Usage and conversion data (via the services in Section 8)
Your behavior on the website, e.g. clicks, scrolling behavior and duration of stay
Achieved website goals (conversions), e.g. contact requests, registrations or newsletter subscriptions
Data you provide to us
In forms, we sometimes ask you for details such as your name and email address, e.g. for contact requests or registration. Providing this is voluntary; however, you cannot use individual functions without it.
6.2 Purposes
Provision, improvement and further development of the website
Creation of usage statistics
Detection, defense and investigation of attacks on the website
Provision of user accounts on our platforms
Contact initiation via email
6.3 Legal Bases
Art. 6 para. 1 lit. f GDPR for the technical operation, security and user-friendly design of the website
Art. 6 para. 1 lit. b GDPR for inquiries, registrations and pre-contractual measures, e.g. the preparation of an offer
Art. 6 para. 1 lit. a GDPR for analytical and marketing services that require your consent
6.4 Retention Period
We generally store automatically collected data for three months. We only store it longer to the extent necessary to investigate detected attacks, and beyond that only until the expiry of relevant limitation or retention periods or until the conclusion of a legal dispute in which the data is required as evidence.
7. Cookies and Consent Management
Cookies are small text files that are stored on your device when you visit a website. They facilitate navigation, store your settings or recognize you during a later visit, among other things. Cookies cannot read or modify other data on your device.
Session cookies are automatically deleted when you leave our website or close the browser.
Persistent cookies remain stored until their expiration date or until they are deleted manually. We use them to recognize you when you visit again.
We place technically necessary cookies on the basis of our legitimate interest in a functioning website (Art. 6 para. 1 lit. f GDPR). We only set all other cookies, in particular for analysis and marketing, with your consent (Art. 6 para. 1 lit. a GDPR, Section 165 para. 3 TKG 2021).
Consent management: We record your selection via our cookie management tool. You can change or withdraw your consent at any time via the "Cookie Settings" link at the bottom of the page. Additionally, you can configure your browser to notify you before cookies are set, or to block and delete cookies; instructions for this can be found in your browser's help function. Blocking cookies may prevent you from using the website to its full extent.
8. Analysis and Marketing Services
Unless otherwise stated, we use the following services only with your consent (Art. 6 para. 1 lit. a GDPR, Section 165 para. 3 TKG 2021). The cookies and lifetimes mentioned correspond to the details provided by the providers and are subject to change. For transfers to the US, see Section 11.
8.1 etracker
Provider: etracker GmbH, Hamburg, Germany (www.etracker.com)
We use etracker to analyze the usage of our website. The etracker consent manager module is used to manage consents, and we integrate scripts from other services via the etracker tag manager. Both of these together control which cookies and services are loaded according to your selection.
Even if you reject statistical cookies, etracker collects usage data. Data that could allow an association with an individual person (IP address, login or device identifiers) is anonymized or pseudonymized as early as possible. The legal basis for this is our legitimate interest in optimizing our online offering and in the legally compliant integration of other services (Art. 6 para. 1 lit. f GDPR). You can object to this processing at any time; the objection will have no disadvantageous consequences for you.
etracker processes and stores the data on our behalf exclusively in Germany. No other use, merging with other data or disclosure to third parties takes place. etracker is certified with the ePrivacyseal data protection seal of quality. Further information: etracker Privacy Notice.
8.2 Google Tag Manager
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
With the Google Tag Manager, we deliver small code elements (tags) on our website according to set rules, e.g. for Google Analytics. It implements the choices made in the cookie management tool and only loads tags in accordance with your selection. The Tag Manager itself does not set cookies and does not evaluate usage data; however, when it loads, your IP address is transmitted to Google for technical reasons. The tags it delivers can collect data themselves.
8.3 Google Analytics
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Google Analytics helps us understand how visitors use our website. Processed information includes the accessed URLs and page attributes, device and browser information, and the approximate location. The data can be transmitted to Google servers in the US and stored there. According to Google, Google Analytics 4 does not store IP addresses.
Google evaluates the data on our behalf and creates reports for us on website activity. We use the results to optimize our website and our advertising measures. You can prevent collection at any time via the "Cookie Settings" at the bottom of the page. Further information: Google Privacy Policy.
Cookies used
_ga (first-party, 2 years): randomly generated ID used to recognize returning visitors and link visits
_ga_<Container-ID> (first-party, 2 years): stores the session state
8.4 Google Ads Conversion Tracking
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
With Google Ads Conversion Tracking, we measure the success of our ads. If you achieve a set goal on our website (conversion), such as a contact inquiry, registration or newsletter subscription, Google records this. Using previously set cookies, Google associates which ad was clicked beforehand. Google also processes this data on servers in the US.
Cookies used
test_cookie (third-party doubleclick.net, 15 minutes): tests whether the browser allows cookies; contains no identification features
IDE (third-party doubleclick.net, 1 year): randomly generated ID with which Google recognizes users across websites and displays personalized ads
8.5 Meta Pixel
Provider: Meta Platforms Ireland Limited, Dublin, Ireland
With the Meta Pixel, we can track how users behave on our website after they have clicked on one of our ads on Facebook. We use this to evaluate ads for statistical and market research purposes, to optimize future advertising measures and to recognize which interactions have taken place on the website (e.g. downloads). We can also display interest-based ads to visitors of our website on Facebook (Custom Audiences).
When visiting our website, the pixel establishes a direct connection to Meta's servers. Meta thereby receives the information that you have visited our website and can assign this to your Facebook account. We do not receive any data ourselves with which we can identify you. We are jointly responsible with Meta for the collection and transmission of the data to Meta (Art. 26 GDPR). Meta is solely responsible for further processing, including for Meta's own advertising purposes. Further information: Meta Privacy Policy.
Cookies used
_fbp (first-party, 3 months): distinguishes visitors in order to display and measure Meta advertising products
fr (third-party facebook.com, 3 months): delivery and measurement of advertising
8.6 LinkedIn Insight Tag
Provider: LinkedIn Ireland Unlimited Company, Dublin, Ireland
The LinkedIn Insight Tag uses cookies to collect page activity, URL, referrer URL, IP address, device and browser characteristics, and timestamps. IP addresses are truncated or hashed. If a visitor is an active LinkedIn member, LinkedIn can assign the data to their account. We use the evaluations to track user behavior after clicking on one of our LinkedIn ads, evaluate ads for statistical and market research purposes, and optimize future advertising measures. Further information: LinkedIn Cookie Policy.
Cookies used
li_fat_id (first-party, 1 month): member identification for conversion tracking, retargeting and analysis
UserMatchHistory (third-party linkedin.com, 30 days): measuring the performance of LinkedIn ads
li-oatml (third-party linkedin.com, 1 month): member identification for conversion tracking, retargeting and analysis
li_sugr (third-party linkedin.com, 3 months): browser identifier
U (third-party linkedin.com, 3 months): browser recognition
bcookie (third-party linkedin.com, 1 year): browser identifier
bscookie (third-party linkedin.com, 1 year): secure browser identifier
h2 id="133">9. Social Media
9.1 Our Facebook Page
When you visit our Facebook page, Meta processes data about your usage behavior using cookies. From this, Meta generates anonymized statistics about activity on our page (Page Insights) and makes them available to us. We are jointly responsible with Meta Platforms Ireland Limited for this processing (Art. 26 GDPR).
The legal basis is our legitimate interest in the presence and optimization of our offering on Facebook (Art. 6 para. 1 lit. f GDPR). Without this processing, this would not be possible for us. Further information: Information about Page Insights.
9.2 Social Plugins
Plugins from Facebook may be integrated on our website. These transmit data about your visit to Meta, even if you are not logged into Facebook or not registered there. We only integrate these plugins with your consent (Art. 6 para. 1 lit. a GDPR). We are jointly responsible with Meta for the collection and transmission of the data to Meta (Art. 26 GDPR); Meta is solely responsible for further processing. Further information: Meta Privacy Policy.
10. Customers of our Platforms Label Up and Labelizer
10.1 Allocation of Roles
Insofar as we can access personal data from your area as a customer within the scope of our services, we process this exclusively as a processor (Art. 28 GDPR), only for the execution of the contract and in accordance with your instructions. For this data, you remain the data controller under data protection law. You, as the controller, review and answer requests from data subjects regarding this data; if such requests reach us, we will forward them to you. The details, in particular regarding instructions, liability and indemnification, are governed by the contract concluded with you.
We process the data of your customer account (e.g. name and email address of users) as controllers to fulfill the contract with you (Art. 6 para. 1 lit. b GDPR). We do not pass on personal data of our customers to third parties and do not use it for purposes other than those mentioned here.
10.2 Access via Google Interfaces
In order to access the Google Merchant Center or the Multi-Client Account (MCA) on your behalf, we process the data required for this via the Google APIs for the Merchant Center. This includes your email address, your Google profile details and access to your shop and product data, specifically via the following permissions (scopes):
https://www.googleapis.com/auth/userinfo.profile (profile details)
https://www.googleapis.com/auth/userinfo.email (email address)
https://www.googleapis.com/auth/content (management of your Merchant Center data)
The use and transfer of information received by Labelizer via Google APIs to other apps is carried out in accordance with the Google API Services User Data Policy, including the Limited Use requirements.
10.3 Shopify App
When you connect a Shopify store to Labelizer, our app reads product and catalog data from your store and uses it exclusively for Labelizer functions. If you uninstall the app, we stop reading and delete the store's data as soon as Shopify transmits the deletion request; upon request, also earlier via dataprotection@labelup.io.
10.4 Anonymized Data
We can use data that you transfer to the platform or that we collect within the scope of service provision in anonymized form, i.e. without any reference to a person, for any purposes, such as for statistics and the further development of our products.
11. International Data Transfers
Some of the recipients mentioned, in particular Google, Meta and LinkedIn or their parent companies, may process your data outside the EU or EEA, primarily in the US. The level of data protection in these countries may not correspond to that in the EU.
We transfer personal data to third countries only if one of the following guarantees exists:
Adequacy decision of the EU Commission (Art. 45 GDPR): For the US, this applies to recipients certified under the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795).
Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR): We conclude the Standard Contractual Clauses of the EU Commission (Implementing Decision (EU) 2021/914) with recipients without an adequacy decision.
A copy of the respective guarantees is available on request to dataprotection@labelup.io.
12. Status and Changes
Status: September 2026. We adjust this privacy policy when our data processing or the legal situation changes.
All texts are protected by copyright. Source: Created with the AdSimple Privacy Generator