Privacy policy

E-Store Privacy Policy (Version 10/2026)

This privacy policy applies to data processing on the website https://vivo-official.com.

The protection of your data is very important to us. We therefore process your data exclusively on the basis of the statutory provisions (GDPR and other applicable law and regulations). In this privacy policy, we inform you about the most important aspects of data processing within the framework of our website.

When you use this website, your personal data is also processed.

According to Art. 4 No. 1 of the General Data Protection Regulation (hereinafter "GDPR"), "personal data" is any information relating to an identified or identifiable natural person.

As the operator of the website, we are the "controller" within the meaning of Art. 4 No. 7 GDPR and process and store your personal data for the period necessary to fulfil the specified purposes and legal obligations.

Below, we would like to explain who we are, what personal data we process, for what purpose and in what manner on the basis of the GDPR, and what rights you may have in this regard.

Content

1. Contact

a) Controller (Art. 4 No. 7 GDPR)

VBF Tech Austria GmbH
Donau-City-Str. 7
A-1220 Wien
(represented by the managing directors: Daizhong Tian and Shiming Mo)
(hereinafter referred to as "we" or "us")
Email: office@at.vivo.com

If you have any questions, please contact us at the address given above. You are entitled to the rights listed in section 6 with regard to your data stored by us. If you believe that we are in breach of data protection regulations, you can lodge a complaint with us or with a data protection authority (see contact details in section 8).

2. Processing of personal data – types and purposes of processing

You are not legally or contractually obliged to provide us with your personal data. However, it is possible that certain functions of our website depend on the provision of personal data. If you do not provide personal data in these cases, this may result in functions not being available or only being available to a limited extent.

2.1. Automated processing

a) Accessing the website

When you visit our website, the browser used on your device automatically sends information to our website's server in order to establish and maintain the connection, ensure the security and functionality of our website, and, if necessary, prosecute any illegal attacks on it.

The following information is stored in a log file and automatically deleted after a short period of time:

  • IP address of the requesting computer
  • Date and time of access
  • Name and URL of the file accessed
  • Website from which access is made (referrer URL)
  • Browser used and, if applicable, the operating system of the requesting computer
  • The name of the access provider

This information is processed on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest arises from the need to ensure the smooth operation of the website and the aforementioned security interests.

We cannot draw any direct conclusions about your identity from the information stored in the log file and do not intend to do so.

In addition, we use cookies and analysis services when you visit our website. For more detailed information, please refer to sections 2.1 b) and 2.1 c) of this privacy policy.

b) Cookies

Our website uses cookies. These are small text files that are stored on your device with the help of your browser in order to improve the functionality and user-friendliness of the website, e.g. by storing settings such as language or shopping basket contents, as well as to analyse the use of the website and provide personalised content. They do not cause any damage.

We distinguish between technically necessary cookies, which are essential for the operation of the website, and non-essential cookies for analysis or marketing purposes. Without cookies, the functionality of the website may be limited, e.g. in terms of navigation or session storage. Some cookies remain stored on your device until you delete them. They enable us to recognise your browser the next time you visit.

The following information may be processed by cookies:

  • Session ID or unique identifiers
  • IP address (for tracking cookies)
  • Browser information (type, version)
  • Usage data (e.g. pages visited, click behaviour)
  • Preferences (e.g. language settings)

For cookies that are not functionally necessary, we ask for your consent in the cookie window (Art. 6(1)(a) GDPR). Only if this consent is actively given will your personal data be processed for the specified purpose.

For cookies that are marked as functionally necessary in the cookie window, we base our legal basis on our legitimate interest (Art. 6 (1) (f) GDPR) in making the website user-friendly.

The data is stored until you delete it or until the cookie expires (e.g. end of session or up to 2 years). We cannot usually draw any direct conclusions about your identity from this data unless it is linked to other data. You can deactivate or delete cookies in your browser settings. If you deactivate cookies, the functionality of our website may be limited. For more information on analysis services, please refer to section 2.1 c).

Please refer to our separate cookie policy for information on the extent to which and how we use certain technologies to improve your online experience and tailor our services to you.

c) Web analysis (e.g. with tools such as Google Analytics)

In order to continuously improve our website and our offerings, we analyse user behaviour anonymously or pseudonymously using web analysis tools such as Google Analytics. These tools help us to measure the effectiveness of the website, e.g. by evaluating access statistics in order to adapt content and optimise the user experience.

The analysis is only carried out if you give your consent and we have concluded a data processing agreement with the provider. When transferring data to third countries (e.g. the USA), we use appropriate safeguards such as standard contractual clauses.

The following information is processed:

  • IP address (pseudonymised, e.g. by truncating the last digits)
  • Usage data (e.g. pages visited, length of stay, click paths)
  • Device information (e.g. browser type, operating system, screen resolution)
  • Approximate location data (e.g. country or region)

This information is processed on the basis of Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest lies in analysing and optimising the website without drawing any direct conclusions about your identity. The data is stored for a limited period of time (e.g. 14 months) and then deleted or anonymised. You can revoke the analysis at any time or prevent it via browser add-ons (e.g. opt-out for Google Analytics).

d) Server logs and hosting

To ensure the smooth operation of our website, access data is logged in server logs and processed by our hosting provider. This serves the purposes of stability, security and troubleshooting, e.g. to detect overloads or attacks. The hosting provider acts as a processor and only processes the data on our behalf.

The following information is processed:

  • IP address
  • Access date and time
  • Requested files and HTTP status code
  • Amount of data transferred
  • Referrer URL

This information is processed on the basis of Art. 6(1)(f) GDPR. Our legitimate interest arises from the technical necessity for the secure operation of the website. The logs are automatically deleted after a short period of time (e.g. 15 days). We do not draw any direct conclusions about your identity from this data.

2.2. Processing based on input

a) Orders in the online shop

When you place an order in our online shop, we process your data in order to conclude the purchase contract with you and handles the transaction, e.g. processes the payment and ships the goods. Without this data, the contract cannot be fulfilled. Processing is carried out only for this purpose and within the scope of statutory retention obligations.

The following information is processed:

  • Name and address (delivery and billing address)
  • Email address and telephone number
  • Payment details (e.g. credit card number, bank details)
  • Logistics details (e.g. goods ship status)
  • Products ordered, order date and time
  • IP address

In order to process your return request, verify your identity, and associate your return request with your original order, we need to collect and process the following data:

  • Name
  • Phone number
  • Email address

This information is processed on the basis of Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR (legal obligations, e.g. tax law). The data is stored until the expiry of the tax retention period (7 years) or product liability period (10 years) and then deleted. The data is passed on to payment and shipping service providers (see section 5).

b) Creation and use of a customer account

When you create a customer account, we process your data in order to offer you personalised access, e.g. to store your order history, wish lists or addresses for faster shopping. Registration is voluntary and makes future orders easier.

The following information is processed:

  • Email address or telephone number used to register the account
  • Account details (e.g. account ID, username, profile photo), Password (encrypted)
  • Address
  • Order history and wish list
  • IP address upon registration
  • Account login status and usage history

This information is processed on the basis of Art. 6 (1) (b) GDPR (performance of a contract). The data is stored for as long as the account is active; in the event of you delete the account we will delete it on request.

c) Participation in promotional campaigns (e.g. competitions or discount campaigns)

When you participate in promotional campaigns such as competitions or discount campaigns, we process your data in order to carry out the campaign, e.g. to determine winners, send prizes or allocate discounts. Participation is voluntary and based on your consent.

The following information may be processed:

  • Name
  • Age
  • Email address
  • Telephone number
  • Delivery address
  • IMEI number of the promotional device
  • Photograph/scan of the proof of purchase and the IMEI number of the promotional device
  • Participation data (e.g. answers to questions)
  • IP address and date of participation

This information is processed on the basis of Art. 6(1)(a) GDPR (consent) or Art. 6(1)(b) GDPR (in the case of prizes). The data will be deleted within 6 months after the promotion has ended (e.g. after the prize has been delivered), unless legal reasons require longer storage.

d) Registration for the newsletter/promotional emails

If you decide to receive our newsletter, promotional emails, SMS, push notifications, messaging services, and other electronic communication channels, in order to receive personalised information, content and offers based on your interactions and preferences about products, promotions or news, the data will be transmitted to us in the respective input mask.

When you subscribe to the newsletter/promotional emails, the following data is stored:

  • Name
  • Email address
  • Telephone number
  • Other messaging services (e.g. FaceBook, Instagram etc.)
  • Registration date and opt-in confirmation

Processing is based on your consent within the meaning of Art. 6 (1) (a) GDPR. The data will be used exclusively for sending the newsletter/promotional emails. You can cancel your subscription at any time. You can also revoke your consent to the storage of your personal data at any time. For this purpose, there is a corresponding link in every newsletter. If you unsubscribe or revoke your consent, we will add your email address to the "List of Users Who Do Not Receive Subscription Information" to avoid continuous harassment. The data will not be used for any other purposes.

e) Contact form or enquiries by e-mail/chat

When you use the contact form, email or chat, we process your data in order to process and respond to your enquiry, e.g. about products or support. This serves the purpose of communication and improving our service.

The following information is processed:

  • Name and email address
  • Telephone number or email address
  • Content of the enquiry (message text)
  • IP address, date and time

This information is processed on the basis of Art. 6 (1) lit. f GDPR (legitimate interest) or Art. 6 (1) lit. b GDPR (for contractual matters). Our legitimate interest lies in the efficient processing of enquiries. We will retain personal data processed for customer support purposes such as data subject requests, complaints and customer interaction records for up to three (3) years from the last interaction.

f) Payment processing

In order to fulfill contracts, ensure transaction security, and prevent fraud, we need to share the following data to our payment service providers:

  • Name and delivery address
  • Email address
  • Country code
  • Order details (e.g. goods description, price, quantity, order amount)
  • Payment details (e.g. credit card number, bank details)
  • Browser Information (e.g. browser name, IP address)

To perform the contract, ensure transaction security and prevent fraud, we share necessary data with (installment) payment service providers. Depending on the selected method, these may include in particular:

  • Payment service provider: [name, registered office]
  • PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg)
  • Installment payment service providers.

Those parties might act as an independent controllers, so their own privacy notices also apply. Where they act as processors, an Art. 28 GDPR agreement is in place.

This information is processed on the basis of Art. 6 (1) (b) GDPR (contract performance) and Art. 6 (1) (c) GDPR (legal obligations). The data is retained in accordance with statutory periods (e.g. 7 years).

g) Shipping and delivery

We process your data for the purpose of shipping your order, e.g. by handing it over to shipping service providers such as DHL. This is part of the fulfilment of the contract.

The following information is processed in this process:

  • Name and delivery address
  • Telephone number (for coordination)
  • Tracking information (e.g. tracking number, carrier code, logistics status)
  • Order details (e.g. order ID, goods description, quantity, device identifier)

We also need to transmit your carrier code and tracking number to our logistics tracking service providers, such as VASTAR, so that they can provide us with your order's logistics status, which will then be displayed to you on the interface.

This information is processed on the basis of Art. 6 (1) (b) GDPR (contract fulfilment). The data will be deleted after successful delivery, unless tax law requires longer storage (e.g. 7 years).

h) Trade-in programme (trade-in of used devices)

If you participate in our trade-in programme and trade in a used device, we process the data required to assess the value of the returned device, process the trade-in transaction, and provide related services. Data might be shared with our third-party trade-in service providers.

The following information may be processed:

  • Name
  • Email address
  • Phone number
  • Country code and language code
  • New device order details (e.g. order number, product model, order status, purchase time, delivery confirmation time)
  • Trade-in device information (e.g. device details, trade-in valuation, bonus amount)
  • Bank details (IBAN, account holder) for payout

This information is processed on the basis of Art. 6 (1) (b) GDPR (contract fulfilment). The data is retained in accordance with applicable statutory retention periods, unless tax law requires longer storage (e.g. 7 years).

i) Invoicing and receipt generation

In order to issue invoices or receipts, comply with tax regulations, and fulfill contracts, we may need to process and share the following data (depending on the legal requirements of your country) to our third-party invoicing service providers:

For individual or company invoices (or receipts) issued by default:

  • Name, Company name
  • Email address
  • Delivery address
  • Country code
  • ID number or tax code
  • VAT number
  • Electronic invoice code
  • Order details (e.g. goods description, price, quantity, order amount)
  • Tax rate

This information is processed on the basis of Art. 6 (1) (c) GDPR (legal obligations) and Art. 6 (1) (b) GDPR (contract fulfilment). The data is retained in accordance with statutory tax and accounting periods (e.g. 7 to 10 years, depending on local laws).

j) Submission of ratings or reviews

When you submit product reviews, we process your data in order to collect feedback and show it to other users, e.g. to improve our products and transparency. Submitting reviews is voluntary.

The following information is processed:

  • Account details (e.g. account ID, username, profile photo)
  • Review text and star rating
  • Product reference
  • IP address and date

This information is processed on the basis of Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest lies in improving quality. The data is stored permanently for as long as the review is relevant; deletion is possible upon request.

k) Consumer research interviews

If you have purchased a product in our online shop, we may contact you to invite you to take part in consumer research interviews (for example about product use or experience). Participation is voluntary.

The following information is processed:

  • E-mail address
  • Model of the smartphone you purchased

We process this data on the basis of your consent (Art. 6(1)(a) GDPR).

We disclose these two data fields to vivo Mobile Communication Iberia S.L. (“vivo Spain”), which acts as a separate controller for the research recruitment and the interviews. vivo Spain will send you the invitation and, if you agree to take part, will provide you with its own privacy notice before the interview. vivo Spain will not use the data for advertising or marketing and will not receive any other data from your shop account.

If you do not reply or decline, vivo Spain will delete the data within 30 days after the recruitment window ends. If you object to further research contact, we will suppress your data for this purpose.

3. Forwarding/processing on third-party websites

Our website allows you to access third-party websites or separately operated websites via links on. These are websites of our service partners. These sites are only integrated into our website as links to the corresponding websites. After clicking on the corresponding link or the integrated graphic, you will be redirected to the site of the respective provider, i.e. only then will user information be transferred to the respective provider.

For information on how your personal data is handled when using these external websites, please refer directly to the respective data protection regulations of the respective providers.

4. Security

We have implemented appropriate security measures to protect your personal data from loss, misuse and unauthorised access, alteration, disclosure or destruction, including, but not limited to, administrative, technical and physical measures. However, we would like to point out that, despite our measures, no security measure exists that guarantees the absolute security and complete protection of your data.

Among other things, we take the following measures to ensure data security:

4.1. Access control

Establishment of rules for access to personal data processed in our information systems, prevention of unauthorised access to locations where the information systems are located.

4.2. Risk assessment

Identification of threats to the security of personal data prior to processing and assessment of the effectiveness of measures taken to ensure the security of such data.

4.3. Desensitisation

Use of technical means to protect information, including but not limited to encryption and anonymisation techniques.

4.4. Processing records

Recording of all processing actions performed on personal data contained in our information systems.

4.5. Regular detection

Detecting unauthorised access to personal data and taking appropriate measures to mitigate the impact of such unauthorised access. Monitoring measures are taken to ensure the security of personal data and the level of protection of information systems for personal data.

4.6. Restoration

Taking all practicable measures to restore personal data that has been modified or destroyed as a result of unauthorised access.

5. Transfer of personal data to third parties

5.1. Recipients of personal data

Within our company, only those persons and departments who need your personal data for the above-mentioned purposes will receive it.

In addition, we sometimes use external service providers (e.g. agencies, logistics partners, etc.) who are bound by data protection law through data processing agreements, Art. 4 No. 8 GDPR. These fall into the following categories, for example:

  • Hosting and shop system providers to operate the web shop;
  • Shipping and logistics partners for the processing of orders, shipping, returns and trade-in collection;
  • Payment partners to complete order payments and ensure transaction security and, in the case of instalments, credit checks;
  • Trade-in, inspection and refurbishing partners, including providers of certified data erasure and IMEI/ theft checks;
  • After-sales service providers for repairs or warranty processing;
  • Vivo Mobile Communication Iberia S.L., Spain, for the limited purpose of inviting you to consumer-research interviews, as described in section 2.2 k). vivo Spain acts as a separate controller for that research;
  • Analytics services (Google LLC, USA - privacy policy), for website optimisation (only with your consent).

When transferring data to third countries outside the EU/EEA (e.g. Canada or the USA), we ensure an adequate level of data protection, e.g. through adequacy decisions by the EU Commission or standard contractual clauses (Art. 44–49 GDPR). You can request a list of current recipients and further details via your right to information (Art. 15 GDPR). We update this information as necessary.

Except in the cases mentioned above, we only pass on your personal data to third parties if:

  • you have given your express consent in accordance with Art. 6 (1) (a) GDPR;
  • this is necessary in accordance with Art. 6 (1) (b) GDPR for the performance of a contract with you or on the basis of pre-contractual measures taken at your request;
  • there is a legal obligation to disclose the data in accordance with Art. 6 (1) (c) GDPR.

5.2. Transfer outside the EU/EEA

We may transfer your personal data to service providers and partners located in third countries outside the European Union (EU) or the European Economic Area (EEA), including external digital marketing agencies. Whenever we transfer your personal data outside of the EU/EEA, we ensure that an adequate level of data protection is maintained. This is guaranteed either through an adequacy decision by the European Commission for the respective country or by concluding standard contractual clauses (SCCs) in accordance with Art. 46 GDPR with the recipients. You can request further details and a copy of the appropriate safeguards by contacting us via the contact details provided in section 1.

6. Your rights as a data subject in relation to the processing of personal data

As a data subject, you have the following rights under the GDPR:

6.1. Withdrawal of consent (Article 7(3) GDPR)

You may revoke your consent at any time. As a result, we will no longer be permitted to continue processing data based on this consent in the future.

6.2. Information (Art. 15 GDPR)

You may request information about your personal data processed by us. In particular, you may request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, deletion, restriction of processing or objection, the existence of a right of appeal, the origin of your data if it was not collected by us, and the existence of automated decision-making, including profiling and, where applicable, meaningful information about its details.

6.3. Correction or completion (Art. 16 GDPR)

You may request the immediate rectification of inaccurate or incomplete personal data stored by us.

6.4. Erasure (Art. 17 GDPR)

You may request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.

6.5. Restriction of processing (Art. 18 GDPR)

You may request the restriction of the processing of your personal data if you dispute the accuracy of the data, the processing is unlawful but you oppose its erasure and we no longer need the data, but you need it for the establishment, exercise or defence of legal claims, or you have objected to the processing pursuant to Art. 21 GDPR.

6.6. Data transfer (Art. 20 GDPR)

You may receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or request its transfer to another controller.

6.7. Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) GDPR (data processing in the public interest) and Article 6(1)(f) GDPR (data processing based on a balancing of interests); This also applies to profiling based on this provision in Article 4(4) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

6.8. Asserting your rights

If you wish to exercise any of your aforementioned rights, simply send us an email at office@at.vivo.com.

7. Storage period

Unless otherwise specified for individual data processing activities, the following applies to the duration of storage of your personal data:

We delete your personal data as soon as the purpose for storing it no longer applies. We may also store your data if this is provided for by European or national legislators in EU regulations, national laws or other regulations to which we are subject. Exceptions to the principle of deletion after the purpose has been achieved may arise, for example, from the provisions of the GDPR and the provisions of German federal law, in particular the BDSG. Furthermore, deletion will not take place, for example, as long as commercial, tax and professional law retention obligations exist.

Longer storage may also be necessary in individual cases due to the (possible) assertion of claims against us in connection with a contract or pre-contractual measures. This would be the case, for example, if there are indications that you will assert claims against us. The same applies if, in individual cases, we assert claims, intend to assert claims or consider asserting claims due to specific circumstances. The data will then be stored for as long as the processing of the data is necessary for the assertion, exercise or defence of legal claims, plus the duration of any statutory retention obligation that may exist.

If a statutory retention obligation prevents deletion, we will initially store your data in such a way that it can only be processed by a limited group of people and will only delete it after the retention obligation has expired.

8. Complaint to the supervisory authority (Art. 77 GDPR)

You can lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters.

The following supervisory authority is responsible for our company:

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Wien
Tel. +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: http://www.dsb.gv.at