Legal
Privacy policy
Which data are processed when you visit Ghomrug, for what purpose, and what rights you have.
Ghomrug is an information service with no account, no contact form, no newsletter and no comment function. We therefore process only a small amount of data, and only in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
1. Controller
Luxonaria GmbH
Lustkandlgasse 3/1/1-2a
1090 Wien, Österreich
Email: [email protected]
2. Visiting the website (server logs)
When a page is requested, our server processes technical data: IP address, date and time, the page requested, browser and operating system. We need these data to provide the website securely and reliably. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). We delete server logs after 14 days at the latest, except in the event of a security incident.
3. Audience measurement with Matomo
We use Matomo to measure which articles are read. Matomo runs on our own server; the data are not passed to any third party. Matomo is configured so that it sets no cookies and truncates IP addresses before storage, so that we cannot identify you. Legal basis: legitimate interest in data-minimising statistics (Art. 6(1)(f) GDPR). We keep the statistical data for no more than 25 months.
4. Cloudflare
The website is delivered via Cloudflare. Cloudflare protects against attacks and delivers pages faster; in the process, the server data listed in section 2 are also processed by Cloudflare. Cloudflare may set a technically necessary security cookie (__cf_bm), which fends off automated attacks and expires after 30 minutes. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) and § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).
5. Email
If you send us an email, we process your address and your message in order to reply. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). We delete the correspondence once the matter has been dealt with, after 24 months at the latest, unless statutory obligations require longer retention.
6. Videos and product images
Some articles contain videos from our YouTube channel. A video is only loaded when you click its preview image; the preview image itself is stored on our own server. After the click, the video is loaded via youtube-nocookie.com from Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). In the process, your IP address and technical data are transmitted to Google, including to the USA. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR). Google’s privacy policy.
The product images in the “See them in the trade” boxes are loaded from media.teppichbazar.at or media.bazarport.co.uk, the image servers of our shops. These shops are also operated by Luxonaria GmbH. The server data listed in section 2 are therefore also processed there. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
7. Service providers
| Service | Purpose | Registered office | Transfer |
|---|---|---|---|
| Hetzner Online GmbH | Server and hosting | Germany | EU |
| Cloudflare, Inc. | Protection against attacks, fast delivery | USA | EU-US Data Privacy Framework, standard contractual clauses |
| Cloudflare, Inc. (Email Routing) | Email forwarding | USA | EU-US Data Privacy Framework, standard contractual clauses |
| Google Ireland Ltd. (YouTube) | Videos after a click | Ireland | EU; transfer to the USA under the EU-US Data Privacy Framework |
| Google Ireland Ltd. (Gmail) | Email mailbox | Ireland | EU; transfer to the USA under the EU-US Data Privacy Framework |
Data processing agreements (Art. 28 GDPR) are in place with the service providers. We load fonts from our own server, not from Google.
8. Cookies
We do not set statistics, marketing or advertising cookies, and no content from advertising networks, social networks or video platforms is loaded when a page is opened. The only technically necessary cookie is Cloudflare’s security cookie (section 4). Only when you click a video may YouTube set its own cookies or similar storage (section 6).
9. Links to other websites
Articles link to museums, libraries, auction houses and other sources, and some also to an online carpet shop of Luxonaria GmbH. These are simple links: no data flow until you click on them. The privacy policy of the website concerned then applies.
10. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. To exercise them, write to [email protected]. If you believe that we are not processing your data lawfully, you can lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
11. Security
The website is encrypted throughout (HTTPS). We make backup copies regularly.
Last updated: November 2026