tadawınk
DEEN
Pick a giftPick a gift

Privacy

Last updated: 25. September 2026

This policy explains which personal data we process when running Tadawink, why, on which legal basis and for how long. It follows the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Controller

Tadawink is a service of:

Daniel Kurdoghlian (Pushing Pixels)
Malmögasse 16
1100 Wien
Österreich
E-Mail: hallo@tadawink.com
Tel.: +43 650 8520015
Web: pushingpixels.at

For questions about data protection or your rights, write to the email address above.

2. Overview

  • We use no tracking or analytics tools, no advertising cookies and no social media plugins.
  • You do not need an account. We only process what the gift, the payment, legal duties and security require.
  • Gift emails contain no advertising and no tracking pixels.
  • We do not sell data.

3. Visiting the website

When you open a page, our server processes technically necessary data: IP address, date and time, the address requested, referrer, and browser and operating system details. We need this to deliver the pages, keep them stable and fend off attacks. Server logs are rotated and deleted automatically.

To prevent abuse we count requests per IP address, for example when you order or upload a voice message. The counter only holds a hash of the IP address, and the entry expires after one hour at most.

Legal basis: our legitimate interest in a secure and fast service (Art 6(1)(f) GDPR).

4. Cookies and browser storage

We only set technically necessary cookies:

  • sessionid: remembers your uploaded voice message and your orders in this session (up to 2 weeks).
  • csrftoken: protects forms against forgery (1 year).
  • messages: shows confirmations on the manage page (until you close the browser).
  • tw_currency: remembers the currency of your order until you close your browser.
  • tw_preview: only for people with a preview link before launch (30 days).

Your browser also stores your configurator draft locally (localStorage) so that it survives a reload: your choices, names, message, handwriting and email addresses. The draft stays on your device and is deleted after you order. The browser also remembers whether sound is on.

Legal basis: § 165(3) Austrian Telecommunications Act 2021 and Art 6(1)(b) and (f) GDPR. No consent is needed for this.

5. Ordering a gift

For a gift we process: your choices (gift, variant, quantity, custom text), the names on the card, your message, the card language, your email address, the delivery method and the time including the time zone. For delivery by email, we also process the recipient's address. From the names we create a link preview image, available at the gift's address.

We also store when you accepted the terms and waived your right of withdrawal, each with the version of the text.

Legal basis: performance of the contract (Art 6(1)(b) GDPR) and legal obligations (point (c)).

Voice message and handwriting

When you record a voice message, your browser asks for the microphone. It only sends the recording when you upload it. We convert it and delete the original file right after, at the latest after one day. We store the voice message to deliver it with your gift. Anyone with the link can listen to it. Legal basis is our contract with you (Art 6(1)(b) GDPR). You can delete it at any time by deleting the gift with your manage link.

If other people can be heard on the recording, we rely on our and your legitimate interest in a shared greeting (Art 6(1)(f) GDPR). Anyone who can be heard may object. Write to us and we will delete the voice message.

For handwriting we store the strokes with their timing, so the card can redraw them, and an image of it.

Bot protection

When you submit your order, your browser solves a small computing task. This lets us detect automated requests. The task comes from our own server. No other provider is involved, and we set no cookie for it. Legal basis: § 165(3) Austrian Telecommunications Act 2021 and our legitimate interest in preventing abuse (Art 6(1)(f) GDPR).

6. Information for recipients

If you received a gift, your data comes from the person who sent it to you (Art 14 GDPR): your name on the card and, for email delivery, your email address. We use the address only to send you this one gift. We delete it 30 days after sending. We do not send you advertising.

We use Mailgun to send emails (section 10). If the email bounces or you mark it as unwanted, Mailgun puts your address on a block list so that no further emails reach it. This block stays until we lift it.

When you first open the gift, we store the time and show it to the person who sent it. Anyone with the link can open the gift. If you report a card, we store your reason. Your name and email address are optional. With the address we send you an acknowledgement and our decision (Art 16 DSA, Art 6(1)(c) GDPR).

Legal basis: the legitimate interest of the sender and our own in delivering the gift (Art 6(1)(f) GDPR).

Your right to object: You can object at any time (Art 21 GDPR). Reply to the gift email or write to the email address above. We then delete your address right away and send you no more gifts from Tadawink. To make this last, we only keep a hash of your address.

7. Payment through Link

Link handles the payment for us. Link is a Stripe company ("Sold through Link"). Link collects the amount, pays the taxes, sends you the receipt and invoice and helps with payment questions. You enter your payment details directly with Link. We never receive them.

We send Link your email address, the amount, the currency, the language and an order number. Link sends us the payment status, payment references and the country of your billing address. Link may show us further order data, such as your name and billing address. We only store what section 11 lists.

For payment, taxes, fraud prevention and support, Link and Stripe process your data as independent controllers. Link's privacy policy applies: link.com/privacy. Where Stripe processes data only on our behalf, it acts as our processor (Art 28 GDPR). Stripe may transfer data to the USA. Stripe, LLC is certified under the EU-US Data Privacy Framework (Art 45 GDPR). More: stripe.com/legal/privacy-center.

To have your data deleted at Link, contact Link. Link will let us know. We delete the data we store ourselves when you ask us (section 12), unless we must keep it.

For each order we store the amount, currency, country, payment references and your email address. Legal basis: performance of the contract and legal obligations (Art 6(1)(b) and (c) GDPR).

8. Emails

We send you emails that belong to your order: the order confirmation with the manage link, the delivery confirmation, notices about delivery problems and, on request, the manage link again. We send the gift to the recipient. There is no newsletter. We track neither opens nor clicks.

If an email bounces or someone marks it as unwanted, we block the address for further emails. For this we only store a hash of the address.

Legal basis: performance of the contract (Art 6(1)(b) GDPR) and, for the block list, our legitimate interest (point (f)).

9. Testimonials

After delivery you can tell us how your gift was received. This is voluntary. We store your quote, your first name and the occasion, and only publish it after review. Legal basis is your consent (Art 6(1)(a) GDPR). You can withdraw it at any time and we will take the quote off the website.

10. Recipients and processors

These providers process data on our behalf and on our instructions (Art 28 GDPR):

  • Server, database and files: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland
  • Sending emails: Mailgun Technologies, Inc. (Sinch-Gruppe), USA, Versand über die EU-Region. The data is stored in the EU. Mailgun is a US company and may access it from there, for example for support. This relies on the EU-US Data Privacy Framework (Art 45 GDPR), with standard contractual clauses as a backup (Art 46 GDPR).
  • Error monitoring: Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. The data is stored in the EU. We send technical error reports and have turned off sending IP addresses and user details. Access from the USA relies on the EU-US Data Privacy Framework (Art 45 GDPR).

Link and Stripe are independent controllers for the payment (see section 7). Beyond that we only share data when the law requires it. Backups are kept on storage owned by Pushing Pixels.

11. How long we keep data

  • Gift content (names, message, custom text, handwriting, voice message, preview image): one year from delivery or unlocking. Earlier if you delete or cancel the gift through the manage link or the payment is refunded.
  • Recipient's email address: 30 days after sending.
  • Gifts that were never delivered, for example because the email bounced: 400 days after the order.
  • Unpaid drafts: 2 days. Uploaded voice recordings that were not used: 1 day.
  • Order and payment data including your email address and the times of your consent: 7 years under § 132 of the Austrian Federal Fiscal Code (BAO). After that we delete them together with consents and withdrawals.
  • Blocked gifts: content 180 days after the block. Name and email address from a report: one year after our decision.
  • Testimonials: until you withdraw consent.
  • Database backups: 14 days on the server; copies on our own storage are overwritten on a rotating basis after a few weeks.

12. Your rights

You have the right of access (Art 15 GDPR), rectification (Art 16), erasure (Art 17), restriction of processing (Art 18), data portability (Art 20) and to object to processing based on legitimate interests (Art 21). You can withdraw consent at any time with effect for the future. Write to the email address above.

If you think we are breaking data protection law, you can complain to a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40 to 42, 1030 Vienna, www.dsb.gv.at.

13. Security

All transfers are encrypted (HTTPS). Gifts can only be reached through a long random link and are not listed in search engines. We only store a hash of the manage link.

14. Changes

We update this policy when Tadawink or the law changes. The version published here applies.