Last updated: November 2026
Here you can find out which personal data we process when you visit this website, why we need it and which rights you have (Art 13 and 14 GDPR, § 165 (3) of the Austrian Telecommunications Act).
1. Controller
The controller within the meaning of Art 4 (7) GDPR is:
Heritsch Media GmbH
Doblerstraße 18, 8501 Lieboch, Austria
Email: impressum@theschoolofrituals.com
2. When you visit this website
Each visit involves processing technically necessary data so that the website can be displayed and run securely:
- IP address
- date and time of access
- pages visited
- browser type and operating system
The legal basis is our legitimate interest in operating the website securely (Art 6 (1) (f) GDPR). We do not use this data to identify you personally and do not combine it with other data.
Visitor statistics: To see which pages are read and where visitors come from, we count page views ourselves, without cookies and without third-party services. We store the page visited, date and time, the website you came from, details from the link (for example utm_source and utm_campaign in ads), the device type (phone, tablet or computer) and the country the visit comes from. We do not store your IP address. From your IP address and browser identifier we create a checksum using a key that changes every day. This lets us count visitors per day without recognising you, not even across several days.
Short links: Some of our links (for example on Instagram, in ads or as a QR code) lead through a redirect on this website (www.theschoolofrituals.com/go/…). When you click one, we store the same kind of data: date and time, the website you came from, device type, country and the daily checksum, never your IP address. We add a random click number to the destination address. If you then sign up for the newsletter or buy something, we can link this to the click.
If you buy through the checkout or sign up for the newsletter, we also learn on which page and through which ad link this happened. The legal basis for visitor statistics, short links and this attribution is our legitimate interest in improving our offer and measuring the success of our advertising (Art 6 (1) (f) GDPR). You can object to this at any time, for example by email to the address above. Click and visit data that is not linked to a sign-up or purchase is deleted automatically after 13 months.
3. Cookies
We use technically necessary cookies without asking (§ 165 (3) of the Austrian Telecommunications Act). For statistics cookies we ask you first in a notice at the bottom of the website. We do not use advertising cookies from other providers.
Technically necessary:
- NEXT_LOCALE: remembers whether you want to read the website in German or English. Storage period: 1 year. It is only stored on your device.
- sor_einwilligung: remembers your answer in the cookie notice so we do not ask you every time. Storage period: 90 days.
Only with your consent:
- sor_besucher: a random identifier. It links your visits through ad links, short links or other websites with a later newsletter sign-up or purchase, so we can see how you found us. Storage period: 90 days.
- sor_herkunft: the most recent ad source (source, campaign, click number of a short link), so it is still known on later pages. Storage period: 90 days.
The legal basis for these two cookies is your consent (§ 165 (3) of the Austrian Telecommunications Act, Art 6 (1) (a) GDPR). The data stays with us and is not passed on to advertising networks. You can withdraw your consent at any time without affecting the lawfulness of processing before the withdrawal.
You can also delete or block cookies in your browser at any time. The website will then show you the language based on your browser settings.
4. Hosting
We work with the following service provider to run this website. It only processes data on our behalf (data processing under Art 28 GDPR).
- Vercel Inc., USA: hosting of the website. Purpose: delivering the pages, security. Legal basis: legitimate interest (Art 6 (1) (f) GDPR). Transfer to the USA based on the EU-US Data Privacy Framework (Art 45 GDPR) and standard contractual clauses (Art 46 (2) (c) GDPR).
5. Fonts
This website does not load fonts from Google or other providers, so no data is transferred to third parties for this purpose.
6. Links to Instagram
This website contains a link to our Instagram profile. Only when you click it are you redirected to Instagram, a service of Meta Platforms Ireland Limited. From then on, Instagram's privacy policy applies: privacycenter.instagram.com/policy. No Instagram content is embedded on this website itself.
7. When you write to us
If you contact us by email, we process your details in order to answer your request (Art 6 (1) (b) and (f) GDPR). We do not pass them on to third parties, except in the case described in section 8.
8. If Stephanie Heritsch takes over sales
The School of Rituals is a brand of Stephanie Heritsch. Heritsch Media GmbH currently operates the website and sells the products. If this cooperation ends, Stephanie Heritsch will continue the brand herself or through her own company.
In that case, we will hand over the data of customers and newsletter subscribers to her. This way you keep access to the products you bought, your questions about them can still be answered, and you continue to receive the newsletter if you subscribed to it. Only the data needed for this is handed over, for example name, email address, purchased products and your language.
The legal basis is the performance of your purchase contract, as far as access to your products is concerned (Art 6 (1) (b) GDPR), and our legitimate interest in the brand being continued with its customers (Art 6 (1) (f) GDPR). For the newsletter, your consent continues to apply. You can withdraw it at any time.
We will inform you by email before the handover. You can object to the handover (Art 21 GDPR), in which case your data will not be handed over. From the handover onwards, Stephanie Heritsch or her company is responsible for your data.
9. How long we store data
We only store your data for as long as necessary for the respective purpose. Statutory retention obligations remain unaffected, for example seven years for invoices and contracts (§ 132 of the Austrian Federal Fiscal Code, § 212 of the Austrian Commercial Code). We store data from enquiries for up to three years after the last contact. Click and visit data not linked to a sign-up or purchase is deleted after 13 months. Information on how you signed up or bought is kept as long as the data of your sign-up or order.
10. Automated decisions
There is no automated decision-making, including profiling, within the meaning of Art 22 GDPR (Art 13 (2) (f) GDPR).
11. Your rights
If the legal requirements are met, you have the right to:
- access the data stored about you (Art 15 GDPR)
- rectification of inaccurate data (Art 16 GDPR)
- erasure of your data (Art 17 GDPR)
- restriction of processing (Art 18 GDPR)
- data portability (Art 20 GDPR)
- object to processing based on our legitimate interest (Art 21 GDPR)
- withdraw consent at any time with effect for the future (Art 7 (3) GDPR)
Simply write to us at impressum@theschoolofrituals.com.
12. Complaints
If you believe that we are not processing your data lawfully, please contact us first. You also have the right to lodge a complaint with the data protection authority:
Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna, Austria