Privacy Policy

Version: August 2026

Thank you for your interest in our online shop. Protecting your personal data is important to us.

Below we inform you which personal data we process when you use our website and online shop, for which purposes this takes place, on which legal bases the processing is carried out, and which rights you have.

1. Controller

The controller responsible for the processing of personal data on this website is:

David Fromm
Sakura Syndrome
Zanglweg 2
8502 Lannach
Austria

E-mail: office@sakura-syndrome.com
Website: www.sakura-syndrome.com

2. General Information on Data Processing

We process personal data exclusively within the framework of applicable data protection law, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and – where applicable – the Austrian Telecommunications Act 2021 (TKG 2021).

Personal data means any information relating to an identified or identifiable natural person.

Personal data is processed in particular:

• to technically provide and secure our website,

• to process and fulfil orders,

• for payment processing,

• for the production and delivery of ordered products,

• to manage customer accounts,

• to communicate with you,

• to comply with legal obligations,

• to safeguard our legitimate interests,

• to analyse and optimise our offering,

• to measure and optimise advertising activities,

• and on the basis of your consent, where such consent is required.

The respective legal basis is explained in more detail in the following sections.

3. Visiting Our Website and Server Log Data

When you access our website, technically necessary information is processed in order to provide the website securely, stably and functionally.

The following data may be processed in particular:

• IP address,

• date and time of access,

• pages and content accessed,

• referrer URL,

• browser type and version,

• operating system,

• device information,

• technical connection and log data.

The processing serves to provide our website, ensure IT security, detect and prevent misuse, and analyse errors.

Legal basis: Art. 6(1)(f) GDPR.

Our legitimate interest lies in the secure, stable and technically error-free operation of our online shop, as well as in protecting our systems against misuse and attacks.

Technical log data is generally stored only for as long as necessary for the purposes stated. Longer storage may occur where this is necessary to investigate a specific security incident, to assert or defend legal claims, or due to legal obligations.

4. Orders and Contract Processing

When you place an order in our online shop, we process the personal data required for the initiation, performance and fulfilment of the purchase contract.

The following data may be processed in particular:

• first and last name,

• billing address,

• delivery address,

• e-mail address,

• telephone number where applicable,

• order number,

• order and product data,

• delivery information,

• payment status and payment-related information,

• information on returns, complaints or refunds,

• additional information voluntarily provided by you.

Processing serves in particular to handle your order, contract performance, payment processing, production, delivery, customer communication and the handling of complaints, returns and warranty cases.

Legal basis: Art. 6(1)(b) GDPR.

Where we are required to retain order, invoice or transaction data due to tax, commercial or other statutory provisions, processing is additionally based on Art. 6(1)(c) GDPR.

5. Necessity of Providing Personal Data

Providing certain personal data is necessary for concluding and performing a purchase contract.

This includes in particular:

• name,

• billing and delivery address,

• e-mail address,

• order data,

• and the details required for the selected payment method.

Without provision of this data, we are generally unable to accept, process or fulfil an order.

Any further details are voluntary unless expressly marked as required.

6. Payment Processing

For payment processing, personal data is transmitted to or processed by the respective payment service provider, depending on the payment method selected and available at checkout.

The payment methods used by us or offered at checkout may include in particular:

• Shopify Payments,

• credit card payment,

• PayPal,

• Klarna.

The following data may be processed in particular:

• name,

• billing address,

• e-mail address,

• order and invoice data,

• payment amount and currency,

• payment status,

• transaction data,

• technical information,

• where applicable, further data required for payment verification, fraud prevention or compliance with legal obligations.

As a rule, we do not receive all payment information that you provide to the respective payment service provider. In particular, complete credit card details are generally processed directly by the respective payment service provider.

Payment service providers may process personal data in part under their own data protection responsibility, for example for payment processing, fraud prevention, security checks, compliance with legal obligations or – where permissible and relevant – for risk assessment or creditworthiness checks.

Legal basis: Art. 6(1)(b) GDPR for carrying out the payment transaction, and where applicable Art. 6(1)(c) or (f) GDPR for legal obligations, security measures and fraud prevention.

Further details can be found in the privacy information of the payment service provider you select.

7. Production, Print-on-Demand, Fulfilment and Shipping

Our products are predominantly manufactured using a print-on-demand process.

We use external production, fulfilment and shipping service providers for the production, handling and delivery of orders.

Depending on the product, production location, delivery country, availability and production capacity, processing takes place in particular via:

• Printify

• MarketPrint / MarketConsultive GmbH

The following data may be transmitted in particular in order to fulfil an order:

• name,

• delivery address,

• order number,

• products ordered,

• product variants and quantities,

• where applicable, personalisation details required for the order,

• shipping information.

This data is processed insofar as it is necessary for the production, fulfilment and delivery of the respective order.

Printify and MarketPrint may in turn engage production partners, print shops, logistics and shipping service providers to fulfil the order. As a result, the data required for production and delivery may be transmitted to the respective production or shipping partner.

Legal basis: Art. 6(1)(b) GDPR.

8. Shipping Service Providers

In order to deliver your order, the personal data required for this purpose is transmitted to the shipping or logistics company commissioned with the delivery.

This includes in particular:

• name,

• delivery address,

• where necessary for shipping information, e-mail address or telephone number,

• parcel and shipping information.

Which shipping service provider is used may depend in particular on the production partner, production location, destination country and the selected shipping method.

Legal basis: Art. 6(1)(b) GDPR.

9. Shopify as Shop and Hosting Platform

Our online shop is operated via Shopify.

Shopify provides in particular the technical infrastructure for the following functions:

• hosting and presentation of the online shop,

• product presentation,

• shopping cart,

• checkout,

• order management,

• customer accounts,

• security functions,

• payment integration,

• technical shop functions.

Within the scope of these services, Shopify may process the following data, among others:

• name and contact details,

• billing and delivery information,

• order and transaction information,

• information about shopping cart contents,

• IP address,

• browser and device information,

• information about the use of and interaction with our shop.

Insofar as Shopify processes personal customer data to provide the regular Shopify services we use, this processing generally takes place on our behalf.

Legal bases: Art. 6(1)(b) GDPR insofar as processing is necessary to fulfil orders, and Art. 6(1)(f) GDPR with regard to the secure, reliable and economical operation of our online shop.

Our legitimate interest lies in using a powerful, secure and reliable e-commerce infrastructure.

Shopify Network Intelligence and Enhanced Services

Shopify offers additional functions under the designation Shopify Network Intelligence or Enhanced Services.

Insofar as such functions are activated in our shop, Shopify may also process certain customer data under its own data protection responsibility, in particular to provide, develop and improve analytics, personalisation, advertising and optimisation functions.

Where consent is required for this under applicable law, the corresponding processing only takes place after your consent has been given.

In particular, functions for targeted advertising as well as non-essential cookies or comparable storage technologies are only used where the required consent has been obtained.

You may withdraw or change consent given at any time with effect for the future via the cookie or privacy settings available on our website.

Further information on the processing of personal data by Shopify and on how to exercise your data protection rights can be found in Shopify's privacy information and privacy portal.

10. Customer Account

Our shop offers the option of using a customer account.

If you create or use a customer account, the following data may be processed in particular:

• name,

• e-mail address,

• login and authentication information,

• billing and delivery addresses,

• order history,

• account settings,

• stored preferences where applicable.

The processing serves to provide and manage the customer account, simplify order processing and display your order information.

Legal basis: Art. 6(1)(b) GDPR.

Customer account data is generally processed for as long as the customer account exists. Statutory retention obligations for orders already completed remain unaffected.

11. Contacting Us

If you contact us by e-mail or via another contact option provided, we process the personal data you transmit in order to handle your enquiry and any follow-up questions.

The following may be processed in particular:

• name,

• e-mail address,

• content of your message,

• order number where applicable,

• any further information voluntarily provided.

If your enquiry relates to an existing or potential contract, processing is based on Art. 6(1)(b) GDPR.

For other enquiries, processing is based on Art. 6(1)(f) GDPR.

Our legitimate interest lies in the proper and efficient handling of incoming enquiries.

The data is generally deleted once the enquiry has been conclusively dealt with and no statutory retention obligations, ongoing contractual relationships or legitimate interests – in particular for the establishment, exercise or defence of legal claims – prevent deletion.

12. Newsletter and E-Mail Marketing

Insofar as our website offers registration for a newsletter or other marketing e-mails and you sign up, we process in particular:

• your e-mail address,

• your name where applicable,

• information about your registration,

• the time and evidence of your consent,

• where applicable, technical information required to document consent.

Processing is based on your consent.

Legal basis: Art. 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in a marketing e-mail you have received or by sending a message to:

office@sakura-syndrome.com

Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent up to the point of withdrawal.

Shopify functions or e-mail service providers used by us may be used for the technical administration of newsletter registrations and for dispatch.

After unsubscribing, certain information about the unsubscription may continue to be stored where this is necessary to ensure that no further promotional messages are sent or to demonstrate compliance with legal obligations.

13. Cookies and Similar Technologies

Our website uses cookies and similar technologies, for example local storage technologies or comparable technical methods.

Cookies are small pieces of information that can be stored on or read from your device.

13.1 Technically Necessary Technologies

Certain cookies and comparable technologies are technically necessary in order to provide the functions of our online shop that you have requested.

These may include in particular:

• page navigation,

• shopping cart,

• checkout,

• login and customer account,

• security and fraud prevention functions,

• language settings,

• country and currency settings,

• cookie and privacy preferences,

• technical shop functions.

Insofar as storing information on your device or accessing it is strictly necessary to provide a service expressly requested by you, this takes place in accordance with § 165(3) TKG 2021 without separate consent.

Insofar as personal data is additionally processed in connection with these technologies, this takes place – depending on the respective purpose – in particular on the basis of Art. 6(1)(b) or (f) GDPR.

Our legitimate interest lies in particular in the secure and functional operation of the online shop.

13.2 Analytics, Statistics, Personalisation and Marketing Technologies

Cookies or similar technologies that are not technically necessary, in particular for:

• reach measurement,

• analysis of usage behaviour,

• statistics,

• personalisation,

• measuring advertising success,

• interest-based advertising,

• retargeting,

are only used insofar as you have previously consented via our cookie or privacy settings and consent is legally required.

The following data may be processed in particular:

• IP address,

• device information,

• browser information,

• online identifiers,

• pages and products visited,

• click and interaction data,

• shopping cart information,

• conversion information,

• where applicable, pseudonymous user identifiers.

Legal basis for the processing of personal data: Art. 6(1)(a) GDPR.

For technologies requiring consent, the storage of or access to information on your device takes place on the basis of your consent pursuant to § 165(3) TKG 2021.

You may change or withdraw your consent at any time with effect for the future via the cookie or privacy settings available on our website.

Withdrawal does not affect the lawfulness of processing carried out up to the point of withdrawal.

14. Meta Pixel

Subject to your consent, we use the Meta Pixel provided by:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland

The Meta Pixel enables us to measure the effectiveness of our advertising activities on Facebook and Instagram and to optimise our advertising campaigns.

In particular, it makes it possible to determine whether visitors to our online shop carry out certain actions after viewing or clicking on an advertisement.

These include, for example:

• visiting our online shop,

• viewing certain products,

• adding products to the shopping cart,

• starting the checkout process,

• completing a purchase,

• other interactions relevant to measuring advertising effectiveness.

The following information may be processed in particular:

• IP address,

• browser and device information,

• pages and products accessed,

• referrer information,

• time and type of interactions,

• purchases and other conversion events,

• shopping cart or order values,

• product and content identifiers,

• cookie and online identifiers,

• where applicable, pseudonymous identifiers.

Insofar as corresponding functions such as advanced matching are activated, additional identification information may be processed in technically protected or hashed form.

The Meta Pixel is only activated once you have consented to the use of such marketing technologies.

Legal basis: Art. 6(1)(a) GDPR and – with regard to access to or storage of information on your device – your consent pursuant to § 165(3) TKG 2021.

You may withdraw your consent at any time with effect for the future via the cookie or privacy settings on our website.

For the collection and transmission of certain event data via the Meta Business Tools to Meta Platforms Ireland Limited, we and Meta may be joint controllers within the meaning of Art. 26 GDPR.

Joint controllership relates in particular to the collection of the corresponding data via the Meta Business Tools and its transmission to Meta.

For certain subsequent processing of the transmitted data, Meta acts under its own data protection responsibility.

Meta may use the information received in particular to measure and analyse advertising activities, create reports, optimise advertising and – in line with the respective settings and consents – personalise advertising.

Further information on the data processing carried out by Meta, on data subject rights and on joint controllership can be found in Meta's privacy information and the terms for the Meta Business Tools.

15. TikTok Pixel

Insofar as the TikTok Pixel is activated in our shop, we use it exclusively subject to your consent.

The provider for users in the European Economic Area is in particular:

TikTok Technology Limited
10 Earlsfort Terrace
Dublin, D02 T380
Ireland

The TikTok Pixel serves to measure and optimise our advertising activities on TikTok.

In particular, it makes it possible to determine whether visitors carry out certain actions in our online shop after viewing or clicking on a TikTok advertisement.

The following events may be recorded in particular:

• visits to certain pages,

• viewing products,

• adding a product to the shopping cart,

• starting the checkout process,

• completing an order,

• other interactions relevant to measuring the success of our advertising campaigns.

The following information may be processed in particular:

• IP address,

• device and browser information,

• online and cookie identifiers,

• pages or URLs accessed,

• referrer information,

• times of page views and interactions,

• product information,

• shopping cart and conversion information,

• order or conversion values,

• technical event and usage data.

The TikTok Pixel is not activated before you have consented to the use of such marketing technologies.

Legal basis: Art. 6(1)(a) GDPR and – with regard to access to or storage of information on your device – your consent pursuant to § 165(3) TKG 2021.

You may withdraw your consent at any time with effect for the future via the cookie or privacy settings on our website.

For certain processing operations in connection with the collection and transmission of personal data via TikTok Business Products, we and TikTok may be joint controllers within the meaning of Art. 26 GDPR.

TikTok may subsequently process the transmitted information under its own data protection responsibility, in particular to measure and optimise advertising campaigns, create audiences, improve ad delivery and for further purposes described in TikTok's privacy information.

Further information on data processing and on exercising your rights can be found in TikTok's privacy information and Business Products Data Terms.

16. Managing and Withdrawing Your Cookie Consent

The Meta Pixel, TikTok Pixel and other non-essential analytics or marketing technologies are not activated before you have given your consent.

Consent is voluntary.

A refusal does not affect your ability to visit our online shop or place orders in principle. However, certain non-essential analytics, personalisation or marketing functions are not available without the corresponding consent.

You may change your selection at any time via the cookie or privacy settings on our website, or withdraw consent already given with effect for the future.

Withdrawal must be as easy as giving consent.

17. Recipients and Categories of Recipients

Personal data is only disclosed where there is a legal basis for doing so, where disclosure is necessary for the performance of the contract, where corresponding consent has been given, or where we are otherwise entitled or obliged to disclose it.

Recipients or categories of recipients may include in particular:

• Shopify,

• payment service providers,

• Printify,

• MarketPrint / MarketConsultive GmbH,

• production and fulfilment partners,

• shipping and logistics service providers,

• IT, hosting and technical service providers,

• e-mail and communication service providers,

• Meta Platforms Ireland Limited,

• TikTok Technology Limited,

• tax advisors and other professional advisors,

• banks and payment institutions,

• authorities, courts and other public bodies where a legal obligation exists.

We do not disclose personal data to third parties without a corresponding legal basis.

18. Transfer of Personal Data to Third Countries

In the context of using certain service providers, personal data may also be processed outside the European Economic Area (EEA) or be accessible from there.

This concerns in particular internationally operating providers such as Shopify, Printify, Meta and TikTok, as well as, where applicable, their affiliated companies, production partners and sub-processors.

A transfer to a third country only takes place if the legal requirements of Art. 44 et seq. GDPR are met.

This may take place in particular:

• on the basis of an adequacy decision by the European Commission,

• on the basis of binding corporate rules,

• on the basis of the standard contractual clauses approved by the European Commission,

• or on the basis of another transfer mechanism permitted under the GDPR.

For certain intra-group transfers from the EEA, Shopify uses in particular approved binding corporate rules and, for further transfers, standard contractual clauses or other permitted transfer mechanisms where applicable.

For other international service providers, standard contractual clauses or other appropriate safeguards pursuant to Art. 46 GDPR are used where necessary.

Information about the safeguards used in each case can be requested from us at office@sakura-syndrome.com or found in the privacy information of the respective service provider.

19. Retention Periods

We store personal data only for as long as is necessary for the respective processing purpose or as long as statutory retention obligations exist.

In particular:

• Order, accounting and invoice records: generally for the duration of the relevant statutory retention obligations. In Austria, books, records and vouchers relevant for tax purposes must generally be retained for seven years. Longer periods may apply in special statutory cases.

• Contract and order data: where applicable beyond this, insofar as necessary for the establishment, exercise or defence of legal claims.

• Contact enquiries: until the enquiry has been conclusively dealt with, and beyond that only insofar as legal obligations or legitimate interests justify further storage.

• Customer account data: generally until the customer account is deleted or terminated. Order data subject to statutory retention obligations remains unaffected.

• Newsletter data: generally until consent is withdrawn or you unsubscribe. Evidence of consent given or withdrawn may be stored beyond this to the extent necessary.

• Cookie and consent data: in accordance with the respective technical lifetime or for as long as necessary to demonstrate consent, refusal or withdrawal.

• Analytics and marketing data: in accordance with the retention periods of the respective services used or until withdrawal of the consent given for this, unless there is another lawful basis for further storage.

• Technical log and security data: only for as long as necessary for operation, security, error analysis or the investigation of specific security incidents.

After the respective retention period has expired, personal data is deleted or anonymised, unless there are legal or other lawful grounds for further storage.

20. Your Data Protection Rights

Subject to the statutory requirements, you have in particular the following rights:

Right of access – Art. 15 GDPR

You may request information as to whether and which personal data we process about you.

Right to rectification – Art. 16 GDPR

You may request the rectification of inaccurate personal data and the completion of incomplete personal data.

Right to erasure – Art. 17 GDPR

Subject to the statutory requirements, you may request the erasure of your personal data.

Right to restriction of processing – Art. 18 GDPR

Subject to the statutory requirements, you may request the restriction of the processing of your personal data.

Right to data portability – Art. 20 GDPR

Insofar as the statutory requirements are met, you may request to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.

Right to object – Art. 21 GDPR

Subject to the statutory requirements, you have the right to object to processing of personal data carried out on the basis of Art. 6(1)(e) or (f) GDPR.

Right to withdraw consent – Art. 7(3) GDPR

You may withdraw consent given at any time with effect for the future.

Withdrawal does not affect the lawfulness of processing carried out on the basis of the consent up to the point of withdrawal.

To exercise your rights, you may contact us at:

office@sakura-syndrome.com

21. Special Notice on the Right to Object

Where we process personal data on the basis of Art. 6(1)(f) GDPR due to legitimate interests, you have the right under Art. 21 GDPR to object at any time to such processing on grounds relating to your particular situation.

We will then no longer process the personal data concerned, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time. In this case, your personal data will no longer be used for direct marketing purposes.

22. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a data protection supervisory authority.

The competent supervisory authority in Austria is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria

E-mail: dsb@dsb.gv.at

The right to lodge a complaint applies without prejudice to any other administrative or judicial remedy.

23. Profiling and Automated Decision-Making

In the context of marketing and advertising technologies such as the Meta Pixel and – where activated – the TikTok Pixel, usage and interaction data may be processed on the basis of your consent, and audiences or interest profiles may be created for advertising, analytics and optimisation purposes.

However, we ourselves generally do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

External payment, advertising or platform providers may carry out automated security, fraud, risk, advertising or creditworthiness checks or profiling under their own data protection responsibility.

Insofar as automated decision-making within the meaning of Art. 22 GDPR is relevant in an individual case, the privacy information of the respective provider applies in addition.

24. Data Security

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Our security measures are reviewed regularly and adapted where necessary, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing as well as the respective risks.

25. Minors

Our online shop is not specifically directed at children.

We do not knowingly collect personal data from children without the required legal basis or, where legally required, the consent of a legal guardian.

26. External Links

Our website may contain links to websites or services of external providers.

The processing of personal data by these external providers is generally governed by their respective privacy policies.

We have no influence over their content and privacy practices, insofar as the relevant data processing does not take place on our behalf or on the basis of joint controllership.

27. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy if legal requirements, our data processing activities, the technical design of our online shop or the service providers we use change.

The current version published on our website applies.

Version: August 2026