Privacy Policy

Last updated: April 15, 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. General Information on Data Processing

Sanvela operates this shop based on Shopify to provide you with a personalized shopping experience. This privacy policy describes how we collect, use, and share personal data when you visit our website or make a purchase.

The processing of personal data always takes place in accordance with the GDPR and applicable national data protection regulations.

3. What personal data do we process?

Depending on the nature of your interaction, we may process the following categories of personal data:

• Contact data: Name, postal address, billing address, delivery address, telephone number, email address
• Financial data: Payment card information, payment method, transaction details, payment confirmation (processing via payment service providers)
• Account information: Username, password, configurations and settings
• Transaction information: Viewed items, shopping cart contents, purchases, returns, cancellations, order history
• Communication data: Contents of your messages to our customer support
• Device information: IP address, browser type, device type, unique identifiers
• Usage information: Browsing and click behavior on our website, time and frequency of use

4. Legal Bases for Processing (Art. 6 GDPR)

4.1 Performance of a contract – Art. 6 para. 1 lit. b GDPR

Processing is necessary to complete your purchase, process orders, receive payments, organize shipping, and enable returns and exchanges.

4.2 Consent – Art. 6 para. 1 lit. a GDPR

If you have given us your consent, we will process your data for marketing and advertising purposes (e.g., newsletters, SMS). You can withdraw your consent at any time with effect for the future.

4.3 Legal obligation – Art. 6 para. 1 lit. c GDPR

We are legally obliged to store certain data, e.g., tax-related retention obligations according to §§ 147 AO, 257 HGB.

4.4 Legitimate interests – Art. 6 para. 1 lit. f GDPR

For fraud prevention, IT security, and improvement of our services, provided that your interests do not override ours.

5. Purposes of data processing

• Processing of purchases and orders
• Customer account management and authentication
• Shipping organization and fulfillment
• Customer support and communication
• Marketing and advertising measures (only with your consent)
• Fraud prevention and IT security
• Compliance with legal obligations

6. Storage period

• Booking receipts and tax-relevant documents: 10 years (§ 147 para. 1 AO)
• Commercial letters and business correspondence: 6 years (§ 257 para. 1 HGB)
• Order data and purchase history: up to 3 years after the end of the contract
• Customer account data: until the account is deleted
• Communication data (support): 2 years after the completion of the process
• Device data / Server logs: 7 days (automatic deletion)
• Marketing consents: until you withdraw your consent

7. Cookies and similar technologies

7.1 Technically necessary cookies

These cookies are absolutely necessary for the operation of the website (e.g., shopping cart function, login session). Legal basis: Art. 6 para. 1 lit. b and lit. f GDPR.

7.2 Analytics and marketing cookies

For analysis and marketing purposes, we only use cookies with your explicit consent (Art. 6 para. 1 lit. a GDPR, § 25 TTDSG). You can withdraw your consent at any time via our cookie settings.

7.3 Shopify cookies

Since our website is based on Shopify, Shopify sets technically necessary cookies for the operation of the shop. Further information: Shopify Privacy Policy

8. Disclosure of personal data

We only share your personal data with third parties in the following cases:

• Shopify Inc. (hosting, payment processing) – processor according to Art. 28 GDPR
• Payment service providers (e.g., PayPal, Klarna) – for processing your payment
• Shipping service providers (e.g., DHL, DPD) – for delivering your order
• Marketing and advertising partners – only with your express consent
• Authorities and courts – if we are legally obliged to do so

9. Relationship with Shopify

The services are hosted by Shopify Inc., 150 Elgin Street, Ottawa, Ontario, Canada K2P 1L4. Shopify processes personal data as a processor on our behalf. Further information: https://www.shopify.com/legal/privacy/app-users

Insofar as data is transferred outside the EEA, we rely on the standard contractual clauses of the European Commission (Art. 46 para. 2 lit. c GDPR).

10. Your rights as a data subject

• Information (Art. 15 GDPR): You can request information about the data we store about you.
• Rectification (Art. 16 GDPR): You can request the correction of inaccurate data.
• Erasure (Art. 17 GDPR): You can request the erasure of your data, provided there are no legal retention obligations preventing this.
• Restriction (Art. 18 GDPR): You can request the restriction of processing.
• Data portability (Art. 20 GDPR): You have the right to receive your data in a machine-readable format.
• Objection (Art. 21 GDPR): You can object to processing based on legitimate interests at any time.
• Withdrawal (Art. 7 para. 3 GDPR): You can withdraw any given consent at any time with effect for the future.
• Complaint (Art. 77 GDPR): You have the right to lodge a complaint with the competent supervisory authority.

11. Competent Data Protection Supervisory Authority

12. Data of minors

Our services are not directed at persons under 16 years of age. We do not knowingly collect personal data from minors. Should you discover that your child has provided us with data, please contact info@sanvela.de.

13. Links to third-party websites

Our website may contain links to third-party websites. We are not responsible for their data protection practices. We recommend that you read their respective privacy policies.

14. Data security

We employ technical and organizational security measures to protect your data. However, no transmission over the internet is completely secure. We recommend that you treat your access data confidentially.

15. Changes to this Privacy Policy

We reserve the right to amend this privacy policy from time to time. The current version will always be found on this page.

16. Contact