Privacy Policy

Privacy Policy

Last updated: 3 October 2026

1. Who is responsible

The controller for your personal data is:

VantArc e.U., trading as Southern Sons Co. Owner: Friedrich Scharinger Schillerstraße 19, 4209 Engerwitzdorf, Austria info@southernsons.store

For anything about your data, write to that address.

2. What this policy covers

This policy explains what personal data we process when you visit www.southernsons.store, place an order, create an account, write to us, subscribe to our newsletter or leave a review. It also tells you why we process it, on what legal basis, who we share it with, how long we keep it, and what rights you have.

3. When you visit the website

When you open our website, our host Shopify automatically processes technical data: your IP address, browser and device type, the pages you visit and the time of your visit. This is necessary to show you the website, keep it secure and prevent abuse. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Cookies. We use cookies that are strictly necessary for the shop to work, such as keeping your cart and your login. These are set without consent (§ 165(3) TKG 2021). Any other cookies, such as for statistics, are only set if you agree in the cookie banner (Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time through the cookie settings link at the bottom of the page.

4. When you place an order

To process your order we need your name, email address, delivery and billing address, the products you order, and your payment details. Your phone number is optional unless the carrier needs it for delivery. Without the required data we cannot complete your order.

We use this data to process, pay for, ship and, where needed, return your order, and to answer your questions about it. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Payment. Card payments are processed through Shopify Payments. If you choose another payment method at checkout, such as PayPal, that provider processes your payment data as its own controller under its own privacy policy. We never see or store your full card number.

Fraud checks. Shopify checks orders for signs of fraud. Where an order is flagged, we review it ourselves. No decision with legal effect is made about you by automated means alone. Legal basis: our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).

Order records. We keep invoices and order records because Austrian tax and commercial law require it. Legal basis: legal obligation (Art. 6(1)(c) GDPR in conjunction with § 132 BAO and § 212 UGB).

5. Fulfilment and delivery, including transfer to China

Our products are supplied and shipped by partner suppliers. To fulfil your order, we pass your name, delivery address, phone number if given, and the ordered products to our order processing services DSers and CJdropshipping, and through them to the supplier who ships your parcel, and to the carriers who deliver it.

DSers, CJdropshipping and our suppliers are located in China. China does not have an EU adequacy decision, which means the level of data protection there is not equivalent to the EU. We transfer only the data needed to ship your order, and only because the transfer is necessary to perform our contract with you (Art. 49(1)(b) GDPR). Without it, we cannot deliver.

6. Customer account

You can order without an account. If you create one, we store your name, email address, addresses and order history so you can view your orders and check out faster. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). You can delete your account at any time by writing to us.

7. When you write to us

If you write to us by email or through the chat on our website (Shopify Inbox), we process your message and contact details to answer you. Legal basis: performance of the contract where your message concerns an order (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

8. Newsletter

If you subscribe, we send you emails about new pieces and the brand. We use Klaviyo to do this. After you sign up, you receive an email asking you to confirm. Only then are you subscribed. Legal basis: your consent (Art. 6(1)(a) GDPR and § 174 TKG 2021).

Klaviyo records whether you open our emails and which links you click, so we can see what is read. You can unsubscribe at any time with the link at the bottom of every email. We then stop sending and remove you from the list. We keep a record of your consent and its withdrawal as proof.

9. Reviews

After delivery we may ask you, by one email, to review what you bought. We only send this email if you agreed to it. Legal basis: your consent (Art. 6(1)(a) GDPR).

If you leave a review, we publish it with your first name and the initial of your surname, unless you choose otherwise. You can ask us to remove your review at any time. Reviews are collected and displayed through a reviews app integrated in our store.

10. Who we share data with

We share personal data only as described in this policy. Our service providers process it on our behalf and on our instructions, under data processing agreements:

• Shopify (Shopify International Limited, Dublin, Ireland): hosting, shop system, checkout, payments, customer accounts and chat.
• Klaviyo (Klaviyo, Inc., Boston, USA): newsletter.
• Our reviews app provider: collecting and displaying reviews.
• DSers and CJdropshipping, our suppliers and carriers: order fulfilment and delivery, as described in section 5.
• Our tax adviser, where needed for accounting.

Shopify's own features. Shopify also uses some data from your visits and purchases across merchants for its own purposes, such as fraud prevention and its Shop app. For these, Shopify is the controller. See shopify.com/legal/privacy/app-users.

To show shipment status, tracking numbers you enter on our Track your order page are processed by 17TRACK (YQTrack Ltd.), solely to retrieve carrier tracking information.

We do not sell your personal data.

11. Transfers outside the EU

Some of our providers process data outside the EU:

• USA: Shopify and Klaviyo, under the EU-US Data Privacy Framework, or the EU Standard Contractual Clauses where a provider is not certified.
• Canada: Shopify, under the EU adequacy decision for Canada.
• China: order fulfilment, as described in section 5.

12. How long we keep your data

• Order records and invoices: seven years from the end of the calendar year, as required by Austrian tax law.
• Customer account: until you delete it.
• Newsletter: until you unsubscribe. Proof of consent is kept for as long as we may need to show it was given.
• Messages: as long as needed to deal with your request, unless they form part of an order record.
• Reviews: as long as the review is published, or until you ask us to remove it.
• Technical website data: for the period Shopify keeps it for security purposes.

13. Your rights

You have the right to:

• access the data we hold about you
• have incorrect data corrected
• have your data deleted
• restrict how we process it
• receive your data in a portable format
• object to processing based on our legitimate interest, and to direct marketing at any time
• withdraw any consent you have given, with effect for the future

To use any of these rights, write to info@southernsons.store. We may ask you to confirm your identity first.

If you believe we process your data unlawfully, you can complain to the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, www.dsb.gv.at) or to the data protection authority in your own EU country.

14. Security

Our website is encrypted with TLS. Payments are processed by certified payment providers. No transmission over the internet is completely secure, so please do not send sensitive data such as card numbers by email or chat.

15. Children

Our shop is for adults. We do not knowingly collect data from children under 16.

16. Changes to this policy

We update this policy when our services or the law change. The current version is always on this page, with the date it was last updated.