Data protection
PRIVACY POLICY
VERSION 1 as of August 24, 2026
Contents
- Controller
- General information on data processing
- What personal data is processed?
- Purposes and legal bases of processing
- Orders and contract fulfillment
- Customer accounts
- Shopify and Hosting
- Shopify Network Intelligence
- Shopify Payments and Klarna
- PayPal
- Fulfillment via Spreadconnect
- Shipping and Delivery
- Cookies and Consent Management
- Google Analytics 4
- Remarketing with Shop
- Newsletter and email marketing via Klaviyo
- Shopify apps used
- Product ratings and reviews
- Contact by email and customer service via IONOS
- Recipients of personal data
- Data transfer to third countries
- Storage period
- Data subject rights
- Right to lodge a complaint
- Data security
- External links
- Changes to this Privacy Policy
1. Controller
Controller in the sense of the General Data Protection Regulation (GDPR):
KSCU.shop - King Sunshine Crypto Universe
Owner: Patricia Pamela Kwistek
Attemsgasse 31/2/31
1220 Vienna
Austria
Email: office(at)kscu.shop
2. General information on data processing
We process personal data exclusively within the framework of applicable data protection regulations.
Personal data is information relating to an identified or identifiable natural person. This includes, for example, name, address, email address, payment information, order data, or technical information such as the IP address.
What data is processed depends on how you use our online shop and which functions or services you use.
3. What personal data is processed?
Depending on the use of our online shop, the following personal data, in particular, may be processed:
- Name and contact details
- Billing and delivery address
- Email address and phone number, if provided
- Order and transaction data
- Selected payment method and payment status
- Customer account and profile data
- Data related to cancellations, returns, complaints, and warranty cases
- Communication data for inquiries
- Device and browser information
- IP address
- Information about the use of our online shop
- Cookie and consent information
- Newsletter and marketing preferences
- Information about viewed products, shopping cart contents, and purchases
- Contents of product ratings and reviews, if applicable
Payment card or similar payment data is generally processed by the respective payment service providers used.
4. Purposes and legal bases of processing
Personal data is processed in particular:
- for the implementation of pre-contractual measures and the processing of orders and sales contracts,
- for the provision and management of customer accounts,
- for payment processing,
- for the production, shipping, and delivery of ordered goods,
- for processing cancellations, returns, complaints, and warranty cases,
- for communication with customers,
- for compliance with legal retention, documentation, and information obligations,
- for the security and protection of our online shop,
- with appropriate consent for newsletter, analysis, personalization, marketing, or advertising purposes.
Depending on the processing, this is carried out in particular on the basis of:
- Art. 6 para. 1 lit. b GDPR – performance of a contract and pre-contractual measures,
- Art. 6 para. 1 lit. c GDPR – compliance with legal obligations,
- Art. 6 para. 1 lit. f GDPR – legitimate interests,
- Art. 6 para. 1 lit. a GDPR – consent.
If processing is based on consent, this can be revoked at any time with effect for the future.
5. Orders and contract fulfillment
When placing an order, we process the data necessary for the execution of the sales contract. This includes, in particular, name, contact details, billing and delivery address, ordered products, order value, payment method, and information on the order status.
The provision of this data is necessary for the conclusion and execution of the sales contract. Without this data, an order cannot be processed or cannot be fully processed.
The legal basis is Art. 6 para. 1 lit. b GDPR.
If data must be stored due to legal retention or documentation obligations, processing is additionally carried out on the basis of Art. 6 para. 1 lit. c GDPR.
6. Customer accounts
Our online shop offers customers the option to use a customer account.
Shopify generally uses passwordless login for customer accounts. Customers enter their email address and receive a one-time verification code to that email address. No password is required for this login method.
If a customer profile already exists for the email address provided, orders and profile data associated with this profile can be viewed and managed after successful login. If an email address is used for which no customer profile exists yet, Shopify can create a corresponding customer profile during the login process.
Depending on the functions provided, the customer account can be used to, in particular:
- view orders and order history,
- manage profile data,
- edit name and email address,
- manage delivery addresses,
- and use other customer account functions provided by Shopify or our shop.
The following data, in particular, may be processed:
- Name
- Email address
- Delivery addresses
- Order and transaction data
- Customer profile and account information
- Login and verification information
- Technical device and usage information
If Shop or Shop Pay is available as a login option, customers can also log in via their existing Shop account. In this case, additional information connected to the respective Shop account may be processed.
Processing in connection with the provision and use of the customer account is carried out in particular for the execution and management of the customer and contractual relationship in accordance with Art. 6 para. 1 lit. b GDPR.
Registration for email marketing or newsletters is not required for the use of the customer account. If corresponding consent is given during registration, processing for marketing purposes is carried out on the basis of Art. 6 para. 1 lit. a GDPR.
Further information on processing by Shopify can be found in the data protection information listed under "Shopify and Hosting."
7. Shopify and Hosting
Our online shop is operated via the Shopify e-commerce platform.
For users in the European Economic Area, processing is carried out in particular by
Shopify International Limited
The Sidings, 4th Floor
Grand Canal Quay
Dublin D02 E7K8
Ireland
Shopify provides the technical infrastructure for the operation of the online shop and processes personal data generated during visits to and use of our shop, as well as in connection with orders and customer accounts.
This may include, in particular, IP addresses, device and browser information, contact details, customer account data, order information, transaction data, and information about the use of the shop.
The hosting location for our Shopify shop is set to the European Union. In connection with individual Shopify services or international subcontractors, personal data may nevertheless also be processed outside the European Economic Area.
Shopify processes certain personal data on our behalf. For individual Shopify services and extended functions, Shopify may also process data under its own data protection responsibility.
Further information:
Shopify Privacy Policy Austria
Shopify Privacy Policy for Consumers
8. Shopify Network Intelligence
Shopify Network Intelligence is activated in our shop.
This feature allows Shopify to use customer data from interactions with our shop, along with information from interactions with Shopify and other Shopify merchants, to provide enhanced Shopify services.
This can serve to improve the following areas in particular:
- Product and shop features
- Analytics
- Personalization
- Product recommendations
- Advertising and marketing features
- Fraud prevention and security
This may involve processing information about shop visits, viewed products, shopping cart contents, purchases, device information, and technical identifiers.
If consent is required for certain processing activities, the corresponding data will only be processed after consent has been given via our cookie and privacy system.
In the case of these extended services, Shopify may itself be responsible for data protection for certain processing operations.
Further information on processing by Shopify and ways to manage your own data can be found in the Shopify Privacy Policy for Consumers and the Shopify Privacy Portal.
Shopify Privacy Policy for Consumers
9. Shopify Payments and Klarna
Shopify Payments
For payment processing, we offer various payment methods via Shopify Payments .
The following data, in particular, may be processed:
- Name and contact details
- Billing address
- Order and transaction data
- Payment method
- Payment status
- Technical data
- Card or bank data required for payment processing
Processing is carried out for the purpose of executing the selected payment and thus fulfilling the purchase contract in accordance with Art. 6 para. 1 lit. b GDPR.
Shopify may involve other payment processors, financial institutions, or payment networks for payment processing.
Further information:
Shopify Payments Terms of Use and Privacy Information
Klarna
If a Klarna payment method is selected at checkout, the personal data required for payment processing will be transmitted to Klarna or processed by Klarna.
Provider:
Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden
This may include, in particular, name, address, contact details, order information, invoice amount, and payment information.
Depending on the selected payment method, Klarna may also process personal data for identity, fraud, or credit checks.
Processing is carried out for the purpose of executing the payment method selected by the buyer in accordance with Art. 6 para. 1 lit. b GDPR. For further processing by Klarna, the provider's own data protection regulations apply.
10. PayPal
If payment via PayPal is selected, the data required for payment processing is transmitted to PayPal or collected directly by PayPal.
For users in Austria, payment processing is carried out in particular via:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
2449 Luxembourg
This may include, in particular, the following data:
- Name and contact details
- Email address
- Billing and, if applicable, shipping address
- Order amount and currency
- Order and transaction information
- Payment status
- Payment and financial data
Processing is carried out for the purpose of executing the chosen payment method in accordance with Art. 6 para. 1 lit. b GDPR.
PayPal processes certain data under its own data protection responsibility and may carry out further legally required checks depending on the payment function used.
11. Fulfillment via Spreadconnect
For the production and processing of our print-on-demand products, we currently use Spreadconnect as our fulfillment partner.
Provider:
Spreadshirt Print On Demand GmbH
Gießerstraße 27
04229 Leipzig
Germany
In order for an order to be produced, shipped, and, if necessary, processed as part of a complaint, the personal data required for this will be transmitted to Spreadconnect.
This may include, in particular:
- Recipient's name
- Delivery address
- If applicable, phone number or email address, as far as required for shipping or delivery
- Ordered products
- Order or assignment information
Processing is carried out for the fulfillment of the purchase contract in accordance with Art. 6 para. 1 lit. b GDPR.
Spreadconnect may use other production and shipping partners for manufacturing and delivery.
12. Shipping and Delivery
To deliver ordered goods, the personal data required for this purpose is transmitted to the shipping and logistics companies commissioned with the shipment.
This may include, in particular:
- Name
- Delivery address
- If applicable, email address or phone number for delivery information
- Shipping and tracking information
Processing is carried out for the fulfillment of the contract in accordance with Art. 6 para. 1 lit. b GDPR.
Which shipping service provider is used may depend on the product, fulfillment partner, and delivery country, among other factors.
13. Cookies and Consent Management
Our online shop uses cookies and similar technologies.
To manage consent, we use the automated cookie and privacy system provided by Shopify.
Visitors can distinguish between the following categories via the cookie settings:
- Strictly necessary cookies
- Personalization
- Marketing
- Analytics
Strictly necessary cookies are required for the online shop to function properly and therefore cannot be completely disabled.
Cookies and similar technologies for personalization, marketing, or analytics are only used if corresponding consent has been given.
Visitors can:
- accept all optional cookies,
- reject all optional cookies,
- make an individual selection.
Consent given or selection made can be changed at any time via the cookie and privacy settings of our online shop.
Shopify also provides an automated page for deactivating certain data sharing for regions where this is required.
Further information:
14. Google Analytics 4
If appropriate consent has been given, we use Google Analytics 4 to analyze the use of our online shop.
For users in the European Economic Area, the following company is involved in particular:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
D04 E5W5
Ireland
Google Analytics helps us understand how visitors use our online shop and which pages, content or products are viewed most frequently.
In particular, the following may be processed:
- IP address
- Device and browser information
- Approximate geographical information
- Visited pages and products
- Time and duration of visits
- Interactions with the online shop
- Technical identifiers
Processing is carried out exclusively with your consent in accordance with Art. 6 para. 1 lit. a GDPR.
Consent can be revoked at any time via the cookie settings of our online shop.
Google may also process data outside the European Economic Area as part of its services.
Further information:
Google Analytics Data Protection
15. Remarketing with Shop
We use Shop features that can use shop visits and purchase interests to provide automated reminders and notifications.
Notifications are activated in particular for:
- abandoned carts
- products back in stock
- price reductions
- repeated interest in our shop or individual products
In particular, information about:
- shop visits
- products viewed
- shopping cart contents
- purchases
- device and usage information
- email address and other contact details required for notification
may be processed.
The specific processing depends on which Shop functions the respective user uses and which data protection or marketing consents are available.
If consent is required for this, processing will only take place after appropriate consent has been given. Further information on data processing by Shopify and Shop can be found in the Shopify Privacy Policy for Consumers.
Shopify Privacy Policy for Consumers
16. Newsletter and Email Marketing via Klaviyo
We use Klaviyo for sending newsletters and marketing emails.
Provider:
Klaviyo, Inc.
125 Summer Street, Floor 6
Boston, MA 02110
USA
If you subscribe to our newsletter or email marketing, the following data may be processed in particular:
- Email address
- Name, if applicable
- Time of registration
- Registration and consent status
- Technical information on registration and newsletter dispatch
- Information about interactions with sent emails, provided that the necessary data protection requirements are met
Depending on the shop function provided, registration can take place in particular via a newsletter form or via a corresponding consent option in connection with the customer account or registration for the customer account.
Registration for email marketing is voluntary and not a prerequisite for using a customer account or placing an order.
Marketing emails are sent exclusively on the basis of your consent in accordance with Art. 6 Para. 1 lit. a GDPR.
Double opt-in
We use the double opt-in procedure for registration. After registering, you will receive an email that you must confirm to complete your registration. Only after this confirmation will the registration be completed.
You can revoke your consent at any time via the unsubscribe link in a marketing email or by email to office(at)kscu.shop . The revocation does not affect the legality of the processing carried out until the revocation.
Klaviyo processes customer data, among other things, via cloud infrastructures in the USA. The necessary data protection mechanisms are used for international data transfers.
Further information:
Klaviyo Data Protection and Legal
17. Shopify Apps Used
We use various Shopify apps for certain additional functions of our Shopify shop. The providers used and the associated data processing are described below.
EU Right of Withdrawal Button Pro
For the provision and processing of electronic declarations of withdrawal, we use the Shopify app EU Right of Withdrawal Button Pro.
Provider:
ECOMBEAT
Martini & Radl OG
Garnisongasse 4
1090 Vienna
Austria
Customers can submit a withdrawal electronically via the app. For this purpose, the data required for processing and allocating the withdrawal is processed.
This may include in particular:
- Email address
- Last name
- Order number
- Order date
- Ordered items or items affected by the withdrawal
- Optionally specified reason for withdrawal
- IP address for abuse prevention and technical security
Within the scope of the Shopify permissions granted for the app, the app can also access customer, order and shop data as well as technical device and activity information required for the function.
The data is used in particular:
- to assign the withdrawal to an order,
- to process and document the declaration of withdrawal,
- to send a receipt or confirmation email,
- to manage the status of the withdrawal,
- for abuse prevention and technical provision of the function.
Processing takes place in particular in accordance with Art. 6 Para. 1 lit. b GDPR in connection with the handling of the contractual relationship and, insofar as processing is necessary for compliance with legal obligations, in accordance with Art. 6 Para. 1 lit. c GDPR.
For the technical provision of the app and for sending confirmation emails, ECOMBEAT may use further service providers or subcontractors.
According to the provider, the storage period of the withdrawal data collected via the app is currently 24 months.
Further information:
EU Right of Withdrawal Button Pro Privacy Policy
AI INDEX PRO
To technically optimize our online shop for search engines and AI-based search and information systems, we use the Shopify app AI INDEX PRO.
Provider:
ECOMBEAT
Martini & Radl OG
Garnisongasse 4
1090 Vienna
Austria
The app can be used in particular for the analysis and optimization of:
- Products and collections,
- Product descriptions,
- Structured data and schema markup,
- FAQ content,
- Page texts,
- Navigation,
-
llms.txt, - Indexing and discoverability of shop content,
- as well as for the analysis of traffic originating from AI platforms and resulting sales
can be used.
According to the provider, AI INDEX PRO does not process any personal customer data and does not set any additional cookies in the online shop.
According to ECOMBEAT, only product or shop content and no personal customer data are transmitted to external AI providers.
For its technical function, the Shopify app has permissions in particular to process or edit products, collections, online shop pages, themes and navigation. In connection with the operation of the app, data of the shop owner and, if applicable, blog contributors may also be processed.
Further information:
AI INDEX PRO – Provider Information
Belegio – Order Printer, PDF & E-Invoice
For the automated creation, management and provision of invoices and other documents, we use the Shopify app Belegio – Order Printer, PDF & E-Invoice.
Provider:
Artur Hoffmann (zrapp.group)
Okenstraße 352b
77652 Offenburg
Germany
Belegio processes the customer, order and transaction data from Shopify required for the creation and allocation of the respective documents.
This may include in particular:
- Name and contact details
- Billing and delivery address
- Email address and, if applicable, telephone number
- Order number and order date
- Ordered products
- Prices, invoice amounts and currency
- Payment and order status
- Tax-relevant information
- VAT identification number, if provided and required for invoicing
During the technical operation of the app or when accessing provided documents, technical information such as IP address, device, browser and operating system information may also be processed.
After successful payment, Belegio automatically creates the corresponding invoice based on the Shopify order data. In our shop, customers are provided with a download link to the invoice in the Shopify order confirmation, via which the invoice can be accessed as a PDF.
Belegio can also be used to create and manage delivery notes, credit notes and cancellation documents.
Processing is carried out for the performance and execution of the contractual relationship in accordance with Art. 6 Para. 1 lit. b GDPR and, insofar as processing is necessary for compliance with legal invoicing, recording or retention obligations, in accordance with Art. 6 Para. 1 lit. c GDPR.
According to the provider, documents and order data are processed and stored on servers in Frankfurt am Main, Germany. According to the provider, personal data does not leave the European Union when using Belegio.
A data processing agreement in accordance with Art. 28 GDPR has been concluded with the provider for the processing of personal data.
Further information:
Belegio – Information on Data Protection and Data Processing
18. Product Reviews and Ratings
If we offer our customers the opportunity to rate products or submit reviews, we process the data submitted for the provision, review and management of the rating function.
This may include in particular:
- Specified name or display name
- Email address
- Star rating
- Review text
- Optionally uploaded photos or other content
- Reference to the respective order or the rated product
- Technical information to prevent abuse
If ratings are displayed publicly, only the information provided for this purpose will be published. The email address will not be displayed publicly, unless explicitly stated otherwise.
Depending on the design, processing is carried out in particular on the basis of consent in accordance with Art. 6 Para. 1 lit. a GDPR or our legitimate interest in providing authentic product reviews in accordance with Art. 6 Para. 1 lit. f GDPR.
If an external service provider is used for the rating function in the future, this privacy policy will be supplemented with the respective provider.
18. Product Reviews and Ratings
If we offer our customers the opportunity to rate products or submit reviews, we process the data submitted for the provision, review and management of the rating function.
This may include in particular:
- Specified name or display name
- Email address
- Star rating
- Review text
- Optionally uploaded photos or other content
- Reference to the respective order or the rated product
- Technical information to prevent abuse
If ratings are displayed publicly, only the information provided for this purpose will be published. The email address will not be displayed publicly, unless explicitly stated otherwise.
Depending on the design, processing is carried out in particular on the basis of consent in accordance with Art. 6 Para. 1 lit. a GDPR or our legitimate interest in providing authentic product reviews in accordance with Art. 6 Para. 1 lit. f GDPR.
If an external service provider is used for the rating function in the future, this privacy policy will be supplemented with the respective provider.
19. Contact by Email and Customer Service via IONOS
If you contact us by email, we process the personal data you transmit to process your request.
This may include in particular:
- Name
- Email address
- Content of the message
- Order or invoice number
- Files or photos transmitted, if applicable
This applies in particular to general inquiries, questions about orders, as well as cancellations, returns, complaints and warranty cases.
For the provision and operation of our business email mailboxes, we use services from:
IONOS SE
Elgendorfer Str. 57
56410 Montabaur
Germany
When sending or receiving an email via our business email addresses, the data required for email communication is processed via IONOS systems.
This may include in particular:
- Sender and recipient address
- Name, if provided
- Date and time of communication
- Subject and content of the message
- Attachments
- Technical connection and log data
IONOS processes this data as part of providing email services.
Depending on the content of the request, processing is based on Art. 6 Para. 1 lit. b GDPR or on our legitimate interest in processing and organizing business communication in accordance with Art. 6 Para. 1 lit. f GDPR.
Further information on data processing by IONOS can be found in the provider's data protection section:
20. Recipients of Personal Data
Insofar as this is necessary for the respective purposes, personal data may be transmitted in particular to the following recipients or categories of recipients:
- Shopify
- Shopify Payments and involved payment service providers
- Klarna
- PayPal
- Spreadconnect and involved production and fulfillment partners
- Shipping and logistics companies
- Klaviyo
- IONOS
- ECOMBEAT / Martini & Radl OG: EU Widerrufs-Button Pro
- BELEGIO / zrapp.group (Artur Hoffmann): Creation, provision, management of invoices
- Technical subcontractors used by the respective service providers
- IT and technical service providers
- Tax consulting or other service providers used to fulfill legal obligations
- Authorities or courts, insofar as there is a legal obligation
Data will only be transferred if there is a legal basis under data protection law for doing so.
AI INDEX PRO is not listed here as a recipient of personal customer data, as, according to the provider, no personal customer data is processed via this app.
21. Data transfer to third countries
Some of the service providers we use, or their subcontractors, may process personal data outside the European Economic Area.
This may particularly affect internationally active providers such as Shopify, Google, Klaviyo or PayPal, as well as, if applicable, technical subcontractors of other services used.
In connection with the EU Widerrufs-Button Pro, subcontractors may be used for individual technical functions, such as sending confirmation emails. Insofar as personal data is transferred to third countries in this context, this is done, according to the provider, only using a permissible data protection transfer mechanism.
According to the provider, with AI INDEX PRO, only product or shop data and no personal customer data are transmitted to external AI providers.
Insofar as personal data is transferred to a third country, this only takes place under the legal conditions of the GDPR.
Data transfer may be based in particular on:
- an adequacy decision of the European Commission,
- the EU-US Data Privacy Framework, provided that the respective provider is certified accordingly,
- standard contractual clauses of the European Commission,
- or another legally provided transfer mechanism.
Further information on international data transfers can be found in the data protection information of the respective service providers.
22. Storage period
Personal data will only be stored for as long as necessary for the respective processing purpose or as required by legal retention obligations.
Data from orders and contractual relationships will be stored in accordance with applicable tax, commercial, and other legal retention obligations.
Furthermore, data may be stored for as long as it is necessary for the assertion, exercise, or defense of legal claims.
Data that is processed exclusively on the basis of consent will generally be stored until the consent is revoked or until the respective purpose ceases to apply, unless there is another legal basis for further storage.
Withdrawal data processed via the EU Widerrufs-Button Pro will be stored for a period of 24 months.
Individual service providers may also have their own legal or technically required retention periods.
23. Data subject rights
Data subjects have the following rights, in particular, in accordance with legal requirements:
- Right to information about the personal data processed
- Right to rectification of inaccurate data
- Right to erasure
- Right to restriction of processing
- Right to data portability
- Right to object to certain data processing activities
- Right to withdraw given consent
Given consent can be revoked at any time with effect for the future.
To exercise these rights, you can contact us at the following email address:
Insofar as Shopify is responsible for a specific processing itself, corresponding data protection rights can also be exercised directly via the Shopify privacy portal.
24. Right to complain
If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a competent data protection supervisory authority.
The authority responsible for us is in particular:
Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb(at)dsb.gv.at
Website: dsb.gv.at
The right to contact another legally competent data protection supervisory authority remains unaffected.
25. Data security
We take appropriate technical and organizational measures to protect personal data from loss, misuse, unauthorized access, alteration, or other unlawful processing.
Despite careful security measures, absolute security cannot be guaranteed when transmitting and processing data via the internet.
26. External links
Our online shop may contain links to websites or services of third parties.
When accessing such a link, you may leave our online shop. The respective operators are generally responsible for data processing on external websites.
Therefore, please note the data protection information of the respective providers.
This applies in particular to links to external social media profiles. As long as only an external link is provided, no data transfer to the respective social media platform generally takes place by us simply by visiting our online shop.
27. Changes to this Privacy Policy
We may adjust this privacy policy if this is necessary due to technical, operational, or legal changes.
This may be necessary in particular if new service providers, payment methods, customer account, withdrawal, marketing, analysis, AI optimization, or rating functions are used or existing services are changed or replaced.
The current version is available on this website. The date of the last update is indicated at the beginning of this privacy policy.