Privacy | Scho3dl

1) Controller

Scho3dl - Fabio Schödl

6122 Fritzens, Austria

Data Protection Officer: not appointed.

2) What this Notice covers

This Notice explains how we collect, use, share, transfer, and retain personal data when you browse the Site, create an account, place an order, contact support, or receive marketing from us.

It also describes your rights under the GDPR and Austrian law.

Scope: applies to scho3dl.com and related sales channels serving the EU (currently EU countries excluding Germany).

3) Personal data we process

Provided by you: - Account & identity data (name, email). - Order & fulfilment data (billing/shipping address, phone, ordered items, delivery notes). - Communications (support requests, reviews, messages).

Support email: support@scho3dl.com

Collected automatically (cookies & similar technologies): - Device/usage data (IP address, browser/OS, pages viewed, interactions, session identifiers). See Cookies & Analytics (§8).

From third parties: - Payment status tokens/confirmations from payment providers (for example Shopify Payments, Klarna, PayPal, Apple Pay, Google Pay). - Fraud-risk signals from Shopify’s built-in fraud analysis.

For certain payment methods (for example card schemes, digital wallets and local payment methods such as Bancontact or EPS), we may receive limited information from the relevant payment provider, such as masked card details, pseudonymous identifiers, payment status, and fraud or risk flags.

We do not intentionally collect special categories of personal data.

4) Purposes and legal bases

Operate the Site & provide the Services (account creation/management, process orders, deliver goods, returns/warranty). Legal bases: Contract (Art. 6(1)(b)); legal obligations for invoicing/records (Art. 6(1)(c)).

Payments (receive payment confirmations/tokens; we do not store full card details). Legal bases: Contract; legal obligations (tax/audit). We process payments via Shopify Payments using Shop Pay, major card schemes (for example Visa, Mastercard, American Express, Maestro, UnionPay), digital wallets (for example Apple Pay and Google Pay) and local payment methods such as Bancontact (Belgium) and EPS (Austria). In addition, we may offer Klarna pay-now / pay-later options and PayPal as separate payment services. For more information, please see their respective privacy policies.

Fraud prevention & security (risk scoring via Shopify fraud analysis; manual review; platform and application security). Legal bases: Legitimate interests (Art. 6(1)(f)). We do not rely on solely automated decisions with legal or similarly significant effects.

Customer support & service communications (respond to enquiries; order/service emails). Legal bases: Contract; legitimate interests (efficient support).

Direct marketing (email via Klaviyo only). Legal bases: Consent (Art. 6(1)(a)) and, where permitted, Austrian soft opt-in for existing customers; you can unsubscribe at any time.

Analytics & advertising: currently not in use. If we add third-party analytics or ad pixels in the future, we will request consent first. Legal bases: Consent (Art. 6(1)(a); ePrivacy/TKG rules for non-essential cookies).

If we need your data for any additional purpose, we will inform you and, where required, obtain consent.

5) Recipients (processors and independent controllers)

Commerce platform (headless) & hosting/CDN: Shopify (Headless) on Shopify Oxygen. Privacy: shopify.com/legal/privacy

Card and wallet processing (including Shop Pay, Visa, Mastercard, American Express, Maestro, UnionPay, Apple Pay, Google Pay, Bancontact and EPS): Shopify Payments (operated with Stripe) — acts as an independent controller for payment processing, fraud prevention and compliance. Privacy: Shopify ; Stripe

When you choose Apple Pay, Apple may also act as an independent controller for its wallet services. For details, please see Apple’s privacy information for Apple Pay: Apple Pay & Privacy.

When you choose Google Pay, Google may also act as an independent controller for its wallet services. For details, please see the Google Payments Privacy Notice: Google Payments Privacy Notice.

Klarna: independent controller for pay-now / pay-later and instalment payments, including related creditworthiness checks, fraud prevention and compliance. Privacy: Klarna Privacy Policy.

PayPal: independent controller for payment processing, fraud prevention and compliance. Privacy: PayPal Privacy Statement.

Couriers/fulfilment: Österreichische Post (and, where applicable, other local carriers we may add in future).

Analytics/ads: none currently deployed.

We sign data-processing agreements where applicable and require appropriate safeguards.

6) International data transfers

Some providers may process data outside the EEA. Where applicable, we rely on: - Adequacy decisions (e.g., for certain Shopify entities in Canada); and/or - Standard Contractual Clauses (SCCs) plus supplementary measures.

This applies in particular to Shopify/Shopify Payments (with Stripe), PayPal, Klarna, and global wallet providers such as Apple Pay and Google Pay. You can request more information or a copy of the relevant safeguards.

7) Retention

We keep personal data only as long as necessary for the purposes above, then delete or irreversibly anonymise it.

Account data: until deletion of your account or 24 months of inactivity.

Orders/invoices: 7 years after the end of the fiscal year (statutory retention under Austrian tax/commercial law).

Payment tokens/confirmations: per provider policy and legal retention (typically until chargeback windows lapse).

Support communications: 24 months after resolution.

Marketing data (consents, email activity): until you withdraw consent or 24 months after last interaction; consent logs retained as required by law.

8) Cookies & Analytics (Austrian ePrivacy/TKG)

We use strictly necessary cookies to operate the Site and the checkout. No analytics or marketing cookies are currently set.

Checkout & payments (strictly necessary): Shopify session/checkout cookies (for example session IDs, country, payment routing) and, where you choose specific payment methods, cookies or similar technologies set by those providers (for example Shop Pay, Klarna, PayPal, Apple Pay, Google Pay, Bancontact or EPS) for authentication, 3-D Secure/SCA, routing, risk and fraud prevention. These tools are essential for secure payment processing and do not require consent.

If we later introduce optional cookies (analytics, advertising, preferences), we will obtain consent first and list all tools and lifetimes within the banner.

9) Marketing communications

We send promotional emails only with your opt-in (or, where legally permitted, under the Austrian soft opt-in for our existing customers). Every message includes an unsubscribe link. Transactional emails (order confirmations, shipping updates) are not marketing.

10) No age-restricted products

We do not sell complete airsoft weapons or other age-restricted products. We therefore do not perform age verification. If we later add any age-restricted items, we will implement an appropriate age-assurance process and update this Notice accordingly.

11) Automated decision-making

We do not take decisions with legal or similarly significant effects solely by automated means. Shopify’s fraud analysis provides a risk recommendation; a human makes the fulfilment decision.

12) Your rights

You have the rights of access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent at any time (without affecting processing prior to withdrawal). To exercise these rights, email support@scho3dl.com. We may need to verify your identity.

13) Right to complain

You can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, DSB): Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, +43 1 52 152-0. You may also contact your local supervisory authority.

14) Security

We implement appropriate technical and organisational measures, including encryption in transit, role-based access controls, least-privilege principles, and monitoring. No method is 100% secure, but we continuously improve our safeguards.

15) Providing data & consequences

Certain information is contractually necessary to purchase from us (e.g., name, address, payment confirmation). If you do not provide required data, we cannot process your order.

16) Changes to this Notice

We may update this Notice from time to time. We will post the new version with an updated “Last updated” date and, where required, provide additional notice.