Privacy policy

Version: 1 October 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Orius IT-Solutions e.U.
Huglgasse 11/8
1150 Vienna, Austria
Phone: +43 660 2829330
Email: shop@orius.at

We have not appointed a data protection officer, as we are not legally required to do so.

2. Hosting and shop system

Our online shop runs on the Shopify platform, operated for customers in the EU by Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland (“Shopify”). When you visit our shop, Shopify processes technical data such as IP address, browser type, date and time of access and pages visited, in order to deliver the website securely and reliably (Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the shop). Shopify acts as our processor; data may also be transferred to Shopify Inc. in Canada (adequacy decision of the European Commission) and to the USA (see section 11). More information: www.shopify.com/legal/privacy.

Shopify Network Intelligence: In addition, Shopify uses data about your interactions with our shop (e.g. pages viewed, purchases, device information) together with data from other Shopify services to improve its products and services, to prevent fraud, for personalisation and for ad targeting, in particular within the Shop app and the Shopify network. For this processing, Shopify acts as an independent controller in accordance with its own privacy policy (www.shopify.com/legal/privacy). The legal basis for making this data available is our legitimate interest in using Shopify functions such as secure payments, Shop Pay and our newsletter (Art. 6(1)(f) GDPR). You can object to this processing at any time (Art. 21 GDPR) by contacting us or Shopify directly.

3. Orders and customer account

When you place an order, we process your name, email address, billing and shipping address, phone number (if provided), order details and payment information in order to perform the contract (Art. 6(1)(b) GDPR). The data marked as mandatory in the checkout is required to conclude and perform the contract; without it we cannot process your order. If you create a customer account, we additionally store your login data and order history until you delete your account.

4. Production and shipping

Our products are produced and shipped by our production partner Printful (Printful Inc., 11025 Westlake Dr, Charlotte, NC 28273, USA, and its affiliated companies, including Printful Latvia AS, Raiņa bulvāris 25, Riga, LV-1050, Latvia). For this purpose, we transmit your name, shipping address, email address or phone number (where required by the carrier) and the order details to Printful (Art. 6(1)(b) GDPR). Printful acts as our processor and passes the shipping data on to the respective shipping company (e.g. national postal services, DHL, UPS). More information: www.printful.com/policies/privacy.

5. Payment

Depending on the payment method you choose, your payment data is processed by the respective payment provider (Art. 6(1)(b) GDPR):

Shopify Payments (credit and debit cards, Apple Pay, Google Pay), processed by Shopify and its payment partner Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland
PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg
Shop Pay (accelerated checkout by Shopify): If you use Shop Pay and save your details for faster checkout, Shopify processes this data as an independent controller in accordance with its own privacy policy (Shopify Consumer Privacy Policy).
Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden

These providers may carry out fraud prevention and, where applicable, identity or credit checks under their own responsibility. Please refer to their privacy policies. We do not make any automated decisions within the meaning of Art. 22 GDPR ourselves.

6. Contact and withdrawal

If you contact us by email, phone or via our contact form, we process your details to handle your request (Art. 6(1)(b) GDPR for contract-related requests, otherwise Art. 6(1)(f) GDPR). If you use our online withdrawal function (“Withdraw from contract”), we process your name, order number, email address and the content of your statement to handle your withdrawal and to send you the legally required acknowledgement of receipt (Art. 6(1)(b) and (c) GDPR in conjunction with § 13a FAGG). The withdrawal function is provided by Revoq (Jonas Busch, BuschBytes, Hofstraße 2–4, 51061 Cologne, Germany) as our processor. We delete this data once it is no longer required, unless statutory retention obligations apply.

7. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about new products, drops and offers. The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 TKG 2021).

We use the double opt-in procedure: after signing up, you will receive an email asking you to confirm your subscription. We store the time of your sign-up and confirmation in order to be able to prove your consent.

We send the newsletter via Shopify Messaging, a service of our shop system provider Shopify, which acts as our processor. We evaluate whether our newsletters are opened and which links are clicked in order to improve our newsletter; this evaluation is covered by your consent.

You can unsubscribe at any time via the link in every newsletter or by email to shop@orius.at; this also ends the evaluation. We store your email address for the newsletter until you unsubscribe.

8. Cookies and statistics

We use technically necessary cookies to operate the shop, e.g. for the shopping cart, checkout, security and to store your cookie choice (§ 165(3) Austrian Telecommunications Act 2021, Art. 6(1)(f) GDPR). These cookies cannot be deactivated.

We only use cookies and similar technologies for statistics if you have given your consent via our cookie banner (§ 165(3) TKG 2021, Art. 6(1)(a) GDPR). We use Shopify Analytics, the statistics function of our shop system, to evaluate how visitors use our shop (e.g. pages viewed, referring website such as TikTok or Instagram, device type, country). Shopify processes this data as our processor. We do not use advertising pixels (e.g. Meta Pixel, TikTok Pixel) or Google Analytics.

You can change or withdraw your consent at any time with effect for the future via the link “Cookie preferences” in the footer of our shop.

9. Our social media profiles

We maintain profiles on TikTok and Instagram. If you visit these profiles or interact with them, the respective platform processes your data under its own responsibility and in accordance with its own privacy policy:

TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland – Privacy Policy
Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland – Privacy Policy

For the page statistics that the platforms provide to us as profile operators (e.g. “Instagram Insights”, “TikTok Analytics”), we are jointly responsible with the respective platform (Art. 26 GDPR). We only receive anonymised statistics and cannot identify individual users from them. The platforms have assumed primary responsibility for this processing and for fulfilling your data subject rights; you can nevertheless also contact us. The legal basis is our legitimate interest in presenting our brand and communicating with our community (Art. 6(1)(f) GDPR). If you contact us via these platforms, we process your message to answer it.

Visiting our shop via a link on TikTok or Instagram does not transfer any data from our shop to these platforms, because we do not use any advertising pixels.

10. Overview of recipients and third-party providers

Provider	Purpose	Role	Location
Shopify International Ltd. (Shopify Inc.)	Shop system, hosting, checkout, Shopify Analytics, newsletter (Shopify Messaging)	Processor	Ireland, Canada, USA
Shopify (Shop Pay)	Accelerated checkout, saved payment and address data	Independent controller	Ireland, Canada, USA
Printful Inc. / Printful Latvia AS	Production and shipping	Processor	USA, EU (e.g. Latvia, Spain), UK and other production sites
Revoq (Jonas Busch, BuschBytes)	Online withdrawal function, acknowledgement of receipt	Processor	EU (Germany, Netherlands, Ireland)
Shipping companies (e.g. national postal services, DHL, UPS)	Delivery	Independent controllers	depending on destination
Stripe Payments Europe Ltd. (via Shopify Payments)	Card payments, Apple Pay, Google Pay	Independent controller	Ireland, USA
PayPal (Europe) S.à r.l. et Cie, S.C.A.	Payment	Independent controller	Luxembourg
Klarna Bank AB (publ)	Payment (Klarna)	Independent controller	Sweden
TikTok Technology Ltd.	Social media profile	Joint controller (page statistics)	Ireland
Meta Platforms Ireland Ltd.	Social media profile (Instagram)	Joint controller (page statistics)	Ireland
Tax advisor, authorities	Accounting, legal obligations	Independent controllers	Austria

Apart from Printful and the withdrawal app listed above, we do not use any apps in our shop that process your personal data.

11. Transfers to third countries

Some of our service providers are based in, or process data in, countries outside the EU/EEA, in particular the USA and Canada. For Canada there is an adequacy decision of the European Commission. Where a recipient in the USA is certified under the EU–US Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR); otherwise we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

12. Retention

We store your data only as long as necessary for the purposes stated. Order and invoice data must be retained for seven years in accordance with Austrian tax and commercial law (§ 132 Federal Fiscal Code, BAO; § 212 Commercial Code, UGB). Data required to defend against legal claims may be stored until the relevant limitation periods have expired.

13. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future; this does not affect the lawfulness of processing carried out before the withdrawal. To exercise your rights, please contact us at shop@orius.at.

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation.

You also have the right to lodge a complaint with a supervisory authority. In Austria, this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.