Privacy policy

Last updated: 17 August 2026

Privacy Policy

This English version is a courtesy translation. In the event of any discrepancy, the German version of this privacy policy shall prevail.

The protection of your personal data is important to us. We process your data exclusively on the basis of the statutory provisions, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG). In this privacy policy we inform you about which personal data we collect, for which purposes and on which legal basis we process it, to whom we disclose it and which rights you have when you visit or use our online shop and our website including all associated content, functions and services (the "Services"), or make a purchase through them.

1. Controller

The controller within the meaning of Art. 4 no. 7 GDPR is:

SOLARVIC PLUS GmbH
Leopold-Böhm-Strasse 5/434
1030 Vienna, Austria
Phone: +43 720 704 330
E-mail: info@solarvic.at

2. Which personal data do we process?

"Personal data" means any information relating to an identified or identifiable natural person (Art. 4 no. 1 GDPR). Anonymous or anonymised information which cannot be attributed to you is not covered. Depending on how you interact with the Services, we process the following categories:

Contact data – name, postal address, billing and delivery address, telephone number, e-mail address.
Payment data – payment method, payment card information, transaction details and payment confirmations. Complete payment data (e.g. card numbers) is processed exclusively by our payment service providers; we ourselves do not receive complete card data.
Account information – username, password (encrypted), settings and configurations of your customer account.
Order and transaction data – items viewed, added to the cart, purchased, returned, exchanged or cancelled, as well as your order history.
Withdrawal data – if you use our online withdrawal function at solarvic.at/pages/vertrag-widerrufen: name, e-mail address, order number, and the date and time your declaration of withdrawal was received.
Communication data – the content of your enquiries to us, e.g. via the contact form, e-mail or telephone.
Device and access data – information about your device, browser, network connection, IP address and similar identifiers.
Usage data – information about your interaction with the Services, e.g. pages visited and times of use.

3. Sources of the data

Directly from you – e.g. when you create an account, place an order, declare a withdrawal, communicate with us or otherwise provide us with your data.
Automatically via the Services – from your device when you visit the website, including via cookies and similar technologies (see point 6).
From our service providers – where they collect or process data on our behalf (e.g. hosting, payment processing, shipping).

4. Purposes and legal bases of processing (Art. 6 GDPR)

Performance of the contract and provision of the Services – processing your order, payment processing, shipping, administration of your customer account, returns and exchanges. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Handling of withdrawals – receipt and processing of your declaration of withdrawal via the online withdrawal function, by e-mail or by post, including immediate confirmation of receipt with date and time, and the reversal of the transaction (refund). Legal bases: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligation under the Austrian FAGG and Directive 2011/83/EU).
Statutory retention and record-keeping obligations – in particular the 7-year retention of business records under section 132 of the Austrian Federal Fiscal Code (BAO) and section 190 of the Austrian Commercial Code (UGB). Legal basis: Art. 6(1)(c) GDPR.
Communication and customer support – answering your enquiries and maintaining the business relationship. Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR (legitimate interest in efficient customer communication).
Marketing and advertising – sending promotional messages by e-mail (newsletter) only with your consent; legal basis: Art. 6(1)(a) GDPR in conjunction with section 174 TKG. You can withdraw your consent at any time via the unsubscribe link in every e-mail or informally. Advertising to existing customers for our own similar products is based on Art. 6(1)(f) GDPR (legitimate interest); you may object to this at any time.
Personalisation of the shopping experience – e.g. product recommendations based on your purchases. Legal basis: Art. 6(1)(f) GDPR or Art. 6(1)(a) GDPR where cookies requiring consent are used.
Security and fraud prevention – authentication of your account, a secure payment and shopping experience, detection and prevention of fraudulent, unlawful or malicious activity. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting our Services) or Art. 6(1)(c) GDPR. Please never disclose your access credentials to third parties.
Legal purposes – compliance with applicable law, responding to official or court requests, and the establishment, exercise or defence of legal claims. Legal basis: Art. 6(1)(c) or Art. 6(1)(f) GDPR.

5. Online withdrawal function

For the online withdrawal function we use the form system of our hosting provider Shopify (Shopify Forms). The data you enter (name, e-mail address, order number) is processed exclusively to handle and document your withdrawal. You will receive an automatic confirmation of receipt with date and time at the e-mail address provided, without delay. We retain the withdrawal data for evidentiary purposes for the duration of the statutory limitation periods.

6. Cookies and similar technologies

Our website uses cookies. Technically necessary cookies (e.g. for the cart, login and security functions) are used on the basis of section 165(3) TKG and Art. 6(1)(f) GDPR. All non-essential cookies – in particular for analytics, marketing and personalisation purposes – are only set with your consent via our cookie banner (Art. 6(1)(a) GDPR, section 165(3) TKG). You can withdraw or adjust your consent at any time with effect for the future via the website's cookie settings. You can also delete or block cookies in your browser settings; this may limit the functionality of the website.

7. Recipients and disclosure of data

We disclose your personal data only insofar as this is necessary for the purposes stated, to:

Shopify – as hosting and shop system provider (see point 8).
Payment service providers – to process your payment (e.g. PayPal, credit/debit card providers, banks), depending on the payment method chosen.
Shipping and logistics providers and freight forwarders – to deliver your order (name, delivery address, and where applicable telephone number/e-mail for delivery notification).
ERP and IT service providers – for order and warehouse processing and for the operation of our systems, as processors pursuant to Art. 28 GDPR.
Review service providers – if you submit a product review.
Tax advisers, legal representatives, authorities and courts – where required by law or necessary for the enforcement of rights.
In the context of a corporate transaction – e.g. a merger or reorganisation, in compliance with data protection requirements.

We have concluded data processing agreements pursuant to Art. 28 GDPR with service providers who process data on our behalf. We do not sell your data.

8. Our relationship with Shopify

The Services are hosted by Shopify. Shopify collects and processes personal data about your access to and use of the Services in order to enable us to provide and improve the Services. Data you submit to the Services is thereby passed on to Shopify and its sub-processors, which may also be located outside your country of residence. In addition, we use certain advanced Shopify features which incorporate data from your interactions with our shop, with other merchants and with Shopify. Shopify is (jointly) responsible under data protection law for this processing, including for responding to requests to exercise your rights. Further information can be found in the Shopify consumer privacy policy and in the Shopify privacy portal, through which you can exercise certain rights directly with Shopify.

9. Transfers to third countries

Insofar as we transfer your personal data to countries outside the European Economic Area (e.g. to Shopify, based in Canada with infrastructure in the USA), this only takes place where an adequacy decision of the European Commission exists (for Canada, or for US providers certified under the EU-U.S. Data Privacy Framework) or on the basis of appropriate safeguards under Art. 46 GDPR, in particular the European Commission's standard contractual clauses.

10. Retention period

We store your personal data only for as long as is necessary for the respective purposes: contract and order data for the duration of the business relationship and beyond within the scope of statutory retention obligations (generally 7 years under section 132 BAO), withdrawal and warranty documents for the duration of the statutory limitation and warranty periods, newsletter data until you withdraw your consent, and communication data for as long as necessary to deal with your request and to provide evidence. Thereafter the data is deleted or anonymised.

11. Data security

We use technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, misuse and unauthorised access, in particular TLS encryption of the website. Please note that no security measure can guarantee absolute security. We recommend that you do not transmit sensitive information via insecure channels.

12. Your rights

Under the GDPR you have the following rights:

Access (Art. 15 GDPR) – to the data stored about you.
Rectification (Art. 16 GDPR) – of inaccurate or incomplete data.
Erasure (Art. 17 GDPR) – unless statutory retention obligations apply.
Restriction of processing (Art. 18 GDPR).
Data portability (Art. 20 GDPR) – receipt of your data in a structured, commonly used, machine-readable format.
Objection (Art. 21 GDPR) – to processing based on legitimate interests, and at any time to direct marketing.
Withdrawal of consent given (Art. 7(3) GDPR) – at any time with effect for the future, without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise your rights, an informal message to the contact details given under point 1 is sufficient. Exercising your rights does not put you at any disadvantage. Where legally permitted or required, we may need to verify your identity before processing your request. You may also appoint an authorised representative; in that case we require proof of authorisation. We will answer your request without undue delay, at the latest within one month (Art. 12(3) GDPR). You can unsubscribe from promotional e-mails at any time via the unsubscribe link; you will continue to receive transactional e-mails (e.g. order and shipping confirmations).

13. Right to lodge a complaint

If you believe that the processing of your data infringes data protection law, please contact us first using the contact details given under point 1. Irrespective of this, you have the right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR). In Austria this is the

Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna
Phone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at
Web: https://www.dsb.gv.at

A list of all supervisory authorities in the European Economic Area can be found at the European Data Protection Board.

14. Children's data

The Services are not directed at children. We do not knowingly collect personal data from persons under the age of 14 (the age limit for consent in Austria pursuant to section 4(4) DSG). If, as a parent or legal guardian, you become aware that a child has provided us with data, please contact us – we will delete such data immediately.

15. Third-party websites

The Services may contain links to third-party websites. We are not responsible for their data protection and security practices. Please consult the privacy policies of the respective providers. The inclusion of a link does not constitute an endorsement of the linked content.

16. No automated decision-making

Automated decision-making in individual cases, including profiling within the meaning of Art. 22 GDPR which produces legal effects concerning you, does not take place.

17. Changes to this privacy policy

We may update this privacy policy from time to time, for example if our practices change or for legal and regulatory reasons. The current version will be published on this website and the "last updated" date adjusted accordingly.

18. Contact

If you have questions about this privacy policy or wish to exercise your rights, you can reach us by phone on +43 720 704 330, by e-mail at info@solarvic.at or by post at SOLARVIC PLUS GmbH, Leopold-Böhm-Strasse 5/434, 1030 Vienna, Austria. The controller responsible for your personal data is SOLARVIC PLUS GmbH.