OYDA – Privacy Policy

Last updated: July 2026

This Privacy Policy explains how SAV GmbH, operating the online store under the brand OYDA (“OYDA”, “we”, “us”, or “our”), collects, uses, stores, and shares personal data when you:

·      Visit our website

·      Create a customer account

·      Contact us

·      Subscribe to marketing communications

·      Place an order

·      Otherwise use our services

Our online store is available at www.oyda.store.

We process personal data in accordance with the General Data Protection Regulation (“GDPR”), the Austrian Data Protection Act (“DSG”), applicable Austrian laws, and other privacy laws that apply to our activities.

This Privacy Policy is intended to provide transparent information about our processing activities. It does not form part of a contract between you and OYDA.

1. Data Controller

The controller responsible for the processing of your personal data is:

SAV GmbH
Operating under the brand OYDA
Capistrangasse 5/2/62
1060 Vienna
Austria

Email: office@oyda.store
Website: www.oyda.store

OYDA is the store and brand name used by SAV GmbH. Unless expressly stated otherwise, SAV GmbH is the legal entity responsible for determining how and why personal data is processed through the OYDA store.

2. Personal Data We Collect

We may collect personal data directly from you, automatically through our website, or through service providers involved in operating the store.

a. Information you provide directly

Depending on how you use the website, this may include:

·      First and last name

·      Billing address

·      Shipping address

·      Email address

·      Telephone number

·      Customer account information

·      Login and authentication information

·      Products ordered

·      Shopping cart and wishlist information

·      Discount codes and gift card information

·      Communication preferences

·      Newsletter subscription information

·      Reviews or other content submitted by you

·      Information included in customer service enquiries, complaints, or return requests

b. Order and transaction information

When you place an order, we process information relating to:

·      Products purchased

·      Order value

·      Currency

·      Payment status

·      Shipping method

·      Delivery status

·      Refunds

·      Returns

·      Cancellations

·      Transaction identifiers

·      Fraud-prevention results

Payment details are generally processed directly by the relevant payment provider.

We do not normally receive or store complete payment card numbers. Depending on the payment method, we may receive limited information such as the payment type, card brand, expiry information, transaction status, or the last digits of a payment card.

c. Information collected automatically

When you visit or use the website, technical information may be collected automatically, including:

·      IP address

·      Browser type and version

·      Device type

·      Device identifiers

·      Operating system

·      Language settings

·      Approximate location derived from your IP address

·      Referring website

·      Pages viewed

·      Products viewed

·      Search activity

·      Shopping cart activity

·      Date and time of access

·      Session information

·      Click and navigation behaviour

·      Cookie identifiers

·      Log files

·      Security and fraud-prevention information

d. Information processed through Shopify

Our online store is hosted and operated using Shopify.

Shopify may process personal data required to provide the ecommerce platform and related services, including:

·      Customer and account information

·      Device and browser information

·      Shopping cart activity

·      Checkout information

·      Order and transaction information

·      Fraud-prevention information

·      Technical and security logs

·      Store interaction data

·      Information associated with Shopify accounts or services such as Shop Pay

Depending on the Shopify features activated for our store, Shopify may process certain information as our processor and certain information for its own purposes as an independent controller.

Further information is available in Shopify’s Consumer Privacy Policy and through Shopify’s privacy controls.

e. Information received from service providers

We may receive information from companies involved in operating the store, including:

·      Shopify

·      Payment providers

·      Shipping carriers

·      Fulfillment providers

·      Print-on-demand providers

·      Customer service providers

·      Analytics providers

·      Marketing providers

·      Fraud-prevention providers

·      Accounting and tax service providers

f. Information received from third parties

Where permitted by law, we may receive personal data from:

·      Social media platforms

·      Advertising networks

·      Marketing platforms

·      Authentication providers

·      Business partners

·      Publicly available sources

·      Services you choose to connect to the website

We do not intentionally collect special categories of personal data such as health information, religious beliefs, political opinions, biometric information, or information regarding sexual orientation.

Please do not send such information to us unless it is necessary for a specific request and we have expressly asked you to provide it.

3. Purposes of Processing

We process personal data for the following purposes.

a. Processing and fulfilling orders

This includes:

·      Receiving and administering orders

·      Processing payments

·      Confirming transactions

·      Producing ordered products

·      Arranging shipping and delivery

·      Providing tracking information

·      Processing cancellations, returns, refunds, or complaints

·      Communicating about an order

b. Operating customer accounts

This may include:

·      Creating and maintaining customer accounts

·      Authenticating users

·      Saving addresses and preferences

·      Displaying order histories

·      Managing wishlists

·      Providing account-related functions

c. Providing customer service

We process information to:

·      Respond to enquiries

·      Resolve delivery problems

·      Handle complaints

·      Investigate damaged or missing products

·      Process returns and refunds

·      Provide technical support

·      Document our communication with customers

d. Operating and improving the website

This may include:

·      Maintaining website functionality

·      Remembering selected preferences

·      Improving navigation and performance

·      Analysing how the store is used

·      Testing website functions

·      Identifying technical problems

·      Preventing errors

·      Developing products and services

Non-essential analytics technologies are used only where permitted by law and, where required, after consent has been obtained.

e. Marketing and personalised advertising

Where you have provided consent or where another legal basis is available, we may process personal data to:

·      Send newsletters

·      Announce new products or collections

·      Inform you about offers and promotions

·      Measure marketing performance

·      Create marketing audiences

·      Display relevant advertising

·      Conduct retargeting or remarketing

·      Understand interactions with our website and advertisements

Marketing and advertising tools may include services provided by Shopify, Google, Meta, TikTok, or similar providers, but only where these services are actually enabled.

You may withdraw your marketing consent or change your cookie preferences at any time.

f. Security and fraud prevention

We process personal data to:

·      Protect customer accounts

·      Detect fraudulent or suspicious transactions

·      Prevent misuse of the website

·      Protect our systems

·      Investigate security incidents

·      Enforce our terms

·      Protect our legal rights and those of our customers

g. Legal and administrative obligations

We may process and retain data to:

·      Comply with accounting and tax laws

·      Issue and retain invoices

·      Maintain legally required business records

·      Respond to lawful requests from authorities

·      Establish, exercise, or defend legal claims

·      Comply with consumer protection obligations

·      Meet product safety or recall requirements

4. Legal Bases Under the GDPR

Where the GDPR applies, we rely on one or more of the following legal bases.

a. Performance of a contract

Article 6(1)(b) GDPR applies where processing is necessary to:

·      Process and deliver an order

·      Administer payment

·      Operate a customer account

·      Handle a return or refund

·      Take steps requested before entering into a contract

b. Legal obligations

Article 6(1)(c) GDPR applies where processing is necessary to comply with legal obligations, including:

·      Accounting requirements

·      Tax obligations

·      Consumer protection requirements

·      Regulatory obligations

·      Lawful requests from authorities

c. Consent

Article 6(1)(a) GDPR applies where you have consented to processing, particularly for:

·      Newsletter subscriptions

·      Non-essential cookies

·      Certain analytics services

·      Personalised advertising

·      Certain social media and embedded-content functions

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

d. Legitimate interests

Article 6(1)(f) GDPR may apply where processing is necessary for our legitimate interests or those of a third party, provided that your interests and fundamental rights do not override those interests.

Our legitimate interests may include:

·      Securing the website

·      Preventing fraud

·      Maintaining reliable business operations

·      Improving our products and services

·      Responding to customer enquiries

·      Establishing or defending legal claims

·      Conducting limited business analytics

·      Protecting customers and our company

We do not rely on legitimate interests where consent is legally required.

5. Sharing Personal Data

We share personal data only where necessary for the purposes described in this Privacy Policy, where legally permitted, or where we are required to do so.

a. Shopify

Shopify provides the ecommerce platform, hosting, checkout infrastructure, store administration, security functions, and related technical services.

Shopify may process personal data within the European Economic Area and in other countries in accordance with its contractual and legal safeguards.

b. Payment providers

Depending on the payment methods offered during checkout, personal data may be shared with providers such as:

·      Shopify Payments

·      Stripe

·      PayPal

·      Klarna

·      Credit card networks

·      Banks and financial institutions

·      Other payment providers displayed during checkout

Payment providers process information according to their own privacy notices and legal obligations.

c. Fulfillment and production partners

To produce and fulfil an order, we may share necessary information with:

·      Gelato

·      Other print-on-demand providers

·      Specialist manufacturers

·      Fine-art printing laboratories

·      Packaging and logistics providers

·      Product suppliers

The information shared is generally limited to what is required to produce and deliver the order.

d. Shipping and delivery providers

Delivery information may be shared with postal and courier services such as:

·      Austrian Post

·      DHL

·      UPS

·      FedEx

·      Local postal services

·      Other carriers selected by our fulfillment partners

e. Professional service providers

We may share information with providers supporting our business, including:

·      Accountants

·      Tax advisers

·      Legal advisers

·      IT service providers

·      Website developers

·      Security providers

·      Customer service providers

·      Cloud storage providers

f. Analytics, advertising, and social media providers

Where permitted and, where necessary, after consent, data may be shared with services such as:

·      Google Analytics or Google Ads

·      Meta platforms and Meta Pixel

·      TikTok and TikTok Pixel

·      Shopify analytics and marketing services

·      Social media platforms

·      Other analytics or advertising providers actually enabled on the website

These providers may use cookies, pixels, device identifiers, or similar technologies.

g. Authorities and legal recipients

We may disclose personal data where required to:

·      Comply with a legal obligation

·      Respond to a court order

·      Cooperate with authorities

·      Investigate suspected fraud

·      Protect our rights

·      Protect customers or third parties

·      Establish, exercise, or defend legal claims

h. Business transfers

If SAV GmbH or part of its business is reorganised, sold, transferred, merged, or acquired, personal data may be transferred to advisers, prospective purchasers, or successor entities where legally permitted.

6. Shopify Enhanced Services and Network Intelligence

Shopify may offer optional services that use information from interactions across Shopify stores to provide enhanced ecommerce, analytics, marketing, or personalised advertising functions.

If Shopify Network Intelligence or comparable Enhanced Services are enabled for OYDA, information about your interactions with our store may be shared with and processed by Shopify for purposes that may include:

·      Providing a more personalised shopping experience

·      Measuring store and advertising performance

·      Understanding customer interactions

·      Improving Shopify services

·      Displaying more relevant advertising

Where legally required, these activities take place only after consent or are subject to an applicable objection or opt-out right.

You can manage certain Shopify privacy choices using Shopify’s privacy controls.

7. Cookies and Similar Technologies

We use cookies and similar technologies such as pixels, tags, local storage, and device identifiers.

a. Essential technologies

These technologies are necessary to:

·      Operate the website

·      Maintain security

·      Remember shopping cart contents

·      Process checkout

·      Authenticate customer accounts

·      Save privacy preferences

Essential technologies cannot generally be disabled through our consent banner because the website may not function properly without them.

b. Functional technologies

These may be used to remember preferences or provide optional website functions.

c. Analytics technologies

These help us understand how visitors use the website, identify errors, and improve performance.

Where legally required, analytics technologies are activated only after consent.

d. Marketing technologies

These may be used to:

·      Measure advertising campaigns

·      Create audiences

·      Provide personalised advertising

·      Conduct retargeting

·      Track interactions with advertisements

Marketing technologies are activated only where legally permitted and, where required, after consent.

You can manage or withdraw your consent through the Cookie Settings available on our website.

Your choice applies to the browser and device used. You may need to repeat your choice when using another device, browser, or after deleting cookies.

Where required by applicable law, we also recognise supported browser-based privacy signals, including Global Privacy Control signals.

8. Newsletter and Email Marketing

We send newsletters and promotional emails only where permitted by law.

Newsletter content may include:

·      OYDA news

·      New products

·      New collections

·      Releases from brands or creative projects available through OYDA

·      Art and fine-art print releases

·      Offers and promotions

·      Store updates

Where required, newsletter registration uses an opt-in or double opt-in procedure.

You may unsubscribe at any time by:

·      Using the unsubscribe link contained in a marketing email

·      Changing your communication preferences

·      Contacting us at office@oyda.store

Unsubscribing from marketing emails does not prevent us from sending necessary transactional messages relating to orders, payments, deliveries, security, or customer service.

9. Storage and Retention

We retain personal data only for as long as necessary for the relevant purpose or as required by law.

Typical retention periods include:

a. Order, invoice, and accounting data

Order and accounting records are generally retained for at least seven years in accordance with Austrian tax and accounting requirements.

Data may be retained longer where required due to an ongoing tax audit, legal dispute, warranty claim, product safety matter, or other legal obligation.

b. Customer account data

Customer account data is generally retained until the account is deleted, subject to information that must be retained for contractual, accounting, security, or legal purposes.

c. Customer service communications

Customer service enquiries and related correspondence may generally be retained for up to 24 months after the matter has been resolved.

Information may be kept longer where necessary for legal claims, recurring enquiries, fraud prevention, or statutory obligations.

d. Newsletter data

Newsletter subscription data is retained until you unsubscribe or withdraw your consent.

We may retain limited suppression-list information after unsubscribing to ensure that no further marketing messages are sent.

e. Cookie and analytics data

Cookie retention periods depend on the specific cookie and provider.

Detailed durations are shown in our cookie settings or consent-management tool where available.

f. Security data

Security and fraud-prevention records may be retained for as long as reasonably necessary to protect our services, investigate incidents, and prevent repeated misuse.

10. Your Rights Under the GDPR

Where the GDPR applies, you may have the following rights:

·      The right to obtain information about the processing of your data

·      The right of access

·      The right to rectification

·      The right to erasure

·      The right to restriction of processing

·      The right to data portability

·      The right to object to processing based on legitimate interests

·      The right to object to direct marketing at any time

·      The right to withdraw consent at any time

·      The right to lodge a complaint with a supervisory authority

These rights may be subject to legal conditions and exceptions. For example, we may be required to retain certain invoice and order information despite a deletion request.

To exercise your rights, contact:

office@oyda.store

We may request reasonable information to verify your identity before responding to a request.

You also have the right to lodge a complaint with:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria

Email: dsb@dsb.gv.at

You may also contact the supervisory authority responsible for your usual place of residence or work within the European Union.

11. Social Media

OYDA may maintain profiles on social media platforms.

When you interact with us through a social media platform, both we and the platform may process information concerning your interaction.

This may include:

·      Public comments

·      Likes

·      Shares

·      Profile information

·      Direct messages

·      Mentions

·      Content submitted by you

Public activities are visible according to the settings and privacy rules of the relevant platform.

Direct messages are processed to respond to your request, manage the relationship, or protect our legal interests.

Social media platforms process personal data according to their own privacy policies.

12. Embedded Content

Our website may contain embedded content from services such as:

·      Instagram

·      TikTok

·      YouTube

·      Vimeo

·      Spotify

·      Other media or social platforms

Embedded content may allow the provider to receive information including:

·      Your IP address

·      Device and browser information

·      The page you visited

·      Your interaction with the embedded content

·      Information stored in the provider’s cookies

Where embedded content is not essential and consent is legally required, it will be loaded only after you have provided consent.

13. External Links

Our website may contain links to third-party websites.

We are not responsible for the content, security, or privacy practices of websites operated by third parties.

Please review the privacy policy of the relevant third-party website before providing personal data.

14. Data Security

We use appropriate technical and organisational measures designed to protect personal data against:

·      Unauthorised access

·      Unlawful use

·      Accidental loss

·      Destruction

·      Alteration

·      Disclosure

These measures may include:

·      Encrypted data transmission

·      Access restrictions

·      Secure account authentication

·      Shopify security infrastructure

·      Regular software updates

·      Organisational access controls

·      Data minimisation

·      Security monitoring

No online system or method of electronic storage can guarantee absolute security.

Customers are responsible for protecting their own account credentials and should notify us if they suspect unauthorised access to their account.

15. International Data Transfers

Some service providers may process personal data outside Austria, the European Economic Area, or your country of residence.

Where the GDPR applies, international transfers are protected using legally recognised safeguards where required, including:

·      Adequacy decisions issued by the European Commission

·      Standard Contractual Clauses approved by the European Commission

·      Contractual data-protection obligations

·      Supplementary technical and organisational measures

·      Other legally permitted transfer mechanisms

Shopify and other global service providers may process data in several countries to provide their services.

16. Children and Minors

Our store is intended for adults and persons legally capable of entering into purchase contracts.

We do not knowingly collect personal data directly from children under the age of 16 for marketing or account purposes without the consent of a parent or legal guardian where such consent is required.

Our services are not directed to children under 13 in the United States.

If you believe that a child has provided personal data to us without the required consent, please contact office@oyda.store.

17. Automated Decision-Making and Fraud Prevention

Payment providers, Shopify, or fraud-prevention services may use automated systems to assess whether an order appears fraudulent, unauthorised, or associated with an increased security risk.

This may result in:

·      Additional verification

·      A delayed transaction

·      A rejected payment

·      Cancellation or manual review of an order

Where applicable law provides rights relating to decisions based solely on automated processing that produce legal or similarly significant effects, you may contact us to request further information or human review.

18. Changes to This Privacy Policy

We may update this Privacy Policy where necessary to reflect:

·      Changes to our services

·      New website functions

·      New service providers

·      Legal or regulatory developments

·      Changes to our business operations

·      Security or technical developments

The latest version will be published on our website together with the date of the most recent update.

Material changes may also be communicated through the website or by email where appropriate.

19. Contact

For privacy questions, requests, or complaints, contact:

SAV GmbH
Operating under the brand OYDA
Capistrangasse 5/2/62
1060 Vienna
Austria

Email: office@oyda.store
Website: www.oyda.store

Additional Privacy Notice for Residents of the United States

This section supplements the general Privacy Policy and applies only where a United States state privacy law applies to SAV GmbH and the relevant individual.

Not every United States privacy law applies to every business. The rights described below are therefore available only to the extent required by applicable law.

1. Categories of Personal Information

During the preceding twelve months, we may have collected the following categories of personal information:

·      Identifiers, such as name, email address, postal address, IP address, and account identifiers

·      Customer records and contact information

·      Commercial information, such as products viewed, purchased, returned, or added to a cart

·      Internet or electronic network activity

·      Device and browser information

·      Approximate location information

·      Payment and transaction information

·      Customer service communications

·      Marketing and advertising interaction information

·      Inferences based on store interactions or purchase activity

We do not intentionally use or disclose sensitive personal information for purposes that require a separate right to limit its use under applicable United States law.

2. Purposes of Collection and Use

We may collect and use personal information to:

·      Process and deliver orders

·      Process payments

·      Operate the online store

·      Provide customer service

·      Maintain customer accounts

·      Prevent fraud

·      Protect website security

·      Comply with legal obligations

·      Analyse website performance

·      Improve products and services

·      Conduct marketing and advertising where permitted

·      Establish or defend legal claims

3. Disclosure of Personal Information

We may disclose personal information to:

·      Shopify

·      Payment providers

·      Fulfillment and production partners

·      Shipping carriers

·      IT and hosting providers

·      Analytics providers

·      Advertising providers

·      Professional advisers

·      Government authorities where required

·      Parties involved in a business transfer

We do not sell personal information in exchange for money.

However, certain uses of advertising cookies, pixels, identifiers, or Shopify advertising services may be considered a “sale”, “sharing”, or use for targeted advertising under certain United States state privacy laws, even where no money is exchanged.

Where applicable, you may opt out through:

·      Our cookie settings

·      A “Do Not Sell or Share My Personal Information” link, where displayed

·      Supported Global Privacy Control signals

·      Shopify privacy controls

·      A request sent to office@oyda.store

4. Rights of United States Residents

Depending on your state and whether the relevant law applies, you may have the right to:

·      Know whether we process your personal information

·      Request access to personal information

·      Request correction

·      Request deletion

·      Obtain a portable copy of personal information

·      Opt out of the sale or sharing of personal information

·      Opt out of targeted advertising

·      Limit certain uses of sensitive personal information

·      Appeal a decision concerning a privacy request

·      Receive equal service and not be discriminated against for exercising your rights

We may need to verify your identity before processing a request.

An authorised agent may submit a request where permitted by law, subject to appropriate verification.

5. Retention

We retain personal information for as long as reasonably necessary to:

·      Fulfil orders

·      Maintain customer accounts

·      Provide support

·      Comply with tax and accounting obligations

·      Maintain security

·      Prevent fraud

·      Resolve disputes

·      Enforce agreements

·      Meet other legal requirements

6. Children

Our services are not directed to children under 13.

We do not knowingly collect, sell, or share personal information belonging to children under 13.

Where required by applicable law, we do not knowingly sell or share personal information belonging to individuals under 16 without the required authorisation.

7. Global Privacy Control and Do Not Track

Where required by applicable law, we recognise supported Global Privacy Control signals as an opt-out request for the browser or device sending the signal.

Because there is currently no universally accepted technical standard for general “Do Not Track” browser signals, the website may not respond to other Do Not Track settings.

8. United States Privacy Contact

To submit a privacy request, contact:

SAV GmbH / OYDA
Email: office@oyda.store