Last updated: 5 October 2026
The controller responsible for processing personal data on this website is:
Supplies Supplies Sporthandels GmbH
Haidgasse 5 / Lokal 9–11
1020 Vienna
Austria
VAT: ATU82997107
Email: hi@supplies-supplies.store
You can contact us at this email address with questions about this policy or to exercise your data-protection rights.
We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Austrian law.
Depending on how you use our website, we process technical information needed to deliver and secure the website, information you provide when contacting us or subscribing to our newsletter, and information needed to process purchases.
Optional third-party services require your consent where described below. Declining optional cookies does not prevent you from browsing the website or using the shop, although certain embedded content may remain unavailable.
Our website is hosted using Vercel Inc.
When you access the website, technical information may be processed, including your IP address, request URL, date and time, browser and operating-system information, referrer information, and diagnostic or security events.
We use this information to deliver the website, maintain its availability, investigate errors, and prevent misuse.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the reliable and secure operation of the website.
Technical information is retained according to the applicable hosting and logging configuration. The retention criteria are the time needed to investigate operational errors, identify and address security incidents, and meet any applicable legal obligations. Information needed for a specific incident or legal claim may be retained until that matter is resolved.
Vercel may process information outside the European Economic Area. Its published data-processing terms describe the applicable international-transfer safeguards.
Further information: Vercel Data Processing Addendum and Vercel Privacy Notice.
We use Storyblok to manage website content.
Content is retrieved by our website server. Images and other media may also be delivered from Storyblok’s infrastructure. When your browser requests those assets, the provider receives the technical information needed to deliver them, including your IP address and request information.
The purpose is to manage and deliver website content. The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in operating the website efficiently.
Further information: Storyblok Privacy Policy.
We use Shopify to provide product, shopping-cart and checkout functionality.
When you place an order, we process the information needed to fulfil it, including your name, contact details, billing and delivery address, ordered products, and payment or transaction information.
Checkout takes place through Shopify. Shopify and the payment provider you select process information needed to complete the transaction. Payment providers may also process information under their own legal responsibilities, including fraud prevention and regulatory obligations.
The legal bases are:
Article 6(1)(b) GDPR for steps requested before a purchase and for performing the purchase contract.
Article 6(1)(c) GDPR for statutory obligations, including accounting and tax requirements.
Article 6(1)(f) GDPR where necessary to protect the shop against misuse and resolve disputes.
Providing the information required during checkout is necessary to complete your purchase.
Further information: Shopify Privacy Policy.
We process order and contact information to prepare purchases for delivery or in-store pickup.
For delivery, we disclose the information needed to fulfil the shipment to the relevant postal or courier service. For pickup, we use the information needed to identify and hand over the order.
The legal basis is Article 6(1)(b) GDPR.
If you contact us, we process the information you provide, such as your name, email address and message, to respond to your enquiry.
The legal basis is Article 6(1)(b) GDPR where the enquiry concerns a purchase or steps before entering a contract. For other enquiries, the legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in responding to correspondence.
We retain correspondence for the time needed to handle the enquiry and any follow-up. Correspondence forming part of an order, accounting record or legal dispute is retained according to the requirements applicable to that matter.
If you subscribe to our newsletter, we process your email address and any other information you voluntarily provide to send updates about products, events and offers.
We use Brevo to manage subscriptions and send newsletters. Brevo receives the subscription information needed to provide this service.
The legal basis for sending the newsletter is your consent under Article 6(1)(a) GDPR. Subscription is voluntary and is independent of your website cookie preferences.
Depending on the campaign settings, newsletter emails may contain tracking pixels or tagged links that allow information about email openings and link clicks to be recorded. This can include the time of the interaction, the link clicked, and technical information supplied by your email application or browser. This information is used to evaluate newsletter engagement.
You may withdraw your newsletter consent at any time using the unsubscribe link in a newsletter or by contacting hi@supplies-supplies.store. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
After unsubscribing, your address will no longer be used to send newsletters. A limited suppression record may be retained to ensure your unsubscribe request is respected. Records needed to demonstrate consent or resolve a dispute may be retained for those purposes.
Further information: Brevo Privacy Policy.
Our website uses necessary cookies to remember your consent choice and maintain your shopping cart.
Optional technologies are activated only after you grant the relevant consent category. The available categories depend on which services are enabled on the website.
Necessary storage
CookieConsent: Stores your selected consent categories and the version of the consent declaration. Retention: 180 days.
cartId: Identifies your active shopping cart. Retention: browser session.
Access to or storage of information that is strictly necessary for a service you request falls within the exemption in § 165(3) Austrian Telecommunications Act 2021. Related personal-data processing is based on Article 6(1)(b) GDPR for shopping-cart functionality or Article 6(1)(f) GDPR for operating the website and remembering privacy choices.
Optional storage
Optional services may use cookies or other browser storage after consent. Details of the enabled services are available through Cookie Details or Change Cookie Settings.
The legal basis for consent-based personal-data processing is Article 6(1)(a) GDPR. Where consent is required for access to or storage on your device, it is also obtained under § 165(3) Austrian Telecommunications Act 2021.
You can accept, reject or select optional categories. You can change or withdraw your choices at any time through Change Cookie Settings in the footer.
Withdrawing consent stops future consent-based activation of the affected services. It does not automatically delete information already lawfully received by a provider.
Some pages may contain YouTube videos provided by Google Ireland Limited, with processing also possible by Google LLC and other Google service providers.
YouTube content is assigned to the Marketing consent category. The embedded player is loaded only after you consent to that category and only on pages containing a YouTube embed.
Once loaded, YouTube receives technical information such as your IP address, browser information and the page containing the video. It may process playback interactions and use cookies or other browser storage. If you are signed into a Google account, Google may associate interactions with that account according to its own settings and policies.
The purpose is to display video content. The legal basis is your consent under Article 6(1)(a) GDPR and, where applicable, § 165(3) Austrian Telecommunications Act 2021.
YouTube controls the retention of information and browser storage it creates. Information may be processed outside the European Economic Area, including in the United States.
You can withdraw consent through Change Cookie Settings in the footer. You can continue using the website without loading embedded YouTube videos.
Further information: Google Privacy Policy and Google international-transfer safeguards.
We use Google Analytics 4 to understand how visitors use our website and to improve its content and usability.
The service is provided by Google Ireland Limited. Information may also be processed by Google LLC and other Google service providers.
Google Analytics is assigned to the Statistics consent category. Its tracking library is loaded only after you consent to Statistics. Declining Statistics keeps this integration disabled.
After consent, Google Analytics processes information such as page visits, interactions and engagement, timestamps, browser and device information, approximate location, and first-party identifiers used to distinguish browsers and sessions. Our page-view implementation excludes query strings and fragments from page locations and referrers.
Google processes your IP address to handle the connection and derive approximate location. According to Google, Analytics does not log or store individual IP addresses from EU users. This does not mean that all Analytics information remains within the EU. See Google’s information for EU users.
The integration disables Google Signals and advertising-personalisation signals.
The legal basis is your consent under Article 6(1)(a) GDPR and § 165(3) Austrian Telecommunications Act 2021.
Google Analytics may create the first-party cookies _ga and ga<measurement-id>, with a configured lifetime of 180 days.
GA4 is configured with a two-month retention period for event data and a fourteen-month period for user data and key-event data. The retention period for user identifiers restarts with new activity, so returning users’ identifiers may be retained for longer than fourteen months from their first visit. Data reaching the end of its retention period is deleted through Google’s monthly deletion process. These settings do not apply to standard aggregated reports and are separate from the 180-day cookie lifetime.
Information may be processed in the United States. Google describes its use of the EU–US Data Privacy Framework and Standard Contractual Clauses in its international-transfer safeguards.
You can withdraw Statistics consent at any time through Change Cookie Settings in the footer. Withdrawal disables further collection through this integration and removes known first-party Google Analytics cookies. It does not automatically delete information already received by Google.
Further information: Google Privacy Policy.
Depending on the service you use, information may be received by our hosting and content-delivery providers, Shopify and payment providers, Brevo, delivery services, and Google when you choose to load YouTube content.
We may also disclose information where required by law or where necessary to establish, exercise or defend legal claims.
Some providers process information outside the European Economic Area. Depending on the recipient and service, transfers may be covered by an adequacy decision under Article 45 GDPR or by appropriate safeguards under Article 46 GDPR, including Standard Contractual Clauses.
The EU–US Data Privacy Framework applies only to participating certified organisations within the scope of the relevant certification. Further information about the safeguards applicable to our services is available through the provider links in this policy or by contacting us.
We retain personal data according to the purpose for which it was collected and applicable legal obligations.
Shopping-cart and consent-cookie retention is described in Section 9.
Order and accounting records are retained for applicable statutory periods. Austrian tax records are generally subject to a seven-year retention period, with longer retention possible where relevant proceedings remain pending.
Newsletter information is retained as described in Section 8.
Enquiry, operational and security information is retained according to the criteria described in the relevant sections.
Information needed for a legal claim may be retained until the claim is resolved or the applicable limitation period expires.
The Austrian accounting-retention requirements are set out in § 132 Federal Fiscal Code.
Subject to the applicable legal requirements, you have the right to:
Access your personal data.
Correct inaccurate or incomplete information.
Request deletion.
Request restriction of processing.
Receive qualifying information in a portable format.
Withdraw consent at any time.
Object to processing based on legitimate interests on grounds relating to your particular situation.
You may object to processing for direct marketing at any time.
To exercise your rights, contact hi@supplies-supplies.store.
You also have the right to lodge a complaint with a supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement.
Our competent Austrian supervisory authority is the Austrian Data Protection Authority — Datenschutzbehörde.
We update this policy when our services, processing activities or legal requirements change. The current version is available on this page.