Privacy policy

Last updated: 2 July 2026

This privacy policy informs you about how Sigmund Freud Privatuniversität Wien GmbH processes personal data when you visit the webshop at https://shop.sfu.ac.at, order goods there, use a customer account, sign up for the newsletter, or communicate with us in connection with the webshop.

The webshop is used to sell merchandise and apparel of Sigmund Freud PrivatUniversität. Sales and shipping are currently to Austria and Germany.

1. Controller

The controller within the meaning of the General Data Protection Regulation is:

Sigmund Freud Privatuniversität Wien GmbH
Freudplatz 1
1020 Vienna, Austria
Telephone: +43 699 104 420 07

For general webshop enquiries, orders, pickup, returns and complaints, you can reach us at: merchandise@sfu.ac.at

2. Data protection coordination

For questions about data protection and the exercise of your data subject rights, please contact:

Data Protection Coordination
Mag.a Saška Milošević, LL.M.
Sigmund Freud PrivatUniversität Wien
Freudplatz 1
1020 Vienna, Austria
E-mail: datenschutz@sfu.ac.at

3. What personal data we process

Depending on how you use our webshop, we process in particular the following categories of personal data:

  • Master data, in particular name and address;
  • Contact data, in particular e-mail address and, where applicable, telephone number;
  • Order data, in particular ordered products, sizes, quantities, prices, order date, order number and order status;
  • Delivery data, in particular delivery address and shipping status;
  • Payment information, in particular chosen payment method, payment status, transaction references and invoice data;
  • Communication data, in particular the content of your enquiries by e-mail or other communication in connection with orders, pickup, returns, complaints or warranty;
  • Technical data, in particular IP address, device information, browser information, log data, and cookie and consent information;
  • Newsletter data, in particular e-mail address, sign-up and confirmation time, IP address at sign-up and confirmation, and unsubscribe status.

Complete credit card, account or wallet data is not stored by us. This data is processed by the respective payment service provider.

We do not process any special categories of personal data within the meaning of Art. 9 GDPR via the webshop, in particular no health data, no information on student status, no employee data, no matriculation numbers, and no personal discount or eligibility checks.

4. Purposes and legal bases of processing

We process personal data exclusively within the framework of applicable data protection regulations and only for the purposes described below.

4.1 Visiting the webshop and technical provision

When you visit our webshop, technically necessary data is processed in order to display the website, ensure its stability and security, and enable error-free use. This may include, in particular, IP address, date and time of access, browser type, operating system, pages accessed and technical log data.

The processing is based on our legitimate interest in a secure, stable and functional webshop pursuant to Art. 6(1)(f) GDPR.

4.2 Order and contract processing

When you order in the webshop, we process the data required to process the order. This includes, in particular, name, billing and delivery address, e-mail address, ordered products, payment method, payment status, order number and other information required for order, shipping, pickup, return or complaint.

The processing is carried out to implement pre-contractual measures and to fulfil the purchase contract pursuant to Art. 6(1)(b) GDPR.

4.3 Customer account, shop login and guest order

Depending on availability, you can order in the webshop via a customer account or via Shopify/Shop functions, or place a guest order.

For a guest order, we only process the data required for order, payment, delivery, pickup, customer service, returns, warranty and statutory documentation obligations.

If you use a customer account, a shop login or Shop Pay, the data required for this is processed via Shopify or the corresponding Shopify services. Depending on the function, Shopify may also act as an independent controller. Further information can be found in Shopify's privacy information.

The processing by us is carried out to fulfil the contract pursuant to Art. 6(1)(b) GDPR and, where necessary, on the basis of our legitimate interest in user-friendly and secure account management pursuant to Art. 6(1)(f) GDPR.

4.4 Payment and payment processing

We offer various payment methods in the webshop, in particular:

  • Credit card;
  • PayPal;
  • Klarna;
  • Apple Pay;
  • Google Pay;
  • EPS/instant bank transfer;
  • Invoice;
  • Shopify Payments.

Depending on the chosen payment method, the data required for payment processing is transmitted to the respective payment service provider or processed directly by them. This may include, in particular, name, billing address, e-mail address, order amount, payment reference, payment status and transaction-related information.

Complete credit card, account or wallet data is not stored by us, but processed by the respective payment service providers.

The processing is carried out to fulfil the contract pursuant to Art. 6(1)(b) GDPR. Insofar as we must store payment and invoice data due to legal obligations, the processing is additionally carried out pursuant to Art. 6(1)(c) GDPR.

For certain payment methods, in particular Klarna, PayPal or purchase on invoice, the respective payment provider may carry out its own checks, in particular payment, risk or credit checks. We do not make any automated credit decision of our own. The privacy information of the respective payment provider applies in addition to these processing operations.

4.5 Shipping and collection

For shipping orders, we use Österreichische Post AG. We transmit to Österreichische Post only the data required for shipping, in particular name and delivery address. E-mail address or telephone number are not routinely transmitted to Österreichische Post for delivery notifications.

Alternatively, collection at the SFU is possible. For collection, we process the necessary order and contact data in order to prepare the order, make it available and hand it over to the right person.

The processing is carried out to fulfil the contract pursuant to Art. 6(1)(b) GDPR.

4.6 Returns, complaints and warranty

If you assert a return, complaint or warranty claim, we process the order, contact, payment, shipping and communication data required for this.

The processing is carried out to fulfil the contract or to handle statutory warranty rights pursuant to Art. 6(1)(b) GDPR and to fulfil legal obligations pursuant to Art. 6(1)(c) GDPR.

4.7 Invoicing, accounting and ERP

For invoicing, accounting, payment reconciliation and statutory documentation obligations, we process order, invoice and payment status data. The data required for accounting and ERP is transferred manually from Shopify into the ERP/accounting system Winline by mesonic by responsible SFU staff.

The processing is carried out to fulfil legal obligations, in particular tax and commercial law retention and documentation obligations, pursuant to Art. 6(1)(c) GDPR.

4.8 Customer service and communication

If you contact us in connection with the webshop, we process your information in order to handle your enquiry. This concerns, in particular, questions about orders, payments, pickup, shipping, returns, complaints and other webshop topics.

Depending on the content of the enquiry, the processing is carried out to implement pre-contractual measures or to fulfil the contract pursuant to Art. 6(1)(b) GDPR, or on the basis of our legitimate interest in handling enquiries pursuant to Art. 6(1)(f) GDPR.

4.9 Newsletter and e-mail marketing

You can sign up for the webshop newsletter in the webshop. The newsletter relates to webshop-related information, in particular merchandise, apparel, offers and news about the SFU webshop.

We use Shopify Email for the newsletter.

Sign-up takes place via the double opt-in procedure. This means that after signing up you receive an e-mail in which you must confirm your registration. We log the sign-up and confirmation, in particular the time, IP address and e-mail address, in order to be able to prove your consent.

The processing is based on your consent pursuant to Art. 6(1)(a) GDPR and in accordance with the provisions on electronic advertising under Section 174 TKG 2021.

You can withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in each newsletter or by contacting us.

Webshop data is not used for general SFU communication, study offers, event advertising or other university newsletters.

4.10 Cookies, consent management and similar technologies

Our webshop uses cookies and similar technologies. We distinguish between technically necessary technologies and those that serve analysis, marketing or tracking purposes.

Technically necessary cookies and comparable technologies are required to provide the webshop, enable cart and checkout functions, ensure security, or store your cookie settings.

Non-technically-necessary cookies and comparable technologies, in particular for analysis, marketing, conversion tracking and retargeting, are only used with your prior consent. Consent is obtained via the Shopify Customer Privacy Banner.

You can change or withdraw your cookie settings at any time via the "Cookie Settings" link in the footer of the webshop or via a comparable function.

The processing of technically necessary data is based on our legitimate interest in a secure and functional webshop pursuant to Art. 6(1)(f) GDPR. Insofar as consent is required, the processing is based on your consent pursuant to Art. 6(1)(a) GDPR and in accordance with Section 165 TKG 2021.

4.11 Google Tag Manager

We may use Google Tag Manager to technically manage certain services, in particular analysis and marketing tags. Google Tag Manager is only loaded in our webshop after your consent via the Shopify Customer Privacy Banner.

Via Google Tag Manager, if activated and if you have consented, Google Ads conversion tracking, Meta Pixel and, where applicable, Google Analytics may be integrated.

The processing is based on your consent pursuant to Art. 6(1)(a) GDPR and in accordance with Section 165 TKG 2021.

4.12 Google Ads conversion tracking

We may use Google Ads conversion tracking to measure the success of our advertising measures. It can be tracked whether users perform a certain action in the webshop after clicking on a Google ad, such as completing a purchase.

Google Ads conversion tracking is only activated after your consent. Consent can be withdrawn at any time via the cookie settings.

The processing is based on your consent pursuant to Art. 6(1)(a) GDPR and in accordance with Section 165 TKG 2021.

4.13 Google Analytics

We may, if activated and if you have consented, use Google Analytics to statistically evaluate the use of our webshop and to improve the webshop.

Google Analytics is only activated after your consent. Consent can be withdrawn at any time via the cookie settings.

The processing is based on your consent pursuant to Art. 6(1)(a) GDPR and in accordance with Section 165 TKG 2021.

4.14 Meta Pixel

We may use the Meta Pixel to measure the effectiveness of our advertising on Meta platforms, in particular Facebook and Instagram, and to deliver advertising in a more targeted manner.

The Meta Pixel is only activated after your consent. Consent can be withdrawn at any time via the cookie settings.

The processing is based on your consent pursuant to Art. 6(1)(a) GDPR and in accordance with Section 165 TKG 2021.

4.15 Enhanced conversion or matching functions

The use of enhanced conversion or matching functions, in which, for example, hashed e-mail addresses, telephone numbers, names or address data are transmitted to Google or Meta, is currently not approved. Such functions may only be used after separate technical and data protection review and, where necessary, after appropriate consent.

5. Shopify as webshop platform

Our webshop is operated via Shopify. Shopify provides the technical platform for the webshop, the checkout, certain payment and account functions, security functions, Shopify Email, Shop Pay and other shop-related functions.

In the course of using the webshop, personal data may be transmitted to and processed by Shopify. This includes, in particular, technical data, order data, payment status data, customer account or shop login data, and information on the use of the webshop.

Insofar as Shopify processes personal data on our behalf, this is done as a processor. For certain functions, in particular Shop Pay, Shop account, security, fraud prevention, payment or cross-shop Shopify functions, Shopify may also act as an independent controller. In these cases, Shopify's privacy information applies in addition.

Insofar as enhanced or cross-shop Shopify functions, in particular Shopify Network Intelligence or comparable functions, are activated, the processing is carried out in accordance with the Shopify settings and Shopify's privacy information. These settings must be reviewed under data protection law before activation or during ongoing operation.

6. Recipients of personal data

We only transmit personal data insofar as this is necessary for the stated purposes or there is a legal basis.

Recipients or categories of recipients may include, in particular:

  • Shopify as the webshop platform;
  • Shopify Email for the newsletter;
  • Shopify Payments and other payment service providers, in particular credit card providers, PayPal, Klarna, Apple Pay, Google Pay, EPS/instant bank transfer and participating banks;
  • Österreichische Post AG for shipping;
  • responsible SFU staff for webshop operation, order processing, pickup, customer service, returns, complaints, accounting and marketing;
  • Winline by mesonic as the ERP/accounting system;
  • Google, insofar as Google Tag Manager, Google Ads conversion tracking or Google Analytics are used after consent;
  • Meta, insofar as the Meta Pixel is used after consent;
  • authorities, courts or other public bodies, insofar as we are legally obliged to do so or this is necessary to assert, exercise or defend legal claims.

Regular transmission to external agencies, external tax advisors or external auditors does not take place in connection with the webshop.

7. International data transfers

In connection with Shopify, payment service providers, Google, Meta and other technical service providers, personal data may be processed outside the European Union or the European Economic Area, in particular in the USA or Canada.

Insofar as personal data is transferred to countries outside the EU or EEA, this is only done on the basis of appropriate safeguards or recognised transfer mechanisms, in particular on the basis of an adequacy decision of the European Commission, the EU-US Data Privacy Framework, where applicable, or the standard contractual clauses of the European Commission.

Further information on international data transfers by Shopify, Google, Meta, PayPal, Klarna and other payment service providers can be found in the respective privacy information of these providers.

8. Storage period

We store personal data only for as long as is necessary for the respective purposes or as long as statutory retention periods exist.

Order, invoice, payment status and accounting data is regularly retained for seven years in accordance with statutory Austrian retention obligations, in particular tax and commercial law provisions. The period generally begins at the end of the calendar year to which the respective document relates.

Data in connection with returns, complaints and warranty cases is stored for the duration of the processing and beyond, for as long as this is necessary to fulfil legal obligations or to assert, exercise or defend legal claims.

Newsletter data is processed until you withdraw your consent. After an unsubscription, we may continue to store the data necessary to prove the consent given and withdrawn.

Cookie and consent information is stored insofar as this is necessary to document your choice and to technically implement your cookie settings.

Complete credit card, account or wallet data is not stored by us, but processed by the respective payment service provider.

9. No automated decision-making by us

In connection with the webshop, we do not make any solely automated decisions within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you.

For certain payment methods, payment service providers may carry out their own payment, risk or credit checks. The respective payment service providers are responsible for these processing operations; their privacy information applies.

10. No processing of minors' data

The webshop is aimed exclusively at customers of legal age. In connection with the webshop, we do not knowingly process any personal data of minors.

If we become aware that personal data of minors has been processed without appropriate authorisation, we will take reasonable steps to delete this data, unless statutory retention obligations prevent this.

11. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction.

Please note that no data transmission over the internet is completely secure. We therefore recommend transmitting confidential information only via designated and secure communication channels.

12. Your rights

Subject to the statutory requirements, you have the following rights:

  • Right to information about the personal data we process;
  • Right to rectification of incorrect or incomplete data;
  • Right to erasure of personal data;
  • Right to restriction of processing;
  • Right to data portability;
  • Right to object to processing based on legitimate interests;
  • Right to withdraw consent with effect for the future;
  • Right to lodge a complaint with a data protection supervisory authority.

If you withdraw consent, this does not affect the lawfulness of the processing carried out on the basis of the consent until withdrawal.

To exercise your rights, please contact the Data Protection Coordination at datenschutz@sfu.ac.at.

Within the framework of the statutory requirements, we may request appropriate identity verification before processing a request.

13. Right to lodge a complaint with the Data Protection Authority

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a data protection supervisory authority.

For Austria, the competent authority is:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna, Austria
Telephone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at
Website: www.dsb.gv.at

14. Changes to this privacy policy

We may adapt this privacy policy if this is necessary due to technical changes to the webshop, new functions, changed service providers or legal requirements.

The current version is available in the webshop at https://shop.sfu.ac.at.