Privacy policy

Last updated: August 26, 2026

This Privacy Policy explains how Sacraia collects, uses, stores, and shares personal data when you visit www.sacraia.art, make a purchase, create a customer account, subscribe to marketing communications, contact us, or otherwise use our online store.

1. Data Controller

The controller responsible for the processing of personal data through this online store is:

Sacraia
Owner: Caroline-Marie Kreuzer
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany
Email: hello@sacraia.art

No data protection officer has been appointed because Sacraia is not legally required to appoint one.

2. Personal Data We Collect

Depending on how you use the website, we may collect the following categories of personal data:

your name;
billing and shipping address;
email address;
customer-account information;
order and transaction information;
products viewed, placed in the shopping cart, or purchased;
payment status and limited payment-related information;
communications and customer-service enquiries;
newsletter and marketing preferences;
cookie and privacy preferences;
IP address;
browser, device, operating-system, and network information;
information about how you interact with the website;
approximate location derived from your IP address;
fraud-prevention and security information;
information you voluntarily provide to us.

We generally receive this information directly from you, automatically through your use of the website, from Shopify, or from service providers involved in processing your order.

We do not intentionally collect special categories of personal data, such as health information, religious beliefs, or biometric data.

3. Purposes and Legal Bases of Processing

If the General Data Protection Regulation applies, we process personal data on the following legal bases:

Processing Orders and Performing the Contract

We process your contact, order, delivery, and payment information to:

process and fulfil your order;
receive and verify payment;
arrange shipment and delivery;
provide order confirmations and status information;
process returns, withdrawals, refunds, or complaints;
provide customer support.

The legal basis is Article 6(1)(b) GDPR because the processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.

Compliance With Legal Obligations

We process and retain certain personal data to comply with legal obligations relating to taxation, accounting, commercial records, consumer protection, product safety, fraud prevention, and lawful requests from public authorities.

The legal basis is Article 6(1)(c) GDPR.

Legitimate Interests

Where necessary, we process personal data for our legitimate interests or those of a service provider, including:

operating and securing the online store;
preventing fraud, abuse, and unauthorised transactions;
responding to general enquiries;
establishing, exercising, or defending legal claims;
improving store functionality and customer service;
performing non-personalised or consent-free statistical analysis where legally permitted.

The legal basis is Article 6(1)(f) GDPR.

We process personal data on this basis only after considering the effect on your rights and interests.

Consent

Where required, we process personal data based on your consent, particularly for:

non-essential cookies and similar technologies;
personalised advertising;
cross-service tracking;
certain analytics functions;
email marketing;
other optional services requiring consent.

The legal basis is Article 6(1)(a) GDPR and, where cookies or similar technologies are used, the applicable provisions of German telecommunications and data-protection law.

You may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

4. Shopify

Our online store is hosted and technically operated using Shopify.

Depending on the services and features used, Shopify processes information such as:

contact and account details;
order and transaction information;
billing and shipping information;
device and browser information;
IP address;
shopping and browsing activity;
products viewed, added to the cart, or purchased;
privacy preferences;
communications connected with Shopify services.

Shopify processes certain personal data on our behalf to provide hosting, checkout, order-management, security, analytics, customer-account, and other ecommerce functions.

Shopify may also process certain information as an independent controller for its own services and purposes. Further information is available in the Shopify Consumer Privacy Policy.

Shopify International Limited is generally the primary Shopify contracting entity for merchants in the European Economic Area. Personal data may be processed by Shopify entities and authorised service providers in countries outside the European Economic Area.

Shopify uses recognised safeguards for international transfers, which may include adequacy decisions, binding corporate rules, and the European Commission’s standard contractual clauses.

5. Shopify Network Intelligence and Enhanced Services

Shopify Network Intelligence is enabled for this store.

This means information about how you interact with our store may be shared with and processed by Shopify to provide enhanced services. Depending on your location, consent choices, and the services available, these services may enable Shopify and Sacraia to:

provide a more personalised shopping experience;
understand how customers interact with the store and advertisements;
measure and improve services;
provide more relevant advertising;
detect fraud and improve security.

Where legally required, information will only be used for personalised advertising or other non-essential purposes after you have provided consent.

You can manage certain Shopify privacy choices, object to certain processing, or opt out of the use of your information for targeted advertising through the Shopify Privacy Portal.

Your choices made through the cookie banner or the store’s privacy-preference functions may also be communicated to Shopify.

6. Customer Accounts

If you create or use a customer account, we process the information necessary to provide and manage that account. This may include your name, email address, saved addresses, account settings, and order history.

The legal basis is Article 6(1)(b) GDPR where the account is used in connection with purchases and Article 6(1)(f) GDPR for the secure and convenient operation of optional account functions.

You may request the deletion of your customer account by contacting hello@sacraia.art. Personal data that must be retained to comply with legal obligations may not be deleted immediately.

7. Payments

Payments may be processed using Shopify Payments, PayPal, or other payment providers displayed during checkout.

When you select a payment method, the information required to complete the payment is transmitted to the relevant payment provider. Depending on the payment method, this may include:

your name;
billing address;
email address;
payment amount and currency;
order and transaction information;
payment-card or account information;
device, security, and fraud-prevention information.

Sacraia generally does not receive or store your complete payment-card details.

Payment providers may process personal data as independent controllers in accordance with their own privacy policies. They may also perform identity, security, fraud-prevention, or credit checks where legally permitted.

The legal basis for payment processing is Article 6(1)(b) GDPR. Fraud-prevention processing may also be based on Article 6(1)(f) GDPR or a legal obligation.

8. Shipping and Delivery

To fulfil your order, we may share the personal data required for delivery with postal services, shipping carriers, logistics providers, customs authorities, and other parties involved in transporting the artwork.

This information may include your name, delivery address, email address, order number, shipment details, and, where necessary, customs information.

The legal basis is Article 6(1)(b) GDPR. Information required for customs or other legal obligations is processed under Article 6(1)(c) GDPR.

Where an international shipment requires personal data to be transferred outside the European Economic Area, the transfer may be necessary for the performance of the contract with you.

9. Order and Store Applications

We use Shopify applications and services to help operate and manage the store. These may include:

Order Printer Pro for creating order documents, invoices, or related records;
Shopify Flow for automating store and order-management processes;
Shopify Messaging or related Shopify communication functions;
Translate & Adapt for language and localisation functions;
Consentik Cookie for cookie and consent-management functions.

Depending on their purpose and configuration, these applications may process order information, contact details, customer communications, device information, consent choices, or other data necessary to provide their functions.

The legal basis depends on the relevant function and may be Article 6(1)(b), Article 6(1)(c), Article 6(1)(f), or Article 6(1)(a) GDPR.

Service providers are given access only to the data reasonably necessary to perform their services. Where they act as processors, they are contractually required to process personal data only in accordance with applicable data-protection requirements.

10. Cookies and Similar Technologies

Our website uses cookies and similar technologies such as pixels, tags, local storage, and software development kits.

These technologies may be used to:

keep the website and checkout functioning;
remember your shopping cart and settings;
protect the website against fraud and misuse;
remember your privacy choices;
understand website performance and usage;
measure advertising performance;
provide personalised content or advertising where permitted.

Cookies that are strictly necessary for the operation, security, checkout, and requested functions of the website may be used without consent where permitted by law.

Non-essential analytics, marketing, personalisation, and advertising technologies are used only after consent where consent is legally required.

You can accept, reject, or adjust non-essential cookies through the cookie banner and the Privacy Preferences link available in the website footer. You may change your selection at any time.

You can also control cookies through your browser settings. Blocking essential cookies may prevent parts of the website or checkout from working correctly.

11. Google Services

Sacraia uses the Google & YouTube sales channel and may use associated Google services for product listings, advertising, conversion measurement, audience analysis, and store-performance reporting.

Where enabled and permitted by your consent choices, Google may receive information such as:

IP address;
device and browser information;
cookie or advertising identifiers;
pages viewed;
products viewed or purchased;
shopping-cart and checkout events;
transaction and conversion information;
approximate location;
interactions with advertisements.

Google may combine this information with data from other Google services where permitted by law and by your Google account settings.

Non-essential Google advertising and tracking functions are activated only after consent where required. You can withdraw your consent through the website’s Privacy Preferences.

Google may process personal data in countries outside the European Economic Area. Applicable transfer safeguards may include an adequacy decision or the European Commission’s standard contractual clauses.

Further information is available in the Google Privacy Policy.

12. Pinterest

Sacraia uses Pinterest as a sales, marketing, and social-media channel.

Where Pinterest advertising, conversion measurement, catalogue, or tracking functions are enabled and permitted by your consent choices, Pinterest may receive information such as:

IP address;
device and browser information;
cookie or advertising identifiers;
pages and products viewed;
shopping-cart and purchase events;
transaction or conversion information;
interactions with Pinterest content or advertisements.

This information may be used to measure advertising performance, understand interactions with Sacraia, build audiences, or provide personalised advertising where permitted.

Non-essential Pinterest tracking is used only after consent where consent is required. You can withdraw your consent through the website’s Privacy Preferences.

Pinterest may process personal data outside the European Economic Area. Applicable safeguards may include an adequacy decision or standard contractual clauses.

Further information is available in the Pinterest Privacy Policy.

If you visit Sacraia’s Pinterest profile or interact with Sacraia directly through Pinterest, Pinterest’s own terms and privacy practices also apply.

13. Social-Media Links

The website may contain links to social-media platforms, including Pinterest.

A normal link does not automatically mean that the platform receives all personal data collected through our store. However, when you click a social-media link, you leave the Sacraia website and the relevant platform may process information about your visit under its own privacy policy.

Sacraia does not control the independent processing carried out by third-party social-media platforms.

14. Email Marketing and Newsletter

If you subscribe to the Sacraia email list, we process your email address and, where provided, your name and marketing preferences to send you news, artwork updates, product information, and other Sacraia communications.

The legal basis is your consent under Article 6(1)(a) GDPR.

We may use a double opt-in procedure. In this case, you will receive an email asking you to confirm your subscription. We may retain information about the subscription and confirmation, including the time, date, and technical information, to demonstrate that valid consent was provided.

You may unsubscribe at any time by clicking the unsubscribe link in a marketing email or by contacting hello@sacraia.art.

Withdrawing consent does not affect the lawfulness of marketing communications sent before the withdrawal.

We may retain limited information in a suppression list after you unsubscribe to ensure that you do not receive further marketing communications.

Transactional messages relating to an order, payment, delivery, return, or customer-service request are not marketing messages and may still be sent where necessary.

15. Contacting Sacraia

If you contact us by email, through a contact form, through Shopify Messaging, or through another available communication channel, we process the information you provide to respond to your enquiry.

This may include your name, email address, order number, message content, attachments, and related correspondence.

If your enquiry relates to a contract or potential purchase, the legal basis is Article 6(1)(b) GDPR. For general enquiries, the legal basis is Article 6(1)(f) GDPR.

Communications may be retained where necessary to provide support, document the matter, comply with legal obligations, or establish, exercise, or defend legal claims.

16. Recipients of Personal Data

Depending on the relevant processing activity, personal data may be shared with the following categories of recipients:

Shopify and Shopify group companies;
payment providers and financial institutions;
shipping, postal, logistics, and customs providers;
ecommerce and order-management applications;
consent-management providers;
website, hosting, security, and technical service providers;
email and communication providers;
Google and Pinterest where their services are enabled;
professional advisers, such as legal or tax advisers;
public authorities, courts, or law-enforcement bodies where legally required;
other recipients authorised by you.

We do not disclose personal data to third parties unless this is necessary for the purposes described in this Privacy Policy, you have consented, or disclosure is legally permitted or required.

17. International Data Transfers

Some service providers or their group companies are located outside the European Economic Area or may process data in other countries.

Where personal data is transferred to a country outside the European Economic Area, we rely on an applicable legal transfer mechanism where required. This may include:

an adequacy decision issued by the European Commission;
the European Commission’s standard contractual clauses;
approved binding corporate rules;
another legally recognised safeguard;
a transfer necessary for the performance of a contract;
your explicit consent in exceptional cases.

Depending on the destination country, public authorities may have access to personal data under local law.

18. Data Retention

We retain personal data only for as long as it is necessary for the purposes for which it was collected or for as long as required or permitted by law.

The retention period depends on the type of information and may be determined by:

the duration of our contractual relationship with you;
statutory accounting, commercial, and tax-retention obligations;
warranty and consumer-protection requirements;
applicable limitation periods;
fraud-prevention and security needs;
the need to establish, exercise, or defend legal claims;
your consent and whether it has been withdrawn.

Order, invoice, payment, and accounting records may be retained for the applicable statutory retention period even after an order has been completed.

General enquiries are deleted when they are no longer required, unless continued retention is necessary for legal or evidentiary reasons.

Newsletter data is retained until you unsubscribe or withdraw your consent, subject to the limited retention of evidence of consent and suppression-list information.

When personal data is no longer required, it will be deleted, anonymised, or securely restricted from further use, subject to technical backup and legal-retention requirements.

19. Your Data-Protection Rights

If the GDPR applies to you, you may have the following rights, subject to the applicable legal requirements:

the right to obtain information about whether and how your personal data is processed;
the right to access your personal data;
the right to correct inaccurate or incomplete personal data;
the right to request deletion of your personal data;
the right to restrict processing;
the right to receive certain personal data in a structured, commonly used, and machine-readable format;
the right to transmit certain data to another controller;
the right to object to processing based on legitimate interests;
the right to object to direct marketing at any time;
the right to withdraw consent at any time with effect for the future;
the right not to be subject to a decision based solely on automated processing where the applicable legal requirements are met;
the right to lodge a complaint with a data-protection supervisory authority.

To exercise your rights in relation to processing carried out by Sacraia, contact hello@sacraia.art.

We may need to request reasonable information to verify your identity before fulfilling a request.

You may also exercise certain rights relating to Shopify’s independent processing through the Shopify Privacy Portal.

20. Right to Object

If we process your personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right to object to that processing on grounds relating to your particular situation.

We will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms or the processing is necessary for the establishment, exercise, or defence of legal claims.

If personal data is processed for direct-marketing purposes, you may object at any time. After your objection, your personal data will no longer be processed for direct marketing.

21. Complaints to a Supervisory Authority

You have the right to lodge a complaint with a competent data-protection supervisory authority.

You may contact the supervisory authority responsible for Sacraia in Baden-Württemberg or the supervisory authority in the country or region where you live, work, or believe that a data-protection infringement has occurred.

The supervisory authority responsible for private businesses established in Baden-Württemberg is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Germany

Current contact information is available at www.baden-wuerttemberg.datenschutz.de.

You are welcome to contact Sacraia first at hello@sacraia.art so that we can try to resolve your concern directly.

22. Automated Decision-Making

Sacraia does not independently make decisions producing legal or similarly significant effects based solely on automated processing.

Payment providers, Shopify, or fraud-prevention providers may use automated systems to assess transactions, prevent fraud, or protect account security. Further information about such processing can be found in the privacy information provided by the relevant service provider.

23. Children’s Privacy

The online store is not directed at children.

Sacraia does not knowingly collect personal data from children who are unable to provide valid consent under applicable law. If you believe that a child has provided personal data to us without the required authorisation, please contact hello@sacraia.art.

24. Data Security

We use appropriate technical and organisational measures intended to protect personal data against accidental or unlawful loss, alteration, disclosure, destruction, or unauthorised access.

The website uses encrypted connections where supported. Payment data is processed through the secure systems of Shopify and the selected payment provider.

No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security.

25. External Links

The website may contain links to websites or services operated by third parties.

Sacraia is not responsible for the privacy practices, security, or content of external websites. Before providing personal data to an external provider, you should review its privacy policy.