Privacy Policy

Last updated: August 2026

We take the protection of your personal data seriously. This privacy policy informs you about the personal data we process when you visit synapshot.com, place an order, or use our other services, the purposes for which we process this data, and the rights you have.

1. Data Controller

The data controller responsible for the processing of personal data in connection with the Synapshot online shop is:

GAPA GMBH
Am Hof 13/2 DG
1010 Vienna
Austria

Telephone: +43 676 7000 666
Email: office@synapshot.com

Synapshot is a brand and online shop of GAPA GMBH.

2. Personal Data We Process

Depending on how you use our online shop, we may process the following personal data in particular:

• First and last name

• Billing and delivery address

• Email address

• Telephone number

• Order and purchase data

• Payment and transaction information

• Shipping and delivery information

• Information about returns, cancellations, and refunds

• Customer account and login data, if you use a customer account

• Content of inquiries to our customer service

• Product reviews you submit, as well as any photos or videos you upload

• IP address

• Browser type and version

• Operating system

• Device information

• Time and duration of website visits

• Pages and products viewed

• Shopping cart and interaction data

• Referrer URL

• Cookie, consent, and advertising identifiers

• Information about interactions with our advertisements, if you have consented to such processing

We receive personal data either directly from you, automatically when you use our website, or from service providers involved in processing your order or providing our services.

3. Provision of the Online Shop and Shopify

Our online shop is operated via the e-commerce platform Shopify.

For users in the European Economic Area, the following company is particularly relevant:

Shopify International Ltd.
2nd Floor, 1-2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify provides us with the technical infrastructure for operating our online shop.

In doing so, the following data may be processed in particular:

• IP address and technical access data

• Device and browser information

• Customer data

• Order data

• Delivery and billing addresses

• Shopping cart and checkout information

• Information about the use of the online shop

To the extent that processing is necessary to provide our online shop or process an order, it is carried out in particular on the basis of Art. 6(1)(b) GDPR.

To the extent that data is processed for technical security, troubleshooting, and abuse or fraud prevention, it is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is to operate our online shop securely and reliably.

Shopify may also process data outside the European Economic Area. Further information on this can be found in the "International Data Transfers" section.

4. Orders and Contract Fulfillment

When you place an order with us, we process the data you provide to fulfill and process the purchase agreement.

This includes, in particular:

• Name

• Billing address

• Delivery address

• Email address

• Telephone number, where necessary

• Ordered products

• Order number

• Purchase price

• Payment status

• Shipping information

• Information about returns and refunds

The legal basis for this processing is Art. 6(1)(b) GDPR.

To the extent that we are legally required to retain certain business, tax, or accounting records, processing is additionally carried out on the basis of Art. 6(1)(c) GDPR.

5. Payment Processing

To process your payment, the data required for this purpose is transmitted to the payment service provider you select or that is used at checkout.

Shopify Payments / Stripe

When using Shopify Payments, payment is processed in particular via:

Stripe Payments Europe, Limited
Ireland

In doing so, the following information may be processed in particular:

• Name

• Billing address

• Payment amount

• Payment method

• Transaction information

• Technical information

• Information about fraud and risk prevention

Processing is carried out to fulfill the purchase agreement and the payment method you select, in accordance with Art. 6(1)(b) GDPR.

Stripe may additionally process certain data under its own data protection responsibilities.

PayPal

When you select PayPal as a payment method, the data required to process the payment is transmitted to

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22-24 Boulevard Royal
L-2449 Luxembourg

and transmitted.

Processing is carried out to fulfill the payment method you select, in accordance with Art. 6(1)(b) GDPR.

PayPal additionally processes certain data under its own data protection responsibilities.

Other payment methods offered at checkout may be processed by the respective payment service providers listed there. The required information will be provided to you in connection with the respective payment method.

6. Fulfillment, Storage, Shipping, and Returns

For the operational processing of our orders, we use an external fulfillment and logistics service provider.

For Synapshot, Entry GmbH is responsible for, in particular:

• Storage of products

• Picking your order

• Packaging

• Preparing shipments

• Handing over to parcel and shipping service providers

• Processing returns

To enable these services to be provided, we transmit the personal data required for this purpose to Entry GmbH.

This may include, in particular:

• First and last name

• Delivery address

• If applicable, email address and telephone number

• Order number

• Ordered products

• Shipping information

• Return information

Processing is carried out to fulfill your order, in accordance with Art. 6(1)(b) GDPR.

For actual delivery, the required data may additionally be transmitted to the respective parcel or shipping service provider used.

Postal Return Address

For returns, the following postal recipient address must be used:

Hendrix Design & Concepts GmbH & Co KG
c/o Entry GmbH
Halskestraße 9 a
47877 Willich
Germany

The designation Hendrix Design & Concepts GmbH & Co KG is part of the postal address intended for return processing.

Our fulfillment, shipping, and return service provider is Entry GmbH.

The data controller for the Synapshot online shop and the customer's contractual partner remains GAPA GMBH.

7. Customer Account

When you create a customer account, we process the data required for this purpose, in particular:

• Name

• Contact details

• Login information

• Order history

• If applicable, saved addresses

Processing is carried out to provide the customer account, in accordance with Art. 6(1)(b) GDPR.

If you request the deletion of your customer account, we will delete the corresponding data unless there are statutory retention requirements or other legal reasons for continued storage.

8. Contact and Customer Service

When you contact us by email, contact form, or by other means, we process the information you provide to handle your inquiry.

This may include, in particular:

• Name

• Email address

• Telephone number

• Order number

• Content of the message

• If applicable, other information you provide

If the inquiry refers to an order or an existing or initiated contract, processing is carried out in accordance with Art. 6(1)(b) GDPR.

For other inquiries, processing is carried out based on our legitimate interest in handling customer and prospective customer inquiries, in accordance with Art. 6(1)(f) GDPR.

9. Newsletter and Email Marketing

When you sign up for our newsletter or other marketing communications, we process your email address in particular to send you information about Synapshot, our products, offers, and promotions.

Processing is generally carried out on the basis of your consent, in accordance with Art. 6(1)(a) GDPR.

To the extent that direct advertising to existing customers is permitted by law without separate consent, such communication is carried out exclusively within the statutory requirements provided for this purpose.

For distribution, we may use specialized email and newsletter service providers, to whom the data required for this purpose is provided.

You can revoke a given consent at any time with future effect. You can use the unsubscribe link at the end of our marketing emails for this purpose in particular.

The lawfulness of processing carried out until revocation remains unaffected.

Transactional and service emails such as order confirmations, shipping information, refund information, or other messages required for contract fulfillment are not affected by unsubscribing from the newsletter.

10. Product Reviews with Loox

We use Loox to manage and display product reviews.

The provider is:

Loox Online Ltd.

In connection with Loox, the following data may be processed in particular:

• Name

• Email address

• Order information

• Purchased product

• Order date

• Submitted review

• Review text

• If applicable, uploaded photos or videos

Loox processes customer data in connection with providing its review platform to us.

When you voluntarily submit a review, we process the data you provide in particular to publish, review, and manage the review.

The legal basis is, depending on the specific processing, your consent in accordance with Art. 6(1)(a) GDPR or our legitimate interest in providing authentic product reviews in accordance with Art. 6(1)(f) GDPR.

Review requests by email are only sent insofar as this is permitted under the respective applicable statutory provisions.

Please note that published reviews, as well as photos or videos you provide for publication, may be visible to the public.

11. Cookies and Similar Technologies

We use cookies and similar technologies on our website.

Cookies are small files or pieces of information that can be stored on or read from your device.

We distinguish in particular between the following categories:

Technically Necessary Technologies

These are required to provide you with our online shop and expressly requested functions.

These may include, in particular:

• Shopping cart

• Checkout

• Payment processing

• Login

• Security functions

• Fraud prevention

• Storage of your privacy and cookie settings

To the extent that personal data is processed in this context, it is carried out in particular on the basis of Art. 6(1)(b) or (f) GDPR.

Statistics and Analysis Technologies

We use these only if you have previously consented to our cookie or privacy settings.

The legal basis for the processing of personal data is Art. 6(1)(a) GDPR.

Marketing and Advertising Technologies

We also use technologies for measuring advertising effectiveness, audience targeting, and personalized advertising only after your prior consent.

The legal basis is Art. 6(1)(a) GDPR.

For access to or storage of information on your device, the respective applicable national regulations also apply, in particular § 165(3) TKG 2021 in Austria and, where applicable, § 25 TDDDG in Germany.

You can change your selection at any time via the cookie or privacy settings available on our website and revoke a given consent with future effect.

Further information about specifically used cookies, providers, and storage durations can be found in the cookie settings provided on the website.

12. Google Analytics

If you have consented, we use Google Analytics to analyze the use of our online shop.

The provider for users in the European Economic Area is in particular:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

In doing so, the following information may be processed in particular:

• IP address

• Device and browser information

• Visited pages

• Time and duration of the visit

• Interactions with our website

• Origin of the visit

• Technical events

• Shopping cart and purchase events

We use this information to analyze the use of our online shop and improve our offering.

Processing is carried out exclusively on the basis of your consent in accordance with Art. 6(1)(a) GDPR.

13. Google Ads

If you have consented, we use Google Ads and associated measurement and advertising technologies.

The provider is in particular:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

This may include processing information about the following activities:

• Visits to our website

• Interactions with Google ads

• Products viewed

• Cart actions

• Orders

• Conversion events

• Device and browser information

• Cookie and advertising identifiers

The data is used in particular to measure the success of our advertising campaigns and, where you have consented, to serve more targeted advertising.

Processing is carried out pursuant to Art. 6(1)(a) GDPR.

14. Meta Advertising Technologies

If you have consented, we use technologies from Meta in connection with advertising on Facebook and Instagram.

The provider for users in the European Economic Area is:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland

This may include processing the following data:

• IP address

• Browser and device information

• Pages visited

• Products viewed

• Cart actions

• Orders

• Conversion events

• Cookie and advertising identifiers

• Information about interactions with our ads

We use this information in particular to measure the success of our advertising campaigns, to build audiences, and, where permitted by you, for personalized advertising.

Processing is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

Meta may further process certain data within the scope of its services under its own data protection responsibility.

15. Security and Fraud Prevention

We process personal and technical information to the extent necessary to protect our online shop and our customers from fraud, misuse, unauthorized access, and other security risks.

This may include, in particular:

• IP address

• Device and browser information

• Order information

• Payment and transaction information

• Technical security information

• Information about suspicious activity

The legal basis is our legitimate interest in operating our online shop securely and preventing fraud pursuant to Art. 6(1)(f) GDPR.

Payment and platform providers may conduct their own risk and fraud checks. Their respective privacy notices apply to their independent processing.

16. Recipients of Personal Data

We only disclose personal data to the extent that this is necessary and legally permitted.

Recipients or categories of recipients may include:

• Shopify and service providers used by Shopify

• Payment service providers such as Stripe and PayPal

• Entry GmbH as a fulfillment, logistics, shipping, and returns service provider

• Parcel and shipping service providers

• IT and hosting service providers

• Email and newsletter service providers

• Loox as a review service provider

• Google, Meta, and Pinterest, provided you have consented to the respective processing

• Tax advisors, auditors, legal advisors, and other professional advisors

• Authorities, courts, or other public bodies when there is a legal obligation

We do not sell your personal data to third parties.

17. International Data Transfers

Some of the service providers we use or their subcontractors may process personal data outside the European Economic Area.

Such a transfer only takes place if the legal requirements of Art. 44 et seq. GDPR are met.

Depending on the recipient, the following transfer bases may be used in particular:

• Adequacy decisions of the European Commission

• the EU-U.S. Data Privacy Framework, provided that the respective recipient is accordingly certified

• Standard contractual clauses approved by the European Commission

• Binding Corporate Rules

• other transfer mechanisms permitted under the GDPR

Where necessary, additional contractual, technical, and organizational safeguards will be implemented.

18. Retention Period

We only store personal data for as long as is necessary for the respective purpose or as long as we are required by law to continue storing it.

Order, Invoice, and Accounting Data

We generally retain accounting records, invoices, and related information in accordance with statutory tax retention periods.

In Austria, this period for accounting records and documents is generally seven years. Longer retention periods may be required by law in individual cases.

Contract and Order Data

We store contract data at least for the duration of contract fulfillment and beyond, insofar as this is required by statutory retention or limitation periods.

Customer Account

Customer account data is generally stored for as long as the account exists. After deletion, data will be removed unless there are statutory retention obligations or other legal reasons for continued storage.

Customer Service

We store communications with our customer service for as long as is necessary to process your request and, if applicable, to assert or defend legal claims.

Newsletter

We generally process newsletter data until you unsubscribe or revoke your consent.

Data required to prove that consent was given or revoked may be stored beyond this period for the duration of statutory limitation and evidence periods.

Tracking and Cookies

The specific retention periods for the cookies and tracking technologies used are set out in our cookie and privacy settings.

After the respective periods expire, we delete or anonymize personal data unless there is a legal basis for further processing.

19. Your Rights

Subject to the statutory requirements, you have the following rights in particular:

Right of Access

You can request information about whether and what personal data we process about you.

Right to Rectification

You can request the correction of inaccurate personal data and the completion of incomplete personal data.

Right to Erasure

Subject to statutory requirements, you can request the erasure of your personal data.

Right to Restriction of Processing

Subject to statutory requirements, you can request that the processing of your personal data be restricted.

Right to Data Portability

Where the statutory requirements are met, you can request that the personal data you have provided be made available to you or transferred to another controller in a structured, commonly used, and machine-readable format.

Right to Object

Where we process personal data on the basis of a legitimate interest pursuant to Art. 6(1)(f) GDPR, you can object to such processing on grounds arising from your particular situation.

You can object to the processing of personal data for direct marketing purposes at any time.

Revocation of Consent

If processing is based on your consent, you can revoke it at any time with effect for the future.

Revocation does not affect the lawfulness of processing carried out up to that point on the basis of your consent.

To exercise your data protection rights, you can contact us at the following address:

office@synapshot.com

20. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law.

Our responsible supervisory authority is:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Austria

Telephone: +43 1 52 152-0
Email: dsb@dsb.gv.at

You may also contact a data protection supervisory authority in the Member State where your habitual residence, place of work, or the place of the alleged data protection breach is located.

21. No Obligation for Automated Decision-Making

We generally do not use decision-making based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.

Where external payment or security service providers conduct automated risk or fraud checks as part of their own services, their respective privacy notices apply.

22. External Links

Our website may contain links to third-party websites or offers.

As soon as you visit such an external website, further data processing is generally the responsibility of the respective provider.

Please therefore refer to the privacy notice of the respective provider.

23. Changes to This Privacy Notice

We may change this privacy notice if the data processing we carry out, the service providers we use, or the legal requirements change.

The current version will be published on our website.

24. Contact

If you have questions about data protection, the processing of your personal data, or the exercise of your data protection rights, you can contact us at any time:

GAPA GMBH
Am Hof 13/2 DG
1010 Vienna
Austria

Telephone: +43 676 7000 666
Email: office@synapshot.com

As of: August 2026