This privacy policy tells you which personal data we process when you use the Sunaofe EU store, for what purpose, on what legal basis, and what rights you have.
1. Controller
SUNON(S) PTE. LTD., 64D Kallang Pudding Road, #10-00 Tannery Building, Singapore 349323, Singapore, email: service@sunaofe.com. More details are in the Legal notice.
2. Visiting the website
The website and the store run on the Shopify platform (Shopify Inc. and its affiliates). When you visit, Shopify and our network provider Cloudflare, Inc. process technically necessary data, for example IP address, date and time, the page requested, browser and operating system. This is needed to deliver the website, run it securely and detect abuse (Art. 6(1)(f) GDPR; our legitimate interest is a secure and stable store).
3. Orders, payment and shipping
When you order, we process your name, contact details, delivery and billing address, the products ordered and payment data to perform the contract (Art. 6(1)(b) GDPR). Checkout and order processing run on Shopify.
- Payment: your payment data goes directly to the payment service you choose: Shopify Payments (card, Apple Pay, Google Pay, Shop Pay), PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, or Klarna Bank AB (publ), Sweden, through our payment provider Airwallex. PayPal and Klarna may check your identity and creditworthiness; they are responsible for this themselves and inform you in their own privacy notices.
- Shipping: we pass your name, delivery address and, where needed for delivery, email address or phone number to our warehouse Y2C Fulfillment, Märkische Str. 10, 44866 Bochum, Germany, and to the carrier (for example DHL Paket GmbH, Bonn).
- Customer account: if you create a customer account, we keep your data there until you delete the account.
Without this data we cannot make the contract. We keep invoice and order data as long as tax and commercial law require, in Germany up to ten years (Art. 6(1)(c) GDPR).
4. Contact and customer service
If you write to us by email, through the contact form or on WhatsApp, we process your details to answer your request (Art. 6(1)(b) GDPR for questions about an order, otherwise Art. 6(1)(f) GDPR). WhatsApp is operated by WhatsApp Ireland Limited; if you write to us there, WhatsApp's privacy notice also applies. We delete requests once they are resolved and no retention obligation applies.
5. Newsletter
If you sign up for our newsletter, we first send you an email with a confirmation link. You are subscribed only after you click it (double opt-in). We store the sign-up with its time to be able to prove it. The legal basis is your consent (Art. 6(1)(a) GDPR).
We send the newsletter with Klaviyo, Inc., USA. Klaviyo measures whether an email is opened and which links are clicked, so that we can improve the newsletter. You can unsubscribe at any time with the link in every email. We then remove your address from the list.
After an order, we ask you by email for a review if you have agreed to receive emails. We manage reviews with the Judge.me service; your first name, the first letter of your last name and your review are published.
6. Prize draws
If you enter a draw on our deals page (for example the free chair draw), we process your email address and the time of your entry to run the draw and to notify the winner (Art. 6(1)(b) GDPR). We pass the winner’s name and delivery address to our warehouse and the carrier (section 3). We keep entries with Klaviyo, Inc., USA (section 8).
Entering does not sign you up for the newsletter. That happens only if you tick its box separately and confirm by email (section 5). We delete the entry data of everyone who did not win no later than three months after the draw. Details are in each draw’s terms of entry.
7. Cookies and similar technologies
We use cookies and similar technologies. We set technically necessary cookies, for example for the cart, checkout, language and your cookie choice, without consent (Section 25(2) TDDDG; Art. 6(1)(b) and (f) GDPR).
We load all other services only after you agree in the cookie banner (Section 25(1) TDDDG; Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time with "Privacy choices" at the bottom of every page.
- Analytics: Google Analytics 4 (Google Ireland Limited, Ireland) and Shopify analytics. We see which pages are visited and how the store is used, to improve it.
- Marketing: Google Ads and Google's merchant badge (Google Ireland Limited, Ireland), Meta Pixel and Meta Conversions API (Meta Platforms Ireland Limited, Ireland), Klaviyo (Klaviyo, Inc., USA) and Preciso (France). These services measure whether our advertising works and show you relevant ads, also on other websites. With your consent, we also send events such as "viewed product" or "purchase" from our server directly to Meta.
8. Recipients and transfers to third countries
We share data only with the service providers and partners named above, and only as far as needed for each purpose. Service providers acting on our behalf are bound by contract under Art. 28 GDPR.
Our company is based in Singapore, and parts of our team work in China. Some service providers are based in the USA. Where data is processed outside the European Economic Area, this is based on an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for certified companies), the European Commission's standard contractual clauses or, where needed to perform your contract, Art. 49(1)(b) GDPR.
9. How long we keep data
We keep personal data only as long as needed for each purpose or as statutory retention obligations require. After that, we delete it.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).
Right to object: where we process data based on Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can object to processing for direct marketing at any time without giving reasons.
To use these rights, write to us at service@sunaofe.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.
We do not make automated decisions under Art. 22 GDPR. Any credit check by Klarna or PayPal is their responsibility.
11. Changes
We update this privacy policy when our processing or the law changes. The version on this page applies.