Privacy policy

Privacy Policy

Last updated: 17 October 2026

We take the protection of your data seriously. This policy explains which personal data we process when you visit poshalleycats.com, place an order, subscribe to our newsletter or shop in our store in Salzburg, what we use it for and what rights you have.

1. Controller

Solution Society Consulting GmbH (brand: Posh Alley Cats)
Moosstraße 98b, 5020 Salzburg, Austria
Email: meow@poshalleycats.com
Company register number: FN 427958a, Regional Court Salzburg

For all privacy questions and requests, email meow@poshalleycats.com. We are not required to appoint a data protection officer.

2. Shop platform and hosting

Our shop runs on Shopify. Our contract partner is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, Ireland. On our behalf, Shopify processes all data that arises when you visit or order (e.g. IP address, browser and device information, pages viewed, order and customer data) and also stores it on servers in Canada and the USA. Shopify is certified under the EU-US Data Privacy Framework and has signed standard contractual clauses with us. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in a secure, working shop (Art. 6(1)(f) GDPR).

Shopify also uses data from your interactions with our shop under its own responsibility for enhanced features (Shopify Network Intelligence, e.g. fraud prevention and personalised advertising). Shopify is the controller for this; see the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

3. Orders and customer account

When you order, we process your name, billing and delivery address, email address, optionally your phone number, the items ordered, payment method and order history. We need this to conclude and perform the contract and to handle deliveries, returns, withdrawals and warranty claims (Art. 6(1)(b) GDPR). Required fields are marked; without them we cannot accept the order. A customer account is optional; it shows your orders. To prevent fraud, Shopify checks orders automatically for irregularities (Art. 6(1)(f) GDPR); if something looks unusual, a person makes the final decision.

We use Billbee (Billbee GmbH, Germany) for order processing. Orders ship from our warehouse in Germany; our logistics partner Willy Maisel GmbH, Münchberger Straße 46, 95176 Konradsreuth, Germany, receives the order and delivery data it needs for this.

4. Payment

Payments are handled by the payment providers offered at checkout, in particular Shopify Payments (Stripe Payments Europe Ltd., Ireland) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), as well as Shop Pay, Apple Pay and Google Pay, depending on your choice. They receive the data needed for the payment and partly check it for fraud. We do not store full card details. Legal basis: Art. 6(1)(b) GDPR.

5. Shipping

To deliver your parcel, we pass your name, delivery address and – for delivery notifications – email address or phone number to the carrier (DHL, FedEx or UPS). For deliveries outside the EU, carriers and customs authorities receive the data needed for customs clearance. Legal basis: Art. 6(1)(b) and (c) GDPR.

6. Store Salzburg

For purchases in our store we use Shopify POS. We process the purchase and payment data and, if you wish, your email address for the digital receipt (Art. 6(1)(b) GDPR).

7. Contact

When you email us or use the contact form, we process your details to answer your request (Art. 6(1)(b) or (f) GDPR). If you contact us via WhatsApp, the privacy terms of WhatsApp Ireland Limited also apply; WhatsApp is a Meta service and also transfers data to the USA. For withdrawals we use the “EU Withdrawal” app, which sends us the details from the withdrawal form (Art. 6(1)(c) GDPR).

8. Newsletter

We send our newsletter with Shopify Email only if you have subscribed and confirmed your subscription via the link in our confirmation email (double opt-in). We store your email address and the time of subscription and confirmation, and we measure whether newsletters are opened and links clicked to improve them. The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 Austrian Telecommunications Act 2021). You can unsubscribe at any time via the link in every newsletter or by emailing us.

9. Reviews

We use Loox (Loox Ltd., Israel) for product reviews. After your order you receive one email asking for a review; for this, Loox receives your name, email address and the products you bought. The legal basis is our legitimate interest in genuine customer reviews (Art. 6(1)(f) GDPR). You can object at any time, e.g. via the unsubscribe link in the email. If you post a review, we publish it with your first name and, if provided, your photo. The review widget loads content from Loox servers, which transmits your IP address.

10. Cookies and consent

We use cookies and similar technologies. Strictly necessary cookies (e.g. cart, language, country, security, your cookie choice) are set without consent (§ 165(3) Austrian Telecommunications Act 2021, Art. 6(1)(f) GDPR). All others – for statistics, marketing and personalisation – are only set with your consent via our cookie banner (Art. 6(1)(a) GDPR, § 165(3) Austrian Telecommunications Act 2021). You can change or withdraw your choice at any time via “Cookie settings” in the footer. Withdrawal applies to the future.

11. Statistics (only with consent)

Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): analysis of how our shop is used. Google Analytics 4 does not store full IP addresses. Without consent, no analytics cookies are set.
Microsoft Clarity (Microsoft Ireland Operations Limited, Dublin, Ireland): anonymised recording of clicks, scrolling and mouse movements to improve usability. Input in form fields is masked. Without your consent, Clarity works without cookies and without recognising you.
Shopify Analytics: Shopify records page views and purchases for our shop statistics; Shopify only sets analytics cookies with consent.

12. Marketing (only with consent)

Meta Pixel and Conversions API (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland): measuring and optimising our ads on Facebook and Instagram, remarketing. Events such as page views, cart and purchase are – only with consent – sent to Meta via your browser and via Shopify’s servers; Meta may link them to your Facebook or Instagram account. The joint controllership agreement with Meta applies to this joint processing.
Google Ads, Google Merchant Center and YouTube (Google Ireland Limited): measuring purchases from our Google ads, remarketing and showing our products on Google. We use Google Consent Mode: without consent, no advertising cookies are set.
Pinterest Tag (Pinterest Europe Limited, Dublin, Ireland): measuring and optimising our ads on Pinterest.
Whatmore (Whatmore Shoppable Videos): showing shoppable videos and measuring which videos lead to purchases.

Our products are also shown via the Google & YouTube, Facebook & Instagram and Pinterest sales channels and Shopify’s Shop app. If you shop there or click ads, the privacy terms of the respective platform also apply.

13. Links to social networks and maps

Our site contains links to Instagram, Facebook, YouTube, WhatsApp and Google Maps. These are plain links without embedded plugins: data is only transferred when you click a link and visit that site.

14. Transfers to third countries

Some providers (e.g. Shopify, Google, Meta, Microsoft, Pinterest, Loox) also process data outside the EU, in particular in the USA, Canada or Israel. For Canada and Israel there are EU adequacy decisions; for the USA we rely on the EU-US Data Privacy Framework where the recipient is certified, otherwise on standard contractual clauses (Art. 45, 46 GDPR).

15. Retention

We keep data only as long as needed for the purpose. We keep invoices and accounting records for seven years (§ 132 Austrian Federal Fiscal Code), contract data until possible warranty and liability periods have expired. Newsletter data is kept until you unsubscribe; cookies expire after the period stated in the cookie settings. We delete contact requests once they are resolved and no retention obligation applies.

16. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on our legitimate interest (Art. 15–21 GDPR). You can withdraw any consent at any time with effect for the future. Email meow@poshalleycats.com. If you believe we process your data unlawfully, you can complain to the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at) or to the supervisory authority in your country.

17. Customers in the USA

If you live in a US state with its own privacy law, you can opt out of sharing your data for targeted advertising on our “Your Privacy Choices” page. We also honour the Global Privacy Control signal.

18. Changes

We update this privacy policy when our shop, our providers or the law change. The version published here applies.

Cart