Soniel Supply

Privacy Policy

Last updated: 1 September 2026

This Privacy Policy explains how SonielSupply collects, uses, shares and protects your personal data when you visit our online store, place an order or contact us. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Luxembourg data protection law.

1. Controller

The controller responsible for your personal data is the provider named in our Legal Notice (Impressum):

  • SonielSupply — Ruben Ferreira
  • Goesdorf, L-9653, Luxembourg
  • Phone: +352 621 780 372
  • Email: info@sonielsupply.com

2. Personal data we collect

  • Identity and contact data: name, billing and shipping address, email address, telephone number.
  • Order and payment data: products ordered, order history and payment status. Card details are processed exclusively by our payment provider; we never store full card numbers.
  • Account data: login details and preferences, if you create a customer account.
  • Communications: messages you send us (customer service, withdrawal notices, reviews) and your marketing preferences.
  • Device and usage data: IP address, browser and device information, pages viewed, referring website.
  • Cookies and similar technologies: see section 6.

3. Purposes and legal bases

  • Order processing and delivery — payment, shipping, returns and customer support. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Customer account — managing your account and order history. Legal basis: Art. 6(1)(b) GDPR.
  • Marketing emails — only with your consent (Art. 6(1)(a) GDPR); you can unsubscribe at any time using the link in every email.
  • Product reviews — inviting you to review a purchased product and publishing your review with your first name. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) and, where required, your consent.
  • Analytics and advertising — measuring and improving our website and campaigns. Legal basis: your consent given via the cookie banner (Art. 6(1)(a) GDPR).
  • Security and fraud prevention — legitimate interest (Art. 6(1)(f) GDPR).
  • Legal obligations — accounting, tax and consumer law (Art. 6(1)(c) GDPR).

4. Recipients and processors

We do not sell your personal data. We share it only with the following recipients, and only to the extent necessary:

  • Chance2Brand GmbH (Germany) — our fulfilment partner, which stores, packs and ships your order from its warehouse in Germany. Data shared: name, delivery address, email address and telephone number (for delivery notifications) and order contents.
  • Carriers engaged by Chance2Brand to deliver your parcel (name, address and contact details for delivery).
  • Shopify International Ltd. — hosting of our store, order management and payment processing via Shopify Payments (including Shop Pay, Apple Pay and Google Pay).
  • Judge.me — collection and display of product reviews (name, email address, order details and review content).
  • Google (Google Analytics, Google Ads) — website analytics and advertising measurement, only with your consent.
  • Meta Platforms (Facebook, Instagram) — advertising measurement and audiences, only with your consent.
  • Email service providers — transactional emails and, with your consent, newsletters.
  • Authorities and professional advisers — where required by law or to protect our legal rights.

All processors act on our documented instructions under data processing agreements pursuant to Art. 28 GDPR.

5. International transfers

Some providers (e.g. Shopify, Google, Meta, Judge.me) may process data outside the European Economic Area, in particular in the United States. Where this happens, we rely on the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework to ensure an adequate level of protection.

6. Cookies and consent

Our store uses cookies and similar technologies. Strictly necessary cookies (shopping cart, checkout, security, language) are set without consent. Analytics and marketing cookies (Google, Meta) are set only after you give consent in the cookie banner shown on your first visit. You can change or withdraw your choice at any time via the cookie settings link in the footer or on Your Privacy Choices. Withdrawing consent does not affect processing carried out before withdrawal.

7. Retention

Order, invoice and payment records are retained for the statutory retention period (generally 10 years under Luxembourg commercial and tax law). Customer account data is kept until you delete your account. Marketing data is kept until you withdraw consent. Analytics data is retained for a maximum of 14 months. Other data is deleted once it is no longer needed for the purpose for which it was collected.

8. Your rights

Under the GDPR you have the right to:

  • Access your personal data (Art. 15);
  • Rectification of inaccurate data (Art. 16);
  • Erasure — the "right to be forgotten" (Art. 17);
  • Restriction of processing (Art. 18);
  • Data portability (Art. 20);
  • Object to processing based on legitimate interests and to direct marketing at any time (Art. 21);
  • Withdraw consent at any time, without affecting the lawfulness of prior processing (Art. 7(3)).

To exercise your rights, email info@sonielsupply.com. We reply within one month.

9. Complaints

You may lodge a complaint with the Luxembourg supervisory authority, the Commission nationale pour la protection des données (CNPD, cnpd.public.lu), or with the data protection authority of your country of residence — for Germany, the authority of your federal state.

10. Security

All data is transmitted over TLS-encrypted connections. Payment data is handled by PCI-DSS-certified providers. Access to personal data is restricted to those who need it to fulfil your order.

11. Children

Our store is intended for adults aged 18 and over. We do not knowingly collect data from children.

12. Changes

We may update this policy from time to time. The current version is always available on this page; the date at the top shows the last revision.