Privacy Policy

Privacy Policy

Last updated: 9 August 2026

We take your privacy seriously. Viking Sneaker exists to put the right pair on your feet, not to misuse your data. In 5 years of business and more than 4,000 pairs shipped, we have always treated everyone who shops with us with the same care. This Privacy Policy explains, in plain terms, what data we collect when you browse and shop at vikingsneakers.shop, what we use it for, who we share it with and how you stay in control of it. It follows the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the ePrivacy Directive (Directive 2002/58/EC) and the guidance of the European Data Protection Board (EDPB).

1. Who is responsible for your data

The controller of the personal data processed in this store is Viking Sneaker, company registration number [COMPANY REGISTRATION NUMBER], with its address at [ENDEREÇO], which is responsible for this Shopify online store and for decisions about how your information is processed.

If you have any questions about privacy, want to exercise a right or simply want to understand better how we look after your data, contact us through our official channels:

  • Email (main privacy channel): [E-MAIL]
  • WhatsApp: [TELEFONE]
  • Official website: vikingsneakers.shop
  • Customer service hours: Monday to Friday, 09:00 to 18:30, and Saturday, 09:00 to 13:00 (Brasília time, UTC-3).

This policy applies to all visitors and customers of the store and describes how we collect, use, share, store and protect your data.

2. What data we collect

We only collect what is needed for you to browse, buy, receive your order and get good service. Here it is by source:

  • Registration / account: full name, email address, phone/WhatsApp number and, if you create an account, your password (stored securely).
  • Order and delivery: full address, postcode, items purchased, chosen size (we stock sizes 33 to 44, Brazilian sizing), order history and preferences.
  • Payment: card details are collected and processed directly by the payment provider of the Shopify checkout. Viking Sneaker does not have access to your full card number: we only receive information such as the transaction status, the last 4 digits, the card brand and the amount.
  • Browsing and technical data: IP address, device and browser type, pages visited, time spent browsing and cookies (details in our Cookie Policy).
  • Customer service: the content of your conversations with us by email or WhatsApp, including photos and videos you send us for a size exchange or a defect assessment (for example, pictures of the pair, the box and the label).

We never ask for data without a purpose. If a field is optional, the form makes that clear.

3. What we use your data for (purpose and legal basis)

Each use has a purpose and a legal basis under Article 6 of the GDPR:

What we use it for Legal basis (GDPR)
Processing, preparing, shipping and billing your order, and providing support Performance of a contract (Article 6(1)(b))
Complying with tax, accounting and record-keeping obligations Legal obligation (Article 6(1)(c))
Preventing fraud and protecting the store and our customers Legitimate interests (Article 6(1)(f))
Improving the store, measuring performance and recommending products Legitimate interests (Article 6(1)(f)), with the right to object
Sending news, offers and new releases by email or WhatsApp Consent (Article 6(1)(a))
Using non-essential cookies and personalised ads Consent (Article 6(1)(a))
Defending our rights in administrative or legal proceedings Legitimate interests in establishing, exercising or defending legal claims (Article 6(1)(f))

You only receive marketing if you agree to it, and saying no never stops you from buying from the store.

4. Legitimate interests

When we process data on the basis of legitimate interests (Article 6(1)(f) of the GDPR), for example to prevent fraud or improve the shopping experience, we assess whether the purpose is legitimate, whether the processing is genuinely necessary and proportionate and whether it respects your expectations. In these cases, you can object at any time: just contact us by email at [E-MAIL] or on WhatsApp at [TELEFONE].

5. Consent: how we collect it and how to withdraw it

When processing depends on your consent (such as marketing and non-essential cookies), that consent is freely given, informed, unambiguous and specific, as defined in Article 4(11) of the GDPR. You are never obliged to accept.

And if you change your mind, you can withdraw your consent at any time, free of charge and easily (Article 7(3) of the GDPR), with no red tape. Withdrawing consent does not affect processing carried out while your consent was valid, and declining marketing does not affect your purchase.

6. Who we share your data with

For your pair to leave our stock and reach you, some partners need to process part of your data. We always share the minimum necessary with:

  • Shopify: the platform that hosts and runs the store;
  • Checkout payment providers: to process your payment with the payment methods shown at checkout and to help prevent fraud;
  • Partner suppliers and distribution centres: which receive the shipping details (name, address and the size purchased) strictly to pick, check, pack and dispatch your order;
  • Our shipping partners: to deliver and track your order;
  • Marketing and analytics tools (for example, email providers, Meta and Google): for communications and metrics, where you have given your permission;
  • Public authorities: only when required by law or by court order.

These partners act as processors: they are bound to keep your data confidential and secure and to process it only for the purposes we define. And let us say it plainly: Viking Sneaker does not sell or trade your personal data.

7. International data transfers

Some of the services we use (Shopify, Meta, Google) have servers outside the European Economic Area (EEA), and parts of our supply chain and logistics may operate from other countries. As a result, some of your data may be processed or stored outside the EEA.

When this happens, the transfer complies with Chapter V of the GDPR: a destination with an adequate level of protection, standard contractual clauses or another appropriate safeguard, always limited to what is necessary (in the case of suppliers, only the shipping details of your order). Your data remains protected wherever it is processed.

8. How long we keep your data (retention and deletion)

We keep your data only for as long as each purpose requires. After that, we delete or anonymise it, unless the law requires us to keep it:

  • Registration / account: while your account is active and for up to 24 months of inactivity, after which it is deleted or anonymised;
  • Tax and order data: for 5 years, in line with tax retention periods and the limitation periods of consumer protection law;
  • Access records (logs): for 6 months, in line with our legal record-keeping obligations;
  • Data processed on the basis of consent: until you withdraw your consent;
  • Data needed to defend legal claims: until the applicable legal time limits expire.

All in line with the storage limitation principle of the GDPR (Article 5(1)(e)). No "we keep it indefinitely" here: every piece of data has a clear time limit or criterion.

9. Your rights and how to exercise them

Under the GDPR, you have the right to:

  • confirm whether we process your data and access it;
  • rectify incomplete, inaccurate or out-of-date data;
  • request the anonymisation, restriction or erasure of data that is unnecessary or processed unlawfully;
  • request the portability of your data to another provider;
  • request the erasure of data processed with your consent;
  • know who we share your data with;
  • be informed about the possibility of not giving consent and what that means for you;
  • withdraw your consent at any time;
  • request a human review of automated decisions (Article 22) and lodge a complaint with a data protection supervisory authority.

How to exercise them: send your request to [E-MAIL] (or, if you prefer, on WhatsApp at [TELEFONE]). We may ask you to confirm your identity to protect your account. We reply immediately in simplified form, or with a full statement within 15 days, well within the one-month deadline set by Article 12 of the GDPR. Exercising your rights is free of charge. Data is deleted whenever possible, unless the law requires us to keep certain data (such as tax records and access logs).

10. Data protection contact

Viking Sneaker's point of contact for data protection matters is our Privacy team, which you can reach by:

  • Email: [E-MAIL]
  • WhatsApp: [TELEFONE]
  • Postal address: [ENDEREÇO]

This is the channel through which we receive complaints and requests from data subjects, provide clarifications and communicate with data protection supervisory authorities, in line with the GDPR.

11. Information security

We take technical and organisational measures to protect your information against unauthorised access, loss, alteration or destruction, such as an encrypted connection (HTTPS) across the whole store, internal access controls, the secure Shopify checkout environment and confidentiality commitments from our processors (Article 32 of the GDPR).

No system in the world is 100% infallible, so we do not promise absolute security, but we work continuously to keep your data protected and, if something does not go to plan, we act quickly (see the next section).

12. Incident notification

If a security incident occurs that may pose a risk or cause significant harm to you, we notify the competent supervisory authority without undue delay, as required by Article 33 of the GDPR, and we also inform the data subjects affected. In that notification, we describe the nature of the data involved, who was affected and the measures we have taken to contain the problem (Articles 33 and 34 of the GDPR).

13. Minors, cookies, marketing and changes

Audience and age. The store is intended for people aged 18 and over. Teenagers aged 16 to 18 may only buy with the assistance of their parents or guardians: in that case, the data needed to complete and deliver the order is processed on the basis of the performance of the contract, under the responsibility of the adult assisting with the purchase. When, exceptionally, we process data relating to children and teenagers (for example, a child's name in the delivery details of a pair in one of the smaller sizes bought by an adult), we always act in the best interests of the minor and, in the case of children, rely on the specific and clearly distinguishable consent of a parent or guardian (Article 8 of the GDPR). We do not knowingly collect data from anyone under 16 for the purpose of entering into a contract.

Cookies. We use essential cookies to make the store work (cart, login, checkout) and, with your consent, analytics and advertising cookies. Details of which cookies we use, what for and how you can manage them are in our Cookie Policy.

Marketing. Every promotional email or WhatsApp message includes an easy, free way to unsubscribe. Only those who want our messages receive them.

Changes. We may update this policy from time to time (the date is always shown at the top). Significant changes are communicated through our channels. And if you feel that something is not being respected, you can complain directly to your local data protection supervisory authority: the list of authorities is available at edpb.europa.eu.

Would you also like to check the timeframes and rules that apply to your purchase? Take a look at the Shipping & Delivery Policy, the Returns, Exchanges & Refunds Policy and the Cookie Policy. If you have any questions, our customer service team is available Monday to Friday, 09:00 to 18:30, and on Saturdays, 09:00 to 13:00 (Brasília time, UTC-3).