Privacy policy

Privacy Policy

1. Access data and hosting
Hosting
2. Data processing for contract performance and contact
Data processing for contract performance
Contact
3. Data processing for shipping
Disclosure of data to shipping service providers for shipment notification
4. Data processing for payment processing
4.1 Data processing for transaction processing
4.2 Data processing for fraud prevention and optimization of our payment processes
5. Advertising by email
5.1 Email newsletter with registration
Email newsletter without registration and your right to object
5.2 Sending review requests by email
6. Cookies and other technologies
6.1 General information
6.2 Consent Manager Platform (CMP)
6.3 Information on transfers to third countries
6.4 Meta Pixel and Meta Conversions API
6.5 Impressum-Privatschutz (IP-Management)
7. Social media
Our online presence on Instagram (by Meta)
8. Contact options and your rights
8.1 Your rights
8.2 Contact options

Controller responsible for data processing:

Yousif Nahama

c/o IP-Management #8897

Ludwig-Erhard-Straße 18

20459 Hamburg

Email: contact@bodysupremacy.de

Phone: 015215648700

Thank you for your interest in our website. Protecting your privacy is very important to us. Below we provide detailed information about how we handle your data.

1. Access data and hosting

You can visit our websites without providing personal information. Each time a website is accessed, the web server automatically stores a server log file containing, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data), and documents the access. This access data is evaluated solely to ensure trouble-free operation of the site and to improve our offering. This serves to safeguard our legitimate interests in the correct presentation of our offering, which prevail in the context of a balancing of interests, pursuant to Art. 6(1)(f) GDPR. All access data is processed only for as long as is necessary to achieve the processing purposes stated above.

Hosting

Our website is hosted by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes personal data on our behalf in connection with providing the online shop pursuant to Art. 28 GDPR.

Hosting and website presentation services are partly provided by our service providers acting on our behalf. Unless otherwise explained in this Privacy Policy, all access data and all data collected in forms provided on this website are processed on their servers. If you have questions about our service providers and the basis of our cooperation with them, please use the contact option described in this Privacy Policy.

Our service providers are based and/or use servers in the following countries for which the European Commission has determined by decision that an adequate level of data protection exists: Canada, USA.

The adequacy decision for the USA serves as the basis for transfers to the United States insofar as the respective service provider is certified. Certification under the European Commission's decision is in place.

2. Data processing for contract performance and contact

Data processing for contract performance

We collect personal data when you voluntarily provide it to us in connection with your order or when contacting us, for example via contact form or email. Mandatory fields are marked as such because in these cases we need the data to perform the contract or process your enquiry, and without providing it you cannot complete the order or send the enquiry. The data collected can be seen from the respective input forms.

We use the data you provide to perform the contract and process your enquiries, including enquiries relating to and handling any existing warranty claims, disruptions in performance and any statutory updating obligations, pursuant to Art. 6(1)(b) GDPR. Further information about the processing of your data, in particular disclosure to our service providers for order, payment and shipping processing, can be found in the following sections of this Privacy Policy. Once the contract has been fully processed, further processing of your data will be restricted and the data will be deleted after expiry of any tax and commercial-law retention periods pursuant to Art. 6(1)(c) GDPR, unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this where permitted by law and about which we inform you in this Policy.

Contact

As part of customer communication, we collect personal data to process your enquiries pursuant to Art. 6(1)(b) GDPR if you voluntarily provide it when contacting us, for example via contact form or email. Mandatory fields are marked as such because in these cases we need the data to process your enquiry. The data collected can be seen from the respective input forms. After your enquiry has been fully processed, your data will be deleted unless you have expressly consented to further use pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this where permitted by law and about which we inform you in this Policy.

3. Data processing for shipping

For performance of the contract pursuant to Art. 6(1)(b) GDPR, we disclose your data to the shipping service provider commissioned with delivery insofar as this is necessary to deliver the goods ordered. If you have questions about our service providers and the basis of our cooperation with them, please use the contact option described in this Privacy Policy.

Disclosure of data to shipping service providers for shipment notification

If you have given us your express consent during or after your order, we will, on the basis of that consent pursuant to Art. 6(1)(a) GDPR, pass your email address and telephone number to the selected shipping service provider so that it can contact you before delivery for the purpose of delivery notification or coordination.

You may withdraw your consent at any time by sending a message to the contact option described in this Privacy Policy. After withdrawal, we will delete the data you provided for this purpose unless you have expressly consented to further use or we reserve the right to use data beyond this where permitted by law and about which we inform you in this Policy.

4. Data processing for payment processing

When processing payments in our online shop, we work with technical service providers, financial institutions and payment service providers.

We also use Shopify Payments, a payment service of Shopify International Limited and/or Shopify Inc.

4.1 Data processing for transaction processing

Depending on the selected payment method, we transmit the data necessary for payment processing to our service providers insofar as this is necessary for contract performance (Art. 6(1)(b) GDPR).

In particular, we use the following payment service providers:

  • Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden – for payment by invoice, instalments or instant bank transfer.
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg – for processing payments via PayPal account or credit card.

Your data is used exclusively for payment processing. Further information about processing of your personal data can be found in Klarna's and PayPal's respective privacy policies.

Depending on the payment method, data may be transferred to third countries outside the EU/EEA. Where no adequacy decision of the EU Commission exists, we rely on Standard Contractual Clauses of the European Commission.

4.2 Data processing for fraud prevention and optimization of payment processes

The service providers mentioned above may also use data collected for payment processing for fraud prevention, review of suspicious payments and optimization of payment processes. This serves to safeguard our overriding legitimate interests in secure payment processing and efficient billing (Art. 6(1)(f) GDPR).

5. Advertising by email

5.1 Email newsletter with registration

If you subscribe to our newsletter, we use the data required for this purpose or separately provided by you to send you our email newsletter regularly on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You can unsubscribe at any time either by sending a message to the contact option described below or by using the unsubscribe link provided in the newsletter. After unsubscribing, we delete your email address from the recipient list unless you have expressly consented to further use pursuant to Art. 6(1)(a) GDPR or we reserve the right to use data beyond this where permitted by law and about which we inform you in this Policy.

Email newsletter without registration and your right to object

If we receive your email address in connection with the sale of goods or services, we reserve the right to send you regular offers by email for products from our range that are similar to those already purchased. This serves to safeguard our overriding legitimate interests in promotional contact with our customers pursuant to Art. 6(1)(f) GDPR. We will not send you such offers if you have already objected to this use of your email address or are entered on a legally binding suppression list.

You can object to this use of your email address at any time, easily and free of charge, by sending a message to the contact option described in this Privacy Policy or by using the link provided in the promotional email, without incurring costs other than transmission costs at the basic rates. After unsubscribing, we delete your email address from the recipient list unless you have expressly consented to further use or we reserve the right to use data beyond this where permitted by law and about which we inform you in this Policy.

5.2 Sending review requests by email

If, during or after your order, you have given us your express consent pursuant to Art. 6(1)(a) GDPR, we use your email address to ask you to review your order via the review system we use. You may withdraw this consent at any time by sending a message to the contact option described in this Privacy Policy or by using a link provided in the review request. After withdrawal, we delete your email address from the recipient list unless you have expressly consented to further use or we reserve the right to use data beyond this where permitted by law and about which we inform you in this Policy.

6. Cookies and other technologies

6.1 General information

To make visiting our website attractive and enable the use of certain functions, we use technologies including cookies on various pages. Cookies are small text files that are automatically stored on your device. Some cookies we use are deleted at the end of the browser session, that is, when you close your browser (session cookies). Other cookies remain on your device and enable us to recognize your browser when you next visit (persistent cookies). You can find the storage duration in the overview in your web browser's cookie settings.

Protection of privacy on end devices

When you use our online offering, we use technologies that are strictly necessary to provide the telemedia service expressly requested. Storing information on your device or accessing information already stored there does not require consent to this extent.

For functions that are not strictly necessary, storing information on your device or accessing information already stored there requires your consent. Please note that if consent is not given, parts of the website may not be fully usable. Any consent you have given remains in effect until you adjust or reset the relevant settings on your device.

Subsequent data processing by cookies and other technologies

We use technologies that are strictly necessary for the use of certain functions of our website. These technologies collect and process IP address, time of visit, device and browser information and information about your use of our website. This serves, within the context of a balancing of interests, our overriding legitimate interests in an optimized presentation of our offering pursuant to Art. 6(1)(f) GDPR.

We also use technologies to fulfil legal obligations to which we are subject, for example to be able to demonstrate consent to processing of your personal data, as well as for web analytics and online marketing. Further information, including the respective legal basis for data processing, can be found in the following sections of this Privacy Policy.

Cookie settings

Cookie settings for your browser can be found at the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™

Where you have consented to the use of technologies pursuant to Art. 6(1)(a) GDPR, you may withdraw your consent at any time by sending a message to the contact option described in this Privacy Policy. Alternatively, you can open the following page: https://www.bodysupremacy.de/en/policies/privacy-policy. If you do not accept cookies, the functionality of our website may be restricted.

6.2 Consent Manager Platform (CMP)

On our website, we use a consent management service (“Consent Manager Platform (CMP)”) to inform you about the cookies and other technologies we use and to obtain, manage and document any consent required for processing your personal data by these technologies. This is necessary pursuant to Art. 6(1)(c) GDPR to fulfil our legal obligation under Art. 7(1) GDPR to be able to demonstrate your consent. The Consent Manager Platform used is provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, which processes the data on our behalf.

Marketing and tracking technologies, in particular the Meta Pixel and, where applicable, Meta Conversions API, are activated only after your express consent via the Consent Manager Platform.

After you submit your cookie preferences on our website, the web server stores in particular the following data: IP address, device information, browser information, selected language, the website or URL visited, date and time of your consent declaration and information about your consent choices.

Cookies and comparable technologies are used to store your consent and take it into account on future visits.

Your data is deleted after one year unless you have expressly consented to further use pursuant to Art. 6(1)(a) GDPR or we reserve the right to process data beyond this where legally permitted.

6.3 Information on transfers to third countries (data transfers to third countries)

We use technologies from service providers on our website whose registered office and/or server locations may be in third countries outside the EU or EEA. If there is no adequacy decision by the EU Commission for a country, an adequate level of data protection must be ensured by other appropriate safeguards.

Appropriate safeguards in the form of contractually agreed Standard Contractual Clauses of the EU Commission or binding internal data protection rules (Binding Corporate Rules) are generally possible, but require the contracting parties to review in advance whether an adequate level of protection can be guaranteed. According to the case law of the CJEU, additional protective measures may be required for this purpose.

As a general rule, we have agreed the Standard Contractual Clauses issued by the EU Commission with technology providers used by us that process personal data in a third country. Where possible, we also agree additional safeguards intended to ensure an adequate level of data protection in third countries without an adequacy decision.

Nevertheless, despite all contractual and technical measures, the level of data protection in a third country may not correspond to that in the EU. In these cases, where necessary, we ask for your consent pursuant to Art. 49(1)(a) GDPR to transfer your personal data to a third country as part of the cookie consent process.

In particular, there is a risk that local authorities in the third country may, from a European data-protection perspective, have insufficiently restricted access rights to your personal data without us as data exporter or you as the data subject becoming aware of this and/or without sufficient legal remedies being available to you to prevent or challenge such access.

The following countries in particular are currently among third countries without an adequacy decision by the EU Commission (examples):

  • China
  • Russia
  • Taiwan

You can find out which third countries receive data transfers from us in the privacy notices for the respective tool and/or the consent management service / Consent Manager Platform (CMP) we use.

6.4 Meta Pixel and Meta Conversions API

If you have given your consent via our cookie banner pursuant to Art. 6(1)(a) GDPR, we use the Meta Pixel and, where technically enabled, the Meta Conversions API of Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta”).

With these technologies, we can track visitor behaviour after visitors have been directed to our website by an advertisement on Facebook or Instagram. This enables us to measure the effectiveness of our advertisements, create statistical analyses and optimize our marketing activities.

The following information in particular may be processed:

  • pages visited,
  • products viewed,
  • shopping-cart and purchase events,
  • technical information about the device and browser used,
  • IP address,
  • timestamps,
  • where applicable, hashed customer data (for example email address or telephone number) where this is transmitted via the Conversions API and with your consent.

Processing takes place only after your express consent. You may withdraw your consent at any time with effect for the future via our cookie settings.

Information collected by Meta may be transferred to and processed on servers of Meta Platforms, Inc. in the USA. Where personal data is transferred to the USA, the transfer is based on the EU-U.S. Data Privacy Framework insofar as Meta is certified under it. Where required, the data transfer is additionally based on Standard Contractual Clauses adopted by the European Commission.

Further information about data processing by Meta can be found at:
https://www.facebook.com/privacy/policy/

6.5 Impressum-Privatschutz (IP-Management)

For managing mail sent to us, we use the services of IMPRESSUM-PRIVATSCHUTZ GmbH, Ludwig-Erhard-Str. 18, 20459 Hamburg. This service provider offers a secure and reliable postal address for our project, for example for the legal notice, privacy policy, withdrawal information and other areas where applicable.

This constitutes our legitimate interest within the meaning of Art. 6(1)(f) GDPR. We have concluded a data processing agreement with Impressum-Privatschutz and fully implement the strict requirements of the German data protection authorities when using this service.

Further information about data protection at Impressum-Privatschutz GmbH can be found here: https://impressum-privatschutz.de/datenschutzerklaerung/

7. Social media

Our online presence on Instagram (by Meta)

If you have given the respective social media operator your consent pursuant to Art. 6(1)(a) GDPR, when visiting our online presences on the social media named above, your data is automatically collected and stored for market research and advertising purposes, from which usage profiles are created using pseudonyms. These can be used, for example, to place advertisements within and outside the platforms that are presumed to correspond to your interests. Cookies are generally used for this purpose. Detailed information about processing and use of data by the respective social media operator, as well as contact options and your rights and settings for protecting your privacy, can be found in the providers' privacy notices linked below. If you still need assistance in this regard, you can contact us.

Instagram (by Meta) is a service of Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). Information automatically collected by Meta Platforms Ireland about your use of our Instagram online presence is generally transferred to and stored on a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. Data processing in connection with visiting an Instagram (by Meta) fan page takes place on the basis of an agreement between joint controllers pursuant to Art. 26 GDPR. Further information (information on Insights data) can be found here.

Our service providers are based and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection: USA, Canada, Japan, South Korea, New Zealand, United Kingdom, Argentina.

The adequacy decision for the USA applies as the basis for transfers to the United States insofar as the service provider is certified. Where service providers are certified under the EU-U.S. Data Privacy Framework, the data transfer is based on the European Commission's adequacy decision.

Our service providers are based and/or use servers in these countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Brazil, Mexico.
There is no adequacy decision by the European Commission for these countries. Our cooperation with them is based on the following safeguards: Standard Contractual Clauses of the European Commission.

8. Contact options and your rights

8.1 Your rights

As a data subject, you have the following rights:

  • pursuant to Art. 15 GDPR, the right to request information about your personal data processed by us to the extent specified there;
  • pursuant to Art. 16 GDPR, the right to request without undue delay the correction of inaccurate personal data or completion of incomplete personal data stored by us;
  • pursuant to Art. 17 GDPR, the right to request erasure of your personal data stored by us unless further processing is required for exercising the right of freedom of expression and information, compliance with a legal obligation, reasons of public interest, or establishment, exercise or defence of legal claims;
  • pursuant to Art. 18 GDPR, the right to request restriction of processing of your personal data where the accuracy of the data is contested by you, the processing is unlawful but you oppose erasure, we no longer need the data but you require it for establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Art. 21 GDPR;
  • pursuant to Art. 20 GDPR, the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format or to request transmission to another controller;
  • pursuant to Art. 77 GDPR, the right to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual residence or place of work or at our place of business.

Right to object

Where we process personal data as explained above to safeguard our legitimate interests, which prevail in the context of a balancing of interests, you may object to this processing with effect for the future. If processing is for direct marketing purposes, you may exercise this right at any time as described above. Where processing is for other purposes, you have a right to object only on grounds relating to your particular situation.

After you exercise your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or where the processing serves the establishment, exercise or defence of legal claims.

This does not apply where processing is for direct marketing purposes. In that case, we will no longer process your personal data for that purpose.

8.2 Contact options

If you have questions about the collection, processing or use of your personal data, require information, correction, restriction or erasure of data, wish to withdraw consent you have given, or object to a particular use of data, please contact us directly using the contact details in our legal notice.