Data protection

1. Name and contact details of the data controller

The data controller for this website within the meaning of the GDPR is Health Bar GmbH, Max-Beer-Strasse 31, 10119 Berlin, Germany, Email: info@health-bar.com.

2. Collection and storage of personal data and the nature and purpose of its use

a. When visiting the website

When you simply browse our website for informational purposes, we only collect data that your browser transmits to the website server. When you access our website, your browser automatically sends information to our website's server. This information is temporarily stored in a server log file.

The following information is collected without your intervention and stored until it is automatically deleted:

IP address of the requesting computer
Date and time of access
Name and URL of the retrieved file
Website from which access is made (referrer URL)
browser used and, if applicable, the operating system of your computer, as well as the name of your access provider.

Purposes of processing:

Ensuring a smooth connection to the website
Ensuring a comfortable user experience on our website
Evaluation of system security and stability
Other administrative purposes

The processing is carried out in accordance with Article 6 paragraph 1 sentence 1 letter f GDPR. Our legitimate interest arises from the purposes mentioned above. Under no circumstances will we use the collected data to draw conclusions about your identity. However, we reserve the right to subsequently review the server log files should there be concrete indications of unlawful use.

b. When you subscribe to our newsletter

If you have expressly consented in accordance with Article 6 Paragraph 1 Sentence 1 Letter a of the GDPR, we will use your email address to send you our newsletter regularly. Providing an email address is sufficient to receive the newsletter. You can unsubscribe at any time, for example, via a link at the end of each newsletter. Alternatively, you can also send your unsubscribe request to [email address/contact information]. info@health-bar.com per Send an email.

Our email newsletter is sent via the provider Klaviyo, 225 Franklin St. Boston, MA 02110, USA.

Klaviyo also processes your data in the USA. The company is an active participant in the EU-US Data Privacy Framework, which regulates the secure and legally compliant transfer of personal data of EU citizens to the USA. Further information can be found at: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

In addition, Klaviyo uses so-called standard contractual clauses pursuant to Art. 46 para. 2, 3 GDPR.These standard contractual clauses, provided by the European Commission, ensure that your data complies with European standards even when transferred to third countries. The standard contractual clauses are based on a corresponding implementing decision of the European Commission, which you can view here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

Further information on Klaviyo's data processing terms can be found at: https://www.klaviyo.com/legal/privacy/privacy-notice?tid=331740143506.

c. Collection and processing when using the contact form

When you use the contact form, we collect your personal data (name, email address, message text) only to the extent that you provide it.

The data processing serves the purpose of establishing contact.

The data processing is based on Art. 6 para. 1 lit. b GDPR if the contact serves the purpose of carrying out pre-contractual measures (e.g. advice on purchase interest, preparation of offer) or relates to a contract already concluded between you and us.

Should you contact us for other reasons, this data processing is based on Article 6(1)(f) GDPR, due to our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object to the processing of your personal data on grounds relating to your particular situation. We will only use your email address to process your inquiry. Your data will then be deleted in accordance with statutory retention periods, unless you have consented to further processing and use.

d. Creation and use of customer account

When you open a customer account, we collect your personal data to the extent necessary to manage your orders and provide you with an optimized shopping experience. This data processing is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR.

You can withdraw your consent and have your customer account deleted at any time by sending us a message to the address above. After your customer account is deleted, your data will be removed unless there are legal retention obligations or legitimate interests on our part that preclude deletion.

We process your personal data to handle your orders. The processing is based on Article 6(1)(b) GDPR and is necessary for the performance of a contract with you. Without this information, we cannot process your order.

To process orders, we share your data with the commissioned shipping company, dropshipping provider, payment service provider, order processing service provider, and IT service provider. This data transfer always takes place within the framework of legal regulations and is limited to the necessary minimum.

3. Data transfer

a.General principles

Your personal data will only be transferred to third parties for the following purposes:

You have given your explicit consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.
The transfer of your data is necessary for the establishment, exercise or defense of legal claims pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR and there is no reason to assume that you have an overriding legitimate interest in not having your data transferred.
There is a legal obligation pursuant to Art. 6 para. 1 sentence 1 lit. c GDPR.
The transfer of data is necessary for the performance of a contract pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR.

b. Data transfer to third countries

As part of our business relationship, your personal data may be shared with or disclosed to third-party companies. These companies may also be located outside the European Economic Area (EEA), i.e., in third countries.

Such processing is carried out exclusively for the fulfillment of contractual and business obligations and for maintaining your business relationship with us. It is based on Art. 6 para. 1 lit. b or f, in conjunction with Art. 44 et seq. GDPR.

The European Commission has certified that some third countries have a level of data protection comparable to the EEA standard through so-called adequacy decisions. A list of these countries and copies of the adequacy decisions can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

In other third countries to which personal data may be transferred, a consistently high level of data protection may not exist. In such cases, we ensure that data protection is adequately guaranteed through appropriate safeguards. This can z.B. through binding company regulations, standard contractual clauses of the European Commission, certificates or recognized codes of conduct.

4. Payment processing

We work with external payment service providers to process payments. Depending on the payment method you select, your payment details will be transmitted to the relevant payment service provider. This processing is based on Article 6(1)(b) GDPR.

The following service providers were used:

Shopify International Limited

https://www.shopify.com/de/legal/datenschutz

PayPal (Europe) S.à r.l. et Cie, S.C.A. , Société en Commandite par Actions

https://www.paypal.com/de/legalhub/paypal/privacy-full

Klarna Bank AB (publ)

https://www.klarna.com/de/datenschutz/

Google Ireland Limited

https://policies.google.com/privacy

Apple Inc.

https://www.apple.com/de/legal/privacy/

Your payment details will be used exclusively for processing the transaction and not for any other purpose. Detailed information on data processing by the payment service providers can be found in their privacy policies.

5. Cookies

The website will inform you on your first visit from one of your devices that cookies may be loaded onto your computer when you use the website. We will request your consent to the use of cookies via a cookie consent banner.

Cookies and Flash cookies are alphanumeric identifiers that are transferred to your computer's hard drive when you visit our website. They allow us to recognize your browser on subsequent visits and primarily serve to make your online experience more convenient and personalized. Cookies enable us to recognize you as a specific user and save your preferences when using the website. This has the advantage for you that you don't have to re-enter the information contained in the cookies every time you visit the website.

You can completely disable the use of cookies at any time in your browser settings. The help function in your web browser's menu bar explains how to configure your browser to never accept new cookies. Similar functions, such as Flash cookies used by browser add-ons, can be disabled or deleted by changing the add-on's settings or via the add-on developer's website.

Session cookies also require your prior consent, even though they are deleted after you leave the website. These cookies enable you to use essential functions of our website, so we recommend that you configure your browser to not automatically reject cookies, but rather allow you to decide on a case-by-case basis. Please note that some areas of the website may not function correctly if your browser is set to reject cookies or similar mechanisms outright, or if you do not consent via the cookie consent form.

6. Analysis Tools

a. Web tracking with Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This tool is used to analyze user interactions on our website and in our apps. The resulting statistics and reports help us optimize our services and make them more appealing to you as a user.

To track interactions between you and our website, we primarily use cookies, device data, browser information, IP addresses, and information about website or app activity. Google Analytics also collects your IP address to ensure the security of the service and to determine the user's location (country, region, city).However, to protect your privacy, we use the anonymization function ("IP masking"), which shortens IP addresses within the EU/EEA by removing the last octet.

In this context, Google acts as a data processor, and we have concluded a corresponding agreement with Google. The information generated by cookies, as well as the (anonymized) IP addresses, are generally transferred to and processed on Google servers in the USA. Google states that it adheres to standards equivalent to those of the former EU-US Privacy Shield and is committed to complying with applicable data protection laws during international data transfers. In addition, we have agreed to standard contractual clauses with Google to ensure an adequate level of data protection in third countries. The legal basis for the data collection and processing, which lasts a maximum of 14 months, is your explicit consent (Art. 6 para. 1 sentence 1 lit. a GDPR). You can withdraw your consent at any time without affecting the lawfulness of the processing carried out before the withdrawal. In mobile apps, you can reset the advertising ID via the settings of your Android or iOS device. The easiest way to withdraw your consent is via our Consent Manager or by installing the Google browser add-on, which is available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

Detailed information about the functions and terms of Google Analytics can be found at https://marketingplatform.google.com/about/analytics/terms/de/ . Google provides information on data processing by Google in connection with the use of Google Analytics here: https://support.google.com/analytics/answer/6004245?hl=de. Google's general privacy policy, which also applies to Google Analytics, can be found at: https://policies.google.com/privacy?hl=de&gl=de.

b. Shopify Analytics

This website uses Shopify Analytics, a web analytics service provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). This tool helps us analyze user interactions on our website and in our apps. The resulting statistics and reports allow us to optimize our offerings and make them more appealing to you as a user.

Shopify acts as a data processor in this context, and we have a corresponding agreement with Shopify. The information generated by cookies and IP addresses are generally transferred to and processed on Shopify's servers. Shopify's servers are located in several regions, including Europe, Canada, the USA, and Singapore. Shopify uses the Google Cloud Platform to ensure a reliable and scalable infrastructure. By default, new merchants in Europe have their store data, order data, and customer data stored in Europe.The basis for data collection and processing, which lasts a maximum of 14 months, is your explicit consent (Art. 6 para. 1 sentence 1 lit. a GDPR). You can withdraw your consent at any time without affecting the lawfulness of the processing carried out before the withdrawal. In mobile apps, you can reset the advertising ID via your Android or iOS device settings. The easiest way to withdraw your consent is via our Consent Manager.

Detailed information about the features and terms of Shopify Analytics can be found at https://help.shopify.com/de/manual/reports-and-analytics/shopify-reports/overview-dashboard#customers. Google provides information on data processing by Google in connection with the use of Google Analytics here: https://www.shopify.com/de/legal/datenschutz.

c. Rakuten Advertising

This website uses services provided by Rakuten Advertising, an online advertising company of Rakuten Marketing LLC, 215 Park Avenue South, 11th Floor, New York, NY 10003, USA ("Rakuten"). Rakuten offers services such as affiliate marketing, performance marketing, personalized advertising, and measurement and reporting. The use of these services serves to measure the effectiveness of our advertising efforts and to optimize our offerings for you.

Rakuten collects various categories of personal data, including:

Online identifiers: These include information such as your IP address, unique device identifiers (e.g. B. Advertising IDs such as IDFA for iOS and AAID for Android), browser type and language, operating system, connection type (e.g. B. wired or Wi-Fi), region, general geographic location and, if applicable, your mobile network provider.
Commercial information: Information about products and services that you have viewed, purchased, or considered on the websites, applications, or media platforms of our business partners.
Internet activity: Data about your behavior on the websites, applications, or media platforms of our business partners and other third parties that interact with Rakuten's services. This includes information about the websites you visit, access times, the website you came from before clicking on an ad, the website you visit after clicking on an ad, interaction data with ads, and your geographic location (latitude and longitude).

Rakuten uses this information to provide personalized advertising, measure the effectiveness of advertising campaigns, and generate reports for us as advertisers. This data processing is based on your explicit consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. You can withdraw your consent at any time via our consent manager without affecting the lawfulness of the processing carried out up to that point.

For more information about Rakuten Advertising's privacy practices, please see their privacy policy: https://go.rakutenadvertising.com/hubfs/Services-Privacy-Policy-English.pdf. Information about your data protection rights and options to deactivate data collection by Rakuten can be found at: https://rakutenadvertising.com/legal-notices/services-privacy-rights-request/

7. Use of social media plug-ins

We currently use the following social media plugins: Meta (Facebook and Instagram) https://apps.shopify.com/facebook?locale=de as well as Pinterest https://apps.shopify.com/pinterest?locale=de, These are only loaded if you have previously activated the function with your consent. Product information is transmitted to the providers via the plug-ins, who then use it to create personalized ads. In addition, cookies are set by the providers when you connect from Facebook, Instagram, or other platforms. or Pinterest may be used to track visits to the website. The legal basis for the use of these plugins is Article 6(1)(a) GDPR, meaning that integration only occurs with your consent.

(2) The plug-in provider stores the data collected about you as user profiles and uses them for advertising, market research, and/or to tailor its website to user needs. This analysis is carried out in particular (even for users who are not logged in) to display targeted advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, and to exercise this right, you must contact the respective plug-in provider. Data is transferred regardless of whether you have an account with the plug-in provider and are logged in. If you are logged in to the plug-in provider, the data we collect from you will be directly associated with your existing account with the plug-in provider. If you click the activated button and, for example, share the page, the plug-in provider will also store this information in your user account and share it publicly with your contacts. We recommend that you regularly log out of social networks after using them, and especially before activating the button, as this will prevent the plug-in provider from associating your activity with your profile.

The collected information is stored on the providers' servers, and in the case of international providers, also outside of Europe. According to the providers themselves, they have committed to a standard equivalent to the former EU-US Privacy Shield and have pledged to comply with applicable data protection laws during international data transfers. We have also agreed upon so-called standard contractual clauses with the providers, the purpose of which is to ensure an adequate level of data protection in the third country.

You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. The easiest way to withdraw your consent is via our consent manager or through the functions of the social media providers.

Further information on the purpose and scope of data collection and processing by the plug-in provider can be found in the privacy policies of these providers, which are linked below. There you will also find further information on your rights and settings options to protect your privacy.Addresses of the respective plug-in providers and URLs of the respective privacy policies:

Meta Platforms Technologies Ireland Limited, Merrion Road, Dublin 4 D04 X2K5, Ireland: https://www.facebook.com/privacy/policy

Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland: https://policy.pinterest.com/de/privacy-policy

8. Rights of the data subject

Under the GDPR, you, as a data subject, have rights regarding your processed personal data. You can assert these rights at any time by contacting us using the contact details provided above. As a data subject, you have the following rights:

In accordance with Article 15 of the GDPR, you have the right to request information about your personal data processed by us. In particular, you can request information about the purposes of the processing, the categories of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if they were not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved.
In accordance with Article 16 GDPR, you have the right to request the immediate rectification of inaccurate or incomplete personal data concerning you that we hold;
In accordance with Article 17 GDPR, you have the right to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims;
In accordance with Article 18 GDPR, you have the right to request the restriction of the processing of your personal data if you contest the accuracy of the data, the processing is unlawful but you oppose its erasure, we no longer need the data but you require it for the establishment, exercise or defense of legal claims, or you have objected to processing pursuant to Article 21 GDPR;
In accordance with Article 20 GDPR, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller;
In accordance with Article 7(3) of the GDPR, you have the right to withdraw your consent at any time. This means that we will no longer be permitted to process your data based on this consent in the future.
According to Article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority. Generally, you can contact the supervisory authority of your habitual residence, your place of work, or the location of our company headquarters.

9. Right to object

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right to object pursuant to Art.Article 21 of the GDPR grants you the right to object to the processing of your personal data, provided there are grounds relating to your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without requiring you to specify a particular situation.

If you wish to exercise your right of withdrawal or objection, simply send an email to info@health-bar.com.

10. Data security

To protect your data, we use the widely used SSL (Secure Socket Layer) protocol in conjunction with the highest level of encryption supported by your browser during your visit to our website. You can recognize an encrypted connection by the closed padlock symbol in your browser's address bar or footer.

We also employ appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

11. Duration of data processing

The storage period of your personal data depends on the respective legal basis, the purpose of the processing and, if applicable, the applicable statutory retention periods.

Data processed based on your consent pursuant to Art. 6 para. 1 lit. a GDPR will be stored until you withdraw your consent. If data is processed for the performance of a contract or for taking steps prior to entering into a contract pursuant to Art. 6 para. 1 lit. b GDPR, it will be stored for as long as it is necessary for these purposes. After the expiry of statutory retention periods, we routinely delete the data, unless legitimate interests justify longer storage. If we process data based on legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR, we will store it until you exercise your right to object pursuant to Art. 21 para. 1 GDPR. However, if there are compelling legitimate grounds for the processing, or if it is necessary for the establishment, exercise, or defense of legal claims, the data will be stored. Data used for direct marketing purposes will be stored until you object to the processing pursuant to Art. 21 para. 2 GDPR.

Unless other specific time limits are stated, we delete personal data as soon as it is no longer required for the purposes for which it was collected or processed.

12. Updates and changes to this privacy policy

This privacy policy is currently valid and was last updated in February 2025. It may be amended due to the further development of our website or changes in legal requirements. It may become necessary to amend this privacy policy. You can view, access, and print the current privacy policy at any time on this website.