Privacy

Unless otherwise specified below, the provision of your personal data is neither legally nor contractually required, nor necessary for the conclusion of a contract. You are not obliged to provide your data. Failure to provide it will have no consequences. This applies only as long as no other information is provided in the respective processing operations below.

"Personal data" means any information relating to an identified or identifiable natural person.

Server Log Files

You can visit our website without providing any personal information. Each time you access our website, usage data is transmitted by your internet browser to us or our web host / IT service provider and stored in log files (so-called server log files). This stored data includes, for example, the name of the accessed page, date and time of access, IP address, amount of data transferred, and the requesting provider.

Processing is carried out pursuant to Art. 6 para. 1 lit. f GDPR based on our overriding legitimate interest in ensuring the smooth operation of our website and improving our services.

Contact

Controller

Please contact us if you wish. The controller responsible for data processing is:
SUP Spirit Soul GmbH, Karl-Feldmann-Str. 20, 24536 Neumünster, Germany,
Phone: +49 4321 6026966, Email: mail@supspiritsoul.com

Initial Contact by Email

If you initiate business contact with us by email, we will collect your personal data (name, email address, message content) only to the extent you provide it. The data processing is carried out to handle and respond to your inquiry.

If the contact is made in order to carry out pre-contractual measures (e.g., consultation regarding a purchase, preparing an offer) or concerns an existing contract between you and us, this processing is based on Art. 6 para. 1 lit. b GDPR.

If the contact is made for other reasons, processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in processing and responding to your request. In this case, you have the right to object to this processing of your personal data at any time for reasons arising from your particular situation.

Your email address will be used only to process your request. Your data will be deleted in compliance with legal retention periods unless you have consented to further processing and use.

Data Collection and Processing When Using the Contact Form

When using the contact form, we collect your personal data (name, email address, message content) only to the extent you provide it. The processing of this data serves the purpose of contacting you.

If the contact is made in order to carry out pre-contractual measures or relates to an existing contract, the processing is based on Art. 6 para. 1 lit. b GDPR.

If the contact is made for other reasons, the processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in handling and responding to your request. In this case, you have the right to object to this processing at any time for reasons arising from your particular situation.

Your email address will be used only to process your request. Your data will then be deleted in accordance with statutory retention periods unless you have consented to further processing and use.

Customer Account & Orders

Customer Account

When opening a customer account, we collect your personal data to the extent provided by you. The data processing serves the purpose of improving your shopping experience and simplifying order processing. Processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You may revoke your consent at any time by notifying us, without affecting the lawfulness of processing carried out based on the consent before its withdrawal. Your customer account will then be deleted.

Collection, Processing and Disclosure of Personal Data for Orders

When placing an order, we collect and process your personal data only as far as it is necessary to fulfill and process your order and to handle your inquiries. The provision of data is necessary for the conclusion of the contract. Failure to provide it will result in no contract being concluded. Processing is based on Art. 6 para. 1 lit. b GDPR and is necessary for the fulfillment of a contract with you.

Your data may be passed on to shipping companies, dropshipping or fulfillment providers, payment service providers, service providers for order processing, and IT service providers. In all cases, we strictly observe the legal requirements. The scope of data transmission is limited to a minimum.

Reviews & Advertising

Review Reminder

After your order, we would like to ask you to review your purchase with us. For this purpose, we will use your personal data (name, email address, order information) independently of the contractual processing to send you a review reminder by email, provided you have expressly consented to this. Processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can withdraw your consent at any time by using the corresponding link in the email or by notifying us, without affecting the lawfulness of the processing carried out based on the consent before its withdrawal.

Use of Email Address for Sending Newsletters

We use your email address to send newsletters with information and offers, provided you have expressly consented to this. The data processing is carried out solely for promotional communication. For this purpose, we process your email address and any additional data you voluntarily provided when registering for the newsletter. The processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time without affecting the legality of the processing carried out up to the point of revocation. You can unsubscribe from the newsletter at any time via the link in the newsletter or by notifying us. Your email address will then be removed from the mailing list. Despite being removed, we may store your email address in a so-called blacklist to prevent future mailings. This storage is based on Art. 6 para. 1 lit. f GDPR based on our and your legitimate interest in preventing further newsletter mailings. You have the right to object to this processing at any time for reasons related to your particular situation.

Use of Email Address for Direct Advertising

We use the email address you provided during the purchase of goods or services to send electronic advertisements for similar goods or services of our own, unless you have objected to this use. The provision of the email address is necessary for the conclusion of the contract. Failure to provide it will result in no contract being concluded. Processing is based on Art. 6 para. 1 lit. f GDPR based on our overriding legitimate interest in direct marketing. You may object to this use of your email address at any time by notifying us. The contact details for exercising your objection can be found in the imprint. You may also use the link provided in the promotional email. No costs other than the transmission costs according to basic rates will be incurred.

Use of Brevo (formerly Sendinblue)

We use the newsletter service provided by Sendinblue GmbH (Köpenicker Straße 126, 10179 Berlin; "Brevo") as part of order processing. We pass on the information you provided during newsletter registration (email address, optionally first and last name) to Brevo. The data processing serves the purpose of sending newsletters and performing statistical analysis.

To evaluate newsletter campaigns, the sent email newsletters contain a 1x1 pixel graphic (tracking pixel) and/or a tracking link. This allows us to determine whether you opened the newsletter and whether you clicked on any embedded links. In this context, your personal data such as IP address, browser type and device, and time of opening may also be collected. Usage profiles may be created from this data under a pseudonym. The data is not used to personally identify you. The data is used solely for statistical evaluation to improve our newsletter campaigns.

The processing of your personal data is based on Art. 6 para. 1 lit. f GDPR from our overriding legitimate interest in a targeted, effective, and user-friendly newsletter system. You have the right to object to the processing of your personal data at any time for reasons relating to your particular situation.

Further information and Brevo's privacy policy can be found at: https://www.brevo.com/de/legal/privacypolicy/

Shipping & Inventory Management

Transfer of Email Address to Shipping Providers for Status Updates

We pass on your email address to the shipping company as part of contract processing, provided you have explicitly agreed to this during the ordering process. The purpose is to notify you by email about the shipping status. Processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us or the shipping company, without affecting the lawfulness of the processing carried out prior to the withdrawal.

Use of an External Inventory Management System

We use an inventory management system for contract processing as part of commissioned data processing. For this purpose, your personal data collected during the order will be transmitted to JTL-Software-GmbH, Rheinstr. 7, 41836 Hückelhoven. The processing of your personal data serves the purpose of fulfilling the contract concluded with you and is carried out based on Art. 6 para. 1 lit. b GDPR.

Payment Service Providers

Use of PayPal Express

We use the PayPal Express payment service on our website, provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg; "PayPal"). The data processing serves the purpose of offering you payment via PayPal Express. To integrate this payment service, PayPal must collect, store, and analyze data (e.g., IP address, device type, operating system, browser type, location of your device) when the website is accessed. Cookies may also be used. These cookies enable the recognition of your browser.

The processing of your personal data is based on Art. 6 para. 1 lit. f GDPR, stemming from our predominant legitimate interest in offering a customer-friendly range of various payment methods. You have the right to object to the processing of your personal data at any time for reasons arising from your particular situation.

By selecting and using PayPal Express, the data necessary for payment processing is transmitted to PayPal in order to fulfill the contract with you using your selected payment method. This processing is based on Art. 6 para. 1 lit. b GDPR. For more information on PayPal's data processing, please refer to the relevant privacy policy at www.paypal.com.

Use of PayPal Check-Out

We use the PayPal Check-Out payment service on our website, also provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg; "PayPal"). The data processing serves the purpose of offering you various payment options via PayPal Check-Out. When selecting and using PayPal, credit card via PayPal, direct debit via PayPal, or "Pay Later" via PayPal, the data required for payment processing is transmitted to PayPal to fulfill the contract using your chosen payment method. This processing is based on Art. 6 para. 1 lit. b GDPR.

Cookies may be stored to enable browser recognition. This data processing is based on Art. 6 para. 1 lit. f GDPR, reflecting our overriding legitimate interest in offering customer-oriented payment methods. You have the right to object to this processing of your personal data at any time for reasons relating to your particular situation.

Credit Card via PayPal, Direct Debit via PayPal & "Pay Later" via PayPal

For specific payment methods such as credit card via PayPal, direct debit via PayPal, or "Pay Later" via PayPal, PayPal reserves the right to carry out a credit check based on mathematical and statistical methods using credit agencies. To do so, PayPal transmits the personal data required for a credit check to an agency and uses the information obtained about the statistical probability of default to make a balanced decision about the initiation, implementation, or termination of the contractual relationship. The credit report may contain score values calculated using scientifically recognized mathematical-statistical methods, which include address data. Your data protection interests will be respected in accordance with legal requirements.

This data processing serves the purpose of assessing creditworthiness prior to a contract being concluded and is carried out based on Art. 6 para. 1 lit. f GDPR from our overriding legitimate interest in protection against payment default if PayPal is required to advance funds. You have the right to object to this processing at any time for reasons arising from your particular situation by notifying PayPal. Providing this data is necessary for the conclusion of a contract with your chosen payment method. Failure to provide the data means that the contract cannot be concluded using the chosen payment method.

Third-Party Providers

When using a third-party payment method, the data necessary for payment processing is transmitted to PayPal. This processing is based on Art. 6 para. 1 lit. b GDPR. For execution, the data may be further transferred by PayPal to the respective provider. This is also based on Art. 6 para. 1 lit. b GDPR. Local third-party providers may include:

Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)

Invoice Purchase via PayPal

When using the payment method "invoice purchase", the data required for payment processing is initially transmitted to PayPal. To complete the payment, PayPal then forwards the data to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; "Ratepay") to fulfill the contract using the selected payment method. This processing is based on Art. 6 para. 1 lit. b GDPR. Ratepay may conduct a credit check using mathematical-statistical procedures (probability or score values) and use credit agencies as described above. This data processing serves the purpose of assessing creditworthiness prior to contract conclusion and is based on Art. 6 para. 1 lit. f GDPR from our overriding legitimate interest in protecting against payment defaults when Ratepay is required to advance funds.

Further information on Ratepay's data protection and the credit agencies they use can be found at: https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/.

More details about PayPal’s data processing can be found in their full privacy policy at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Use of Mollie Payment Service

We use the payment service provider Mollie B.V. (Keizersgracht 313, 1016 EE Amsterdam, Netherlands; "Mollie") to process payments on our website. The data processing serves the purpose of offering you various payment methods via Mollie. If you choose one of Mollie’s payment options, the data necessary for payment processing will be transmitted to Mollie. This may include your payment information (e.g. bank account number or credit card number), IP address, browser and device type, as well as your name, address, and product/service information where applicable. This processing is based on Art. 6 para. 1 lit. b GDPR.

For more details about how Mollie processes data, please see their privacy policy at: https://www.mollie.com/de/privacy

Cookies

Our website uses cookies. Cookies are small text files that are stored on the user's computer system by the web browser or are transmitted by the browser. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a distinctive string that enables the browser to be uniquely identified when the website is visited again.

Cookies are stored on your computer. Therefore, you have full control over the use of cookies. By selecting appropriate technical settings in your web browser, you can be notified before cookies are set and decide on their acceptance on a case-by-case basis, prevent the storage of cookies and the transmission of the contained data. Cookies that have already been stored can be deleted at any time. However, we would like to point out that this may mean you cannot use all functions of this website to their full extent.

You can find information on how to manage (including disable) cookies in the most common browsers via the following links:

Technically Necessary Cookies

Unless otherwise stated in this privacy policy, we only use technically necessary cookies for the purpose of making our website more user-friendly, effective, and secure. Furthermore, cookies enable our systems to recognize your browser even after a page change and to offer you services. Some functions of our website cannot be provided without the use of cookies. These require that the browser be recognized again even after a page change.

The use of cookies or comparable technologies is based on Section 25 (2) of the German Telecommunications-Telemedia Data Protection Act (TDDDG). The processing of your personal data is based on Art. 6 para. 1 lit. f GDPR from our overriding legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our services. You have the right to object to this processing of your personal data at any time for reasons related to your specific situation.

Use of the EU Cookie Plugin

We use the EU Cookie Plugin from WebStollen GmbH (Prinz-Ludwig-Str. 15, 93055 Regensburg, Germany; "WebStollen") on our website.

This plugin enables you to give consent to data processing activities on the website, particularly the setting of cookies, and to exercise your right to withdraw consent already given. The data processing serves the purpose of obtaining necessary consents for data processing and documenting them to comply with legal obligations. Cookies are used for this purpose. The following information may be collected and stored: encrypted IP address, consent status, date and time of consent, expiration date of consent. This data is not passed on to third parties.

The data processing is carried out to comply with a legal obligation based on Art. 6 para. 1 lit. c GDPR.

For more information about data protection at WebStollen, visit: https://www.webstollen.de/Datenschutzerklaerung

Analytics

Use of Google Analytics 4

We use the web analytics service Google Analytics provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website. The data processing serves the purpose of analyzing this website and its visitors as well as for marketing and advertising purposes. Google will use the information obtained on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activities, and to provide further services related to the use of the website and the internet to the website operator. The following information may be collected: IP address, date and time of page access, click path, information about the browser you use and the device you use (device), pages visited, referrer URL (website through which you accessed our website), location data, and purchase activity. Your data may be linked by Google with other data such as your search history, personal accounts, usage data of other devices, and other data Google may have about you.

Your IP address is shortened by us on our own servers before being transmitted to Google. Thus, Google only receives pseudonymized data.

Google uses technologies such as cookies, browser storage, and tracking pixels that enable an analysis of your use of the website. The use of cookies or similar technologies is based on your consent pursuant to Section 25 (1) sentence 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR.

The processing of your personal data is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out based on the consent until the withdrawal.

We use the extended implementation of the consent mode (Advanced Consent Mode). In this context, user data is also transmitted to Google in the form of "pings" even without granted consent. These pings may contain the following information: IP address to determine the IP country (the IP address is not logged), date and time of the page view, URL of the visited pages, user agent, referrer URL (website through which our website was accessed), or information about the triggering of website events such as conversions. Google uses this data to model usage behavior and generate comprehensive usage analytics even without consent.

The information generated about your use of this website is generally transmitted to a Google server in the USA and stored there. An adequacy decision by the EU Commission exists for the USA via the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF and is therefore committed to complying with European data protection principles. Both Google and U.S. government authorities may have access to your data.

For more information on terms of use and data protection, please visit: https://policies.google.com/technologies/partner-sites and https://policies.google.com/privacy?hl=en&gl=en

Plugins and Miscellaneous

Use of Google reCAPTCHA

We use the reCAPTCHA service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website. This service is used to determine whether an input is made by a human or through automated, machine-based processing. Your input is transmitted to Google and further used there. Additionally, the IP address and any other data required by Google for the reCAPTCHA service may be transmitted to Google. This data is processed within the European Union and may also be transmitted to servers of Google LLC in the USA. An adequacy decision by the EU Commission is in place for the USA via the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF and therefore committed to complying with European data protection principles.

The use of cookies or similar technologies is based on your consent pursuant to Section 25 (1) sentence 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. The processing of your personal data is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out based on the consent until the withdrawal.

Further information about Google reCAPTCHA and the associated privacy policy can be found at: https://www.google.com/recaptcha/intro/android.html and https://www.google.com/privacy

Use of Google Invisible reCAPTCHA

We use the Invisible reCAPTCHA service by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website. This service is used to distinguish whether an input is made by a human or through automated, machine-based processing. In the background, Google collects and analyzes usage data which is used by Invisible reCAPTCHA to differentiate regular users from bots. Your input, IP address, and other data required by Google for Invisible reCAPTCHA are transmitted to Google.

This data is processed within the European Union and may also be transmitted to Google LLC servers in the USA. An adequacy decision by the EU Commission exists for the USA through the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF and therefore committed to complying with European data protection principles.

Further information about Google reCAPTCHA and the associated privacy policy can be found at: https://www.google.com/recaptcha/intro/android.html and https://www.google.com/privacy

Use of YouTube

We use the function to embed YouTube videos by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "YouTube") on our website. YouTube is affiliated with Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google").

The function displays videos stored on YouTube in an iFrame on the website. The "enhanced privacy mode" option is activated, which means that no data about website visitors is stored by YouTube unless they watch a video. When you play the video, this information is transmitted to YouTube and stored there. Your data may also be transmitted to the USA. An adequacy decision by the EU Commission is in place for the USA via the Trans-Atlantic Data Privacy Framework (TADPF). YouTube is certified under the TADPF and therefore committed to complying with European data protection principles.

More information on the collection and use of data by YouTube and Google, your rights, and privacy protection options can be found in YouTube's privacy policy at: https://www.youtube.com/t/privacy

Data Subject Rights and Storage Duration

Duration of Storage

After the contract has been fully executed, the data will initially be stored for the duration of the warranty period, then in accordance with statutory retention periods, particularly those relating to tax and commercial law, and will be deleted after the retention period has expired unless you have consented to further processing and use.

Rights of the Data Subject

If the legal requirements are met, you have the following rights under Articles 15 to 20 of the GDPR: the right to access, rectification, erasure, restriction of processing, and data portability.

Furthermore, under Article 21(1) of the GDPR, you have the right to object to the processing of personal data based on Article 6(1)(f) GDPR, as well as to the processing for the purpose of direct marketing.

Right to Lodge a Complaint with the Supervisory Authority

According to Article 77 of the GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data is not lawful.

You can file a complaint with the supervisory authority responsible for us, which you can contact at:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein
PO Box 71 16
24171 Kiel
Germany
Phone: +49 431 9881200
Fax: +49 431 9881223
Email: mail@datenschutzzentrum.de

Right to Object

If the processing of personal data listed here is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to this processing at any time with future effect for reasons arising from your particular situation.

After an objection has been made, the processing of the data concerned will be stopped unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

If personal data is processed for direct marketing purposes, you can object to this processing at any time by notifying us. After an objection, we will stop processing the data concerned for the purpose of direct marketing.

Last updated: April 20, 2025