Legal

Privacy policy

This English translation is provided for convenience. The German version is legally binding.

Last updated: September 2026

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

You can find further details in our legal notice (Impressum). For questions about data protection, you can reach us at any time at the email address above. No data protection officer has been appointed, as the legal requirements for doing so are not met.

2. Overview and legal bases

We process personal data only to the extent necessary to provide this website, process orders and communicate with you, or where you have given your consent. We do not sell personal data. Processing is based on the following legal bases:

• Art. 6(1)(a) GDPR and § 25 para. 1 TDDDG: your consent, for example for optional cookies for analytics and marketing.
• Art. 6(1)(b) GDPR: performance of a contract or pre-contractual measures, for example when you place an order.
• Art. 6(1)(c) GDPR: compliance with legal obligations, for example retention obligations under commercial and tax law.
• Art. 6(1)(f) GDPR: legitimate interests, for example the secure and stable operation of the website.
• § 25 para. 2 no. 2 TDDDG: storing information on, and accessing information from, your device, to the extent strictly necessary for the service you have requested, for example for the shopping cart.

We do not collect or store health data within the meaning of Art. 9 GDPR on this website. See also section 12 on the needs calculator.

3. Hosting and shop system (Shopify)

Our online shop is operated on the Shopify platform. The provider for merchants in the European Economic Area is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify provides us with the technical infrastructure for the website, shopping cart, checkout, customer accounts and order management, and in doing so processes personal data on our behalf. We have concluded a data processing agreement with Shopify pursuant to Art. 28 GDPR.

Shopify may also transfer data to Shopify Inc. in Canada and to subcontractors in the USA. For Canada, there is an adequacy decision of the EU Commission. Transfers to the USA take place on the basis of the EU-US Data Privacy Framework, insofar as the recipients are certified under it, and additionally on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

The legal basis is Art. 6(1)(b) GDPR insofar as the processing serves the performance of the contract, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable and cost-efficient operation of our online shop. You can find further information in Shopify's privacy policy.

4. Visiting the website and server logs

When you visit our website, Shopify automatically processes technical information transmitted by your browser. This includes your IP address, the date and time of access, the page accessed, the referrer URL, browser type and version, operating system and the amount of data transferred. This data is required to deliver the website, to ensure the stability and security of the system and to detect misuse. The legal basis is Art. 6(1)(f) GDPR. The data is not combined with other data sources and is deleted in accordance with Shopify's specifications as soon as it is no longer required for these purposes.

5. Cookies and consent

We use cookies and similar technologies (for example local storage). These are small data records stored in your browser. On your first visit, we ask for your consent via a cookie banner. There you can accept or reject all optional cookies, or select them individually by category. “Reject” is just as easy as “Accept”. Without your consent, we only set technically necessary cookies.

You can change or withdraw your choice at any time with effect for the future via the Cookie settings link in the footer of every page. Your decision is stored in the cookie _tracking_consent for up to 12 months.

Categories

Category	Purpose	Legal basis
Necessary	Shopping cart, checkout, security, language and currency settings, storage of your cookie choice. The shop does not work without these cookies.	§ 25 para. 2 no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR
Preferences	Storage of settings that make your visit easier.	Consent, § 25 para. 1 TDDDG, Art. 6(1)(a) GDPR
Statistics	Anonymised or pseudonymised analysis of the use of our shop via Shopify's statistics functions and via Google Analytics, in order to improve our offering (see “Google Analytics and Google tags” below).	Consent, § 25 para. 1 TDDDG, Art. 6(1)(a) GDPR
Marketing	Measurement and attribution of marketing activities by Shopify and via Google Ads conversion tracking and the Google tag of our Google Merchant Center (see “Google Analytics and Google tags” below).	Consent, § 25 para. 1 TDDDG, Art. 6(1)(a) GDPR

Key cookies at a glance

Name	Category	Purpose	Duration
_shopify_essential, cart, cart_currency, localization, keep_alive, secure_customer_sig	Necessary	Shopping cart, session, currency, language, security and customer login	Session up to 1 year
_tracking_consent	Necessary	Stores your cookie choice	1 year
_shop_app_essential, shopify_pay_redirect	Necessary	Shop Pay functions in the checkout, if you use them	Session up to 1 year
_shopify_y, _shopify_s, _shopify_analytics	Statistics	Shopify statistics on the use of the shop	30 minutes to 1 year
_shopify_marketing	Marketing	Measurement of marketing activities by Shopify	up to 1 year
_ga, _ga_<ID>	Statistics or marketing	Google Analytics and Google tag: distinguishing visitors and sessions	up to 2 years
_gcl_au	Marketing	Google Ads conversion tracking: attributing purchases to ad clicks	90 days

The exact names and durations may change due to technical changes at Shopify. Shopify publishes an up-to-date overview in its cookie policy.

Google Analytics and Google tags

If you consent in the cookie banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This allows us to analyse how our shop is used, for example pages visited, time spent, origin of the visit (such as a search engine or an ad), device, browser, approximate location and shop events such as product views, cart, checkout start and purchase with order value. It is integrated via Shopify's “Google & YouTube” app. The same app also integrates a Google tag for our Google Merchant Center and Google Ads conversion tracking. This enables us and Google to measure whether a visit came about through one of our ads or product listings on Google and whether it resulted, for example, in a purchase. We do not use personalised audiences (remarketing) based on your visit to our shop.

Google Analytics and the Google tag are only loaded after you have given your consent in the cookie banner. Without consent, no data is transmitted to Google and no Google cookies are set. The legal basis is your consent pursuant to § 25 para. 1 TDDDG and Art. 6(1)(a) GDPR. You can withdraw it at any time via the cookie settings in the footer.

Google Analytics 4 does not store complete IP addresses. We have limited the retention of analytics data to 14 months. We have concluded a data processing agreement with Google. It cannot be ruled out that data is transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; in addition, the EU Standard Contractual Clauses apply. You can find further information in Google's privacy policy.

6. Orders and contract processing

When you place an order with us, we process the data you provide in the checkout: first and last name, delivery and billing address, email address, telephone number if applicable, products ordered, payment method and order history. We use this data to conclude and perform the contract, to send you order and shipping confirmations, to process payment, to answer queries and to handle warranty and withdrawal cases. The legal basis is Art. 6(1)(b) GDPR. Invoice and accounting data is retained on the basis of Art. 6(1)(c) GDPR in conjunction with the provisions of commercial and tax law.

Mandatory fields are marked in the checkout. Without this information, we cannot process your order.

7. Customer account and Shop Pay

You can create a customer account to view your orders and avoid having to re-enter your details. In doing so, we process your email address, your name, your addresses and your order history. The legal basis is Art. 6(1)(b) GDPR. You can have your account deleted at any time by sending us an email. Statutory retention obligations remain unaffected.

In the checkout, you can optionally use Shop Pay, a Shopify service for storing payment and delivery details for faster ordering. If you use Shop Pay, your data is processed by Shopify. The legal basis is Art. 6(1)(b) GDPR. You can find further information in Shop's privacy policy.

8. Subscription

If you order GLYN as a monthly subscription, we use Shopify's subscription function (Shopify Subscriptions). In doing so, we process your order, delivery and payment data for the recurring deliveries and charges and for the management and cancellation of the subscription. The legal basis is Art. 6(1)(b) GDPR.

9. Payment service providers

To process payments, we pass on the necessary data to the payment service provider you select in the checkout. This is in particular your name, address, email address, invoice amount and order number. The payment service providers process some of this data under their own responsibility, for example for fraud prevention and for identity and credit checks. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR for fraud prevention. Depending on the payment method offered and selected, these are:

• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. PayPal's privacy policy.
• Shopify Payments (credit card and other payment methods), operated by Shopify in cooperation with Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe's privacy policy.
• Apple Pay or Google Pay, if offered and used by you, subject to the privacy policy of the respective provider.

For transfers to third countries, the payment service providers rely on the EU-US Data Privacy Framework or on the EU Standard Contractual Clauses.

10. Shipping

To deliver your order, we pass your name and delivery address on to the shipping company we have commissioned. The legal basis is Art. 6(1)(b) GDPR. We only pass your email address or telephone number on to the shipping company if you have expressly consented to this in the checkout, so that it can inform you about the delivery (Art. 6(1)(a) GDPR). You can withdraw this consent at any time by notifying us or the shipping company.

If you order delivery to a country outside the EU and the EEA, your name and delivery address must be transmitted to shipping and delivery companies and to authorities in the destination country for delivery and customs clearance. For some countries, for example Switzerland and the United Kingdom, there is an adequacy decision of the EU Commission. For all other countries, the transfer takes place because it is necessary for the performance of the contract with you (Art. 49(1)(b) GDPR). The level of data protection in these countries may be lower than in the EU.

11. Contact by email and cancellation form

If you contact us by email, we process your email address, your name and the content of your message in order to answer your request. The legal basis is Art. 6(1)(b) GDPR if your request is related to a contract, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in answering your request. Please do not send us any health data by email that is not necessary for your request.

If you cancel your subscription using the “Cancel contracts here” form, we process the data you provide there (name, email address, order or subscription number, type and effective date of the cancellation, and where applicable the reason and a message) in order to carry out the cancellation and confirm its receipt to you. The data is transmitted via Shopify's contact form function. The legal basis is Art. 6(1)(b) and (c) GDPR in conjunction with § 312k BGB.

12. Needs calculator

On the “Find your needs” page, you can enter information such as therapy phase, weight, age group, appetite and number of meals in order to receive general guideline values. The calculation takes place exclusively locally in your browser. Your entries are not transmitted to us or to third parties, are not stored and are not linked to you or to an order. They are lost once you close or reload the page.

13. Fonts, images and videos

The fonts used on this website are hosted locally on the servers of our shop system. No connection to servers of Google or other font providers is established when the pages are accessed. Images and videos are also delivered via Shopify's infrastructure. We do not embed external video platforms.

14. Links to social networks

On our website, we link to our profiles on social networks. These are simple links, not embedded plugins. Only when you click a link are you redirected to the page of the respective network. The privacy policy of the respective provider applies there.

15. Storage period

We store personal data only for as long as is necessary for the respective purpose or as long as statutory retention obligations exist. Contract data is blocked after complete processing and deleted once the statutory periods have expired. Commercial correspondence is retained for six years, accounting records and invoices for eight to ten years (§ 257 HGB, § 147 AO). Data based on consent is deleted after you withdraw your consent, unless another legal basis applies.

16. Your rights

You have the following rights against us with regard to personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an email to bobby@get-glyn.de is sufficient.

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

17. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR). You can contact the supervisory authority at your place of residence or the authority responsible for us:

18. Security and changes

For security reasons, this website uses SSL or TLS encryption. You can recognise an encrypted connection by “https://” and the lock icon in your browser's address bar. We take technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

We will update this privacy policy if our data processing or the legal situation changes. The version published here at any given time applies.