Privacybeleid

We take the protection of your personal data seriously. This policy explains what data we process when you visit vitalyris.com or place an order, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

Linkerbaan LLC, 304 S. Jones Blvd, 89107 Las Vegas, USA, email: info@vitalyris.com.

2. Data we process and why

Website visit: IP address, date/time, pages visited, browser and device data (server logs) – to deliver the site securely (Art. 6(1)(f) GDPR). Logs are deleted after 30 days.

Orders: name, address, email, phone, order details and payment status – to fulfil the contract (Art. 6(1)(b) GDPR) and meet statutory retention obligations (Art. 6(1)(c) GDPR, 10 years for accounting records). Payment data is processed by the payment provider; we do not store full card numbers.

Shipping: name, address, email/phone are passed to the carrier for delivery and tracking (Art. 6(1)(b) GDPR).

Customer account and support: data you provide when registering or contacting us (Art. 6(1)(b) and (f) GDPR).

Newsletter: email address, with your consent (Art. 6(1)(a) GDPR), via double opt-in. Unsubscribe anytime via the link in every email.

3. Processors and third parties

We use the following service providers, some of which may process data outside the EU under EU Standard Contractual Clauses or an adequacy decision:

Shopify International Ltd. (Ireland) – shop platform, hosting, order management. Shopify privacy policy
Funnelish – order pages and checkout flow
Payment providers (Shopify Payments/Stripe, PayPal, Klarna) – payment processing and fraud prevention
Klaviyo Inc. – email marketing (consent-based)
Shipping carriers – delivery

4. Cookies, analytics and advertising

We use technically necessary cookies to operate the shop (cart, session, security) based on Art. 6(1)(f) GDPR and § 25(2) TDDDG. Analytics and marketing cookies/pixels (e.g. Meta Pixel, Google Analytics, TikTok Pixel) are set only with your consent via our cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw consent at any time in the cookie settings. Meta Platforms Ireland Ltd. and Google Ireland Ltd. may process data in the USA under the EU-US Data Privacy Framework.

5. Retention

We keep personal data only as long as necessary for the purposes above or as required by law (commercial and tax retention periods of 6–10 years).

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR), and to withdraw consent at any time with effect for the future. You may lodge a complaint with a supervisory authority, e.g. the data protection authority of your federal state in Germany.

7. Security

Data is transmitted via SSL/TLS encryption. We apply technical and organisational measures to protect your data against loss, misuse and unauthorised access.