Privacy Policy

Privacy Policy

The protection of your personal data is important to us. Below we inform you about which personal data we collect when you visit our online shop and use our offers, for what purposes and on what legal basis we process it, and what rights you have. The basis for this processing is the General Data Protection Regulation (GDPR) as well as the additionally applicable German and Dutch data protection law.

1. Responsible party

Responsible party within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is:

Fatbikeskopen.nl B.V., trading as “Gofatbike"
Vissenstraat 32
7324 AL Apeldoorn
Netherlands

Commercial register (Kamer van Koophandel, NL): 94972427
VAT ID No.: NL866955380B01
Authorized representative: G.T. van Dieren

Phone: +49 800 0010271
E-mail: support@gofatbike.de
Service hours: Mon–Fri 09:00–17:00

For any questions about data protection and exercising your rights, you can contact the above contact details at any time.

2. General information on data processing

We generally process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. The processing of personal data usually takes place only with the user's consent or if another legal basis permits the processing.

The legal basis particularly includes:

  • your consent (Art. 6 para. 1 lit. a GDPR);
  • the necessity to fulfill a contract or to carry out pre-contractual measures (Art. 6 para. 1 lit. b GDPR);
  • the necessity to fulfill a legal obligation (Art. 6 para. 1 lit. c GDPR);
  • the protection of our legitimate interests, unless your interests or fundamental rights override (Art. 6 para. 1 lit. f GDPR).

Personal data is deleted as soon as the purpose of storage no longer applies. Further storage takes place only if required by legal retention obligations (especially commercial and tax law). In this case, the data is blocked for further processing.

3. Collection of data when visiting the website (server log files)

Each time our website is accessed, the system automatically collects data and information from the accessing device. The following data is collected:

  • the IP address of the requesting device;
  • date and time of access;
  • the page or file accessed as well as the referrer URL;
  • the type of browser used and the browser version;
  • the user's operating system.

The temporary storage of this data is necessary to enable the delivery of the website to your device and to ensure the stability and security of our systems. The legal basis is our legitimate interest in a technically error-free and secure presentation of our offer (Art. 6 para. 1 lit. f GDPR). The log files are deleted after a short time unless they are needed to clarify or trace security incidents.

4. Cookies and Consent Management

Our website uses cookies. Cookies are small text files stored on your device. Technically necessary cookies, which are required for the operation of the website and the provision of its basic functions (e.g., shopping cart, session control, storage of your cookie selection), are used based on our legitimate interest (Art. 6 para. 1 lit. f GDPR); their storage is absolutely necessary to provide the service you explicitly requested (§ 25 para. 2 TDDDG).

Cookies and similar technologies that are not technically necessary – especially for analysis, reach measurement, and marketing purposes – are only used based on your explicit consent (Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG). You give your consent via our consent banner. You can revoke your consent at any time with effect for the future via the cookie settings without affecting the legality of the processing carried out until the revocation.

5. Shopify as Hosting Provider and Processor

Our online shop is operated on the platform of Shopify International Limited (Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify provides us with the technical infrastructure to operate the shop and processes personal data on our behalf (order processing according to Art. 28 GDPR). This includes in particular usage, access, and order data.

The legal basis is our legitimate interest in a secure and efficient provision of our online offer (Art. 6 para. 1 lit. f GDPR) as well as, insofar as the processing serves contract execution, Art. 6 para. 1 lit. b GDPR. Any possible transfer to third countries is described in section 13.

6. Order Processing and Customer Account

When you place an order in our shop, we process the data you provide (in particular name, delivery and billing address, email address, phone number, as well as order and payment data) to establish, execute, and handle the purchase contract. The legal basis is Art. 6 para. 1 lit. b GDPR.

If you create a customer account, we store the data saved there to enable you to manage your orders. To fulfill commercial and tax retention obligations (especially according to HGB and AO), we store contract- and billing-relevant data beyond the contract duration for the legally prescribed periods; the legal basis for this is Art. 6 para. 1 lit. c GDPR.

7. Payment Service Providers

For processing payments, we use external payment service providers depending on the payment method you choose. The processing of the payment data required for this is carried out to fulfill the contract (Art. 6 para. 1 lit. b GDPR). The payment data entered during the payment process (e.g., card data) is processed by the respective payment service provider; this provider is independently responsible for this processing.

The following payment methods are available with us:

  • Klarna (Invoice / Installment Payment) – Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. When selecting a Klarna payment method, a credit check may be performed. Further information can be found in Klarna’s privacy notices.
  • Credit and Debit Cards (Visa, Mastercard, American Express, Maestro).
  • Apple Pay – Apple Inc. or Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.
  • Google Pay – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Which data the respective payment service provider collects and how it processes it can be found in the privacy policies of the respective provider.

8. Shipping (DHL)

To deliver your order, we transmit your delivery address and – for the purpose of shipment tracking and shipping notification – your email address to the logistics company commissioned with the shipment. The shipment is carried out with DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany). The legal basis is the fulfillment of the purchase contract (Art. 6 para. 1 lit. b GDPR). We inform you about the status of your shipment by email.

9. Contact via Email and Phone

When you contact us by email or phone, we process the data you provide (especially your name, email address, and the content of your inquiry) to handle and respond to your request. The legal basis is our legitimate interest in responding to inquiries (Art. 6 para. 1 lit. f GDPR) or – if your inquiry is aimed at concluding or performing a contract – Art. 6 para. 1 lit. b GDPR. We delete the data collected in this context as soon as its storage is no longer necessary and no legal retention obligations prevent this.

10. Newsletter (Klaviyo)

For sending our newsletter, we use the service Klaviyo (Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA). When you sign up for our newsletter, we process your email address and, if applicable, other voluntarily provided data to send you information about products and offers.

The sending is based on your explicit consent (Art. 6 para. 1 lit. a GDPR in conjunction with § 7 para. 2 UWG) in a double opt-in procedure. You can revoke your consent at any time with effect for the future, for example via the unsubscribe link at the end of each newsletter email or by sending a message to support@gofatbike.de. The revocation does not affect the legality of the processing carried out up to that point. To provide the service, Klaviyo may transfer data to the USA (see section 13).

11. Customer Reviews (Judge.me)

To collect and display product and shop reviews, we use the service Judge.me (Judge.me Ltd.). When you submit a review after a purchase or are invited to do so, we process the necessary data (in particular your name or display name, your email address, the content of the review, and the reference to the purchased goods).

The invitation to review after a purchase is based on our legitimate interest in meaningful customer reviews or on your consent, if such is required (Art. 6 para. 1 lit. f or lit. a GDPR). The publication of the review is based on the consent you have given (Art. 6 para. 1 lit. a GDPR), which you can revoke at any time with effect for the future.

12. Web Analysis and Consent

To analyze and improve our online offerings, we use the following services exclusively with your consent. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG). The services are only loaded and activated after you have agreed via our consent banner. You can revoke your consent at any time with effect for the future via the cookie settings.

  • Google Analytics 4 – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Purpose: Measuring reach and analyzing user behavior to optimize our offerings. Data may be transferred to Google LLC in the USA in this context (see section 13).
  • Microsoft Clarity – Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Purpose: Analysis of the use of our website (including session recordings and heatmaps in pseudonymized form) to improve the operation and structure of the pages. Data may be transferred to the USA in this context (see section 13).

13. Transfer to Third Countries

Some of the services we use (including Shopify, Klaviyo, Google, Microsoft, as well as the providers of payment services) may transfer personal data to the USA or other third countries outside the European Economic Area. To the extent such a transfer takes place, it is based on appropriate safeguards within the meaning of Arts. 44 et seq. GDPR, in particular on the basis of the EU-US Data Privacy Framework, provided the respective provider is certified, and/or on the basis of standard contractual clauses of the European Commission (Art. 46 para. 2 lit. c GDPR). Further information is available via the contact details mentioned above.

14. Your rights as a data subject

If your personal data is processed, you as the data subject have the following rights against the controller:

  • Information about the personal data we process (Art. 15 GDPR);
  • Correction of incorrect or completion of your data (Art. 16 GDPR);
  • Deletion of your data stored with us, provided there are no legal retention obligations or other reasons to the contrary (Art. 17 GDPR);
  • Restriction of processing (Art. 18 GDPR);
  • Data portability (Art. 20 GDPR);
  • Objection to processing, insofar as it is based on Art. 6 para. 1 lit. f GDPR (Art. 21 GDPR);
  • Revocation of a given consent with effect for the future (Art. 7 para. 3 GDPR).

To exercise your rights, a simple message to the contact details listed in section 1 is sufficient, especially by email to support@gofatbike.de.

Note on the right to object: You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you that is based on Art. 6 para. 1 lit. f GDPR.

15. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR.

Since the controller is based in the Netherlands, the lead supervisory authority is the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens
P.O. Box 93374
2509 AJ The Hague
Netherlands
www.autoriteitpersoonsgegevens.nl

You are also free to contact the supervisory authority of your usual place of residence or workplace in Germany.

16. Currency and amendment of this privacy policy

This privacy policy is currently valid. Due to the further development of our website and our offers or due to changed legal or official requirements, it may be necessary to adjust this privacy policy. The version available on this page at any given time applies.