Privacy Policy
Introduction
swapandfit is a brand operated by [XXX Company Legal Name], a company registered in Germany. This Privacy Policy explains how we collect, use, store and process personal data when you visit our website, place an order or contact us.
We process personal data in accordance with the General Data Protection Regulation (GDPR), applicable German data protection legislation and other relevant legal requirements.
Data Controller
The data controller responsible for processing personal data is:
Company Name: [XXX Company Legal Name]
Registered Address: [XXX Registered Address, Germany]
Company Registration Number: [XXX Registration Number]
Email: promo@swapandfit.com
Telephone: [XXX Telephone Number]
Website: www.swapandfit.com
For enquiries concerning personal data, please contact us using the details above.
Personal Data We Collect
Depending on how you use our website, we may collect the following information.
Contact Information
Your name, email address, telephone number, billing address and delivery address.
Order Information
Products purchased, order reference, purchase date, order status, delivery details, refund records and related correspondence.
Payment Information
Payment status, transaction references and payment-related information required to administer your order. Payment card details are generally handled by Stripe rather than stored directly in our order records, depending on the payment method and processing arrangements.
Customer Service Information
Information you provide when contacting us about products, orders or other enquiries.
Website Information
Where applicable, technical records such as IP address, browser type, device information, access timestamps and server logs.
Purposes and Legal Bases for Processing
We process personal data for the following purposes and on the applicable legal bases under Article 6 GDPR.
Order Administration
We use contact, order and delivery information to process purchases, administer orders and respond to order-related enquiries. The legal basis is Article 6(1)(b) GDPR where processing is necessary for a contract or pre-contractual steps.
Payment Processing
We process relevant information to facilitate payments, confirm transaction status and administer refunds. The legal bases are Article 6(1)(b) GDPR where necessary for contract performance and Article 6(1)(c) GDPR where processing is required by law.
Customer Service
We use information supplied in enquiries to respond to requests and manage communications. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries or Article 6(1)(f) GDPR where we have a legitimate interest in responding to general enquiries.
Accounting and Legal Obligations
We process and retain relevant business records to comply with applicable accounting, tax and other statutory requirements. The legal basis is Article 6(1)(c) GDPR.
Website Operation
Where necessary, we process relevant technical records to operate the website, investigate faults, manage irregular activity and protect our legitimate business interests. The legal basis is Article 6(1)(f) GDPR, subject to the applicable balancing of interests.
Optional Communications and Website Preferences
Where applicable, we process personal data for optional communications, analytics or similar purposes on an appropriate legal basis. Where consent is required, it will be requested before processing begins.
Payment Processing by Stripe
We use Stripe to process payments for purchases made through www.swapandfit.com.
Stripe processes personal data as necessary to facilitate payment transactions, confirm payment status, administer refunds and handle payment-related matters.
Depending on the payment method and transaction, information processed may include your name, email address, billing details, transaction amount, currency, payment status, payment method details, IP address and transaction references.
Stripe may process personal data as an independent controller for certain purposes. For other processing activities, its role depends on the applicable service and contractual arrangements.
We receive the transaction information required to administer orders and maintain relevant business records. Full payment card details are generally handled by Stripe and are not intentionally stored in our own order records where Stripe processes those details directly.
Disclosure of Personal Data
We may disclose personal data where necessary and legally permitted to:
- Stripe, for payment processing and related transaction administration.
- Service providers supporting website hosting, website operation, communications and order administration.
- Delivery and fulfilment providers, where relevant to fulfilling customer orders.
- Professional advisers, including accounting and legal advisers.
- Public authorities where disclosure is required by applicable law.
We disclose information relevant to the purpose concerned and in accordance with applicable legal requirements.
International Data Transfers
Our company is based in Germany and serves customers in Europe. Certain service providers may process personal data outside the European Economic Area (EEA).
Where personal data is transferred outside the EEA, the requirements of Chapter V GDPR apply. Depending on the circumstances, the transfer may rely on an applicable adequacy decision, appropriate safeguards or another lawful transfer mechanism.
Further information about relevant transfer arrangements may be requested by contacting us.
Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, taking account of statutory retention requirements, contractual obligations and the establishment, exercise or defence of legal claims.
Customer Enquiries
General enquiries and customer service correspondence are normally retained for up to 12 months after the enquiry has been resolved, unless a longer period is necessary to handle an ongoing matter or legal claim.
Customer Accounts
Where customer accounts are available, account information is retained while the account remains active. Following account closure or a valid deletion request, information is deleted or anonymised where appropriate, unless continued retention is required or permitted by law.
Order and Contract Records
Order details, invoices and related business documents are retained for the applicable statutory periods. Under German law, certain accounting records are generally subject to an eight-year retention period, while other business records may be subject to six-year or different periods depending on their classification and the applicable legislation.
Tax and Accounting Records
Records subject to German statutory retention requirements are retained for the relevant period under applicable German tax and commercial legislation. The period depends on the type of document and the applicable statutory provisions.
Payment Records
Payment status, transaction references, refund records and related information are retained for as long as necessary to administer transactions and comply with applicable statutory requirements. Records forming part of accounting or tax documentation are retained for the relevant statutory period.
Website Technical Records
Server logs and related technical records are retained for the period necessary for website operation, fault investigation and the protection of legitimate interests. The applicable period depends on the nature and purpose of each record.
Consent Records
Records of consent and withdrawal are retained for as long as necessary to demonstrate compliance with applicable legal obligations and address potential legal claims.
When the applicable retention period expires, personal data will be deleted or anonymised unless another lawful basis requires or permits further retention. Where immediate deletion is not possible, access will be restricted where appropriate.
Your Data Protection Rights
Subject to the conditions and limitations under the GDPR, you may have the right to:
- Request access to personal data concerning you.
- Request correction of inaccurate or incomplete personal data.
- Request erasure where the applicable legal requirements are met.
- Request restriction of processing in the circumstances provided by law.
- Request data portability where the relevant legal requirements are met.
- Object to processing based on legitimate interests on grounds relating to your particular situation.
- Withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise these rights, contact promo@swapandfit.com. We may request information reasonably necessary to verify your identity before responding.
You may also lodge a complaint with a competent data protection supervisory authority in accordance with the GDPR.
Cookies and Similar Technologies
Our website may use cookies and similar technologies necessary for website functions, order processing and the retention of relevant preferences.
Where analytics, advertising or other non-essential technologies require consent under applicable law, they will be used subject to the required consent arrangements.
Information about the cookies used, their purposes and retention periods should be provided in the website’s applicable cookie information and preference settings.
Data Security
We apply organisational and technical measures appropriate to the nature of the personal data processed and the risks associated with processing. Access to personal data is limited according to relevant business requirements, and service providers are engaged under applicable contractual arrangements.
Third-Party Websites
Our website may contain links to external websites or services. Those websites operate under their own privacy practices. We recommend reviewing their privacy information before providing personal data to them.
Changes to This Privacy Policy
We may revise this Privacy Policy when our processing activities or applicable legal requirements change. The version published on this page describes our current approach to personal data processing.
Contact
For questions about this Privacy Policy or the processing of personal data, please contact:
[XXX Company Legal Name]
Registered Address: [XXX Registered Address, Germany]
Company Registration Number: [XXX Registration Number]
Email: promo@swapandfit.com
Telephone: [XXX Telephone Number]
Website: www.swapandfit.com