Privacy policy

Stolvations GmbH – www.gymmonky.de
As of: June 2026 | Version 1.0

This Privacy Policy applies to our online shop at www.gymmonky.de and to the processing of personal data of users in Germany and the European Union.

Language note: This Privacy Policy is an English translation of the German version. In the event of any discrepancy, ambiguity or contradiction between the language versions, the German version shall prevail.

1. Controller and EU Representative

Controller:
Stolvations GmbH
Rütistrasse 10
CH-8952 Schlieren
Switzerland
Email: support (at) gymmonky.com
VAT ID: DE453048206

EU Representative pursuant to Art. 27 GDPR:
As Stolvations GmbH is based in Switzerland and offers goods to persons in the EU (Art. 3(2) GDPR), we have designated a representative in the European Union in writing pursuant to Art. 27 GDPR. The EU representative may be contacted by data subjects and supervisory authorities on all matters relating to the processing of personal data. The designation of the EU representative does not affect the responsibility of Stolvations GmbH.

Elmar Scholz
Kurt-Schumacher-Strasse 22
64569 Nauheim
Germany
Email: support (at) gymmonky.com

2. Legal Bases for Data Processing

The processing of personal data of users in Germany and the EU is carried out on the basis of the General Data Protection Regulation (GDPR), the German Act on Data Protection and Privacy in Telecommunications and Telemedia (TDDDG), and, where applicable, the Federal Data Protection Act (BDSG). For electronic advertising, in particular newsletters and review requests by email, the provisions of the Act Against Unfair Competition (UWG), in particular § 7 UWG, additionally apply.

The relevant legal bases under the GDPR are:

Art. 6(1)(a) GDPR: Consent (e.g. for marketing cookies, newsletter, email tracking)
Art. 6(1)(b) GDPR: Performance of a contract (e.g. order processing, customer account, withdrawal)
Art. 6(1)(c) GDPR: Compliance with a legal obligation (e.g. retention obligations)
Art. 6(1)(f) GDPR: Pursuit of legitimate interests – the respective legitimate interest pursued is explicitly stated below for each processing activity.

Where cookies or similar technologies are stored on or read from your device, § 25 TDDDG additionally applies.

3. Data Collection When Visiting Our Website

3.1 Server Log Files

When you access our website, technical access data is processed by our shop and hosting provider (Shopify), in particular IP address, date and time of access, pages accessed, browser, operating system, referrer URL, and status codes. This data is required to technically provide the website, ensure system security, and analyse errors. It is not combined with other data sources.

Legal basis: Art. 6(1)(f) GDPR. Legitimate interest: technically error-free provision and security of the website.
Retention period: Where we have access to server log files ourselves, we generally store them for up to 7 days, and beyond that only to investigate security incidents. Processing by Shopify is additionally governed by their technical and organisational deletion concepts.

3.2 Consent Management (Consentmo)

We use Consentmo (Consentmo Ltd., Sofia, Bulgaria / EU) to manage cookie consents. Consentmo stores your consent decisions and anonymised log data (consent ID, timestamp) to provide evidence pursuant to Art. 7(1) GDPR. Consentmo loads on the first page visit and does not itself require consent, as it is technically necessary for compliance with our legal obligations.

Legal basis: Art. 6(1)(c) GDPR (legal obligation to document consent).
Consentmo privacy policy: consentmo.com/privacy-policy

3.3 Cookies

We use cookies and similar technologies in accordance with the GDPR and TDDDG. Where these are stored on or read from your device, this is only permissible under § 25(1) TDDDG with your consent, unless technically strictly necessary cookies are involved (§ 25(2) TDDDG).

Technically necessary cookies: Required for the operation of the shop (shopping basket, checkout, security). Legal basis: § 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR.
Analytics cookies: Only with your consent. Legal basis: § 25(1) TDDDG, Art. 6(1)(a) GDPR.
Marketing cookies: Only with your consent. Legal basis: § 25(1) TDDDG, Art. 6(1)(a) GDPR.

You can adjust or withdraw your cookie consents at any time via our cookie banner.

4. Orders, Customer Account, and Contract Processing

4.1 Order Data

To process your order, we collect: first and last name, delivery and billing address, email address, payment information, and order history. The provision of this data is required for the conclusion and performance of the purchase contract. Without this information, we cannot fulfil the contract.

Legal basis: Art. 6(1)(b) GDPR.
Retention period for order data: Generally 10 years due to statutory commercial and tax law retention obligations. For Stolvations GmbH, the Swiss retention obligations under Art. 958f CO (Swiss Code of Obligations) apply primarily. Where German tax law obligations apply, supplementary retention obligations under § 147 AO (German Fiscal Code) may also exist.

4.2 Customer Account

If you create or use a customer account, we process the data required for this purpose, in particular name, email address, addresses, order history, and account settings. This serves the provision and management of the customer account and easier order processing.

You can request the deletion of your customer account at any time by email to support (at) gymmonky.com. Statutory retention obligations for order, invoice, and payment data remain unaffected.

Legal basis: Art. 6(1)(b) GDPR.
Retention period: Until deletion of the customer account or after 3 years of inactivity, provided no statutory retention obligations exist.

4.3 Withdrawal Declarations

If you submit a withdrawal declaration, we process the information required for this purpose – in particular name, contact details, order number, order data, and content of the withdrawal declaration – to process the withdrawal, reverse the order, and fulfil our legal obligations (§§ 355 et seq. BGB, § 356a BGB).

Legal basis: Art. 6(1)(b) and (c) GDPR.
Retention period: 10 years.

4.4 Shop System (Shopify)

Our online shop is operated via Shopify International Ltd., 2nd Floor 1-2 Victoria Buildings, Haddington Road, Dublin 4, Ireland. Shopify processes personal data on our behalf to provide the shop system, hosting, checkout, and order management. Shopify may process customer and order data in the EEA, the United Kingdom, and via affiliated Shopify entities and sub-processors in other countries, in particular Canada and the USA. This is safeguarded by adequacy decisions of the EU Commission, Standard Contractual Clauses (Art. 46(2)(c) GDPR), and the Shopify Data Processing Addendum. We have concluded a data processing agreement with Shopify pursuant to Art. 28 GDPR.

Legal basis: Art. 6(1)(b) and (f) GDPR. Legitimate interest: operation of a technically reliable online shop.
Shopify privacy policy: shopify.com/legal/privacy

4.5 Dispatch (Fulfilment Service Provider)

For the delivery of our products, we transmit the data required for this purpose – in particular name, delivery address, and where applicable email address and telephone number – to our fulfilment service provider and to the parcel service provider used. The specific provider will be added to this Privacy Policy once the engagement has been finalised. The parcel service provider used may vary depending on the shipping method and will be displayed during the order process and in shipping communications.

Legal basis: Art. 6(1)(b) GDPR (performance of contract – delivery).

4.6 Payment Processing

Payment service providers process payment data partly as independent controllers depending on the payment method chosen. We generally do not receive full credit card or bank details, but only payment status, transaction data, and information required for order processing.

Credit card / Shop Pay / Apple Pay / Google Pay: Payment processing is handled via Shopify Payments. Supported methods include in particular Shop Pay, Visa, Mastercard, American Express, UnionPay, Apple Pay, and Google Pay. Shopify entities, Stripe entities, and further payment service providers and banking partners may be involved. These process payment data either as data processors or as independent controllers depending on their role. We do not receive complete card or bank details. Privacy policy Shopify Payments / Stripe: stripe.com/privacy
PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal acts as an independent controller for payment processing. For certain payment methods, PayPal may carry out a credit check. Privacy policy: paypal.com/privacy
Advance payment / bank transfer: If you pay by advance payment, you transfer the amount to our business account independently via your bank. We receive the information required for payment allocation (name, amount, payment reference, payment date). Payment processing is carried out by the account-holding payment or credit institution, which acts as an independent controller in this regard.

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

5. Newsletter and Marketing Communications (Klaviyo)

We use Klaviyo Inc., 125 Summer St, Floor 6, Boston, MA 02111, USA for the sending of newsletter, marketing, and automated e-commerce emails. Klaviyo is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Standard Contractual Clauses (Art. 46(2)(c) GDPR) additionally apply. We have concluded a data processing agreement with Klaviyo pursuant to Art. 28 GDPR.

Via Klaviyo we send in particular newsletters, marketing emails, abandoned cart reminders, product recommendations, order follow-up emails, reactivation emails, and other automated e-commerce communications. We also use Klaviyo for segmentation based on purchasing and usage behaviour and for analysing open and click rates.

We only send advertising emails where consent has been given or where the statutory requirements for existing customer advertising under § 7(3) UWG are met. Newsletter registration is carried out via a double opt-in procedure and is logged. You can withdraw your consent at any time via the unsubscribe link in our emails or by email to support (at) gymmonky.com. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal (Art. 7(3) GDPR).

Email tracking: Our emails may contain pixels that tell us whether and when an email was opened or a link was clicked. This only takes place on the basis of your consent.

Legal basis for newsletter and email marketing: Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG.
Legal basis for transactional emails (order confirmations, shipping notifications, withdrawal confirmations): Art. 6(1)(b) GDPR.
Retention period for newsletter data: Until unsubscription.
Klaviyo privacy policy: klaviyo.com/legal/privacy-policy

6. Product Reviews (Judge.me)

We use Judge.me (Judge.me Ltd, C/O Buckworths, 2nd Floor, 1-3 Worship Street, London EC2A 2AB, United Kingdom) for the management of customer reviews. Judge.me may send review requests by email on our behalf and display voluntarily submitted reviews on our website.

We only send review requests by email where express consent has been given or where the statutory requirements for existing customer advertising under § 7(3) UWG are met. This requires in particular that we obtained your email address in connection with the purchase of goods, that the request concerns our own similar goods, that you have not objected to the use, and that you are clearly informed of your right to object both when the address is collected and on each use.

You may object to the use of your email address for review requests at any time – by email to support (at) gymmonky.com or via the opt-out link in the review request – without incurring any costs other than transmission costs at basic rates.

The display of voluntarily submitted customer reviews on our website is carried out on the basis of our legitimate interest in the transparent presentation of customer experiences and quality assurance.

We have concluded a data processing agreement with Judge.me pursuant to Art. 28 GDPR.

Legal basis for review requests: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG (existing customer rule).
Legal basis for display of reviews: Art. 6(1)(f) GDPR. Legitimate interest: transparent presentation of customer experiences.
Judge.me privacy policy: judge.me/privacy

7. Contact

If you contact us by email or contact form, we process your details to handle your enquiry. The provision of your contact details is voluntary; however, without them we are unable to respond to your enquiry.

Legal basis: Art. 6(1)(b) GDPR for contract-related enquiries; Art. 6(1)(f) GDPR for other enquiries. Legitimate interest: processing of customer enquiries.
Retention period: 3 years.

8. Tracking and Advertising

The following tracking tools are only activated with your express consent via our cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Consent must be given before the services are loaded. You can withdraw your consent at any time via the cookie banner. Services not in use are not listed in this Privacy Policy.

8.1 Google Analytics 4

We use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to analyse user behaviour. IP anonymisation is activated. Google is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

Legal basis: § 25(1) TDDDG, Art. 6(1)(a) GDPR.
Retention period: 14 months.
Opt-out: tools.google.com/dlpage/gaoptout | Privacy policy: policies.google.com/privacy

8.2 Google Ads (Conversion Tracking)

We use Google Ads to place advertisements and measure conversions (Google Ireland Limited, Dublin). Google is certified under the EU-U.S. Data Privacy Framework.

Legal basis: § 25(1) TDDDG, Art. 6(1)(a) GDPR.
Privacy policy: policies.google.com/privacy

8.3 Meta Pixel (Facebook/Instagram)

We use the Meta Pixel (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland) for conversion tracking and retargeting. Meta is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR, adequacy decision C(2023) 4745). Standard Contractual Clauses (Art. 46(2)(c) GDPR) additionally apply.

Meta and we act as joint controllers for certain processing operations (Art. 26 GDPR). You may assert your data subject rights both against us and directly against Meta.

Legal basis: § 25(1) TDDDG, Art. 6(1)(a) GDPR.
Retention period: Up to 180 days.
Meta privacy policy: facebook.com/privacy/policy

8.4 TikTok Pixel

We use the TikTok Pixel (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland) for conversion tracking and retargeting. Data transfers to third countries are made on the basis of Standard Contractual Clauses (Art. 46(2)(c) GDPR).

TikTok and we act as joint controllers for certain processing operations (Art. 26 GDPR). Agreement: TikTok Joint Controller Terms. TikTok alone is responsible for the subsequent processing carried out by TikTok.

Legal basis: § 25(1) TDDDG, Art. 6(1)(a) GDPR.
Retention period: Up to 13 months from last use.
TikTok privacy policy: tiktok.com/legal/privacy-policy

9. Social Media Presences and User Generated Content

We maintain profiles on the following social networks. When you visit our profiles, the platform operators process your data in accordance with their own privacy policies, over which we have no influence.

Legal basis: Art. 6(1)(f) GDPR. Legitimate interest: presentation of our brand and communication with customers and interested parties.

Instagram / Facebook: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2. Privacy policy: facebook.com/privacy/policy
TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin. Privacy policy: tiktok.com/legal/privacy-policy
LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2. Privacy policy: linkedin.com/legal/privacy-policy

User Generated Content (UGC): Where we republish content from customers on our own channels or website, we obtain express consent in advance. In doing so, we process in particular the public username, the content of the post, and documentation of consent. Consent may be withdrawn at any time with effect for the future; content already published will in such cases be removed without delay.

Legal basis for UGC: Art. 6(1)(a) GDPR (consent).

10. #HangWithGYMMONKY Challenge

In the context of our #HangWithGYMMONKY Challenge, we process the following categories of data: public social media username, submitted content (videos), communication data (DM contact), and in the event of winning, name, contact details, and payment data for prize processing.

Legal basis: Art. 6(1)(b) GDPR (conducting the Challenge in accordance with the terms of participation) and Art. 6(1)(a) GDPR (consent to the use of the entry on our channels).

Retention period: We delete data of non-selected participants after the conclusion of the respective Challenge, provided no documentation is required for legal defence. Winner data and payment- and tax-relevant records are stored in accordance with statutory retention obligations.

Full terms of participation: Terms of Participation – HangWithGYMMONKY

11. Disclosure of Data and Third-Country Transfers

We only share your personal data in the following cases:

With delivery and fulfilment service providers (name, delivery address) for delivery – Art. 6(1)(b) GDPR
With payment service providers for payment processing – Art. 6(1)(b) GDPR
With technical service providers as data processors pursuant to Art. 28 GDPR
With authorities where required by law – Art. 6(1)(c) GDPR

We do not sell your personal data to third parties.

Processing in Switzerland: As Stolvations GmbH is based in Switzerland, personal data is also processed there. The European Commission has determined an adequate level of data protection for Switzerland by adequacy decision pursuant to Art. 45 GDPR. A transfer of personal data to Switzerland is therefore permissible without additional safeguards.

Further third-country transfers: Transfers to further third countries only take place where necessary for the provision of our services and where an adequate level of data protection is ensured, in particular through:

Adequacy decisions of the EU Commission (Art. 45 GDPR), e.g. for Canada and for US companies certified under the EU-U.S. Data Privacy Framework
Standard Contractual Clauses of the EU Commission (Art. 46(2)(c) GDPR)
Additional technical and organisational protective measures

Further information on the safeguards used is available upon request. Contact: support (at) gymmonky.com

12. Retention Periods and Deletion

Order, invoice, and payment data: 10 years (primarily Art. 958f CO, supplementarily § 147 AO where applicable)
Withdrawal declarations: 10 years
Customer account: Until deletion or after 3 years of inactivity
Newsletter data: Until unsubscription
Support enquiries: 3 years
Analytics and marketing cookies: In accordance with the respective service provider's information (generally 13–26 months)
Server log files: Up to 7 days

After the respective purpose has ceased and the retention periods have expired, data is deleted or anonymised.

13. Automated Decision-Making

We do not use automated decision-making processes including profiling within the meaning of Art. 22 GDPR that have legal or similarly significant effects on you.

14. Data Security

We take appropriate technical and organisational measures to protect your personal data pursuant to Art. 32 GDPR, in particular SSL/TLS encryption (identifiable by "https"), access controls, and regular security reviews.

15. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

Right of access (Art. 15 GDPR): Access to your processed data, purpose, categories, recipients, retention period, and origin.
Right to rectification (Art. 16 GDPR): Correction of inaccurate or completion of incomplete data.
Right to erasure (Art. 17 GDPR): Deletion of your data, provided no retention obligations apply.
Right to restriction of processing (Art. 18 GDPR): Restriction of the use of your data.
Right to data portability (Art. 20 GDPR): Transfer in a common, machine-readable format.
Right to object (Art. 21 GDPR): Objection to processing based on legitimate interests. An unconditional right to object applies in the case of direct marketing.
Right to withdraw consent (Art. 7(3) GDPR): At any time with effect for the future, without affecting the lawfulness of processing carried out prior to withdrawal.

We will respond to requests without undue delay and no later than one month (Art. 12(3) GDPR).
Contact: support (at) gymmonky.com

Data subject rights against Meta in the context of joint controllership may also be asserted directly against Meta.

16. Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement.

As our EU representative is based in Frankfurt am Main (Hesse), the competent authority is:

The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
Postfach 3163, 65021 Wiesbaden
datenschutz.hessen.de

Alternatively, you may contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI) or the supervisory authority in your federal state.

17. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy as necessary, in particular in the event of changes to the legal situation, new services, or expansions of our offering. The date of the most recent update and the version number are noted above. We recommend reviewing this Privacy Policy regularly.