Privacy policy

Who is responsible

Muscle Supplements Ltd., company registration number 208649398, is the controller for the processing described here. Contact: support@musclesupplements.eu. Full details are at the bottom of this page.

What we process, and why

To deliver your order — name, email, phone number, delivery address and what you bought. Legal basis: performance of the contract, Article 6(1)(b) GDPR. Without these we cannot ship anything.

Your phone number is used by us and by the carrier to notify you about the delivery — a text message when the parcel is on its way, and a call if delivery fails. It is therefore passed on to the warehouse and the carrier; see the recipients below.

To keep accounts — the order as an accounting record. Legal basis: legal obligation, Article 6(1)(c). This is why order data survives a deletion request.

To answer you — your address and whatever you write, for as long as the case is open. Legal basis: legitimate interest, Article 6(1)(f).

We do not profile you, we do not sell data, and we run no advertising or analytics trackers on this site.

Cookies

Every cookie below is strictly necessary for the shop to work, which is why there is no consent banner: the ePrivacy exception applies. We set nothing else.

musclesupplements_cart

30 days · not readable by page scripts · carries supplierSku, quantity

musclesupplements_checkout

2 days · not readable by page scripts · carries email, phone, firstName, lastName, shippingLine1, shippingLine2, shippingPostalCode, shippingCity, shippingCountry, customerNote

musclesupplements_ombud

1 days · not readable by page scripts · carries parcelShopId, parcelShopName, parcelShopAddress, parcelShopPostalCode, parcelShopCity

musclesupplements_locale

365 days · carries language

musclesupplements_rabattkod

0.25 days · not readable by page scripts · carries discountCode, email

musclesupplements_market_hint

365 days · carries dismissed

musclesupplements_consent

180 days · carries granted eller denied

musclesupplements_admin

Session cookie · not readable by page scripts · carries adminSession

Who else sees the data

These are our processors. Each receives only what it needs to do its job.

Railway Corp.

EU (Amsterdam) · receives server logs, IP address, order data while it is being processed

Railway Postgres

EU (Amsterdam) · receives order data, contact details, delivery address

Resend, Inc.

USA (SCC + DPF) · receives email address, name, order number, order contents

Mollie

EU (Amsterdam) · receives amount, order number, name, email address, billing address

Our logistics partner

order handling, picking, packing and dispatch from the partner's warehouse at Mailstep a.s., Praha 9, Czechia · EU (Czechia) · receives name, delivery address, phone number, order contents

Transfers outside the EU are covered by the standard contractual clauses, and where noted by the EU–US Data Privacy Framework.

Payment

Card and account details never reach us. They go straight to Mollie, our payment service provider, which is the controller for that part. We see the amount, the order and whether the payment was approved.

How long we keep it

Order records: 10 years, because accounting law requires it. Support correspondence that is not an accounting record: 24 months. The checkout cookie's contents disappear on their own after 2 days.

Your rights

You have the right of access (Article 15), rectification (16), erasure (17), restriction (18), data portability (20) and to object (21). Email support@musclesupplements.eu and we answer within one month.

Erasure does not extend to what accounting law requires us to keep. We will say which data that is rather than refuse the whole request.

You may also complain to a supervisory authority. As the controller is established in Bulgaria, that is Commission for Personal Data Protection (КЗЛД), and you may equally turn to the authority in your own country of residence or place of work (Article 77).

Automated decision-making

We make no automated decisions producing legal effects concerning you. If you choose a payment method involving credit, the provider may make such an assessment — that processing is theirs, and their terms and privacy notice are shown before you confirm.