Privacy Policy

Last updated: June 2026

This privacy policy provides an overview of how we process your personal data when you visit our website, place an order, or contact us. Personal data refers to any information that relates to an identified or identifiable natural person. As a German company, we are subject to the EU General Data Protection Regulation (GDPR), which applies to all visitors to our website regardless of their country of origin.

1. Controller

2. Hosting and Shop System (Shopify)

Our website and online shop are operated via the e-commerce platform Shopify, provided by Shopify International Ltd., Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland.

Shopify processes personal data on our behalf as a data processor (Art. 28 GDPR) — including order data, customer data, and technical access data. Transfers to third countries (including Canada and the USA) are based on the EU Standard Contractual Clauses and the EU–U.S. Data Privacy Framework (DPF).

Further information: https://www.shopify.com/legal/privacy

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in secure and functional shop operation).

3. Server Log Files

When you visit our website, your browser automatically transmits information that is stored in server log files. This includes:

• Page visited / URL
• Date and time of access
• Data volume transferred
• Browser type and version
• IP address
• Requesting internet provider

This data is not combined with other data sources and is deleted after a maximum of 30 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the stable and secure operation of the website).

4. Contacting Us

When you contact us by email or via a contact form, we collect your details (name, email address, message) solely to process your inquiry. Data is deleted once your inquiry has been fully processed, unless a legal retention obligation applies.

Legal bases:

• Art. 6(1)(b) GDPR – for contract-related inquiries
• Art. 6(1)(f) GDPR – for general inquiries (legitimate interest in responding)

You have the right to object to this processing at any time on grounds relating to your particular situation.

5. Customer Account and Orders

Customer Account

When you create a customer account, we process your data to simplify order handling and give you access to a personalised account area.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures and contract performance).

Orders

To process your order we use the data you provide (name, address, email, payment details, order contents). This data is only passed on to shipping providers, payment providers, and IT service providers to the extent necessary.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

6. EU Withdrawal Button (Right of Withdrawal Form)

We use the Shopify app EU-Widerrufsbutton (EU Withdrawal Button) by 401layers UG (haftungsbeschränkt), Dorothea-Erxleben-Straße 1a, 40721 Hilden, Germany. This app allows you to exercise your statutory right of withdrawal conveniently via a digital button and to submit the associated withdrawal form.

In doing so, 401layers UG processes the following personal data on our behalf as a data processor (Art. 28 GDPR):

• Master data (first name, last name, customer ID)
• Contact data (email address, delivery and billing address)
• Order data (order number, order date, returned items, purchase price, date of withdrawal)
• Communication data (reason for withdrawal, messages from free-text fields)
• Usage data (IP address, timestamp of button use, user agent, and technical identifiers to secure the form)

Data processing takes place primarily within the EU/EEA. To provide the technical infrastructure, 401layers UG engages the following sub-processors (among others):

• Amazon Web Services (AWS), Frankfurt – cloud and database hosting
• Vercel Inc., USA – frontend hosting (processing in Frankfurt, Dublin, Paris, Stockholm)
• Hetzner Online GmbH, Germany – cloud hosting
• Shopify International Ltd., Ireland – e-commerce platform

Where data is transferred to third countries (e.g. the USA), this is done on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR (EU Standard Contractual Clauses or the EU–U.S. Data Privacy Framework).

A data processing agreement pursuant to Art. 28 GDPR is in place between Reviva GmbH and 401layers UG.

Legal basis: Art. 6(1)(c) GDPR (legal obligation to provide a withdrawal mechanism) and Art. 6(1)(b) GDPR (contract performance).

7. Merchandise Management System (PlentyONE)

To process your order we use the merchandise management system PlentyONE, operated by Plenty One GmbH, Johanna-Waescher-Straße 7, 34131 Kassel, Germany. Relevant order and customer data (e.g. name, address, order contents) is processed by PlentyONE as a data processor pursuant to Art. 28 GDPR.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

8. Shipping and Dropshipping

Shipping Providers

To deliver your order, we pass your delivery address and the data required for shipping to the following providers:

• Deutsche Post AG / DHL Paket GmbH, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany

Legal basis: Art. 6(1)(b) GDPR (contract performance).

Dropshipping Partners

For certain products, orders are shipped directly from our suppliers (dropshipping partners) to you. In these cases, we only transmit the data strictly necessary for delivery (delivery address, ordered products and quantity) to the respective dropshipping partner. Delivery by the partner is carried out via DHL, DPD, GLS, or Deutsche Post.

Your data will not be used by dropshipping partners for their own purposes beyond order fulfilment.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

9. Payment Providers

Shopify Payments / Credit Card

Payments by credit card (Visa, Mastercard and other available card types) and other payment methods processed via Shopify Payments are handled by Shopify International Ltd. and its payment partners. The data required for payment processing (e.g. card details, billing address) is transmitted in encrypted form and is not stored permanently by us. Shopify Payments is integrated into the Shopify platform; data processing takes place within the framework of the Shopify data processing agreement.

Further information: https://www.shopify.com/legal/privacy

Legal basis: Art. 6(1)(b) GDPR (contract performance).

PayPal

When paying via PayPal, the data required for payment processing is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal may carry out credit checks for fraud prevention purposes.

Further information: https://www.paypal.com/en/webapps/mpp/ua/privacy-full

Legal basis: Art. 6(1)(b) GDPR (contract performance).

Klarna

When using Klarna payment methods (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden), your data is transmitted to Klarna for payment processing. For certain payment methods (e.g. pay later, installments), Klarna may obtain credit information from credit agencies. You have the right to object to processing based on legitimate interests at any time.

Further information: https://www.klarna.com/en/privacy/

Legal bases: Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(f) GDPR (legitimate interest in payment security and fraud prevention).

Prepayment (Bank Transfer)

For orders paid by bank transfer, we process your order data (name, order number, amount) solely to allocate and confirm receipt of your payment. No data is passed on to third parties. Your banking details are not collected or stored by us.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

Apple Pay

When paying via Apple Pay, the data required for the transaction is processed by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.

Further information: https://www.apple.com/legal/privacy/

Legal basis: Art. 6(1)(b) GDPR (contract performance).

10. Newsletter

If you subscribe to our newsletter, we process your email address and, where applicable, your name solely for the purpose of sending the newsletter. Sending is carried out via Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany; parent company: Brevo SAS, 7 rue de Madrid, 75008 Paris, France). Brevo processes data as a data processor pursuant to Art. 28 GDPR.

Subscription is confirmed via a double opt-in process. You may revoke your consent at any time, e.g. via the unsubscribe link in any newsletter or by emailing info@reviva.de.

Further information: https://www.brevo.com/en/legal/privacypolicy/

Legal basis: Art. 6(1)(a) GDPR (consent, revocable at any time).

11. Cookies and Consent Management

Our website uses cookies and similar technologies. Technically necessary cookies are used without consent on the basis of Art. 6(1)(f) GDPR. For all other cookies (in particular analytics and marketing cookies), we obtain your consent in advance.

Consent management is handled via Shopify Customer Privacy. You can adjust or withdraw your consent at any time via the cookie banner or the privacy settings on our website.

You can also disable or delete cookies at any time in your browser:

• Chrome: support.google.com
• Edge: support.microsoft.com
• Firefox: support.mozilla.org
• Safari: support.apple.com

12. Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager does not itself process personal data or set cookies. It is used solely to manage JavaScript tags that embed analytics and marketing tools. These tags are only activated when you have given your consent.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient tag management).

13. Google Analytics 4

We use Google Analytics 4 (GA4), provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. GA4 analyses user behaviour on our website, for example pages visited, time spent, and conversion events. IP addresses are shortened by GA4 as standard before processing (IP anonymisation); no full IP addresses are stored.

Data may be transferred to the USA. Google is certified under the EU–U.S. Data Privacy Framework (DPF), ensuring an adequate level of data protection.

GA4 is only activated once you have consented via our cookie banner. You may withdraw your consent at any time.

Further information: https://policies.google.com/privacy

Legal basis: Art. 6(1)(a) GDPR (consent).

14. Google Ads Conversion Tracking

We use Google Ads Conversion Tracking, provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, to track which conversions (e.g. purchases) on our website were generated by Google advertisements. Cookies with a limited lifespan are used; personal identification is not possible.

Data may be transferred to the USA. Google is certified under the EU–U.S. Data Privacy Framework (DPF).

Google Ads Conversion Tracking is only activated once you have consented.

Further information: https://policies.google.com/privacy

Legal basis: Art. 6(1)(a) GDPR (consent).

15. Reviews and Comments

When you submit a review or comment, we process your details for the purpose of displaying and managing the review.

Legal basis: Art. 6(1)(a) GDPR (consent, revocable at any time).

16. Sharing of Personal Data with Third Parties

Where required by law or necessary for contract performance, we share personal data with the following recipients:

• Authorities: e.g. tax authorities, where legally required
• External service providers: lawyers, auditors, accountants, debt collection agencies
• Shipping providers: DHL, Deutsche Post (own dispatch); DHL, DPD, GLS, Deutsche Post (dropshipping partners)
• Payment providers: Shopify Payments (Shopify International Ltd.), PayPal (Europe) S.à r.l. et Cie S.C.A., Klarna Bank AB, Apple Distribution International
• Shop infrastructure: Shopify International Ltd.
• Merchandise management: Plenty One GmbH (PlentyONE)
• Withdrawal form: 401layers UG (EU Withdrawal Button)
• Newsletter: Brevo (Sendinblue GmbH)
• Analytics: Google Ireland Ltd. (Google Analytics 4, Google Ads, Google Tag Manager)

All service providers processing data on our behalf are bound by data processing agreements pursuant to Art. 28 GDPR.

17. Data Retention

We store personal data only for as long as necessary for the respective processing purpose or as required by statutory retention periods (e.g. 6–10 years under German tax and commercial law pursuant to §§ 147 AO, 257 HGB). Once the processing purpose has ceased or retention periods have expired, data is deleted or blocked.

Data collected via the EU Withdrawal Button is automatically deleted within 30 days of the app being uninstalled, unless a data export in machine-readable format (e.g. CSV) has been requested beforehand.

18. Your Rights as a Data Subject

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR) – to find out what data we hold about you
• Right to rectification (Art. 16 GDPR) – to correct inaccurate data
• Right to erasure (Art. 17 GDPR) – the right to be forgotten
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interests (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR) – without affecting the lawfulness of processing carried out prior to withdrawal

For data protection enquiries, please contact: info@reviva.de

19. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data (Art. 77 GDPR). The supervisory authority competent for us is:

If you are located in another EU member state, you may also contact the data protection authority in your country of residence.

Last updated: June 2026