Privacy Policy

This Privacy Policy explains how Gymchemy collects and processes your personal data when you visit our store, place an order or subscribe to our newsletter, in accordance with the EU General Data Protection Regulation (GDPR) and applicable e-privacy rules.

Data controller

The data controller is Gymchemy, the operator of this online store.

For any privacy matter you can contact us at support@gymchemy.com.

Data we collect

Order data: products, size, colour, language and order history.
Contact data: email address and, for shipping, your name and delivery address.
Payment data: processed directly by Stripe and PayPal — we never see or store full card numbers.
Newsletter data: your email address and subscription status when you sign up.
Technical data: cookies and similar identifiers as described in our Cookie Policy.
Support data: any information you include when you contact us or request a return.

Purposes and legal bases

Processing and delivering your orders and providing customer support — performance of a contract (Art. 6(1)(b) GDPR).
Sending the newsletter and marketing measurement (Meta Pixel) — your consent (Art. 6(1)(a)); you can withdraw it at any time.
Invoicing, tax and accounting obligations — compliance with a legal obligation (Art. 6(1)(c)).
Fraud prevention, security and improving the store — our legitimate interest (Art. 6(1)(f)).

Recipients and processors

We share data only with providers who process it on our behalf under a data processing agreement:

Stripe and PayPal — payment processing.
Printful — production and shipping of made-to-order items.
Brevo — newsletter delivery.
Resend — transactional emails (order confirmations, shipping notices).
Meta — advertising and conversion measurement (only with marketing consent).
Our hosting and database providers — operating the website and storing order data.

Transfers outside the EU

Some processors (e.g. Stripe, Meta, Resend) are based in the United States. Where data is transferred outside the EU/EEA, it is protected by the European Commission's Standard Contractual Clauses (SCC) and additional safeguards where required.

Retention

Order and invoicing data are kept for the period required by tax and accounting law. Newsletter data are kept until you unsubscribe. Consent logs are kept as proof of consent for as long as needed for accountability. Other data are deleted when no longer necessary for the purposes above.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability and to object to processing. Where processing is based on consent, you can withdraw it at any time without affecting prior processing. You also have the right to lodge a complaint with your supervisory authority (in Italy, the Garante per la protezione dei dati personali).

Contact

To exercise your rights or for any question about this policy, contact us at support@gymchemy.com.