Data protection

We are pleased that you are visiting our online shop calo-shop.com. Here you will find out what personal data we process, for what purpose, on what legal basis, and what rights you have. We have organized the sections by situation: website visit, order, contact, advertising.

1. Data Controller

KAP3 PREMIUM PRODUCTS UG (limited liability)
Sophie-Christ-Straße 4, 55127 Mainz
Email: info@calo-shop.com · Phone: +49 6131 4924528

For all questions about data protection, you can reach us at the email address provided above.

2. The most important things in brief

• Without your consent, we only use cookies that are necessary for the operation of the shop (e.g., shopping cart, checkout, saving your cookie selection). Some shop functions, such as reviews and bundle packages, load content from the servers of their providers (Sections 3.2, 3.5, and 4.4). Pop-ups and the "Back in stock" notification only become active if you agree in the cookie banner (Sections 3.6 and 4.4).
• Analytics and advertising services (Google, Meta, Awin, and others) only run if you agree in the cookie banner. You can change your selection at any time via "Cookie Settings".
• We pass your order data on to service providers that we use for contract processing, customer service, and accounting (Sections 4 to 6). The analytics and advertising services described in Section 3.4 require your consent. We send review requests by email on the basis of our legitimate interest, as described in Section 3.5; you can object.

3. Website visit

3.1 Shop platform and server logs (Shopify)

Our shop runs on the Shopify e-commerce platform. The provider for customers in the EU is Shopify International Ltd., Ireland. When you visit any page, Shopify automatically processes technical data sent by your browser: IP address, date and time, page visited, referrer, browser, and operating system. This is necessary to deliver the pages, ensure security, and prevent misuse.

The legal basis is our legitimate interest in a secure and functional shop (Art. 6(1)(f) GDPR). Shopify is our data processor (Art. 28 GDPR). Data may be transferred to Shopify Inc. in Canada and to sub-processors in the USA. For Canada, there is an adequacy decision by the European Commission. Transfers to the USA are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. You can request a copy of the Standard Contractual Clauses at info@calo-shop.com.

If you visit one of our other web addresses, Shopify automatically redirects you to calo-shop.com.

3.2 Page design, images, and fonts

• GemPages: Parts of our pages are created with the GemPages page builder (provider: GemCommerce, Hanoi, Vietnam). For this, your browser loads program code, images, and design files from the provider's servers (assets.gemcommerce.com and its storage at Amazon Web Services). Your IP address is transmitted to the provider. According to its own statements, GemCommerce also processes data in the USA. For transfers to Vietnam and the USA, the EU Standard Contractual Clauses apply, which GemCommerce has committed to in its data processing agreement.
• Uploadcare: Some images are delivered via the Uploadcare image network (Uploadcare Inc., USA; ucarecdn.com). Your IP address is also transmitted to the provider. According to its own statements, Uploadcare is certified under the EU-US Data Privacy Framework.
• Fonts: We load our own fonts from our shop platform's servers. Connections to Google Fonts are technically blocked for this purpose. Only the Google review widget (Section 3.4) loads its own fonts from Google servers after your consent.

The legal basis is our legitimate interest in a fast and uniform display of the shop (Art. 6(1)(f) GDPR).

3.3 Cookies and consent (Pandectes)

For the cookie banner, we use the Shopify app "Pandectes GDPR Compliance" (Pandectes, based in Estonia). In the banner, you can agree ("Accept") or decline ("Decline"). We store your selection in a cookie so that we do not have to ask you again on every visit.

• Necessary cookies and storage (shopping cart, checkout, customer account, language and currency, your cookie selection, protection against misuse) are set without consent because the shop would not otherwise function (§ 25(2) No. 2 TDDDG; Art. 6(1)(b) and (f) GDPR).
• All other cookies and comparable techniques (statistics, marketing, personalized advertising) are only set if you agree in the banner (§ 25(1) TDDDG; Art. 6(1)(a) GDPR).

You can revoke or change your consent at any time with future effect via the "Cookie Settings" link at the bottom of every page.

So that we can prove your consent, Pandectes stores your selection on the provider's servers (consents.pandect.es): a random consent ID, date and time, your truncated IP address (last part removed), country or region, and device type. The legal basis is our obligation to prove consents (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). We retain the proofs as long as we are required to prove the respective consent.

3.4 Statistics and advertising (only with your consent)

The following services only run if you have agreed in the cookie banner (§ 25(1) TDDDG; Art. 6(1)(a) GDPR):

• Google Analytics 4 and Google Tag Manager (Google Ireland Ltd., Ireland): Analysis of how our shop is used (e.g., pages visited, shopping cart and purchase events), in truncated or pseudonymized form.
• Google Ads Conversion Tracking and Remarketing (Google Ireland Ltd.): Measurement of whether an ad led to a purchase, and ads for visitors to our shop.
• Google Merchant Center – Shop Review Widget (Google Ireland Ltd.): Display of our merchant rating from Google and measurement of how often the widget is viewed. The widget loads its own fonts from Google servers for this purpose.
• Meta Pixel (Meta Platforms Ireland Ltd., Ireland): Measurement of purchases from Facebook and Instagram advertising and ads for visitors to our shop. We are jointly responsible with Meta for the collection during visits to our shop and the transmission to Meta (Art. 26 GDPR). You can find the essential content of the agreement at https://www.facebook.com/legal/controller_addendum. You can assert your rights against us and against Meta.
• Awin (AWIN AG, Eichhornstraße 3, 10785 Berlin): Affiliate marketing. If you come to us via the website of an advertising partner, Awin measures whether this results in a purchase so that we can pay the partner a commission. For this, Awin receives information about your visit and orders via the Shopify interface (e.g., order number, order value). The Awin app integrates the "Lantern" measurement service (lantern.roeye.com), which sets a cookie with a random ID for 30 days and transmits the referrer page, entry page, and browser information.
• Shown (Instaon SRL, Belgium; shown.io): Measurement and management of our shopping ads.
• SendWILL Pixel (CWILL, USA): The pop-up app from Section 3.6 receives information about your visit (e.g., products viewed, shopping cart) and, if you are registered, your name, email address, and phone number to display pop-ups appropriately and measure their effectiveness.
• Shopify Analytics: Shopify collects visit and purchase events so that we can see reports in the shop management area. Shopify only sets the analytics cookies for this after your consent. Your browser also sends technical events to Shopify without consent (Section 3.1).
• Judge.me Pixel: measures whether visitors view reviews and purchase afterwards.

Data may also be processed outside the EU by Google, Meta, Shown, and SendWILL, especially in the USA. Google LLC and Meta Platforms Inc. are certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses also apply.

3.5 Customer reviews (Judge.me)

We display the reviews in our shop using the Judge.me app (Judge.me Ltd.). For this, your browser loads content from Judge.me servers; your IP address is transmitted in the process (Art. 6(1)(f) GDPR, legitimate interest in displaying genuine customer reviews). Judge.me stores data at Amazon Web Services and Heroku, also in the USA; for transfers to third countries, the EU Standard Contractual Clauses from Judge.me's data processing agreement apply.

If you submit a review, we process your name (or initials), your email address, the review, and, if applicable, photos. The name or initials, review, and photos are displayed publicly; the email address is not. The legal basis is your consent by submitting the review (Art. 6(1)(a) GDPR), which you can revoke at any time.

Request for a review via email: After your order, we ask you via email at the earliest 14 days after shipping to review the purchased products. We also write to customers who have ordered from us earlier and have not yet been asked for a review. For this, we use the email address you provided us when ordering and transmit your name, email address, and the ordered items to Judge.me, which sends the email on our behalf. The legal basis is our legitimate interest in feedback on our products and in genuine customer reviews (Art. 6(1)(f) GDPR). Unsubscribing from our promotional emails (newsletter) does not automatically apply to review requests. You can object to review requests separately at any time without incurring any costs other than the transmission costs according to the basic rates – via the unsubscribe link in every review email or by sending a message to info@calo-shop.com. After that, you will no longer receive review requests. We also point this out to you at checkout under the email field.

3.6 Pop-ups (SendWILL, formerly EcomSend)

For pop-ups, e.g., for newsletter sign-ups, we use the Shopify app SendWILL (formerly EcomSend; provider CWILL INC, Dover, USA). The app's design file is already delivered from Shopify's own servers when the page is loaded (cdn.shopify.com, see Section 3.1); however, the app is only activated if you agree in the cookie banner ("Accept"). Only then does your browser load program code, pop-up settings, and images from the provider's servers (ecomsend.com); your IP address is transmitted, and the app stores the pop-up settings in your browser's local storage. According to its own statements, CWILL processes data in the USA, Hong Kong, and China. The legal basis is your consent (§ 25(1) TDDDG; Art. 6(1)(a) GDPR), which you can revoke at any time via "Cookie Settings". Without consent, the integration of the app only stores a technical marker without reference to you in the local storage, which records that the app's privacy mode is enabled. If you sign up in the pop-up, we process your email address as described in Section 6; we send the newsletter itself with Shopify Email. The app only receives further information about your visit with your consent (see "SendWILL Pixel" in Section 3.4).

3.7 Calorie calculator

Our calorie calculator calculates in your browser. We do not send your information about age, height, and weight to us or third parties. If you have agreed to statistics, we only count that a result was calculated and which goal you selected (e.g., "Maintain weight").

3.8 Links to social networks

On our pages, we link to our presences on Instagram and Facebook. These are simple links: data is only transferred if you click a link and visit the platform. For our own Facebook page, we are jointly responsible with Meta Platforms Ireland Ltd., insofar as Meta creates statistics about visitors to our page (Art. 26 GDPR).

4. Order, customer account, and shipping

4.1 Order and customer account

For your order, we process the information from the order form: name, billing and delivery address, email address, if applicable, phone number, ordered items, and payment method. Mandatory fields are marked; without them, we cannot conclude the contract. If you create a customer account, we store this information and your order history until you delete the account. The legal basis is contract fulfillment (Art. 6(1)(b) GDPR).

We additionally process our orders in our JTL-Wawi inventory management system (invoices, inventory, shipping). The system is hosted by an IT service provider that processes the data on our behalf and according to our instructions (Art. 28 GDPR).

4.2 Warehouse and shipping

• Fulfillment: Storage, packaging, and shipping are handled by our logistics service provider Shipmunks (warehouse: Nirmer Weg 20, 52080 Aachen). For this, it receives the name, delivery address, and order contents.
• Parcel services: We pass the name and delivery address to DHL or DPD so that the parcel can be delivered (Art. 6(1)(b) GDPR).
• We only pass your email address or phone number to the parcel service if you have agreed to it, so that it can announce the delivery to you (Art. 6(1)(a) GDPR). You can revoke the consent at any time towards us.

4.3 Payment

Depending on the selected payment method, we pass the necessary payment data to the respective payment service provider (Art. 6(1)(b) GDPR):

• Credit card, Apple Pay, Google Pay, and other payment methods via Shopify Payments: Handled by Stripe Payments Europe Ltd., Ireland, as a partner of Shopify.
• Shop Pay: Shopify. If you use Shop Pay, Shopify stores your details for future purchases at its own responsibility. To enable Shop Pay to start quickly, your browser establishes connections to shop.app (Shopify) when you visit the page.
• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
• Klarna (e.g. invoice): Klarna Bank AB (publ), Sweden. Depending on the payment method, Klarna checks your identity and creditworthiness at its own responsibility. We do not conduct any credit checks ourselves. Details can be found in Klarna's privacy notices, which are linked in the ordering process.
• Prepayment: You transfer money to our account at Volksbank pur eG.

4.4 Bundles, loyalty program, vouchers, business customers

• Bundles (Revy): For our bundles and combination packages, we use the Revy app (provider: Revy Apps, USA). Your browser loads program code from Revy's servers (bundle.revy.io) for this purpose; your IP address is transmitted in the process, including to the USA. The legal basis is our legitimate interest in displaying bundle offers and volume discounts directly on the product page (Art. 6(1)(f) GDPR).
• Calo Reward Club (loyalty points): If you participate in the loyalty program, we process your customer number, orders, and point balance via the loyalty app by Essential Apps (Vilnius, Lithuania) to credit points and redeem rewards (Art. 6(1)(b) GDPR).

• "Back in stock" notification (CWILL Back in Stock, formerly Sealapps): If an item is sold out, you can be notified by email as soon as it is available again. The program files for this feature are delivered by Shopify from its own servers when you visit the page (cdn.shopify.com, see section 3.1); however, they are only executed when you agree in the cookie banner ("Accept"). Only then does your browser request the stock status from CWILL's servers on product pages (bisapi.sealapps.com); your IP address is transmitted in the process. According to its own statements, CWILL processes data in the USA, Hong Kong, and China. The legal basis is your consent (§ 25(1) TDDDG; Art. 6(1)(a) GDPR), which you can revoke at any time via "Cookie Settings". If you enter your email address, we use it for this notification (Art. 6(1)(a) GDPR).

• Gift vouchers: If you send a voucher, we process the recipient's email address and your personal message to send the voucher at the desired time (Art. 6(1)(b) GDPR).

• Business customers (pharmacies): For retailer accounts, we additionally process the company name, contact person, VAT identification number, and proof of business authorization (Art. 6(1)(b) GDPR).

4.5 Online cancellation ("Revoke contract")

If you revoke your contract via our online form "Revoke contract", we process the information you provide there: email address, order number, your name voluntarily, the selected items in the case of a partial revocation, as well as a reason and a message voluntarily. We also store the date and time of receipt. We use this data to process your revocation and confirm receipt by email (Art. 6(1)(b) and (c) GDPR in conjunction with § 356a BGB).

We operate the form with the Shopify app "Revoq" as the data processor: Jonas Busch, Hofstraße 2-4, 51061 Cologne. A data processing agreement pursuant to Art. 28 GDPR exists with them. Revoq uses the following sub-processors: Supabase Pte. Ltd., Singapore (database, storage location Frankfurt), Fly.io Inc., USA (servers in Amsterdam and Frankfurt), Resend Inc., USA (sending the confirmation of receipt, server in Ireland; certified under the EU-US Data Privacy Framework), and Shopify Inc., Canada (matching with your order; EU Commission adequacy decision). EU standard contractual clauses have also been agreed with these providers. Access from countries outside the EU is therefore not completely ruled out.

Your IP address is only processed briefly (around 60 seconds) to prevent abuse and spam and is not stored (Art. 6(1)(f) GDPR). The revocation data is automatically deleted after 24 months, unless statutory retention requirements apply.

5. Contact and chat

5.1 Email and telephone

If you contact us by email or telephone, we process your details to answer your request. If the request concerns an order or a contract, the legal basis is Art. 6(1)(b) GDPR; otherwise, it is our legitimate interest in answering (Art. 6(1)(f) GDPR).

5.2 Chat function (Shopify Inbox) and AI assistant

We offer a chat function on our website. It is provided by Shopify (Shopify International Ltd., Ireland) as part of our shop platform. Questions in the chat are initially answered by a Shopify AI assistant; the chat window will indicate this. The assistant uses our product data, shop policies, and frequently asked questions for this purpose. If you wish or if the request requires it, the assistant will refer you to our customer service (info@calo-shop.com), which will handle your request personally.

Your chat messages, if applicable your contact details, technical connection data, and – if you are logged in and ask about it – your order data are processed. The legal basis is Art. 6(1)(b) GDPR insofar as your request concerns an order or a contract; otherwise, it is our legitimate interest in responding quickly to customer inquiries (Art. 6(1)(f) GDPR). Shopify processes this data on our behalf. If data is transmitted to countries outside the EU in the process, this is done on the basis of Shopify's data processing agreement (adequacy decision or EU standard contractual clauses).

Health data: Please do not submit health data such as diagnoses or medications in the chat. For personal health questions, your doctor or pharmacy are the right contacts. As displayed in the chat window, chat messages are also visible to Shopify for the provision and improvement of services; details on this can be found in Shopify's privacy policy. You can request the deletion of a chat history at any time, e.g. by emailing info@calo-shop.com.

Chat histories are stored in Shopify Inbox as long as they are necessary to process your request and for any follow-up questions.

6. Newsletter and email advertising

• Newsletter: You will only receive the newsletter if you subscribe to it and confirm your email address via the link in our confirmation email (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR). We store the registration and confirmation times as proof. For sending, we use Shopify Email, a service from our shop platform Shopify (section 3.1).
• Reminder of your cart: If you have subscribed to promotional emails from us and abandon an order, we will remind you once by email of the items in your cart. You will not receive this email without a subscription (Art. 6(1)(a) GDPR).
• Promotional emails only with consent: We only send newsletters, offers, and cart reminders if you have subscribed to promotional emails from us (Art. 6(1)(a) GDPR). You can revoke your consent at any time, for example via the unsubscribe link in any email or by messaging info@calo-shop.com. The only exception is the request for a product review after your order (section 3.5), which you can object to at any time.

You can revoke your consent at any time via the unsubscribe link in any email or by messaging info@calo-shop.com.

7. Retention period

We only store personal data for as long as is necessary for the respective purpose. After that, we delete it, unless we are required to retain it: commercial and business letters for six years, booking documents such as invoices for eight years, books and annual financial statements for ten years (§ 257 HGB, § 147 AO). The period begins with the end of the calendar year. We store customer accounts until you delete them. Data that we process based on your consent is deleted as soon as you revoke the consent, unless there is a retention obligation. For individual services, we state the retention period above in the respective section.

8. Other recipients

As far as necessary, data is also received by: our tax advisors and accounting (invoices, payments), banks (payment transactions), IT and hosting service providers (operation and maintenance), and authorities and courts, when we are legally obliged to do so (Art. 6(1)(b), (c), and (f) GDPR).

9. Your rights

You have the right at any time to:

• Information about your data stored with us (Art. 15 GDPR),
• Correction of incorrect data (Art. 16 GDPR),
• Deletion (Art. 17 GDPR),
• Restriction of processing (Art. 18 GDPR),
• Data portability (Art. 20 GDPR),
• Revocation of a granted consent with effect for the future (Art. 7(3) GDPR). The revocation does not affect the lawfulness of the processing carried out up to that point.

Right to object (Art. 21 GDPR): If we process your data on the basis of our legitimate interest, you can object to this processing at any time for reasons arising from your particular situation. You can object to the use of your data for direct advertising at any time without giving reasons.

An informal message to info@calo-shop.com is sufficient.

Right to complain: You can complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, poststelle@datenschutz.rlp.de.

10. Provision obligation and automated decisions

For concluding a contract, we need the information marked as mandatory. All other information is voluntary. We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR. Checks carried out by payment service providers such as Klarna at their own responsibility are described in their privacy notices.

11. Changes

We adapt this privacy policy if our shop, our service providers, or the legal situation changes. The version published here at the time applies.

Current as of: October 2026