This notice explains which personal data we process when you visit myologikshop.de, create a customer account, place an order or contact us – and what rights you have.
Alexander Mohr, trading as “Institut für Myologik”
Bergstraße 49
75223 Niefern-Öschelbronn
Germany
Phone: +49 179 7999053
E-mail: info@myologikshop.de
We have not appointed a data protection officer; we are not required to do so under section 38 of the German Federal Data Protection Act (BDSG). For any data protection matter, please contact us at the address above.
We process personal data only where this is necessary for a functioning shop, for our services or because the law requires it. Depending on the purpose, the legal basis is your consent (Art. 6(1)(a) GDPR), performance of a contract or pre-contractual steps (lit. b), a legal obligation (lit. c) or our legitimate interest (lit. f). The applicable basis is stated at each section.
We erase personal data once the purpose no longer applies and no retention obligation remains. Section 17 gives an overview of the periods.
When you access our pages, our hosting provider automatically records data transmitted by your browser: IP address, date and time, the page requested, the previously visited page, and your browser and operating system. This data is technically necessary to deliver the page and serves the security and stability of our service.
In addition, the shop software maintains an internal session overview. On every page request it records your IP address, your session identifier, the address last requested, the time of your last click and – if you are logged in – your customer number and your name. These entries serve the operation of the shop and the prevention of misuse, and are deleted automatically once 15 minutes have passed without a further page request.
Independently of Google Analytics (section 14), the shop software keeps its own simple visit statistic. Without a cookie and without consent, it counts how often a page and an item are viewed, with which browser and operating system and from which country or language region, and it stores the terms entered into our shop search. So that repeat visits are not counted twice, your IP address is not stored: only a checksum derived from it, which cannot be converted back into the IP address. The same applies to the session identifier. These checksums are deleted after 24 hours, after which only counts remain that cannot be linked to a person.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and uninterrupted operation of the website and in seeing which pages and items are in demand.
Retention: the session overview is cleared after 15 minutes of inactivity, the checksums of the visit statistic after 24 hours. The counts and search terms themselves we keep indefinitely; they cannot be linked to you. We keep server log files only for as long as this is necessary for operational security; they are overwritten automatically at regular intervals. We keep individual entries for longer where they are needed to investigate a specific security incident, and erase them once that investigation is complete.
Hosting: the website is hosted by ESTUGO, sole proprietorship, owner Alexander Mehner, Schuhhagen 18, 17489 Greifswald, Germany. The provider processes the data solely on our instructions; we have concluded a data processing agreement with it under Art. 28 GDPR.
Cookies are small files your browser stores. Without your consent, we only set the cookies the shop cannot work without:
| Cookie | What for | How long |
|---|---|---|
| GXsid_… | basket and login | until you close your browser |
| GXConsents, oil_data | remembers your cookie choice | about one month |
Only if you agree under Statistics are the Google Analytics cookies added (_ga and _ga_B61B2KDYWT, 400 days each; see section 14).
You can change or withdraw your choice at any time via the cookie settings link at the bottom of every page. Withdrawal does not affect anything done up to that point.
Legal basis: for the necessary cookies, section 25(2) no. 2 TDDDG (the German Telecommunications Digital Services Data Protection Act) and Art. 6(1)(f) GDPR; for Google Analytics, your consent (section 25(1) TDDDG, Art. 6(1)(a) GDPR).
To process an order we handle your form of address, first and last name, billing and delivery address, e-mail address and – if provided – telephone and fax number, company and VAT identification number, together with the details of your order and the payment method chosen. If you create a customer account, we store this data until you have the account deleted. Your password is not stored in plain text but only as a cryptographic hash from which the password cannot be recovered. Ordering without an account is possible.
If you provide a VAT identification number, we verify it through the European Commission's VAT Information Exchange System (VIES). Only the country code and the number itself are transmitted; no further details such as your name or your company are sent. The check is necessary in order to issue the invoice correctly for VAT purposes.
So that it remains possible to establish later which version of our terms and conditions, our withdrawal notice and this privacy notice applied to your order, we create a record of it. That record holds your name, your e-mail address, the language, the date and the wording of those texts as it stood at the time. No IP address is stored with it.
Legal basis: Art. 6(1)(b) GDPR for performing the contract; Art. 6(1)(c) GDPR for the VAT verification, the record of the legal texts and the subsequent retention.
Retention: we retain invoices and other accounting records for eight years, and commercial correspondence – such as order confirmations and correspondence relating to an order – for six years (section 257 of the German Commercial Code (HGB), section 147 of the German Fiscal Code (AO)). Each period starts at the end of the calendar year in which the document was created. During that time, processing is restricted to fulfilling the retention obligation. You may have your customer account deleted at any time; documents subject to retention are unaffected.
We offer PayPal, payment in advance by bank transfer, and cash on collection. We do not store payment data such as card or bank account numbers. Where you pay in advance, our bank statement shows us your name and your account details to the extent you provide them with the transfer.
If you choose PayPal, the data required for payment – name, address, e-mail address and the order and payment details – is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal is an independent controller for that processing; PayPal's own privacy notice applies, available at paypal.com/uk/legalhub/privacy-full.
In the basket and at every step of the checkout, a script provided by PayPal (paypalobjects.com) is loaded to prepare the payment selection and express checkout. Your IP address is transmitted to PayPal in the process; no cookie is set. The script is loaded regardless of your cookie choice because it is what makes the payment method available in the first place.
Legal basis: Art. 6(1)(b) GDPR for processing the payment; for loading the script in the basket and during the checkout, Art. 6(1)(f) GDPR – our legitimate interest lies in offering you the available payment methods without detours.
For delivery we pass your name and delivery address, and where required for parcel tracking or to arrange delivery your e-mail address or telephone number, to the transport company engaged. We ship with DHL and Deutsche Post (DHL Group, Sträßchensweg 10, 53113 Bonn, Germany).
For deliveries to Switzerland we additionally transmit the details required for the customs declaration to the customs authorities and to the customs agent engaged.
Legal basis: Art. 6(1)(b) GDPR; for the customs declaration, Art. 6(1)(c) GDPR.
To process orders, invoices and shipping labels we use software provided by Billbee GmbH, Arolser Straße 10, 34477 Twistetal, Germany. Billbee retrieves order data from the shop at regular intervals via an interface. Form of address, name, billing and delivery address, e-mail address, telephone number, order items, payment method and order status are processed in doing so. Billbee processes this data solely on our instructions; we have concluded a data processing agreement with the provider under Art. 28 GDPR. Billbee uses its own subcontractors for certain tasks, including providers based in the USA (see section 16).
The shop also has the marketplace interface magnalister, provided by RedGecko GmbH, Gerhart-Hauptmann-Straße 6, 99096 Erfurt, Germany, installed. It was used to import orders from online marketplaces into the shop. No marketplace connection is currently active and no data is transmitted through it. Orders received this way up to October 2022 are subject to the retention periods set out in section 5.
Legal basis: Art. 6(1)(b) GDPR.
Beyond the parties already named, we disclose personal data only where this is necessary to perform the contract or required by law. The recipients are:
We do not disclose data for advertising purposes and we do not sell data.
Every e-mail our shop sends – order confirmations, invoices, dispatch notes and replies to form enquiries, for example – is archived in the shop system. The recipient's name and address, the subject, the content and any attachments are stored. The archive serves as a record of our correspondence; for e-mails relating to an order, the retention periods set out in section 5 apply, and all others we erase once the reason for them has ceased to apply (Art. 6(1)(c) and (f) GDPR).
Via the contact form we process your name, e-mail address, the subject and your message; via the callback service your name, e-mail address, telephone number and the period in which you would like to be called back. We use these details solely to deal with your request.
Legal basis: Art. 6(1)(b) GDPR where the enquiry concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR (responding to enquiries).
Retention: until your enquiry has been dealt with conclusively and no retention obligation stands in the way; enquiries relating to an order are subject to the periods set out in section 5.
If you are logged in and add items to your wish list, we store against your customer account which items those are, so that you find them again on your next visit. You can empty the wish list yourself at any time; it is deleted together with your customer account.
Legal basis: Art. 6(1)(b) GDPR – the function is part of the customer account you created.
For the newsletter we need only your e-mail address; the sign-up form asks for nothing else. If the address belongs to a customer account, we additionally take the first and last name from that account so that we can address you personally. We use the double opt-in procedure: after signing up you receive an e-mail containing a confirmation link, and only then are you added to the distribution list. To evidence your consent we store the time of your sign-up and the fact that you followed the confirmation link. The newsletter is sent from our own shop system; no external service provider is involved. We do not store an IP address when you sign up.
Legal basis: Art. 6(1)(a) GDPR for sending the newsletter; Art. 6(1)(f) GDPR for evidencing consent.
Withdrawal: you may withdraw your consent at any time, for example via the unsubscribe link at the end of every newsletter or by sending us a message. Withdrawal takes effect for the future and does not affect the lawfulness of newsletters sent up to that point.
Retention: your data remains stored for as long as you receive the newsletter. If you unsubscribe, the entry is deleted in full – we do not keep a record of it afterwards either. Sign-ups you do not complete via the confirmation link are erased after one month at the latest.
Product reviews are currently switched off: no reviews are shown and no new ones are accepted. Reviews submitted earlier remain stored but are not visible. Before we switch the function back on, we will update this notice.
Legal basis: Art. 6(1)(a) GDPR, i.e. the consent given when the review was submitted. You may withdraw it at any time; we will then delete your review.
Only if you consent in the Statistics category do we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it to understand how our shop is used so that we can improve it. The data processed includes in particular the pages requested, time spent and click paths, the referring page, details of your device, browser and screen size, your approximate location, and a pseudonymous identifier that recognises your device across visits.
Your IP address is transmitted to Google in the process. According to Google, it is used only to derive your approximate location and is not stored in the reports. Google Analytics 4 no longer provides for any additional shortening of the IP address by us; the setting formerly used for that has no effect there, and we do not use it.
We have configured Consent Mode so that, without your consent, no analytics cookies are set and no data is sent to Google. Before you consent, no contact with Google takes place. We do not cause your data to be combined with other Google services or with your Google account; we have not enabled advertising features or data sharing with Google advertising products.
Legal basis: Art. 6(1)(a) GDPR together with section 25(1) TDDDG.
Withdrawal: at any time via the cookie settings link in the footer. Withdrawal takes effect for the future.
Retention: the cookies expire after 400 days. Usage data in our Google Analytics account is erased automatically after the retention period configured there, at the latest 14 months after your last visit.
Further information on Google's processing is available at policies.google.com/privacy.
The contact form, the callback service, the newsletter sign-up and the request for a new password are protected against automated submissions by a simple security check: you type in the characters shown in an image. In addition, the shop recognises forms that are submitted immediately after the page has loaded, which only automated programs do. Both run entirely within our shop: no data is passed to third parties and no additional cookies are set. The code and a timestamp are stored only in your session on our server.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting the forms against misuse by automated programs.
Retention: until the end of your session.
With Google Analytics, data may be transferred to the USA. Our contracting party is Google Ireland Limited in Ireland; processing by Google LLC in the USA cannot be ruled out.
On 10 July 2023 the European Commission adopted an adequacy decision for the USA in the form of the EU-US Data Privacy Framework, under which Google LLC is certified. An action challenging that decision was dismissed by the General Court of the European Union on 3 September 2025; an appeal against that judgment is still pending before the Court of Justice of the European Union. The decision remains in force unless and until it is set aside. In addition, Google's data processing terms apply, which incorporate the European Commission's standard contractual clauses for transfers to third countries.
We use Google Analytics exclusively on the basis of your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). Please note that where data is transferred to the USA, access by US authorities cannot be ruled out and effective legal remedies against such access may not be available to you. If you would rather that did not happen, do not consent to the Statistics category – Google Analytics is then not loaded, and the shop remains fully usable.
Our service provider Billbee (section 8) in turn uses subcontractors, some of which are based in the USA, for example for storing order documents such as invoices and delivery notes and for sending e-mails. Order data may reach the USA in the process. Under the data processing agreement, Billbee may make such transfers only where the requirements of Art. 44 et seq. GDPR are met, and it has concluded the European Commission's standard contractual clauses for this purpose. The legal basis is Art. 6(1)(b) GDPR.
For deliveries to Switzerland (section 7) we transmit address and consignment data to the Swiss customs authorities. An adequacy decision of the European Commission is in place for Switzerland.
| Data | Retention |
|---|---|
| Session overview in the shop | 15 minutes after the last page request |
| Checksums of the visit statistic | 24 hours; the counts themselves carry no link to a person |
| Server log files | only for as long as necessary for operational security; longer only in the event of a specific security incident |
| Customer account | until you have it deleted |
| Invoices and accounting records | eight years from the end of the year of creation (section 257 HGB, section 147 AO) |
| Commercial correspondence on orders | six years from the end of the year of creation |
| Record of the legal texts for an order | as for the order concerned |
| The shop's e-mail archive | as for the order where one is concerned, otherwise until the reason ceases to apply |
| Enquiries unrelated to an order | until dealt with conclusively |
| Newsletter | until you unsubscribe; the entry is then deleted in full |
| Unconfirmed newsletter sign-ups | one month at the latest |
| Product reviews (function currently switched off) | until you withdraw your consent |
| Google Analytics cookies | 400 days; usage data at the latest 14 months after the last visit |
| Security check on the forms | until the end of the session |
You have the following rights in relation to us:
An informal message to info@myologikshop.de is sufficient.
You may also lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany
Postal address: Postfach 10 29 32, 70025 Stuttgart, Germany
Phone: +49 711 615541-0, e-mail: poststelle@lfdi.bwl.de
Where we process data on the basis of a legitimate interest – this includes in particular the server log files, the session overview and the visit statistic (section 3), the loading of the PayPal script in the basket and during the checkout (section 6), the e-mail archive and the technical maintenance of the shop (section 9), the handling of enquiries unrelated to a contract (section 10), the record of your newsletter consent (section 12) and the security check on the forms (section 15) – you have the right to object to that processing at any time. No reason is required where the objection is directed against direct marketing; otherwise, grounds arising from your particular situation are sufficient. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests. An objection to advertising is always honoured. You can object informally, for example by e-mail to info@myologikshop.de.
We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
You can browse our shop without providing any personal details. To place an order, however, we need the data marked as mandatory during checkout – without it the contract cannot be concluded or performed. For invoicing, those details are additionally required by law (section 14 of the German VAT Act (UStG)). All other details, such as your telephone number or a newsletter sign-up, are voluntary; you suffer no disadvantage if you leave them out.
This privacy notice is dated September 2026. We update it whenever our processing operations or the legal requirements change.