Privacy Policy

Last updated: 14 August 2026

Protecting your personal data matters to us. This page explains what data we process when you visit our online store at outperformer.xyz, place an order, or use our other services – what we use it for, and what rights you have. We process data strictly in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection law (BDSG, TDDDG).

1. Controller

Scaleweb3 GmbH
Schwimmbadstraße 17a
83620 Feldkirchen-Westerham
Germany

Represented by: Julian Richter
Email: julian@outperformer.xyz
Legal notice: Impressum

We are not legally required to appoint a data protection officer and have not done so. Please direct all privacy requests to the email address above.

2. Your Rights

As a data subject, you can exercise the following rights against us at any time – an informal email is enough:

• Access (Art. 15 GDPR): confirmation of whether and which data we process about you, including purposes, recipients and storage periods.
• Rectification (Art. 16 GDPR): correction of inaccurate or completion of incomplete data.
• Erasure (Art. 17 GDPR): deletion of your data, unless statutory retention obligations or other exceptions apply.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR): receipt of the data you provided in a structured, commonly used, machine-readable format.
• Withdrawal of consent (Art. 7(3) GDPR): at any time with effect for the future; the lawfulness of processing before withdrawal remains unaffected.

Right to object (Art. 21 GDPR): You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. Where we process data for direct marketing, you may object at any time without giving reasons.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example at your place of residence or at our registered office (competent for us: Bavarian State Office for Data Protection Supervision, BayLDA).

3. Store Platform and Hosting (Shopify)

Our store runs on the e-commerce platform Shopify (Shopify International Limited, 2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland; parent company: Shopify Inc., 151 O'Connor Street, Ottawa, ON K2P 2L8, Canada). Shopify provides hosting, the shop system, databases and a content delivery network (CDN) for fast and secure delivery of content, and processes on our behalf all data generated when you visit and use the store. A data processing agreement is in place with Shopify (Data Processing Addendum: shopify.com/legal/dpa).

When you access the store, access data is automatically recorded in server log files: IP address, date and time, pages and files accessed, data volumes transferred, browser type and version, operating system, and referrer URL. We use this data solely to operate the store, ensure its stability and security, and prevent abuse (e.g. attacks) – not for marketing. Log files are deleted or anonymised after 30 days at the latest; longer storage occurs only where required to investigate a specific incident.

Processing may also take place on servers in Canada and the USA. An EU Commission adequacy decision exists for Canada; transfers to the USA are based on the EU-U.S. Data Privacy Framework (DPF) and standard contractual clauses.

Legal bases: Art. 6(1)(f) GDPR (technical operation, security); for orders Art. 6(1)(b) GDPR. Shopify privacy policy: shopify.com/legal/privacy.

4. Cookies and Consent Management

We use cookies and similar technologies. Technically necessary cookies (e.g. cart, checkout, login, security and consent status) are used on the basis of § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR – the store does not work without them. All non-essential cookies (analytics, marketing, preferences) are only set after you have given consent via our cookie banner (§ 25(1) TDDDG in conjunction with Art. 6(1)(a), Art. 7 GDPR).

To obtain, document and manage consent we use the consent management tool Consentmo (Shopify app; consentmo.com). Your consent status (selected categories, timestamp) is stored in your browser so the prompt does not repeat on every visit and we can prove consent.

A complete, always up-to-date list of all cookies in use – including provider, purpose and storage period – is available directly in the cookie banner, where you can also adjust or withdraw your consent at any time with effect for the future.

5. Orders, Customer Account and Guest Checkout

You can order as a guest or via a customer account. To process your order we handle: name, delivery and billing address, email address, phone number where provided, the products ordered, order number and prices, payment status, and related communication (e.g. order and shipping confirmations, queries, returns, warranty matters). Mandatory fields are marked during checkout; without them we cannot fulfil the contract.

If you create a customer account, we additionally store your login credentials (email, password in encrypted form) and your order history until you delete the account or request its deletion. Statutory retention obligations remain unaffected.

Legal bases: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (commercial and tax law obligations) and Art. 6(1)(f) GDPR (proper business administration, fraud prevention, enforcement of claims).

6. Shipping, Production and Fulfilment

To deliver your order, we share the necessary data (name, delivery address, order contents, and your email address for shipping notifications) with our production and shipping partners. Depending on the product, these are in particular:

• Gelato (Gelato ASA, Oslo, Norway – EEA) – print-on-demand production and shipping of apparel; produced locally in the country or region of delivery.
• ChanceToBrand / Brands on Demand UG (Berlin, Germany) – storage and shipping of food supplements.
• Shipping carriers (depending on the shipment, e.g. DHL, DPD, UPS or local carriers used by our production partners) – delivery and shipment notifications.

The legal basis for sharing name and address is Art. 6(1)(b) GDPR (performance of contract); for transferring your email address for shipment notifications, Art. 6(1)(f) GDPR or your consent where obtained by the carrier. As an EEA state, Norway is directly subject to the GDPR.

7. Electronic Withdrawal Function

You can withdraw from your contract using an electronic withdrawal function in our store. We process the details you enter (name, email address, order number, and any further information on the withdrawal) to receive, confirm, process and document your withdrawal. Legal bases: Art. 6(1)(b) and (c) GDPR. This function is provided by 401layers UG (haftungsbeschränkt) (Hilden, Germany) acting as our processor; the confirmation of receipt required by law is sent by email through this service. The data is stored for as long as needed to handle the withdrawal and to meet statutory retention obligations.

8. Payment Providers

Payments are handled by external payment providers. You enter your payment details (e.g. card or account data) directly with the respective provider – we never receive complete card or account data, only confirmation or rejection of the payment and the transaction information needed for accounting and fraud prevention. All payment traffic is encrypted. Legal basis: Art. 6(1)(b) GDPR; additionally Art. 6(1)(f) GDPR (fraud prevention, accounting).

Providers in use:

• Shopify Payments (Shopify International Limited, Dublin, Ireland; payment processing via Stripe, Inc., San Francisco, USA – DPF-certified): credit/debit cards (Visa, Mastercard, American Express) and wallets (Apple Pay by Apple Inc., Google Pay by Google Ireland Ltd.). Details: shopify.com/legal/privacy, stripe.com/privacy.
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg): PayPal account and payment methods offered by PayPal. Details: paypal.com/legalhub.
• Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden): invoice, instalment and instant payment. If you choose pay-by-invoice or instalments, Klarna may transfer data to credit agencies for identity and credit checks. Details: klarna.com/privacy-policy.

The payment methods actually available to you are shown at checkout before you complete your order.

9. Contact

When you contact us (email, contact form, social media), we process your details (name, contact data, content of your enquiry) solely to handle and respond to your request. Legal bases: Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete the correspondence once the matter is fully resolved and no retention obligations apply.

10. Newsletter and Email Marketing

You can subscribe to our newsletter – covering our products, drops, and topics around performance and lifestyle. Your email address is all we need. Sign-up uses a double opt-in: you receive a confirmation email, and only your confirmation activates the subscription. We log the sign-up and confirmation timestamps and IP address to be able to prove consent. Legal basis: Art. 6(1)(a) GDPR.

We may inform existing customers by email about similar own products within the limits of § 7(3) of the German Act against Unfair Competition (UWG) (legal basis: Art. 6(1)(f) GDPR); you can object at any time.

Performance measurement: Our newsletters contain a tracking pixel and trackable links. This shows us whether and when a newsletter was opened and which content was clicked (including technical details such as browser, system, IP address, time), helping us improve our content. Opting out of measurement alone is not possible – in that case, please unsubscribe entirely. You can unsubscribe at any time via the link at the end of every email or by simply messaging us.

After unsubscribing, we may store your email address for up to three years solely to prove prior consent (Art. 6(1)(f) GDPR) and keep it permanently on a suppression list to honour your objection.

Email services in use:

• Beehiiv (beehiiv Inc., New York, USA) – editorial newsletter. Servers located in the USA; transfers based on standard contractual clauses. Details: beehiiv.com/privacy.
• Klaviyo (Klaviyo, Inc., Boston, USA – DPF-certified) – store-related emails such as cart reminders and product recommendations, strictly based on your consent or § 7(3) UWG. Klaviyo processes your email address plus order and interaction data from our store. Details: klaviyo.com/legal/privacy-notice.
• Shopify – transactional emails (order and shipping confirmations; Art. 6(1)(b) GDPR) and, where applicable, newsletter sending via the platform (see section 3).

11. Product Reviews (Judge.me)

You can review products you bought in our store. For this we use Judge.me (Judge.me Ltd., London, United Kingdom – an EU Commission adequacy decision exists for the UK).

To verify that a review is based on a genuine purchase, we transfer your name, email address, order number and order date to Judge.me (Art. 6(1)(f) GDPR – our legitimate interest in authentic reviews). If you have consented, you will receive a post-purchase email inviting you to leave a review (Art. 6(1)(a) GDPR). Published reviews (display name, star rating, text, photo if any) are visible to other visitors (Art. 6(1)(a) GDPR). You can have your review deleted by us at any time. Details: judge.me/privacy.

12. Web Analytics (Google Analytics 4)

To analyse how our store is used, we deploy Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) – only after you have consented via the cookie banner (Art. 6(1)(a) GDPR).

GA4 creates pseudonymous usage profiles (pages visited, interactions, device and browser data, approximate location). For EU users, Google Analytics does not store full IP addresses: only coarse location data is derived from the IP before it is discarded, and lookups take place on EU servers. Transfers to Google servers in the USA are possible (DPF-certified, additionally standard contractual clauses; data processing terms: business.safety.google/adsprocessorterms). You can withdraw consent at any time in the cookie banner; Google also offers an opt-out plugin (tools.google.com/dlpage/gaoptout).

13. Online Marketing and Conversion Measurement

To measure and improve our advertising campaigns, we may use marketing pixels – strictly after your consent via the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Unless you consent, no marketing technologies are loaded.

• Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland): measures whether users performed an action in our store (e.g. a purchase) after clicking one of our ads on Instagram/Facebook, and enables interest-based audiences. This involves event data (pages visited, purchases), device and browser data and pseudonymous identifiers; Meta may link this data to your Meta account and use it for its own purposes – to that extent, Meta and we are joint controllers under Art. 26 GDPR for the collection and transfer. Third-country transfer: DPF. Details and objection: facebook.com/privacy/policy, ad preferences: facebook.com/adpreferences.

If we add further advertising services in the future, you will find them listed in the cookie banner before activation – they remain disabled without your consent.

14. Social Media Presences

We run profiles on Instagram (Meta Platforms Ireland Ltd., Dublin, Ireland), X (X Internet Unlimited Company, Dublin, Ireland), TikTok (TikTok Technology Ltd., Dublin, Ireland) and YouTube (Google Ireland Ltd., Dublin, Ireland) to share information about our products and communicate with you.

When you interact with our profiles (comments, likes, messages), we process those details to communicate with you (Art. 6(1)(f) GDPR; where contract-related, Art. 6(1)(b) GDPR). The platforms additionally process your data under their own responsibility, including for market research and advertising and partly outside the EU; we have no control over this. You can exercise your data subject rights most effectively directly with the respective platform – but we are happy to assist. Privacy notices: Instagram, X, TikTok, YouTube/Google.

15. Embedded Content

We occasionally embed third-party content, e.g. videos. Technically, this requires the third party to receive your IP address in order to deliver the content to your browser.

• YouTube videos are embedded in privacy-enhanced mode (“youtube-nocookie.com”): data only flows once you actively play a video (Google Ireland Ltd.; third-country transfer: DPF; Art. 6(1)(a) GDPR).
• X content (e.g. embedded posts): X Internet Unlimited Company, Dublin; third-country transfers based on standard contractual clauses; Art. 6(1)(f) or (a) GDPR.

16. International Data Transfers

Where we transfer data to countries outside the EU/EEA, we do so only with appropriate safeguards: primarily on the basis of EU Commission adequacy decisions (including Canada, the United Kingdom, and the EU-U.S. Data Privacy Framework for certified US providers), supplemented by standard contractual clauses as a contractual safeguard. The applicable basis is stated for each service in this policy. More on the DPF and certified companies: dataprivacyframework.gov.

17. Storage Periods and Deletion

We store personal data only as long as necessary for the stated purposes or as required by law, and delete it afterwards. Key retention periods under German law include: 10 years for books, records and annual accounts (§ 147 AO, § 257 HGB), 8 years for accounting documents such as invoices, 6 years for business correspondence, and 3 years (standard limitation period, §§ 195, 199 BGB) for data needed to defend against or assert contractual claims. Periods begin at the end of the calendar year in which the triggering event occurred. Where several periods apply to the same data, the longest prevails.

18. Changes to this Privacy Policy

We update this privacy policy whenever our data processing or the legal situation changes. The version published here applies. If a change requires action on your part (e.g. renewed consent), we will inform you separately.