Privacy policy

Privacy Policy

We appreciate your interest in our online shop. The protection of your privacy is very important to us. Below we inform you in detail about the handling of your data.

1. Access Data and Hosting

You can visit our website without providing any personal information. Each time a web page is accessed, the web server automatically stores a so-called server log file, which contains, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred, and the requesting provider (access data), and documents the access.

This access data is evaluated exclusively for the purpose of ensuring trouble-free operation of the site and improving our services. This serves, in accordance with Art. 6(1)(f) GDPR, to protect our predominantly legitimate interests in the correct presentation of our offerings, as determined through a balancing of interests. All access data is deleted no later than seven days after the end of your site visit.

Hosting Services by a Third-Party Provider

As part of processing on our behalf, a third-party provider provides us with hosting and website display services. All data collected in the course of using this website or in forms provided for this purpose in the online shop, as described below, is processed on their servers. Processing on other servers only takes place within the framework described here.

This service provider is based in the USA and is certified under the EU-US Privacy Shield. A current certificate can be viewed here [https://www.privacyshield.gov/list]. Based on this agreement between the USA and the European Commission, the latter has established an adequate level of data protection for companies certified under the Privacy Shield.

2. Data Collection and Use for Contract Processing, Contact, and Customer Account Creation

We collect personal data when you voluntarily provide it to us as part of your order or when contacting us (e.g., via contact form or email). Required fields are marked as such, as in these cases we necessarily need the data for contract processing or for handling your inquiry, and you cannot submit the order or inquiry without providing them. Which data is collected can be seen from the respective input forms. We use the data you provide in accordance with Art. 6(1)(b) GDPR for contract processing and handling your inquiries.

If you have given your consent pursuant to Art. 6(1)(a) GDPR by choosing to open a customer account, we use your data for the purpose of creating a customer account.

After full completion of the contract or deletion of your customer account, your data will be restricted for further processing and deleted after the expiration of tax and commercial law retention periods, unless you have expressly consented to further use of your data or we have reserved a further use of data that is permitted by law and about which we inform you in this statement. Deletion of your customer account is possible at any time and can be done either by sending a message to the contact option described below or via a function provided in the customer account.

3. Data Sharing

For the purpose of contract fulfillment pursuant to Art. 6(1)(b) GDPR, we share your data with the shipping company commissioned to deliver the goods, insofar as this is necessary for the delivery of ordered goods. Depending on which payment service provider you select during the ordering process, we pass on the payment data collected for payment processing to the credit institution commissioned with the payment and, where applicable, to payment service providers we have commissioned, or to the selected payment service. In some cases, the selected payment service providers also collect this data themselves if you create an account there. In this case, you must log in to the payment service provider with your credentials during the ordering process. The privacy policy of the respective payment service provider applies.

4. Email Newsletter and Postal Advertising

Email Advertising with Newsletter Registration

If you subscribe to our newsletter, we use the data required for this purpose or separately provided by you to send you our email newsletter regularly based on your consent pursuant to Art. 6(1)(a) GDPR.

You can unsubscribe from the newsletter at any time, either by sending a message to the contact option described below or via a link provided in the newsletter. After unsubscribing, we will delete your email address from the mailing list unless you have expressly consented to further use of your data or we have reserved a further use of data that is permitted by law and about which we inform you in this statement.

The newsletter is sent as part of processing on our behalf by a service provider, to whom we pass on your email address for this purpose.

This service provider is based in the USA and is certified under the EU-US Privacy Shield. A current certificate can be viewed here [https://www.privacyshield.gov/list]. Based on this agreement between the USA and the European Commission, the latter has established an adequate level of data protection for companies certified under the Privacy Shield.

Postal Advertising and Your Right to Object

Furthermore, we reserve the right to use your first and last name and postal address for our own advertising purposes, e.g., for sending interesting offers and information about our products by mail. This serves to protect our predominantly legitimate interests in advertising to our customers, as determined through a balancing of interests, pursuant to Art. 6(1)(f) GDPR.

Postal mailings are carried out as part of processing on our behalf by a service provider, to whom we pass on your data for this purpose.

You may object to the storage and use of your data for these purposes at any time by sending a message to the contact option described below.

5. Data Use in Payment Processing

Identity and Credit Check When Selecting Klarna Payment Services

If you choose Klarna's payment services, we ask for your consent pursuant to Art. 6(1)(a) GDPR to transmit the data necessary for payment processing and identity and credit checks to Klarna. In Germany, the credit agencies listed in Klarna's privacy policy [https://cdn.klarna.com/1.0/shared/content/policy/data/de_de/data_protection.pdf] may be used for identity and credit checks.

Klarna uses the information received about the statistical probability of non-payment for a balanced decision on the establishment, execution, or termination of the contractual relationship.

You may revoke your consent at any time by sending a message to the contact details below. This may result in us no longer being able to offer you certain payment options. You may also revoke your consent to this use of personal data at any time directly with Klarna.

6. Cookies and Web Analytics

To make visiting our website attractive and to enable the use of certain functions, to display suitable products, or for market research purposes, we use so-called cookies on various pages, provided you have given your consent pursuant to Art. 6(1)(a) GDPR.

Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted after the browser session ends, i.e., after you close your browser (session cookies). Other cookies remain on your device and allow us to recognize your browser on your next visit (persistent cookies). You can check the duration of storage in the overview of cookie settings in your web browser. You can set your browser to inform you about the setting of cookies and individually decide whether to accept them, or to exclude the acceptance of cookies for certain cases or in general. If cookies are not accepted, the functionality of our website may be limited. Each browser differs in how it manages cookie settings. This is described in the help menu of each browser, which explains how to change your cookie settings. You can find these for the respective browsers at the following links:

Microsoft Edge™ [https://support.microsoft.com/en-us/help/4027947/microsoft-edge-delete-cookies] / Safari™ [https://support.apple.com/en-us/guide/safari/sfri11471/mac] / Chrome™ [https://support.google.com/chrome/answer/95647?hl=en] / Firefox™ [https://support.mozilla.org/en-US/products/firefox/protect-your-privacy/cookies] / Opera™ [https://help.opera.com/en/latest/web-preferences/#cookies]

Furthermore, you may revoke your consent at any time by sending a message to the contact option described in this privacy policy.

Use of Google (Universal) Analytics for Web Analysis

Provided you have given your consent pursuant to Art. 6(1)(a) GDPR, this website uses Google (Universal) Analytics for the purpose of website analysis. The web analysis service is provided by Google Ireland Limited, a company incorporated and operated under Irish law, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. Google (Universal) Analytics uses methods that enable an analysis of your use of the website, such as cookies. The automatically collected information about your use of this website is usually transmitted to and stored on a Google server in the USA. By activating IP anonymization on this website, the IP address is truncated within the member states of the European Union or in other contracting states of the Agreement on the European Economic Area before transmission. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. The anonymized IP address transmitted by your browser within the framework of Google Analytics is generally not merged with other data from Google. After the purpose has been fulfilled and our use of Google Analytics has ended, the data collected in this context will be deleted.

Insofar as information is transmitted to and stored on Google servers in the USA, the American company Google LLC is certified under the EU-US Privacy Shield. A current certificate can be viewed here [https://www.privacyshield.gov/list]. Based on this agreement between the USA and the European Commission, the latter has established an adequate level of data protection for companies certified under the Privacy Shield.

You may revoke your consent at any time with future effect by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en. This prevents the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google.

As an alternative to the browser plugin, you can click this link to prevent future collection by Google Analytics on this website. An opt-out cookie will be placed on your device. If you delete your cookies, you will be asked to give your consent again.

Provided you have given your consent pursuant to Art. 6(1)(a) GDPR, this website also uses Google Signals. This is an extension feature of Google Analytics that enables so-called "cross-device tracking." This means that if your internet-enabled devices are linked to your Google account, Google can create reports on usage behavior (in particular cross-device user numbers) even when you switch devices. For this purpose, Google uses data if you have activated the "personalized advertising" setting in your Google account.

We do not process personal data in this regard; we only receive statistics created on the basis of Google Signals.

You may revoke your consent at any time with future effect by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en. This prevents the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google. In addition, you can deactivate the "personalized advertising" setting in your Google account. Details can be found here [https://support.google.com/ads/answer/2662922?hl=en].

7. Online Marketing

Google Ads Remarketing

We advertise this website in Google search results and on third-party websites via Google Ads. Provided you have given us your consent pursuant to Art. 6(1)(a) GDPR, the so-called remarketing cookie from Google is set when you visit our website, which automatically enables interest-based advertising by means of a pseudonymous cookie ID and based on the pages you have visited. After the purpose has been fulfilled and our use of Google Ads Remarketing has ended, the data collected in this context will be deleted.

Further data processing only takes place if you have agreed with Google that your web and app browsing history will be linked to your Google account and information from your Google account will be used to personalize ads you see on the web. In this case, if you are logged into Google during your visit to our website, Google will use your data together with Google Analytics data to create and define audience lists for cross-device remarketing. For this purpose, your personal data is temporarily linked by Google with Google Analytics data to form audiences.

Google Ads is a service of Google Ireland Limited, a company incorporated and operated under Irish law, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. Insofar as information is transmitted to and stored on Google servers in the USA, the American company Google LLC is certified under the EU-US Privacy Shield. A current certificate can be viewed here [https://www.privacyshield.gov/list]. Based on this agreement between the USA and the European Commission, the latter has established an adequate level of data protection for companies certified under the Privacy Shield.

You may revoke your consent at any time with future effect by disabling the remarketing cookie via this link [https://adssettings.google.com/authenticated?hl=en]. In addition, you can learn about cookie settings and make adjustments at the Digital Advertising Alliance [https://www.aboutads.info/].

Google reCAPTCHA

For the purpose of protecting our web forms against misuse and spam, we use the Google reCAPTCHA service in some forms on this website. Google reCAPTCHA is a service of Google Ireland Limited, a company incorporated and operated under Irish law, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. By verifying manual input, this service prevents automated software (so-called bots) from carrying out abusive activities on the website. This serves, in accordance with Art. 6(1)(f) GDPR, to protect our predominantly legitimate interests in protecting our website against misuse and ensuring trouble-free presentation of our online presence, as determined through a balancing of interests.

Google reCAPTCHA uses methods that enable an analysis of your use of the website, such as cookies, by means of a code embedded in the website (a so-called JavaScript) during the verification process. The automatically collected information about your use of this website, including your IP address, is usually transmitted to and stored on a Google server in the USA. In addition, other cookies stored by Google services in your browser are evaluated by Google reCAPTCHA.

No reading or storage of personal data from the input fields of the respective form takes place.

Insofar as information is transmitted to and stored on Google servers in the USA, the American company Google LLC is certified under the EU-US Privacy Shield. A current certificate can be viewed here [https://www.privacyshield.gov/list]. Based on this agreement between the USA and the European Commission, the latter has established an adequate level of data protection for companies certified under the Privacy Shield.

You can prevent the collection of data generated by the JavaScript or cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by disabling the execution of JavaScripts or the setting of cookies in your browser settings. Please note that this may limit the functionality of our website for your use.

For more information about Google's privacy policy, please visit [https://policies.google.com/privacy].

8. Social Media

Our Online Presence on Facebook, YouTube, Instagram, Pinterest, LinkedIn

Our presence on social networks and platforms serves to improve active communication with our customers and prospects. We provide information there about our products and current promotions.

When visiting our online presences on social media, your data may be automatically collected and stored for market research and advertising purposes. From this data, usage profiles are created using pseudonyms. These may be used to display advertisements within and outside the platforms that presumably correspond to your interests. Cookies are typically used on your device for this purpose. The visitor behavior and user interests are stored in these cookies. This serves, in accordance with Art. 6(1)(f) GDPR, to protect our predominantly legitimate interests in an optimized presentation of our offerings and effective communication with customers and prospects, as determined through a balancing of interests. If you are asked for consent to data processing by the respective social media platform operators, e.g., by means of a checkbox, the legal basis for data processing is Art. 6(1)(a) GDPR.

Insofar as the aforementioned social media platforms are headquartered in the USA, the following applies: The European Commission has issued an adequacy decision for the USA. This is based on the EU-US Privacy Shield. A current certificate for the respective company can be viewed here [https://www.privacyshield.gov/list].

For detailed information about the processing and use of data by the providers on their pages, as well as contact options and your rights and settings options for protecting your privacy, particularly objection options (opt-out), please refer to the privacy notices of the providers linked below. If you still need assistance in this regard, you can contact us.

Facebook: https://www.facebook.com/about/privacy/

Google/YouTube: https://policies.google.com/privacy?hl=en

Instagram: https://help.instagram.com/519522125107875

Pinterest: https://about.pinterest.com/en/privacy-policy

LinkedIn: https://www.linkedin.com/legal/privacy-policy

Opt-Out Options:

Facebook: https://www.facebook.com/settings?tab=ads

Google/YouTube: https://adssettings.google.com/authenticated?hl=en

Instagram: https://help.instagram.com/519522125107875

Pinterest: https://www.pinterest.com/settings

LinkedIn: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

9. Contact Options and Your Rights

As a data subject, you have the following rights:

  • pursuant to Art. 15 GDPR, the right to request information about your personal data processed by us to the extent described therein;
  • pursuant to Art. 16 GDPR, the right to request without undue delay the rectification of inaccurate or completion of your personal data stored by us;
  • pursuant to Art. 17 GDPR, the right to request the deletion of your personal data stored by us, unless further processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;
  • pursuant to Art. 18 GDPR, the right to request the restriction of processing of your personal data;
  • pursuant to Art. 20 GDPR, the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or to request its transfer to another controller;
  • pursuant to Art. 77 GDPR, the right to lodge a complaint with a supervisory authority.

If you have questions regarding the collection, processing, or use of your personal data, for information, rectification, restriction, or deletion of data, as well as revocation of granted consents or objection to a particular use of data, please contact us directly using the contact details in our legal notice.

Right to Object

Insofar as we process personal data as explained above to protect our predominantly legitimate interests as determined through a balancing of interests, you may object to this processing with future effect. If processing is for direct marketing purposes, you may exercise this right at any time as described above. If processing is for other purposes, you have a right to object only on grounds relating to your particular situation.

After exercising your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.

This does not apply if processing is for direct marketing purposes. In that case, we will no longer process your personal data for this purpose.

Privacy in the Vaya iOS App

Locally Stored Data

The Vaya App stores all data exclusively on your device. No challenge data, progress, or personal information is transmitted to Vaya servers. The following data is stored:

- Your name (optional, only if provided)
- Your email address (optional, only if provided)
- Your chosen reminder time for daily notifications
- Your 30-day challenge progress (completed tasks, exercises, energy logs)

Data is stored in iOS standard storage (UserDefaults) and is protected by iOS device encryption.

Optional Email Collection

If you voluntarily provide your email address during onboarding, it is transmitted once to our secure webhook service and stored in our marketing list. Purpose: product updates and Vaya news. Providing your email is completely voluntary and does not affect app functionality. You can unsubscribe at any time at privacy@vaya.com or request the deletion of your data.

Anonymous Usage Analytics

The app uses PostHog (EU servers, Frankfurt) for anonymous analysis of app usage. Only events such as viewed screens and used features are collected – no names, email addresses, or other personal data. PostHog is configured in compliance with GDPR:

- No device IDs or advertising IDs
- No linking to your identity
- IP addresses are not stored
- Data processing exclusively in the EU

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving our app).

Local Notifications

If you choose a reminder time, the app sends daily local notifications on your device. These notifications are processed entirely locally – no data is transmitted to external servers. You can disable notifications at any time in iOS Settings.

No Third-Party Sharing

Apart from anonymous usage analytics via PostHog (EU) and optional email collection, no data is shared with third parties. No cross-app tracking, no location data, no health data from the Apple Health app.

Data Deletion

You can delete all app data at any time by:
- Uninstalling the app (deletes all local data)
- Starting a new challenge in the app (resets all data)

To delete your email address from our list, contact: support@try-vaya.com

Data Controller

The data controller within the meaning of the GDPR is the same as for the Vaya online shop (see above).