Privacy Notice — SVYT BODY

Last updated: July 2026

This Privacy Notice explains how SVYT BODY ("we", "us", "our") collects, uses, and protects your personal data when you visit or make a purchase from svytbody.com, create an account, or otherwise interact with us.

We are committed to protecting your privacy and processing your personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Who We Are

Data Controller:

• Legal name: SVYT
• Trading name: SVYT BODY
• Address: Bosrankstraat 48, 1032 LH, Amsterdam, Netherlands
• KvK number: 99020424
• BTW-ID: NL005366940B24
• Contact: info@svytbody.com

If you have questions about this Privacy Notice or your personal data, you can contact us using the details above.

2. What Personal Data We Collect

a) Information you provide to us

• Name
• Email address
• Shipping and billing address
• Phone number
• Account details
• Order and payment information
• Communications with us (emails, contact forms)

b) Information collected automatically

When you visit our website, we may automatically collect:

• IP address
• Device and browser information
• Pages viewed and interactions
• Referral source

This data is collected through cookies and similar technologies (see Section 5).

3. How We Use Your Personal Data

We use your personal data to:

• Process and deliver your orders
• Create and manage customer accounts
• Process payments and prevent fraud
• Handle returns, cancellations and withdrawal requests
• Communicate with you about your orders or account
• Improve our website and services
• Analyse website usage and performance
• Send marketing communications, where you have consented

4. Legal Basis for Processing

We process your personal data on the following legal grounds:

• Performance of a contract — to fulfil orders and provide services
• Legal obligation — accounting and tax compliance
• Legitimate interest — improving our services, fraud prevention
• Consent — marketing communications, cookies, and tracking technologies

Where processing is based on consent, you may withdraw that consent at any time.

5. Cookies and Tracking Technologies

Cookies are small text files placed on your device when you visit our website. They help the website function properly, improve user experience, and provide information to us. Cookies may be session cookies, deleted when you close your browser, or persistent cookies, stored for a defined period.

a) Strictly necessary cookies

Required for the operation of our website and cannot be disabled. They allow you to navigate the website, use the shopping cart and checkout, access secure areas, and manage your account.

Legal basis: contractual necessity

b) Analytics and performance cookies

These help us understand how visitors interact with our website, such as pages visited, time spent, and errors or performance issues. This data is aggregated.

Examples: Google Analytics (GA4), where enabled. Legal basis: consent

c) Marketing and advertising cookies

Used to deliver relevant ads, measure the effectiveness of advertising campaigns, and track conversions and interactions. These cookies may track your browsing activity across websites.

Examples: Meta Pixel, Pinterest Tag. Legal basis: consent

d) Functional cookies

These allow enhanced functionality and personalisation, such as remembering preferences and language or region settings.

Legal basis: legitimate interest or consent, depending on the function

Cookie consent. When you first visit our website, you will be presented with a cookie banner allowing you to accept all cookies, reject non-essential cookies, or manage your preferences. You can withdraw or change your consent at any time via the cookie settings on our website or through your browser settings. Please note that disabling certain cookies may affect website functionality.

Some cookies involve data transfers outside the EU. Where applicable, we rely on adequacy decisions, Standard Contractual Clauses, or other lawful safeguards.

We and our partners, including Shopify, use cookies and other technologies to personalise your experience, show you ads, and perform analytics. We will not use cookies or other technologies for these purposes unless you accept them.

6. Third-Party Service Providers

We share personal data with trusted third parties only where necessary to operate our business and fulfil your orders:

• E-commerce platform: Shopify
• Payment processing: Shopify Payments, PayPal, Klarna, iDEAL
• Shipping and delivery: DHL, UPS, DPD, PostNL, Nova Post
• Order fulfilment: our fulfilment partners in the Netherlands and the Czech Republic
• Marketing and advertising: Meta (Facebook / Instagram), Pinterest
• Email marketing: Klaviyo, where enabled
• Analytics: Google Analytics, where enabled
• Accounting: Moneybird

These providers act as data processors or as independent controllers and process data in accordance with their own privacy policies. Personal data shared with carriers and fulfilment partners is limited to what is necessary to deliver your order: name, address, phone number, and email for delivery notifications.

Hosting and data processing. Our store is hosted by Shopify Inc. Shopify collects and processes your personal data when you visit and make purchases on our store, including to provide services based on your interactions with other merchants and with Shopify ("Enhanced Services"). These Enhanced Services enable us and Shopify to provide you with a more customised experience, serve you more relevant ads, and understand how you interact with our store and our ads.

Data sharing. Information about your activity on our store will be shared with Shopify and other third parties that may be located in other countries, in order to provide you and us with services, including Enhanced Services.

Your privacy rights with Shopify. You can opt out of Shopify's processing of your data for certain uses, or request deletion of your data, directly via Shopify's privacy portal at https://privacy.shopify.com. For more information on how Shopify collects and uses your data, see https://www.shopify.com/nl/legal/privacy/consumers.

7. International Data Transfers

Some of our service providers are located outside the European Economic Area.

Where personal data is transferred internationally, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions, where the European Commission has recognised the destination country as providing an adequate level of protection
• Standard Contractual Clauses approved by the European Commission

Deliveries to Ukraine. Where you place an order to be delivered in Ukraine, your name, address, phone number and email are transferred to our carrier Nova Post in Ukraine so that your order can be delivered. Ukraine is not covered by an EU adequacy decision. This transfer is necessary for the performance of the contract between you and us, and is made on the basis of Article 49(1)(b) GDPR, supported by Standard Contractual Clauses where applicable.

Deliveries to Switzerland. Switzerland is covered by an EU adequacy decision, and transfers of delivery data to Swiss carriers and customs authorities take place on that basis.

8. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this Privacy Notice:

• Order and transaction data: 7 years from the date of the transaction, as required by Dutch tax law
• Customer account data: for the duration of your account, plus 12 months after account deletion
• Marketing and communication data: until you withdraw consent or unsubscribe
• Website analytics data: up to 26 months, depending on the analytics provider
• Customer support correspondence: up to 2 years after resolution

After the applicable retention period, personal data is securely deleted or anonymised.

9. Your Rights

Under the GDPR, you have the right to:

• Access your personal data
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data
• Object to processing based on legitimate interest
• Restrict processing in certain circumstances
• Data portability — receive your data in a portable format
• Withdraw consent at any time for consent-based processing

To exercise your rights, contact us at info@svytbody.com. We will respond within one month of receiving your request. Where a request is complex, we may extend this period by up to two further months and will inform you if that happens.

You also have the right to lodge a complaint with your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. This includes encrypted connections (SSL/TLS), secure payment processing, and access controls.

11. Children's Privacy

Our website and products are intended for adults. We do not knowingly collect personal data from children under the age of 16. If we become aware that we have collected such data, we will take steps to delete it promptly.

12. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. Any changes will be posted on this page with an updated revision date.

13. Contact

For any privacy-related questions or requests: info@svytbody.com