Privacy Policy

Last updated: 25 August 2026

1. INTRODUCTION

This Privacy Policy explains how Sports Nutrition Co. B.V., trading as Oxydope® (“Oxydope”, “we”, “us” or “our”), collects, uses, shares and protects personal data when you visit our website, place an order, create or use a customer account, contact us, subscribe to marketing communications or otherwise interact with our website and related services (the “Services”).

We process personal data in accordance with applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Dutch data protection legislation.

This Privacy Policy explains what personal data we process, why we process it, the legal basis for doing so, with whom personal data may be shared, how long it may be retained and the rights available to you.

2. DATA CONTROLLER

The controller responsible for the processing of your personal data is:

Sports Nutrition Co. B.V.
Trading as Oxydope®

Riga 4-K
2933 LW Barendrecht
The Netherlands

Chamber of Commerce (KVK): 97836222
VAT: NL868252943B01
Email: info@oxydope.com

3. PERSONAL DATA WE COLLECT

The personal data we process depends on how you interact with Oxydope.

3.1 Information you provide to us

We may collect personal data including:

first and last name;
email address;
telephone number;
billing address;
shipping address;
customer account information;
order and transaction information;
products purchased, returned or refunded;
communication preferences;
information submitted through forms on our website;
customer service correspondence;
chat messages;
newsletter and marketing preferences;
information submitted as part of a wholesale or distributor application; and
other information you voluntarily provide to us.

3.2 Payment information

Payments are processed using payment services available through our webshop, including Shopify Payments and, depending on availability and your chosen payment method, services such as PayPal, Apple Pay and Google Pay.

The payment information processed depends on the payment method you choose and may include payment card information, bank or account information, transaction identifiers and other information necessary to authorise and process your payment.

Oxydope does not necessarily receive or store complete payment card details. Payment information may instead be processed directly by the relevant payment service provider.

Your use of a particular payment service may also be subject to the privacy terms of that provider.

3.3 Information collected automatically

When you visit or interact with our website, we and our authorised service providers may automatically collect technical and usage information, including:

IP address;
browser type and version;
device type;
operating system;
language and regional settings;
referring URLs;
pages and products viewed;
date and time of visits;
interactions with our website;
shopping cart activity;
cookie identifiers;
advertising identifiers where permitted;
approximate location derived from technical information; and
information about how you use our Services.

The use of non-essential analytics and advertising technologies is subject to your cookie choices where consent is required.

3.4 Information from third parties

We may receive personal data from third parties involved in providing our Services, such as:

ecommerce providers;
payment providers;
shipping and logistics providers;
analytics providers;
advertising platforms;
fraud-prevention and security providers; and
marketing and communications providers.

Where personal data is obtained from another source rather than directly from you, applicable GDPR transparency requirements continue to apply.

4. HOW AND WHY WE USE PERSONAL DATA

We process personal data only where we have an appropriate legal basis.

4.1 Processing and fulfilling orders

We process personal data to:

receive and process orders;
process payments;
confirm transactions;
arrange fulfilment and delivery;
provide order and shipping updates;
handle cancellations;
process returns and refunds;
maintain relevant transaction records; and
provide customer service relating to your purchase.

The legal basis for this processing is generally the performance of a contract or taking steps at your request before entering into a contract.

4.2 Customer accounts and Services

Where customer accounts or related features are available, we may process personal data to create, maintain and secure your account and provide account-related functionality.

The legal basis is generally the performance of a contract and, where applicable, our legitimate interests in operating and securing our Services.

4.3 Customer service and communications

We process information when you contact us by email, website form, Shopify Inbox or another available support channel.

We use this information to:

respond to questions;
provide customer support;
resolve order issues;
handle complaints;
manage returns or refunds; and
maintain relevant correspondence.

Depending on the nature of your request, processing may be necessary for the performance of a contract, compliance with a legal obligation, or our legitimate interests in providing customer service and managing our business.

4.4 Legal and regulatory obligations

We process and retain certain personal data where necessary to comply with applicable laws and regulations, including tax, accounting, consumer protection and other regulatory requirements.

The legal basis for such processing is compliance with a legal obligation.

4.5 Security and fraud prevention

We may process personal data to:

protect our website and systems;
secure customer accounts;
identify suspicious activity;
prevent fraud and payment abuse;
prevent misuse of our Services;
investigate security incidents;
enforce our rights and agreements; and
establish, exercise or defend legal claims.

Where applicable, we rely on our legitimate interests in protecting Oxydope, our customers, our systems and our Services, provided those interests are not overridden by your fundamental rights and freedoms.

The GDPR permits legitimate-interest processing only where the organisation has assessed the interests involved against the rights and freedoms of the individual.

4.6 Website analytics and improvement

We may process information about website usage to understand how visitors use our Services, identify technical problems, measure website performance and improve functionality and customer experience.

We currently use technologies including Google Analytics 4 for analytics purposes and Google Tag Manager to manage website tags and related technologies.

Where consent is required for the use of analytics technologies, such technologies are used in accordance with your cookie choices.

The legal basis is consent where required by law and, where legally permitted, our legitimate interests in operating and improving our Services.

4.7 Advertising and measurement

We use Meta technologies, including the Meta Pixel, to support activities such as advertising measurement, attribution, campaign optimisation and, where permitted, audience-related advertising functionality.

Advertising and tracking technologies that require consent are used only after the required consent has been obtained.

Depending on your choices and the functionality used, information such as cookie identifiers, device information, website interactions and purchase-related events may be processed by or transmitted to the relevant provider.

4.8 Email marketing

We currently use Klaviyo to manage email marketing, subscriber information, marketing preferences and related marketing activities.

Where required, we send marketing communications based on your consent.

Where applicable law permits us to send relevant marketing communications to existing customers without separate prior consent, we may do so within the limits of applicable law.

You can unsubscribe from marketing emails at any time by using the unsubscribe link included in our marketing communications or by contacting us.

You have the right to object to the processing of your personal data for direct marketing purposes at any time.

5. WHETHER YOU ARE REQUIRED TO PROVIDE PERSONAL DATA

Certain personal data is necessary for us to provide our Services or enter into or perform a contract with you.

For example, we generally need your name, contact details, delivery address and the information required by the relevant payment provider to process and deliver an order.

If you do not provide information that is necessary to complete a transaction, comply with a legal obligation or provide a requested Service, we may be unable to complete your order or provide that Service.

Information identified as optional does not have to be provided.

6. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies to operate our website and, depending on your choices, for analytics, measurement and advertising purposes.

These technologies may include cookies, pixels, tags and similar identifiers.

They may be used to:

enable essential website functionality;
maintain shopping cart and checkout functionality;
remember preferences;
protect our website against fraud and misuse;
understand website usage;
measure website performance;
analyse customer journeys;
measure advertising performance; and
support relevant advertising activities.

Some technologies are strictly necessary for our website and Services to operate.

Where applicable law requires consent for analytics, advertising or other non-essential technologies, those technologies are used only in accordance with your cookie choices.

You can manage or withdraw relevant choices using the cookie settings available on our website.

Further information about the technologies used, their purposes and applicable retention periods is provided in our Cookie Declaration.

7. SERVICE PROVIDERS AND RECIPIENTS

We share personal data only where reasonably necessary for the purposes described in this Privacy Policy or where disclosure is otherwise permitted or required by law.

7.1 Shopify

We use Shopify to operate our online store and related ecommerce infrastructure.

Shopify may process personal data in connection with functions including:

webshop operation;
checkout;
customer accounts;
order management;
Shopify Payments;
security; and
other ecommerce functionality.

7.2 Payment providers

Payments may be processed using Shopify Payments and supported payment methods and providers, including PayPal, Apple Pay and Google Pay.

The personal data processed and shared depends on the payment method you choose.

Payment providers may process certain information as independent controllers for their own regulatory, fraud-prevention, security or payment-processing obligations.

7.3 Shipping, fulfilment and logistics providers

We share information necessary to fulfil and deliver orders with the relevant shipping, fulfilment and logistics providers.

Depending on the shipment, these may include VerstuurJePakket and/or DHL.

Information provided may include:

recipient name;
delivery address;
email address;
telephone number;
shipment information; and
other information reasonably necessary to deliver or manage the shipment.

7.4 Google services

We use Google services including Google Tag Manager and Google Analytics 4.

Depending on your consent choices and our configuration, Google may process technical, usage and online identifier information in connection with these services.

7.5 Meta

We use Meta Pixel and related Meta functionality for advertising measurement and related marketing purposes where permitted.

Depending on your cookie choices and the functionality used, information concerning your device and interactions with our Services may be processed by Meta.

7.6 Klaviyo

We use Klaviyo to provide email marketing and related marketing functionality.

Klaviyo may process information such as contact details, marketing preferences, engagement with communications and relevant customer or transaction information used for permitted marketing activities.

7.7 Shopify Inbox

We use Shopify Inbox to provide website chat and customer support functionality.

Information you provide through chat may be processed through Shopify's infrastructure and used by us to respond to your enquiry and provide customer support.

7.8 Professional advisers and authorities

We may disclose personal data where appropriate to:

accountants;
auditors;
legal advisers;
insurers;
tax authorities;
regulators;
law-enforcement authorities;
courts; or
other competent authorities.

Such disclosure may occur where required by law or where necessary to establish, exercise or defend legal claims.

7.9 Business transactions

If our business, assets or operations are subject to a merger, acquisition, restructuring, financing, sale or similar transaction, relevant personal data may be disclosed to advisers and prospective or actual parties involved in the transaction, subject to applicable data protection requirements.

We do not sell your personal data for monetary consideration.

8. INTERNATIONAL DATA TRANSFERS

Some of the service providers we use operate internationally. As a result, personal data may in certain circumstances be processed outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we use or rely on a lawful transfer mechanism where required.

Depending on the recipient and destination, this may include:

an adequacy decision adopted by the European Commission;
European Commission-approved Standard Contractual Clauses (“SCCs”); or
another lawful transfer mechanism or safeguard available under applicable data protection law.

Where necessary, supplementary measures may also be applied.

You may contact us for further information about safeguards applicable to relevant international transfers.

The GDPR continues to protect personal data when it is transferred outside the EEA, and transfers to countries without an adequacy decision generally require appropriate safeguards such as SCCs or another permitted mechanism.

9. DATA RETENTION

We retain personal data only for as long as necessary for the purpose for which it was collected, taking into account applicable legal, tax, accounting, fraud-prevention, consumer-protection and reporting requirements and the need to establish, exercise or defend legal claims.

Retention periods therefore vary according to the type of personal data and the purpose for which it is processed.

In general:

order, invoice and transaction records are retained for the period required under applicable tax and accounting legislation;
customer account information may be retained while your account remains active and thereafter where necessary for legal, security or administrative purposes;
customer service correspondence is retained for as long as reasonably necessary to resolve the enquiry and manage relevant follow-up, complaints or potential legal claims;
marketing subscription information is processed until you unsubscribe, withdraw consent or object, subject to our ability to retain limited information necessary to record and respect your opt-out;
distributor or business applications may be retained for as long as reasonably necessary to assess the application, manage a potential business relationship and maintain relevant business records;
analytics and cookie information is retained according to the relevant technology and configuration, as further described in our Cookie Declaration; and
security and fraud-prevention information may be retained for a period reasonably necessary to protect our Services, investigate incidents and establish or defend legal claims.

When personal data is no longer required, we delete, anonymise or otherwise securely dispose of it unless further retention is required or permitted by law.

The GDPR's storage-limitation principle requires organisations not to retain personal data longer than necessary and to establish appropriate deletion or review periods.

10. YOUR DATA PROTECTION RIGHTS

Subject to applicable conditions and exceptions, the GDPR gives you a number of rights regarding your personal data.

These may include the right to:

access personal data we hold about you;
obtain rectification of inaccurate or incomplete personal data;
request erasure of personal data in applicable circumstances;
request restriction of processing;
receive certain personal data in a structured, commonly used and machine-readable format and exercise your right to data portability;
object to processing based on legitimate interests;
object at any time to direct marketing;
withdraw consent at any time where processing is based on consent; and
exercise applicable rights concerning certain forms of automated decision-making.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise your rights, contact:

info@oxydope.com

We may request additional information where reasonably necessary to confirm your identity and protect personal data against unauthorised disclosure.

We will handle requests in accordance with the time limits and requirements of applicable data protection law. Under the GDPR, organisations generally have to respond without undue delay and at the latest within one month, subject to the Regulation's permitted extensions in certain circumstances.

11. RIGHT TO OBJECT TO DIRECT MARKETING

You have the right to object at any time to the processing of your personal data for direct marketing purposes.

If you object to direct marketing, we will stop processing your personal data for that purpose.

You can also unsubscribe from marketing emails at any time by using the unsubscribe link contained in the relevant communication.

We may retain limited information necessary to record your opt-out and ensure that your marketing preference continues to be respected.

12. RIGHT TO LODGE A COMPLAINT

If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.

For Sports Nutrition Co. B.V. in the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).

You may also have the right to lodge a complaint with the competent data protection authority in the EU/EEA country where you habitually reside, work or where an alleged infringement occurred.

We welcome the opportunity to address privacy concerns directly, but you are not required to contact us before exercising your right to complain to a supervisory authority.

13. AUTOMATED DECISION-MAKING AND PROFILING

We may use automated technologies for purposes such as:

fraud detection;
security;
analytics;
customer segmentation;
advertising measurement;
marketing personalisation; and
website personalisation.

These activities do not necessarily constitute automated decision-making within the meaning of Article 22 GDPR.

We do not currently intend to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, unless such processing is permitted under applicable law and the required safeguards are implemented.

If we introduce such automated decision-making, we will provide the information and safeguards required by applicable data protection law.

The existence of relevant automated decision-making and profiling is among the information that must be disclosed under the GDPR where applicable.

14. DATA SECURITY

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures may include appropriate access controls, security measures provided through our ecommerce and technology infrastructure and internal procedures intended to limit access to personal data to those who require it for legitimate purposes.

No internet-based service can guarantee absolute security.

Where you maintain an account with us, you are responsible for keeping your account credentials confidential and for notifying us if you believe your account has been compromised.

15. CHILDREN

Our Services are intended for a general consumer audience and are not designed for the purpose of knowingly collecting personal data from children where parental or guardian consent would be required under applicable data protection law.

If we become aware that personal data relating to a child has been collected unlawfully, we will take appropriate steps in accordance with applicable law.

16. THIRD-PARTY WEBSITES AND SERVICES

Our website may contain links to or integrations with websites, applications or services operated by third parties.

Where you interact directly with an independent third-party provider, that provider may process personal data under its own privacy terms.

We are not responsible for the privacy practices of independent third parties and encourage you to review their privacy information where relevant.

17. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in:

our Services;
our processing activities;
technologies we use;
service providers;
business operations; or
applicable legal or regulatory requirements.

The latest version will be published on this page and the Last updated date will be revised accordingly.

Where required by law, we will provide additional notice or obtain renewed consent for relevant changes.

18. CONTACT

If you have questions about this Privacy Policy, how we process your personal data or wish to exercise your data protection rights, please contact:

Sports Nutrition Co. B.V.
Trading as Oxydope®

Riga 4-K
2933 LW Barendrecht
The Netherlands

Chamber of Commerce (KVK): 97836222
VAT: NL868252943B01
Email: info@oxydope.com