Privacy Policy

This Privacy Policy describes how GOAT Supplements collects, uses, and shares your personal data when you visit our website, make a purchase, or interact with our services. We are committed to protecting your privacy in full compliance with the General Data Protection Regulation (GDPR).

1. Data Controller

2. Data We Collect

We may collect and process the following categories of personal data:

• ✔ Full name
• ✔ Email address
• ✔ Phone number
• ✔ Billing and shipping address
• ✔ IP address and browser details
• ✔ Order history and purchase details
• ✔ Payment status (processed securely via Stripe)
• ✔ Customer account credentials (if registered)
• ✔ Date of birth (optional, only if you choose to give it for a birthday offer)
• ✔ Product reviews you submit, and loyalty-points history (if registered)

We do not offer social login, and we never ask for your card details: payments are entered directly on Stripe's secure page and we only receive the payment status.

3. Purpose of Processing

We process your personal data for the following operational and commercial purposes:

• • Process and fulfill orders, including delivery, confirmation, and status updates.
• • Provide responsive customer support and resolve general inquiries.
• • Manage payments, handle invoicing, and comply with tax regulations.
• • Send relevant transactional emails and notification updates.
• • Analyze and improve our website performance, stability, and customer experience.
• • Conduct tailored marketing activities, campaigns, and newsletter distributions (strictly with explicit consent).
• • Prevent fraud, protect intellectual property, and secure transactions against abuse.

4. Legal Basis for Processing

We process personal data based on the following legal frameworks:

• Contract performance: Necessary to process and deliver orders placed through our shop.
• Legal obligations: Necessary to comply with tax, corporate accounting, and financial reporting laws.
• Legitimate interest: Applied to fraud prevention, commercial security, and service analytics.
• Explicit consent: For marketing newsletters, promotional campaigns, and non-essential cookie tracking.

5. Third-Party Providers

We share data with trusted third-party providers solely to facilitate our core business operations:

• ✔ Stripe: Secure, encrypted payment processing.
• ✔ GLS Spain, SEUR, Correos Express: Shipping and tracking services.
• ✔ Resend: transactional e-mail delivery (order confirmations, account and newsletter messages).
• ✔ Hostinger: hosting of the website and its database, in the European Union.
• ✔ No analytics or advertising trackers (no Google Analytics, no Meta Pixel) are in use at present. See our Cookie Policy.

Stripe and Google may process data in the United States; both do so under the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses.

6. Data Retention Periods

We store personal data only as long as necessary for its intended purpose:

• Order transactions: Retained for 5–10 years as required by commercial tax and auditing law.
• Customer accounts: Maintained continuously until a deletion or deactivation request is submitted.
• Marketing data: Retained continuously until the user formally withdraws their consent.
• Analytics data: Retained for a maximum period of 26 months.

7. Your Rights (GDPR Compliance)

Under European General Data Protection Regulation, you have the following enforceable rights:

• • Access your stored data at any time.
• • Correct inaccurate, outdated, or incomplete data.
• • Request permanent data deletion ("right to be forgotten").
• • Restrict the processing or limiting of specific dataset actions.
• • Exercise data portability to another system/provider.
• • Object to the processing of data based on legitimate interests.
• • Withdraw a consent you have given at any time (newsletter, cookies), without affecting processing carried out before the withdrawal.
• • Lodge a complaint with the supervisory authority: the Spanish Data Protection Agency (AEPD, C/ Jorge Juan 6, 28001 Madrid), or the authority of your own EU country.

To exercise any of these rights, write to us at thegoatfitnessshop@gmail.com. We answer within one month.

Cookies

Which cookies we set, what for, and how to change your choice is described in our Cookie Policy. Non-essential cookies are only set after you accept them in the banner.

8. Automated Decision-Making

We do not make decisions about you based solely on automated processing. Our payment provider, Stripe, applies its own fraud checks to card payments under its own privacy policy.

Last updated: 14 September 2026.