Privacy policy

PRIVACY POLICY

Last updated: October 2026. This privacy policy applies to the heilys online shops (heilys.de, heilys.eu, heilys.co.uk and heilys.com). It informs you about the processing of your personal data under the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection (FADP).

1. Controller

WeCare+ GmbH, Detmolder Str. 596-598, 33699 Bielefeld, Germany
Represented by: Yike Pan (Managing Director)
E-mail: hallo@heilys.de · Phone: +49 521 7598 3718
Contact for data protection: Tanja Pape, hallo@heilys.de

2. Our principles

We state clearly for which purposes we process personal data; we limit the data we collect to what is necessary for legitimate purposes; where your consent is required, we ask for it first; we take appropriate security measures and require the same of everyone who processes data on our behalf; and we respect your right to access, correct or delete your data.

3. Purposes, data, legal bases and retention

3.1 Visiting the website. When you visit our shop, our hosting provider automatically processes technical data (IP address, date and time, pages viewed, browser and device information) to deliver the website and keep it secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website). Log data is deleted after a short period unless it is needed to investigate security incidents.

3.2 Orders and customer account. To process your order, we process your name, billing and delivery address, e-mail address, phone number (if provided), order details and payment information. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). We keep this data for as long as required by commercial and tax law (generally 6 to 10 years in Germany).

3.3 Payment. Payments are processed by the payment provider you choose at checkout (e.g. Shopify Payments/Stripe, PayPal, Klarna). We pass on the data required for payment. Klarna may carry out an identity and credit check for purchase on account or instalment payments. Legal basis: Art. 6(1)(b) GDPR and, for credit checks, Art. 6(1)(f) GDPR.

3.4 Shipping. We pass your name, delivery address and, where needed for delivery notifications, your e-mail address or phone number to the shipping company (DHL) or freight forwarder. For deliveries to Switzerland, data is also passed to MeinEinkauf AG / MeinEinkauf GmbH for customs clearance and delivery. Legal basis: Art. 6(1)(b) GDPR, and for delivery notifications Art. 6(1)(f) GDPR.

3.5 Contact. If you contact us by e-mail, phone, post or web form, we process your name, contact details and message in order to answer your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual or contractual requests) or Art. 6(1)(f) GDPR (other requests). We delete the data once your request has been fully dealt with, unless statutory retention obligations apply.

3.6 Newsletter. If you subscribe to our newsletter, we use your e-mail address to send you information about our products, with your consent (Art. 6(1)(a) GDPR, double opt-in). We send our newsletter via Klaviyo (Klaviyo, Inc., Boston, USA). You can unsubscribe at any time via the link in every e-mail. If you have bought from us, we may send you information about similar products to the e-mail address you provided; you can object to this at any time (Art. 6(1)(f) GDPR).

3.7 Product reviews. After a purchase we may invite you to review the product. Reviews are collected and displayed with our review service (Loox). Your review is published with your first name or initials. Legal basis: Art. 6(1)(f) GDPR and, for the publication of photos, your consent.

3.8 Affiliate programme. If you reach our shop via a partner link, we record which partner referred you so that the partner can be paid a commission (Art. 6(1)(f) GDPR, or your consent where cookies are used).

4. Cookies, analytics and advertising

We use technically necessary cookies to run the shop (e.g. shopping cart, language and country selection, consent settings). Legal basis: § 25(2) TDDDG / Art. 6(1)(f) GDPR.

With your consent only (Art. 6(1)(a) GDPR, § 25(1) TDDDG), we use analytics and marketing technologies: Google Analytics 4 and Google Ads conversion tracking (Google Ireland Ltd.), Meta Pixel / Conversions API (Meta Platforms Ireland Ltd.) and server-side tracking via a Stape server container, which forwards events to these services. These services help us measure how our shop and our ads perform and show relevant ads. You can give, change or withdraw your consent at any time via the cookie banner/cookie settings on our website. We use Google Consent Mode: without your consent, no analytics or advertising cookies are set.

5. Recipients and processors

Our shop runs on Shopify (Shopify International Ltd., Dublin, Ireland). Shopify and other service providers (e.g. hosting, e-mail delivery, review, translation and bundle apps) process data on our behalf under data processing agreements (Art. 28 GDPR). We only pass data to other recipients where this is necessary for the purposes above (e.g. payment providers, shipping companies, tax advisers) or where we are legally obliged to do so.

6. Transfers to third countries

Some service providers (e.g. Shopify, Google, Meta, Klaviyo, Klarna, PayPal) may process data in the USA or other countries outside the EU/EEA. Such transfers take place on the basis of an adequacy decision (e.g. the EU-U.S. Data Privacy Framework for certified companies) or the EU standard contractual clauses (Art. 46 GDPR).

7. Security

We take appropriate technical and organisational measures to protect personal data against misuse and unauthorised access. Our website uses SSL/TLS encryption. Only authorised persons have access to your data, and our security measures are reviewed regularly.

8. Third-party websites

This privacy policy does not apply to third-party websites linked from our website. Please read the privacy policies of those websites before using them.

9. Your rights

You have the right to access your personal data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). If processing is based on your consent, you may withdraw your consent at any time with effect for the future. To exercise your rights, simply contact us at hallo@heilys.de. Please state clearly who you are so that we do not change or delete the data of the wrong person.

10. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the country of your habitual residence. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW). In the UK, you can contact the Information Commissioner's Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).