Privacy Policy

Information on the processing of personal data in accordance with the GDPR (RGPD).

As of: July 2026

1. Controller

Wiktoria Klaudia Guzowska · Sole proprietorship (EI) · 5 Rue Jaboulay, 69007 Lyon, France · E-mail: info@blitzlab.eu.
Data protection officer: not appointed (not legally required).

2. Competent Supervisory Authority

CNIL – Commission Nationale de l'Informatique et des Libertés, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr). Where our activities are directed at the German market, the German data protection supervisory authorities may also have jurisdiction.

3. Processed Data, Purposes & Legal Bases

• Order processing – Name, delivery/billing address, email, telephone. Purpose: performance of a contract (Article 6(1)(b) of the GDPR). Storage period: statutory retention periods (commercial/tax law in France generally up to 10 years).
• Customer account – Email address, password (stored exclusively as a cryptographic hash and unreadable to us), name, stored delivery and billing addresses, and order history. The account is voluntary; an order is also possible without an account as a guest. Purpose: Management of orders and simplified subsequent orders (Art. 6(1)(b) GDPR). Storage for the duration of the account; more details under section 5.
• Blitz-VIP membership – the transaction is processed via Whop (Whop, Inc., USA). On the page Blitz-VIP the till will be only after you have explicitly clicked loaded; prior to this, there is no connection to Whop. When the page loads, your IP address and technical details of your browser are transmitted to Whop, which also uses its own analytics scripts in the process. Legal basis: your consent, given by actively requesting the checkout (Article 6(1)(a) of the GDPR), and the performance of a contract (Article 6(1)(b) of the GDPR). Transfer to third countries – see section 7.
• Payment by card and Apple Pay – processed via our payment service provider Whop Payments (Whop, Inc., USA). The data required for the payment is transmitted to the service provider; card details are collected and processed exclusively by them, not by us. Legal basis: performance of a contract (Article 6(1)(b) of the GDPR). This involves a transfer to a third country – see section 7.
• Payment by cryptocurrency – processed via the payment service provider NOWPayments. The details required to allocate the payment (including the order number, amount and email address) are transmitted. Legal basis: performance of a contract (Article 6(1)(b) of the GDPR).
• Shipping – Transfer of delivery details to the contracted parcel/courier service provider for delivery (Article 6(1)(b) of the GDPR).
• Transaction emails – Order confirmations, dispatch notifications and account emails are sent via the mail server of our hosting provider, Hostinger (Article 6(1)(b) of the GDPR).
• Newsletter – Email address; only with consent (Article 6(1)(a) of the GDPR), which may be withdrawn at any time. More details under section 6.
• Enquiries – the information you have provided (name, email address, message) for the purpose of processing your enquiry (Article 6(1)(b) or (f) of the GDPR).
• Age verification – Confirmation that you are at least 21 years old is stored exclusively locally in your browser (local storage, 30 days). No data is transferred to us or to third parties in the process.
• Cart & session – Strictly necessary cookies from WooCommerce which ensure that the cart and the login function correctly when navigating between pages (Article 6(1)(f) of the GDPR, Section 25(2) of the TDDDG).
• Fonts – the fonts used are served from our own server. In this regard, there is no connection to Google Fonts or another external provider; no data will be transferred to third parties.
• Audience measurement / Marketing – Currently inactive. No statistics, analytics or marketing tools are integrated (no Google Analytics, no Meta Pixel, no advertising cookies). Should such tools be used in future, this will only take place with your prior consent (Article 6(1)(a) of the GDPR) via a consent banner to be set up at that time; this statement will be amended accordingly beforehand.
• Server log files – When you visit the website, technical access data (IP address, time of access, resource accessed, browser and system details) is processed by our hosting provider, Hostinger International Ltd. Purpose: operation, security and error analysis; legitimate interest (Article 6(1)(f) of the GDPR).

4. Cookies & Consent

This website uses only cookies that are strictly necessary for technical purposes – for the cart, login and security. They are required for the operation of the shop and do not require consent under Section 25(2) of the TDDDG. For this reason, no consent banner is currently displayed.

Non-essential cookies, tracking and marketing tools are not . Should this change, such services will only be loaded once you have given your active consent; we will set up a consent banner in advance and update this statement accordingly.

We also store your age verification locally in your browser (Local Storage, 30 days). It is also noted locally whether you have already closed or used our newsletter notification window – so that it is not displayed to you again. In both cases, no data is transmitted to us or to third parties.

5. Customer Account

You can create a customer account, but you do not have to: orders can also be placed as a guest. In your account, you can see your previous orders and store addresses for future orders. Your password is stored exclusively as a cryptographic hash and is not readable by us at any time.

You can have your account deleted at any time – an informal email to info@blitzlab.eu is sufficient. Data that we are required by law to retain, in particular invoices and accounting records, is excluded from erasure.

6. Newsletter

Registration is via the registration form on this website. You can withdraw your consent at any time with effect for the future; every email contains an unsubscribe link. You can also unsubscribe informally by email to info@blitzlab.eu.

The recipient list is managed on our own web server – your address will not be passed on to an external newsletter service provider. Technical dispatch is carried out via the mail server of our hosting provider, Hostinger. We store the time of registration for documentation purposes.

7. Transfer to Third Countries

Transfers to third countries take place when payments are processed via Whop Payments (Whop, Inc., USA), if you choose that payment method, and if you contact us via the WhatsApp button on our website; in that case your telephone number and the content of your message are processed by WhatsApp Ireland Limited and its US parent company Meta Platforms, Inc. The transfer is based on the appropriate safeguards adopted by the European Commission – in particular the standard contractual clauses (Article 46(2)(c) of the GDPR) or, where the provider is certified, the EU-U.S. Data Privacy Framework (Article 45 of the GDPR). A level of data protection that fully corresponds to the European level cannot always be guaranteed in third countries.

Upon simply visiting our website, none of your data is transferred to recipients outside the EU: fonts, images and scripts are hosted on our own server, and hosting and email dispatch are handled by a provider based in the EU.

8. Your Rights

Access, rectification, erasure, restriction of processing, data portability and objection (Articles 15–21 GDPR) as well as the right to lodge a complaint with a supervisory authority. You can withdraw your consent at any time with effect for the future; the withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal. Enquiries to: info@blitzlab.eu.