Data protection
Controllers and contact details
The GUYA Online Shop is operated by GFY Babylon LLC, 30 N Gould St ste n, Sheridan, Wyoming 82801, USA. The seller and issuer of invoices for your purchases is GFY BABILON LLP, 44322 Yale Rd, Unit 3B #182, Chilliwack, BC V2R 4H1, Canada. GFY Babylon LLC is not the other party to your purchase contract. Both companies make decisions about processing in connection with the GUYA Online Shop. You can address privacy enquiries to both companies at support@drinkguya.com.
For processing under joint responsibility, GFY Babylon LLC provides the privacy information and handles the technical aspects of data protection requests in the shop. GFY BABILON LLP handles purchase- and invoice-related matters, including the associated retention and erasure obligations. Both companies handle data protection requests jointly through support@drinkguya.com and cooperate in fulfilling your rights. Irrespective of this allocation of tasks, you may exercise your rights against either company.
Where both companies jointly determine the purposes and means of processing, you may exercise your data protection rights against either company. The shared contact address does not affect this right.
Shopify and connected shop features
Our shop runs on Shopify. Shopify processes data when you visit the shop and place orders, including contact, delivery, billing, purchase and technical usage data. Necessary order and subscription data are used to perform contracts under Article 6(1)(b) GDPR. We use Seal Subscriptions for subscriptions; it processes the customer, order and contract details needed to manage them, such as the product, delivery interval and subscription status.
Shopify Network Intelligence is enabled. It uses information about interactions with our shop together with information about interactions with other merchants and Shopify to provide enhanced services, such as personalisation, analytics and advertising. This may involve transferring data to Shopify and other service providers in other countries. For these enhanced services, Shopify also acts as a controller in its own right. Consent-based analytics and advertising rely on Article 6(1)(a) GDPR; you can change your choices using the cookie settings in the footer. Further information and ways to exercise your rights are available in Shopify's Consumer Privacy Policy and the Shopify Privacy Portal. The published Shopify Data Processing Addendum explains the different roles and arrangements for international data transfers.
Product reviews
We use Judge.me for product reviews and related messages. This involves processing the information needed to send review requests, link a review to a product or purchase, and handle your review. Reviews, photos, videos and answers to product questions that you submit voluntarily may be published in the shop. Please do not include other people's personal information without their permission. You can withdraw consent for the future by contacting support@drinkguya.com. To unsubscribe from Judge.me review requests, use the unsubscribe link in those messages; this is separate from unsubscribing from our newsletter.
Unless stated otherwise below, you are not required by law or contract to provide your personal data, nor is providing it necessary to enter into a contract. You are not obliged to provide the data. Not providing it has no consequences. This applies only where the processing activities described below do not state otherwise.
“Personal data” means any information relating to an identified or identifiable natural person.
Server log files
You can visit our websites without providing information about yourself. Whenever you access our website, your internet browser transmits usage data, which are stored in server log files. These data include, for example, the name of the page accessed, the date and time of access, the volume of data transferred and the requesting internet service provider. These data are used exclusively to keep our website running smoothly and improve our services. Technical information may constitute personal data, especially when linked to an IP address or other identifiers. Processing necessary operational and security data serves our legitimate interest in keeping the shop available and protected, under Article 6(1)(f) GDPR.
Contact, email and chat
If you contact us through a form, by email or in a chat, we process the contact details you provide, the content of your message and any order information needed to handle your enquiry. We use Shopify Inbox for chat and also use Richpanel for support. You do not need to provide information that is not needed for your enquiry.
We handle contractual and pre-contractual enquiries on the basis of Article 6(1)(b) GDPR. For other enquiries, appropriate communication is our legitimate interest under Article 6(1)(f) GDPR. Making an enquiry does not constitute general consent to advertising. How long we retain the data depends on the resolution of the enquiry and any necessary records relating to contracts or claims.
Spam protection with hCaptcha
In Shopify, we have enabled hCaptcha protection for contact and comment forms and for supported login, account creation and password recovery forms. hCaptcha is a service provided by Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA. It helps distinguish human input from automated or abusive access. This may involve processing technical information such as your IP address, the time and characteristics of your interaction with the protected form, and transmitting it to the provider. Depending on the assessment, an additional security challenge may appear.
The necessary protection of our shop and its users against spam and abusive automated access serves our legitimate interest under Article 6(1)(f) GDPR. Where information is stored on or read from your device, the requirements of section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) also apply. Further information about the provider's processing, including international transfers, is available in the hCaptcha Privacy Policy.
Customer account
If you use a customer account, we process the data provided for that purpose to give you the account features you request and enable you to manage your orders. The legal basis is Article 6(1)(b) GDPR. You can request closure of your account at support@drinkguya.com. Necessary invoices, order records and evidence relating to claims must be considered separately from the continued use of a customer account.
Data collected when you post a comment
When you comment on an article or post, we collect your personal data (name, email address and comment text) only to the extent you provide them. The purpose is to enable comments to be submitted and displayed. By submitting your comment, you consent to the processing of the data you send. Processing is based on your consent under Article 6(1)(a) GDPR. You can withdraw your consent at any time by notifying us, without affecting the lawfulness of processing based on consent before its withdrawal. Erasure is subject to the statutory requirements; necessary evidence must be distinguished from the continued publication of the comment.
When your comment is published, the only identifying information published is the name you provide.
Collection, processing and use of personal data for orders
When you place an order, we process the contact, delivery, billing and order details needed to prepare, fulfil and administer your purchase contract. We cannot process the order without the necessary information. The legal basis is Article 6(1)(b) GDPR.
To perform the contract, the shop, payment, fulfilment, shipping and IT service providers involved receive the data they need for their respective tasks. Some providers process data on our behalf; others process them for their own purposes, depending on their function. This necessary order processing is distinct from, in particular, the enhanced Shopify services described above and consent-based advertising and analytics. The separately explained purposes, roles and legal bases apply to those activities.
Newsletters and requested guides
For newsletters, we use Shopify features and our own newsletter application. In our own application, we store your name and email address for registration and sending messages. Our own infrastructure runs on servers in the EU. This does not mean that all processing by Shopify or other services we use takes place exclusively in the EU.
Newsletters are sent on the basis of your consent under Article 6(1)(a) GDPR. When you sign up for our free guides, you first receive an email asking you to confirm your registration. Once you confirm, the message containing the guide downloads is triggered.
You can withdraw newsletter consent at any time for the future using the unsubscribe link in the relevant message or by contacting support@drinkguya.com. This does not retrospectively make earlier processing unlawful. After you unsubscribe, your data must no longer be used to send that newsletter. Necessary records of registration and unsubscription must be considered separately. Unsubscribing from a newsletter does not cancel an order or a product subscription.
Fulfilment, shipping and our own accounting
We use Koepfel 4PL to fulfil your order. Orders and shipping labels are handled through a shipcloud integration. The fulfilment and shipping providers involved receive the order and delivery data needed for this purpose. The legal basis for necessary contract performance is Article 6(1)(b) GDPR.
In our own accounting application, Dashboard, we store names, addresses and purchase details to document invoices and business transactions. Invoices and purchase records are retained after the ongoing customer relationship ends where, and for as long as, they are needed to meet applicable retention and documentation obligations or to establish, exercise or defend specific legal claims. The possibility of a future enquiry does not justify retaining all customer data indefinitely.
Payment processing
We use payment service providers, including Shopify Payments and PayPal, to process the payment methods offered during checkout. The data processed depend on the payment method you choose. The transaction and order details needed for payment, along with necessary contact and payment information, are transmitted to the providers involved. We use the payment status returned to us to process your order. Necessary payment processing is based on Article 6(1)(b) GDPR.
Payment providers may also process information as controllers in their own right, for example to meet their own legal obligations. Their information is available with the respective payment method; for PayPal, see the PayPal Privacy Statement. The Shopify information linked above explains Shopify's processing.
Cookies
Our website uses cookies. Cookies are small text files stored in your internet browser or by the browser on your computer system. When you visit a website, a cookie may be stored on your operating system. It contains a characteristic string of characters that allows the browser to be uniquely identified when you return to the website. We use cookies to make our services more user-friendly, effective and secure. Cookies also enable our systems to recognise your browser after you move to another page and to provide services to you. Some features of our website cannot be provided without cookies. They require the browser to remain recognisable after a page change.
We also use cookies on our website to analyse our visitors' browsing behaviour.
We also use cookies to reach visitors later on other websites with targeted, interest-based advertising.
Section 25 TDDDG governs the storage of or access to information on your device. Strictly necessary technical operations may qualify for an exemption from the consent requirement. Optional analytics and advertising purposes require your consent; the associated processing of personal data is based on Article 6(1)(a) GDPR. You can change your choices in the native Shopify dialogue and later through “Cookie settings” in the footer. Withdrawal takes effect for the future.
Pseudonymous identifiers may still constitute personal data. Pseudonymisation does not mean that identifying a person or linking the information with other data is generally impossible.
Cookies are stored on your computer, so you have control over their use. By choosing appropriate technical settings in your internet browser, you can prevent cookies from being stored and the data they contain from being transmitted. You can delete cookies already stored at any time. Please note that you may then be unable to use all features of this website to their full extent.
The following links explain how to manage cookies, including disabling them, in the main browsers:
Chrome browser: https://support.google.com/accounts/answer/61416?hl=de
Mozilla Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Safari: https://support.apple.com/de-de/guide/safari/manage-cookies-and-website-data-sfri11471/mac
Use of Google Analytics
Google Analytics analyses how this website is used and produces reports on website activity. This may involve processing cookie and device identifiers and information about pages viewed and interactions.
Optional analytics are based on your consent under Article 6(1)(a) GDPR. Where information is stored on or read from your device, section 25 TDDDG must also be observed. You can change your consent at any time for the future through “Cookie settings” in the footer. A pseudonymous identifier does not automatically mean anonymity or rule out linkage with other data.
Further information, including information about international data processing, is available in Google's Privacy Policy.
Advertising and performance measurement
As of 11.10.2026. Optional analytics, advertising and affiliate measurement are subject to your consent under Article 6(1)(a) GDPR. Section 25 of the German TDDDG also applies to storing or reading information on your device. You can change your choices through “Cookie settings” in the footer and withdraw consent for the future. Hashed or pseudonymous identifiers are not automatically anonymous.
Facebook and Instagram / Meta
Our Meta integration is set to “Maximum”: the Meta pixel, advanced matching and Conversions API are configured. These are used to analyse shop activities such as product views and purchases for advertising measurement and audience targeting. In addition to browser events, server-side transmission of purchase events is configured. Available contact details may be included for matching with Meta. About Meta data sharing.
Google and YouTube / Google Ads
Conversion tracking and enhanced conversions are enabled; Customer Match is disabled. The integration is configured for page and product views, searches, cart, checkout and purchase events. Depending on the event, the configured destination is Google Analytics, Google Ads or product listing measurement. Enhanced conversions may use contact details you provide in hashed form for attribution. An additional Google event integration includes the shipping method, items, quantity, order value, currency and coupon codes when shipping information is submitted. This serves to analyse the purchase journey, not to publish your order. About conversion measurement.
ChatGPT / OpenAI Ads
Our OpenAI Ads channel is connected and pixel access is enabled. The integration is used to attribute shop events to advertising interactions. When an ad is clicked, the “oppref” identifier may be stored in a first-party cookie and associated with later events. This is advertising measurement, not merely the provision of product catalogue data. About OpenAI conversion measurement.
A Pinterest tag integration for advertising measurement is configured. Shopify shows its access as automatically paused since 06.10.2026 because no signals were detected. Access may resume automatically when new referral or campaign signals occur; the pause is not permanent deactivation. About the Pinterest tag.
TikTok
A TikTok pixel integration for analytics and advertising is configured. It is intended to attribute shop activities to advertising and measure its performance. Processing events and technical identifiers is configured for this purpose. About TikTok data sharing.
Responsibility of advertising providers
For OpenAI advertising measurement, we and OpenAI generally act as independent controllers; different rules apply to narrowly defined processing on behalf of a controller. For EEA data, the OpenAI advertising data protection terms identify OpenAI Ireland Limited. Under the Conversion Terms, OpenAI may also use the data to provide, improve and develop its services.
Under the Pinterest terms, collection and transmission of activity data through the Pinterest tag involve joint responsibility with Pinterest Europe Ltd.; Pinterest’s subsequent processing is separate. Requests may also be addressed to Pinterest.
International data processing
Our companies are based in the USA and Canada. The providers described above may also process data outside the European Economic Area. Hosting our own applications on EU servers therefore does not mean that all data processing takes place in the EEA.
The Shopify data processing terms identify binding corporate rules for intra-group transfers and EU standard contractual clauses for other relevant transfers. Google’s advertising and analytics transfer information describes transfers under the EU-US Data Privacy Framework, where applicable, and standard contractual clauses. The hCaptcha privacy notice refers to standard contractual clauses for European data.
These statements describe the published arrangements of the respective named providers and do not mean that every provider we use is certified under the EU-US Data Privacy Framework. You may request information about the transfers relevant to your data and access to the corresponding safeguards at support@drinkguya.com.
Links to social networks
Our website includes links to our social network pages. Following such a link opens the relevant provider's service. Its privacy information applies there; if you sign in, usage information may be linked to your account with that provider. Signing in to a social network does not constitute general consent to every type of data processing by our shop.
Use of YouTube
We use the video embedding feature of YouTube LLC (901 Cherry Ave., San Bruno, CA 94066, USA; “YouTube”) on our website.
YouTube is part of Google. The provider's current privacy information applies to its processing.
This feature displays videos hosted on YouTube in an embedded player. Loading an external player may transmit technical data, such as your IP address and information about the page viewed, to the provider. Privacy-enhanced mode does not mean that all data processing is excluded. You can access the settings for optional purposes through “Cookie settings” in the footer.
More information about the collection and use of data by YouTube and Google, your related rights and ways to protect your privacy is available in YouTube's privacy information (https://www.youtube.com/t/privacy).
Retention and erasure
How long data are retained depends on the purpose of the processing concerned. Order and contract data are needed to process your order, fulfil an ongoing product subscription and handle related enquiries. These are distinct from records that are required for longer for accounting, statutory evidence or specific legal claims.
Newsletter data are used to send messages while you remain subscribed; after withdrawal of consent or unsubscription, they are no longer used for that purpose. Necessary records of registration, unsubscription and consent are treated separately. For support data, the relevant factors are the resolution of the enquiry and necessary records relating to contracts or claims. Technical operational and security data are used to provide and protect the systems; further use for other purposes requires a separate basis.
You may request erasure of your personal data at any time by contacting support@drinkguya.com. Whether, and to what extent, you have a right to erasure depends on the statutory requirements. Invoices and other necessary records cannot always be erased immediately along with other data. Conversely, data that are no longer needed must be erased even without a request if there is no lawful reason for further processing. A continuing customer relationship does not in itself entail indefinite retention.
Your rights as a data subject
Where the statutory requirements are met, you have the following rights under Articles 15 to 20 GDPR: access, rectification, erasure, restriction of processing and data portability.
You also have a right under Article 21(1) GDPR to object to processing based on Article 6(1)(f) GDPR, as well as to processing for direct marketing purposes.
You can send privacy enquiries to support@drinkguya.com. You may withdraw consent at any time for the future. You may object to direct marketing at any time without giving reasons; for other processing based on legitimate interests, you may object on grounds relating to your particular situation.
Right to complain to a supervisory authority
Under Article 77 GDPR, you have the right to complain to a supervisory authority if you believe that your personal data are not being processed lawfully.
Last updated: 12.10.2026