Privacy Policy

1. Controller

BioBoostX
Grabarska 1
Pegaz Building B
Wroclaw 50-079
Poland
+49 1551 0400976
Email: info@BioBoostX.com
No Data Protection Officer has been appointed; please use the contact above for privacy requests.

2. Scope of this Policy

This Policy applies to our website, online store, and related communications (email/support). It does not cover third-party websites linked from our site.

3. Legal Bases (GDPR)

• Art. 6(1)(b) GDPR — contract or pre-contract measures
• Art. 6(1)(c) GDPR — legal obligations (e.g., tax/commerce)
• Art. 6(1)(a) GDPR — consent (e.g., cookies/marketing, where applicable)
• Art. 6(1)(f) GDPR — legitimate interests (e.g., security, fraud prevention, usability)

4. Data We Process, Purposes & Recipients

Website access & logs

When you visit our site, our servers temporarily store: IP address, date/time, request/URL, referrer, user agent, device/OS, and error codes.
Purpose: ensure technical delivery, security (e.g., DDoS mitigation), and analytics in aggregate.
Legal basis: Art. 6(1)(f) GDPR.

Orders & customer service

We process identification and order data (e.g., name, address, email, products, prices, payment status, messages) to process and fulfil your purchase and respond to inquiries.
Legal basis: Art. 6(1)(b) and (c) GDPR.

Payments

Payments are processed via selected providers. Depending on the method, the following recipients may receive your payment data (amount, order ID, card/account number, fraud prevention data):

• PayPal (Europe) S.à r.l., 22-24 Boulevard Royal, L-2449 Luxembourg
• Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden
• Visa Europe Services, London, United Kingdom
• Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium
• American Express Europe S.A., Theodor-Heuss-Allee 112, 60486 Frankfurt am Main, Germany
• SEPA transfers: your bank & our payment service provider (e.g., Wise Payments Europe SA, Belgium)
• Crypto payments: blockchain network participants (pseudonymous data only)

Legal bases: Art. 6(1)(b) and 6(1)(f) GDPR; where required, Art. 6(1)(a).

Shipping

To deliver your order, we transmit delivery data to logistics partners:

• DHL Paket GmbH, Bonn, Germany
• Deutsche Post AG, Bonn, Germany

Legal basis: Art. 6(1)(b) GDPR.

Support & email

If you contact us, we process your message and contact details to handle your request.
Legal basis: Art. 6(1)(b) or 6(1)(f) GDPR.

Cookies & similar tech

We use necessary cookies for site operation (e.g., shopping cart, session). Non-essential (analytics/marketing) cookies are used only with your consent and can be withdrawn at any time.
Legal basis: Art. 6(1)(a) GDPR; necessary cookies: Art. 6(1)(f) GDPR.

5. Cookies & Consent Management

Our site uses a Consent Management Platform (CMP). You can manage your preferences via our cookie banner or your browser settings. Where consent is required, we store proof of consent (timestamp, preferences, device/browser). You may withdraw consent at any time with effect for the future.

6. Processors & Third Parties

We use service providers for hosting, payment, shipping, analytics and store operation. These providers process data solely under our instructions and on the basis of Art. 28 GDPR agreements.

7. International Transfers

Some providers (e.g., PayPal, Google, Cloudflare) may process data outside the European Economic Area (EEA). In such cases, we ensure appropriate safeguards (e.g., Standard Contractual Clauses of the EU Commission, adequacy decisions).

8. Retention Periods

• Order & invoice data: statutory retention (typically 6–10 years under tax/commercial law).
• Support tickets: generally 12–24 months after closure, unless longer required.
• Server logs: typically 30–90 days, unless needed for incident investigation.
• Cookies: per cookie lifetime; consents until withdrawal + required audit period.

9. Security

We implement appropriate technical and organizational measures (TOMs) to protect data, including access controls, encryption in transit, least-privilege policies and regular reviews. Nevertheless, no method is 100% secure on the Internet.

10. Your Rights

• Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17), Restriction (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time (Art. 7(3)), without affecting prior processing
• Complain to a supervisory authority (Art. 77)

To exercise your rights, contact us at info@BioBoostX.com. To protect your data, we may need to verify your identity.

11. Children's Data

Our website and products are intended for professional research use only and not directed to children under 16. We do not knowingly collect data from children.

12. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

13. Changes to this Policy

We may update this Policy as our services evolve or legal requirements change. If significant changes are made, we will inform users via our website or email. The current version is indicated below.