Body Pharm

Privacy policy

Last updated: 6 July 2026

1. Who we are

Body Pharm ("we", "us", "our") operates bodypharm.es ("the website"), and this privacy policy sets out how we gather and make use of your personal data. Should you need our company registration details, ask for them through our contact page.

For the personal data covered by this policy we act as the "data controller": it is we who determine the purposes and means of processing, in line with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

What we supply is meant solely for research and analytical work, and none of it is intended to be consumed by people or animals. We make no deliberate attempt to gather health data, and orders from anyone younger than 18 are not processed.

2. What data we collect

Account details. Should you open an account, we hold your name, email address, mobile phone number and date of birth (used to confirm that you are 18 or older), together with your password (kept only as a hash, so it cannot be read by us) and a note of whether you have agreed to receive marketing messages.

Orders and deliveries. The recipient name and Spanish postal address for delivery, what each order contained, your purchase history and spend, plus any messages you send us about an order.

Payments. PayTree, an external payment service provider, takes care of payments. Card details go straight to PayTree and never reach our systems; all we get back is minimal confirmation data (whether a payment went through, for instance, plus a transaction reference), which we need in order to complete your order.

Age and eligibility check. An eligibility check precedes your first purchase: in it you confirm that you are 18 or older and that you understand our products are meant for research use alone. Your individual answers to that check are not retained by us. As soon as eligibility is confirmed they are discarded, leaving only a note that it was granted and on what date. For age verification, your date of birth is held separately within your account.

Analytics and cookies. Google Analytics 4 (GA4) helps us see how the website is being used: device type, browser, rough location (inferred from the IP address), pages viewed and where visitors arrive from. Section 8 has more detail.

Support messages. When you write to us by email or WhatsApp, the content of your messages and your contact identifier are processed so that we can answer you and keep a record of the exchange.

3. Legal bases for processing

  • Contract performance: setting up and running your account, handling and delivering your orders, and supporting you with them.
  • Legal obligation: confirming that you are 18 or older, maintaining accounting and tax records, and complying with consumer protection rules.
  • Legitimate interests: running and safeguarding the website, understanding usage in aggregate, preventing fraud and answering enquiries.
  • Consent: optional marketing messages and non-essential (analytics) cookies. Your consent can be withdrawn whenever you wish.

4. How we use your data

Your data lets us set up, verify and run your account (age verification included); handle, fulfil and deliver orders and deal with returns; collect payment through our provider; send service notifications (email verification, order confirmations, dispatch and tracking updates); give you support; send marketing messages but only with your consent; detect and stop fraud and misuse; gauge and improve how the website performs; and satisfy the legal obligations that apply to us.

5. Marketing communications

Marketing messages go out only to people who have opted in. Withdrawing is possible at any moment: use the unsubscribe link in any marketing email, change your account settings, or reach us through our contact page. Opting out has no effect on the service messages we still need to send about your account or your orders.

6. Who we share your data with

Your personal data is never sold. It is passed on only where necessary, and only to the following: our payment service provider (PayTree); the fulfilment provider and the carriers that handle insured delivery to Spain — several are used and which one depends on the shipment; among them are Correos Express, SEUR, GLS, DHL and UPS; our analytics provider (Google/GA4), subject to your consent; WhatsApp/Meta, when that is the channel you use to reach us; IT, hosting and infrastructure providers, which act on our instructions; and advisers or authorities, where the law requires it. Every processor working on our behalf is under a contractual duty to protect your data.

7. Retention periods

  • Account data: held while the account remains open; after closure it is erased or anonymised, apart from records we are obliged to keep.
  • Order and transaction records: kept for as long as legal, accounting and tax duties demand (typically six to ten years).
  • Eligibility check answers: discarded the moment eligibility is granted; what remains is the fact and the date.
  • Support messages: held for a reasonable time, then erased.
  • Analytics: governed by the retention settings we have chosen in GA4 and Google.

8. Cookies

Essential cookies keep your session open, remember what is in your cart and support security; no consent is needed for them. Analytics cookies (GA4) track how the website is used and are placed only with your consent. Consent can be adjusted or withdrawn at any point, and your browser lets you block or delete cookies; bear in mind that blocking essential cookies can prevent parts of the website from working.

9. International data transfers

Certain providers (Google and Meta/WhatsApp, for instance) may handle data outside the European Economic Area (EEA). Whenever data leaves the EEA, we ensure a suitable safeguard applies, such as a European Commission adequacy decision or the EU standard contractual clauses, so that the protection your data enjoys is equivalent.

10. Your rights

The GDPR grants you the rights of access, rectification, erasure, restriction of processing, data portability, objection (which includes objecting to direct marketing at any time) and withdrawal of consent. Use our contact page to exercise any of them. Verification of your identity may be required; we reply within one month, a period that can be extended for complex requests. Normally no fee applies.

Should you be dissatisfied with the way we handle your data, a complaint can be lodged with a data protection supervisory authority. That said, we would welcome the opportunity to sort the matter out with you directly first.

11. Age restriction (over-18s only)

Both the website and our products are meant only for people who are 18 or older. We never knowingly gather data from anyone younger than 18, and any such data is erased as soon as we discover we hold it.

12. Security

Suitable technical and organisational safeguards are in place: data is encrypted in transit, passwords are hashed and access to personal data is restricted. Although no means of transmission or storage can be entirely secure, we take reasonable precautions to keep your information safe.

13. Changes to this policy

This policy may be revised from time to time. When that happens the "last updated" date at the top is amended and, for material changes, reasonable steps are taken to inform you.

14. Contact

Questions or requests about data protection can be sent through our contact page.