Privacy policy

Last updated: 1 October 2026

This privacy policy explains which personal data we process when you visit rocketfuelendurance.com, place an order, contact us, sign up for our newsletter or interact with our ads, why we do it, and what rights you have.

1. Controller

RocketFuel Endurance Ltd
Foti Pitta 11, Stella Court 8, Apt 203
7060 Livadia, Cyprus
Company registration no.: HE 476127
Director: Raphael Zimmer
Email: info@rocketfuelendurance.com

We have not appointed a data protection officer because we are not legally required to. For all privacy questions, write to the email address above.

2. Overview: what we process and on which legal basis

  • Running the website (server logs, security, essential cookies): Art. 6(1)(f) GDPR, our legitimate interest in a secure, working shop; for essential cookies also the exemption for strictly necessary storage under the ePrivacy rules.
  • Orders, payment, shipping, returns, customer account, support: Art. 6(1)(b) GDPR (contract and pre-contractual steps).
  • Keeping invoices and order records: Art. 6(1)(c) GDPR (legal retention duties under commercial and tax law).
  • Analytics, marketing and advertising cookies and pixels: Art. 6(1)(a) GDPR, your consent via our cookie banner. Without your consent these tools do not load.
  • Newsletter: Art. 6(1)(a) GDPR (consent, double opt-in).
  • Product recommendations by email to existing customers for similar products: Art. 6(1)(f) GDPR. You can object at any time, free of charge, via the unsubscribe link.
  • Fraud prevention: Art. 6(1)(f) GDPR.

3. Hosting and shop system (Shopify)

Our shop runs on Shopify, provided for merchants in Europe by Shopify International Ltd., Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, Ireland. Shopify processes all data needed to run the shop (contact and order data, IP address, device and browser data, shopping cart) on our behalf as a processor. Our store data is stored in the European Union. Shopify may transfer data to Shopify Inc. in Canada (adequacy decision) and to the USA (Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework). Details: shopify.com/legal/privacy, cookies: shopify.com/legal/cookies.

Shopify as an independent controller. For some features Shopify itself decides how data is used and is responsible for it under its own privacy policy. This includes Shop Pay and the Shop app, fraud prevention, and Shopify Network Intelligence: Shopify uses information about your interactions with stores on its platform (for example purchases, checkouts and email engagement) to improve and personalize its services and the features we use, such as abandoned checkout and other customer emails. Cookies or similar technologies for analytics or marketing are only used for this with your consent via our cookie banner. Details: shopify.com/legal/privacy.

When the browser connects, the server automatically records technical data (IP address, date and time, page requested, referrer, browser and operating system). We use this to deliver the site, fix errors and keep it secure (Art. 6(1)(f) GDPR).

4. Cookies and consent

Cookies and similar technologies (pixels, local storage) are used on our site. Strictly necessary ones (shopping cart, checkout, security, storing your cookie choice) always run. All others (analytics, marketing, advertising) only run after you click "Accept all" in the cookie banner or allow them under "Manage preferences". You can change or withdraw your consent at any time with future effect via the "Cookie preferences" link in the footer. Legal basis: Art. 6(1)(a) GDPR and the national rules implementing Art. 5(3) of the ePrivacy Directive (in Germany § 25 TDDDG).

5. Orders, payment and shipping

To process your order we collect name, billing and shipping address, email, phone number (optional unless the carrier needs it), order contents and payment status. We pass data to the following recipients only as far as needed:

  • Payment: Shopify Payments (card payments, Apple Pay, Google Pay and other methods shown at checkout; processed by Stripe Payments Europe Ltd., Dublin, Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Payment providers may run their own fraud and credit checks under their own privacy policies.
  • Warehouse and fulfillment: our logistics partner beliso in Germany, which picks, packs and ships your order (processor).
  • Shipping software: Sendcloud B.V., Stadionplein 10, 5616 RE Eindhoven, Netherlands, to create labels and tracking (processor).
  • Carriers: DHL, UPS or DPD depending on the destination and the option you choose. They receive name, address and, where needed for delivery notifications, email or phone number.
  • Address check: AddressHero (HeroSoftware GmbH, Germany) checks your shipping address at checkout to prevent failed deliveries (processor).
  • Tax reporting: SalesVAT Reports (Online VAT Services) and our tax advisors receive the order data needed for VAT returns.

Legal basis: Art. 6(1)(b) and (c) GDPR.

6. Customer account

If you create an account, we store your login data, addresses and order history so you can view them. You can delete your account at any time or ask us to do it (Art. 6(1)(b) GDPR).

7. Contact and customer service

If you contact us by email, contact form, live chat, Instagram or WhatsApp, we process your message and contact details to answer you (Art. 6(1)(b) or (f) GDPR). We use:

  • Re:amaze (GoDaddy Operating Company, LLC, USA) as our help desk and live chat (processor; Standard Contractual Clauses / EU-US Data Privacy Framework).
  • WhatsApp Business (WhatsApp Ireland Ltd. / Meta Platforms Ireland Ltd., Dublin) if you choose to message us on WhatsApp. Meta processes metadata under its own responsibility and may transfer data to the USA.
  • Google Workspace (Google Ireland Ltd., Dublin) for our business email (processor).

8. Newsletter and emails (MailerLite)

If you subscribe to our newsletter, take part in our Fuel Guide quiz with your email or fill in one of our surveys, we use MailerLite (UAB "MailerLite", J. Basanavičiaus 15, LT-03108 Vilnius, Lithuania) to send emails. We use double opt-in: you only receive the newsletter after confirming your address. We store sign-up time and IP address as proof. MailerLite measures whether emails are opened and which links are clicked so we can improve our emails. You can unsubscribe at any time via the link in every email. Legal basis: Art. 6(1)(a) GDPR.

As an existing customer we may also email you about similar products from our range (Art. 6(1)(f) GDPR in conjunction with the national rules implementing Art. 13(2) of the ePrivacy Directive). You can object at any time via the unsubscribe link without any costs other than basic transmission costs. We also send order-related service emails (for example order confirmation, shipping notice, a request for feedback) via Shopify and MailerLite.

9. Surveys, quiz and reviews

Fuel Guide quiz and surveys: answers to our Fuel Guide quiz and our customer feedback surveys (which may be hosted with Tally, Tally BV, Belgium, or Google Forms/Sheets, Google Ireland Ltd.) are used to recommend products and improve them. Survey participants receive a discount code for completing the survey (Art. 6(1)(a) or (b) GDPR).

Product reviews: we use Judge.me (Judge.me Ltd.) to collect and display reviews. After a purchase we may invite you to review your order. If you leave a review, your display name, rating, text and any photos are published. Reviews submitted in our feedback survey are only published if you chose to write one there. More on how we check reviews is shown next to the reviews (Art. 6(1)(a) and (f) GDPR).

10. Affiliate program (UpPromote)

We run an affiliate program with UpPromote (Secomapp, Vietnam). If you arrive via an affiliate link or use an affiliate code, UpPromote records the referral, the order number and order value so we can pay the affiliate a commission. If you apply to become an affiliate, we process your application data. Tracking cookies are only set with your consent (Art. 6(1)(a), (b) and (f) GDPR; transfers outside the EU based on Standard Contractual Clauses).

11. Analytics (only with consent)

  • Shopify Analytics: visit and conversion statistics within Shopify.
  • Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland): usage statistics with shortened IP addresses and pseudonymous identifiers; data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework).
  • Microsoft Clarity (Microsoft Ireland Operations Ltd., Dublin): heatmaps and session recordings to understand how the site is used. Input in form fields is masked. Data may be transferred to the USA (EU-US Data Privacy Framework).

Legal basis: Art. 6(1)(a) GDPR. Cookie lifetimes range from the session up to 13 months.

12. Advertising and conversion tracking (only with consent)

We advertise on other platforms and measure whether an ad led to a visit or purchase. With your consent, the following tools receive information such as pages viewed, products viewed, items added to cart, checkout and purchase (order value, products, order ID), together with online identifiers (cookie ID, ad click ID, IP address, device and browser data):

  • Meta Pixel and Conversions API (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland) for ads on Facebook and Instagram. For collecting and transmitting the data we are joint controllers with Meta under Art. 26 GDPR (Controller Addendum); Meta is solely responsible for the further processing. With the Conversions API, hashed contact data (for example a hashed email address) may be sent server-side to improve matching. Transfers to the USA: EU-US Data Privacy Framework.
  • Google Ads, Google Merchant Center and YouTube (Google Ireland Ltd., Dublin) for ads and product listings on Google and YouTube, including conversion tracking. Transfers to the USA: EU-US Data Privacy Framework.
  • OpenAI Ads (ChatGPT ads) (OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland). If you click one of our ads in ChatGPT, the link contains a click identifier. With your consent our OpenAI measurement pixel reports page views, product views, add to cart, checkout and purchases (order value, products, order ID) together with this click identifier, your IP address and browser data, so OpenAI can attribute the purchase to the ad and optimize delivery. OpenAI processes this data as an independent controller under its Ad Tools Data Processing Addendum; we do not send your chats, and OpenAI does not share your conversations with us. OpenAI may transfer data to the USA based on Standard Contractual Clauses.

Our shop links in ads also carry campaign parameters (utm_source, utm_campaign) so we can see in our own statistics which campaign brought a visit. Legal basis for all of the above: Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the cookie preferences in the footer.

13. Other shop functions

We use further Shopify apps that run on our behalf: Shopify Flow, Shopify Messaging, Shopify Bundles, Translate & Adapt and Hextom (translation and currency display), Essential Upsell (offers after checkout), Quantity Limit (order quantity limits) and Order Printer (invoices and packing slips). They process the order and session data needed for their function (Art. 6(1)(b) and (f) GDPR).

Withdrawal button: if you withdraw from your contract with the "Withdraw from contract" form on our website, we store the details you enter (name, email address and, if given, order number, dates, items and message) together with the date and time of receipt in Google Workspace (Google Ireland Ltd., Dublin, processor) and send you the confirmation of receipt by email. We need this to process your withdrawal and to prove receipt (Art. 6(1)(b) and (c) GDPR). We keep these records for as long as claims arising from the order can be asserted, generally up to 3 years after the end of the year of the withdrawal.

14. Transfers outside the EU/EEA

Some providers named above are located in, or transfer data to, countries outside the EU/EEA (in particular the USA). We only allow this where the European Commission has found an adequate level of protection (for example the EU-US Data Privacy Framework for certified companies, Canada, the UK, Switzerland) or where Standard Contractual Clauses under Art. 46(2)(c) GDPR are in place. You can request a copy of the safeguards from us.

15. How long we keep data

  • Order and invoice data: as long as commercial and tax law requires us to (generally 6 to 10 years from the end of the year of the order).
  • Customer account: until you delete it.
  • Support conversations: up to 3 years after the last contact, unless longer storage is required for legal claims.
  • Newsletter: until you unsubscribe; proof of consent for up to 3 years afterwards.
  • Analytics and advertising data: according to the cookie lifetimes shown in the cookie banner, at most 25 months.
  • Server logs: up to 30 days, longer only to investigate security incidents.

16. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent at any time with future effect (Art. 7(3)). To exercise them, email info@rocketfuelendurance.com.

Right to object (Art. 21 GDPR): where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to direct marketing at any time without giving reasons; we will then stop using your data for this purpose.

Right to complain: you can lodge a complaint with a data protection supervisory authority, in particular in your country of residence or work. Our lead authority is the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus (dataprotection.gov.cy).

17. No automated decisions, no obligation to provide data

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). You are not obliged to provide personal data, but without the data needed for an order we cannot conclude or fulfill the contract.

18. Children

Our shop is not aimed at children under 16. We do not knowingly collect their data.

19. Changes

We update this policy when our services or the law change. The current version is always available on this page.