Privacy Policy

Last updated: September 21, 2026

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Jannis Kilikowski
trading as DEFINED MOTION
Am Damm 1
24983 Handewitt
Germany

Email: contact.definedmotion@gmail.com
Phone: +49 15679 819303

2. Scope

DEFINED MOTION operates an online shop for digital products, in particular PDF training plans, nutrition guides, and other digital guides.

Our sales offering is aimed at customers in Germany, the Member States of the European Union for which we have enabled access, and the United States of America. We currently do not ship physical goods.

This privacy policy explains which personal data we process when you:

visit our shop;
place an order;

download digital content;

use a customer account;
subscribe to our newsletter;
submit a review;
exercise legal rights or withdrawal options;
contact us.

Personal data is information relating to an identified or identifiable person.

3. Legal bases under the GDPR

We process personal data primarily on the following legal bases:

Art. 6(1)(a) GDPR: based on your consent, in particular for newsletters and analysis, personalization, or marketing measures that require consent;
Art. 6(1)(b) GDPR: for the performance of pre-contractual measures and for the fulfillment of a contract;
Art. 6(1)(c) GDPR: for the fulfillment of legal obligations, in particular tax-related documentation and retention obligations;
Art. 6(1)(f) GDPR: to safeguard legitimate interests, in particular for secure and reliable shop operation, for handling general inquiries, for preventing abuse, and for the assertion or defense of legal claims.

Where we rely on legitimate interests, we take into account your interests, fundamental rights, and freedoms.

4. Processed data categories and data sources

Depending on your usage, we may process, in particular, the following data:

Identity and contact data: name, email address, billing address, and, if applicable, telephone number;
Account data: customer ID, login information, language settings, and order history;
Order data: purchased products, shopping cart contents, order number, order date, payment status, refunds, and complaints;
Payment information: selected payment method, transaction IDs, and truncated payment information;

Download information: products provided, download access, and technical details regarding provision;

Declaration and evidence data: consents, permissions, newsletter registrations, and withdrawal notices;
Communication data: messages, inquiries, and voluntarily submitted attachments;
Technical data: IP address, browser, operating system, device information, access times, error logs, and cookie IDs;
Usage data: pages visited, interactions, shopping cart activities, and shop functions used;
Review data: review text, star rating, published name or pseudonym, as well as voluntarily provided images or videos.

We receive this data:

directly from you;
automatically when using our shop;
from Shopify;
from payment service providers;
from service providers used for downloads and other shop functions.

We ask that you do not provide us with any health data or other particularly sensitive data without an explicit request from us.

5. Shopify and technical shop operation

Our online shop is operated via Shopify. Shopify International Limited in Ireland is generally responsible for platform services in the European Economic Area.

Shopify provides, in particular, the following functions:

hosting and technical page delivery;
shopping cart and checkout;
customer accounts;
order management;
payment integration;
market, language, and currency functions;
privacy and cookie settings.

In doing so, the contact, account, order, payment status, device, and usage data required for these functions are processed.

Legal bases are Art. 6(1)(b) GDPR for contract processing and Art. 6(1)(f) GDPR for secure and reliable shop operation.

In providing the shop platform, Shopify processes data partly as a data processor. For certain of its own services and extended Shopify functions, Shopify may act as an independent controller.

Even with a primary hosting location within the European Union, processing by Shopify companies or subcontractors outside the EU or the European Economic Area may take place.

Further information:

https://www.shopify.com/legal/privacy/consumers

https://www.shopify.com/legal/dpa

6. Shopify Network Intelligence

Shopify Network Intelligence is enabled in our shop.

In this context, Shopify may process information about visits, interactions, and purchases in our shop to provide extended services. This information may be aggregated with data from interactions with Shopify and other merchants.

The extended Shopify services may serve the following purposes in particular:

analysis and measurement;
personalization of services;
improvement of Shopify products and functions;
detection of fraud and abuse;
provision and measurement of advertising services.

This may concern, in particular, customer IDs, contact, device, usage, transaction, and privacy preference data.

To the extent that Shopify processes data for its own purposes as part of these extended services, Shopify acts as an independent controller in accordance with its terms.

Where consent is required for analysis, personalization, or advertising purposes, processing is based on Art. 6(1)(a) GDPR. For access to an end-user device that requires consent, § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act) additionally applies.

You can change your selection via the privacy or cookie settings provided in the shop.

Further information:

https://www.shopify.com/legal/privacy/consumers

https://privacy.shopify.com/

7. Access data, cookies, and privacy settings

When visiting our shop, the following data is processed for technical reasons in particular:

IP address;
time of access;
pages accessed;
browser and device information;
information about technical errors and security incidents.

This processing serves the provision, stability, and security of the shop. The legal basis is Art. 6(1)(f) GDPR.

We use Shopify's privacy and cookie functions to capture and manage your selection.

Technically necessary cookies and similar technologies enable, in particular:

shopping cart and checkout;
login and customer accounts;
security functions;
storage of language, market, and privacy settings.

Insofar as the storage or reading of information is strictly necessary for an explicitly requested service, this is done on the basis of § 25(2) no. 2 TDDDG. The further processing of personal data is based, depending on the purpose, on Art. 6(1)(b) or (f) GDPR.

Non-essential cookies and comparable technologies for analysis, personalization, or marketing are only used for affected users after the required consent has been obtained. The legal bases are § 25(1) TDDDG and Art. 6(1)(a) GDPR.

You can change or revoke your consent at any time with effect for the future via the cookie or privacy settings.

We currently have no advertising pixels of our own from Meta, TikTok, or Pinterest, and no integration of Google Analytics or Google Ads. Irrespective of this, the described Shopify functions remain possible.

8. Customer accounts and orders

For the setup and use of a customer account, we process in particular:

email address;
customer ID;
login information;
order history;
language and market setting.

When an order is placed, we process the necessary contact, billing, product, and transaction data. This serves the processing of the order, payment, the provision of digital content, as well as the handling of inquiries, withdrawals, refunds, and complaints.

The legal basis is Art. 6(1)(b) GDPR. We fulfill legal documentation and retention obligations on the basis of Art. 6(1)(c) GDPR.

You may request the deletion of your customer account. Data that must continue to be stored due to legal obligations remains unaffected and will be restricted to the necessary purposes.

9. Payment processing

For payment processing, we use Shopify Payments as well as the payment services you select at checkout, such as PayPal.

In doing so, the following data may be processed in particular:

name and billing details;
order amount and currency;
selected payment method;
transaction information;
technical security and fraud prevention data.

Complete card, account, or access details are generally processed directly by the respective payment service. We primarily receive the information required for the allocation and confirmation of a payment.

The legal basis is Art. 6(1)(b) GDPR. Measures for fraud prevention and payment security may be based on Art. 6(1)(f) GDPR.

Payment providers may process data under their own responsibility, in particular for the fulfillment of legal obligations as well as for security, fraud, and, if applicable, credit checks.

Information on PayPal:

https://www.paypal.com/de/legalhub/paypal/privacy-full

For other payment services, the privacy information of the respective provider provided during checkout applies additionally.

10. Provision of digital content with Fileflare

We use Fileflare for the provision and security of digital downloads. The provider is Kestrel Commerce, LLC, USA.

In doing so, the following data may be processed in particular:

name and email address;
customer and order ID;
purchased products;
download status and download access;
IP address;
browser information;
time of access.

Processing for the provision of purchased digital content is based on Art. 6(1)(b) GDPR.

Protection against unauthorized access and abuse is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the protection of our digital content and in the proper execution of the contract.

Further information:

https://fileflare.io/legal/privacy/

11. Documentation of consent for immediate provision

Before the immediate provision of digital content, we collect the required consent from affected consumers for the commencement of contract performance before the expiry of the withdrawal period and confirmation of awareness regarding the potential loss of the right of withdrawal resulting from this.

For the checkbox during checkout, we use "TC Terms and Conditions Checkbox" by Gm Infotech Inc. Additional confirmation may be provided via Fileflare.

In doing so, the following data may be processed in particular:

content and status of the declaration provided;
order number;
email address;
date and time;
technical evidence data.

The legal bases are Art. 6(1)(b) and (c) GDPR. To the extent that storage is necessary for the assertion or defense of legal claims, Art. 6(1)(f) GDPR also applies.

This declaration solely concerns the provision of digital content. It does not constitute consent to advertising or tracking that requires consent.

Provider information:

https://apps.shopify.com/terms-and-condition-checkbox

12. Electronic withdrawal function

We provide an electronic withdrawal function via an app from 401layers UG (limited liability).

When used, we process in particular:

name and email address;
order and contract details;
content of the withdrawal notice;
date and time of receipt.

Processing serves the receipt, confirmation, handling, and documentation of the withdrawal.

The legal bases are Art. 6(1)(b) and (c) GDPR. Necessary storage for the assertion or defense of legal claims may be based on Art. 6(1)(f) GDPR.

13. GemPages and translations

For the design of our shop pages and forms, we use GemPages by GemCommerce.

When accessing relevant pages, technical information such as IP address, browser, and device information may be processed. If you use a form, the data you enter is also processed.

Technical page display is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in a functional and clearly designed online shop.

For contract-related inquiries, processing is based on Art. 6(1)(b) GDPR.

Newsletter registrations via a GemPages form are transmitted to Shopify. The newsletter regulations below apply to this.

Further information:

https://gempages.net/pages/privacy

To manage translated shop content, we use Shopify Translate & Adapt. Language and regional settings are processed within the Shopify platform to display the appropriate shop version.

14. Newsletter

You can subscribe to our email newsletter with news and offers from DEFINED MOTION.

Registration takes place via a form integrated into the shop. We use the double opt-in procedure. You will receive a message with a confirmation link. The registration is only completed after confirmation.

We process in particular:

Email address;
Time of registration;
Time of confirmation;
Technical proof of data;
Unsubscription information.

Management and dispatch are handled via the email marketing functions provided by Shopify.

The legal basis for sending the newsletter is your consent in accordance with Art. 6 (1) (a) GDPR. Newsletter registration is not a prerequisite for making a purchase.

You may revoke your consent at any time with effect for the future, in particular via the unsubscribe link in every newsletter email or by sending a message to contact.definedmotion@gmail.com.

Required registration and unsubscription records may be stored in a restricted manner beyond the point of unsubscription, insofar as this is necessary to fulfill legal obligations to provide evidence or to defend against claims.

Evaluation of the newsletter

Tracking of email opens is deactivated.

Shopify may continue to provide technical metrics regarding deliveries, link clicks, unsubscriptions, and spam reports. Click data can, if applicable, be assigned to individual recipients.

We process technical delivery information and unsubscriptions, as necessary, for reliable dispatch and to respect your unsubscription.

Personalized evaluation of link clicks for analysis or optimization purposes only occurs for affected users if the necessary consent has been provided for this.

15. Reviews with Loox

We use Loox for the management and display of product reviews.

When leaving a review, the following data may be processed in particular:

Review text;
Star rating;
Name or pseudonym;
Email address;
Product reviewed;
If applicable, order information;
Voluntarily provided images or videos.

Information marked as public is published in the shop. The email address is not published as part of the review.

The publication of a voluntarily submitted review is based on your consent in accordance with Art. 6 (1) (a) GDPR.

Technical management, verification of authenticity, and prevention of abuse are performed, as necessary, on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in reliable reviews and protection against manipulated or unlawful content.

Review requests via email are only sent if there is a sufficient legal basis for doing so.

Further information:

https://loox.app/

16. Contacting us and Gmail

When you contact us via email, telephone, or a contact form, we process your contact details and the content of your inquiry.

For contract-related inquiries, Art. 6 (1) (b) GDPR is the legal basis. We handle general inquiries on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in proper communication and the processing of incoming requests.

Our contact email address is provided via Google's Gmail. In this process, the following data may be processed in particular:

Sender and recipient addresses;
Subject and message content;

Attachments;

Technical transmission information.

Further information:

https://policies.google.com/privacy?hl=en

Please send us only the information required for your inquiry and, if possible, no health data or other particularly sensitive information.

17. Recipients of personal data

We transmit personal data to the service providers mentioned in this privacy policy, insofar as this is necessary for the described purposes and a legal basis exists.

This includes, in particular:

Shopify and affiliated companies;
Payment service providers;
Fileflare;
Providers of integrated Shopify apps;
Email and communication service providers;
IT and security service providers.

Other recipients may include tax advisors, legal advisors, authorities, courts, or other public bodies, insofar as transmission is legally required or necessary for the enforcement or defense of legal claims.

18. International data transfers

Some service providers and their subcontractors are located outside the European Union or the European Economic Area or process personal data there.

This also applies if you reside within the European Union and the primary hosting location of our shop is within the EU.

For transfers to third countries, the requirements of Art. 44 et seq. GDPR apply.

Depending on the recipient, the following transmission bases, in particular, may be used:

An adequacy decision by the European Commission;
The EU-US Data Privacy Framework for appropriately certified US companies and covered processing scope;
EU Standard Contractual Clauses;
Other legally recognized protective measures.

Information regarding the guarantees used for a specific transfer can be requested at contact.definedmotion@gmail.com.

19. Storage period

We only store personal data for as long as it is required for the respective purpose or as long as statutory retention obligations exist.

The following criteria apply in particular:

Order and provision data: for contract fulfillment, processing of potential claims, and the duration of agreed access to digital content;
Invoicing and business documents: in accordance with statutory tax and commercial retention periods;
Customer account data: until account deletion or the purpose ceases to exist, provided no retention reasons prevent this;
Newsletter data: until unsubscription; required consent and unsubscription records may be stored in a restricted manner beyond this;
Consent-based analysis data: until consent is revoked or the analysis purpose ceases, provided no other legal basis exists;
Contact, revocation, and complaint data: until final processing and, if necessary, until the expiration of relevant retention or limitation periods;
Reviews: until removal, revocation of an underlying consent, or the purpose ceases to exist, provided no further legal reasons for storage exist.

Insofar as data is stored solely due to legal obligations, its further use is limited to the required purposes.

20. Necessity of providing data

We require the data marked as required in the ordering process to carry out the order and to provide digital content.

Without this data, we may not be able to conclude or fulfill the contract.

Additional voluntary information, newsletter registrations, and reviews are not required for a purchase.

21. Automated decisions

We do not ourselves make any exclusively automated decisions in the sense of Art. 22 GDPR that have legal effects on you or significantly affect you in a similar way.

Shopify, payment providers, or other service providers may perform automated security, fraud, or credit checks. Information about such processing and possible rights can be obtained from the respective provider.

22. Rights under the GDPR

Under the statutory requirements, data subjects have the following rights in particular:

Access in accordance with Art. 15 GDPR;
Rectification in accordance with Art. 16 GDPR;
Erasure in accordance with Art. 17 GDPR;
Restriction of processing in accordance with Art. 18 GDPR;
Data portability in accordance with Art. 20 GDPR;
Objection in accordance with Art. 21 GDPR;
Revocation of consent in accordance with Art. 7 (3) GDPR;
Complaint to a data protection supervisory authority in accordance with Art. 77 GDPR.

The revocation of consent is effective for the future. The lawfulness of processing carried out until the revocation remains unaffected.

Right to object

If we process personal data on the basis of Art. 6 (1) (f) GDPR, you may object at any time for reasons relating to your particular situation.

You may object to the processing of your data for direct marketing purposes at any time without providing reasons. This also applies to any associated profiling.

To exercise your rights, a message suffices to:

contact.definedmotion@gmail.com

If there are reasonable doubts about your identity, we may request additional information necessary to confirm your identity.

23. Data protection rights in the United States

Depending on your US state and whether the legal application requirements of the respective data protection law are met, you may have the following rights in particular:

Information about the personal data processed;
Confirmation of whether your data is being processed;
Rectification of inaccurate data;
Erasure of personal data;
Receipt of a transferable copy of certain data;
Objection to the sale of personal data;
Objection to the sharing for cross-contextual advertising or targeted advertising;
Restriction of certain uses of sensitive personal data;
Objection to certain forms of profiling;
Protection against discrimination for exercising your data protection rights;
If applicable, appeal against the denial of a data protection request.

These rights exist only insofar as the applicable law provides for them and its requirements are met.

We do not sell personal data for monetary consideration.

Depending on the legal classification, certain Shopify functions, in particular Shopify Network Intelligence and associated advertising or personalization services, may qualify as "sharing," "targeted advertising," or similar disclosure within the meaning of individual US data protection laws.

Insofar as a legal right to object exists, you can exercise it via the data protection or cookie settings provided in the shop or by sending a message to contact.definedmotion@gmail.com.

Where technically supported and legally required, we honor recognized opt-out signals such as the Global Privacy Control.

We do not use sensitive personal data to infer characteristics about an individual. Full payment details are generally processed by the payment service providers used.

To process a data protection request, we may request information to appropriately verify your identity and state of residence. An authorized agent may submit a request insofar as applicable law allows and corresponding authorization is proven.

We do not discriminate against you for exercising a legal data protection right.

24. Categories of personal data for US users

Insofar as a categorized presentation is required under US data protection law, we have processed the following categories in particular during the preceding twelve months:

Identifiers and contact details;
Customer and account information;
Commercial information such as order and product history;
Internet and electronic network activity;
Device and cookie identifiers;
Transaction and payment status data;
Communication and review content.

The sources, purposes of use, and recipient categories are derived from the relevant sections of this privacy policy.

We store this data according to the criteria mentioned in Section 19 and no longer than is necessary for the described purposes or legal obligations.

25. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular at your habitual residence, place of work, or the place of an alleged data protection breach.

The competent authority for our company headquarters is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein
Holstenstraße 98
24103 Kiel
Germany

Email: mail@datenschutzzentrum.de
Website: https://www.datenschutzzentrum.de/

US users may also contact the competent data protection or consumer protection authority of their state, insofar as this is provided for under applicable law.

26. Minors

Our digital content may in part be aimed at adolescents. The processing of personal data is governed by the respective applicable legal requirements.

Our shop is not specifically targeted at children under 13 years of age. We do not knowingly collect personal data from children under 13 without the necessary consent of parents or legal guardians.

Insofar as consent of legal guardians is required for consent-based online services under European or national law, this must be obtained.

Consent under data protection law and legal capacity to enter into a purchase contract are to be assessed separately from one another.

If you suspect that the personal data of a child has been processed unlawfully, please contact us at contact.definedmotion@gmail.com.

27. Data security and external links

We implement appropriate technical and organizational measures to protect personal data. This includes, in particular, encrypted data transmission and access restrictions.

However, no data transmission or electronic storage can guarantee complete security.

Our shop may contain links to external websites or social media profiles. When accessing these external offers, the privacy policies of the respective operators apply.

28. Changes to this privacy policy

We update this privacy policy if: