Privacy policy

Last updated: 4 October 2026

Protecting your personal data is important to us. In this privacy policy, we inform you which personal data we process when you visit and use our online shop PIQ | Energypouches.de, for what purposes this is done, on what legal bases the processing is carried out and what rights you have.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

SCL&DG Labs GmbH
Heimstättenstraße 3
89077 Ulm
Germany

Phone: +49 (0) 17862525-04
Email: hello(at)energypouches.de

Represented by the managing director David Fichtner.

2. Which personal data we process

Depending on how you use our online shop, the following categories of personal data in particular may be processed:

• contact details such as name, address, email address and phone number;

• billing and delivery data;

• order, contract and transaction data;

• payment information;

• customer account and login data;

• content of your communication with us;

• information about returns, complaints and refunds;

• IP address as well as device, browser and network information;

• usage data such as pages viewed, interactions and access times;

• cookie, consent and similar technical identifiers;

• information about the origin of a visit, for example via an advertisement or an affiliate link.

We receive this data in particular directly from you, automatically when you use our online shop, and from service providers and partners involved in providing our services.

3. Purposes and legal bases

We process personal data in particular:

• to provide and technically secure our online shop;

• to carry out orders and contracts;

• to process payments and shipping;

• to handle customer enquiries, returns and complaints;

• to manage customer accounts;

• for fraud prevention and IT security;

• to carry out newsletter and marketing activities;

• to measure reach and optimise our advertising;

• to provide reviews and affiliate functions;

• to comply with legal obligations.

Processing is carried out in particular on the following legal bases:

Art. 6(1)(b) GDPR, where processing is necessary for the performance of a contract or pre-contractual measures.

Art. 6(1)(c) GDPR, where we are subject to a legal obligation.

Art. 6(1)(f) GDPR, where processing is necessary to protect our legitimate interests or those of a third party and your interests or fundamental rights do not override them.

Art. 6(1)(a) GDPR, where you have given us your consent.

Where information is stored on or read from your device, this is done – where necessary – on the basis of your consent pursuant to § 25(1) TDDDG. § 25(2) TDDDG applies to strictly necessary processes.

4. Shopify and provision of the online shop

Our online shop is operated via the e-commerce platform Shopify.

Among other things, Shopify provides us with the technical infrastructure for our online shop, checkout, customer accounts, orders and other shop functions.

In particular, IP address, device and browser information, contact and customer data, order information, payment and transaction information, and information about the use of our shop may be processed.

Depending on the specific function, Shopify processes personal data on our behalf or, for certain of its own services, under its own data protection responsibility.

Further information on data processing by Shopify can be found in Shopify's privacy information.

5. Orders and customer account

When you place an order with us or use a customer account, we process the data required to perform the contract.

These include in particular:

• name;

• billing and delivery address;

• email address and, where applicable, phone number;

• products ordered;

• order and transaction information;

• payment and shipping information;

• where applicable, data on returns, complaints or refunds.

Processing is carried out in particular on the basis of Art. 6(1)(b) GDPR.

Where statutory retention obligations exist, further storage is based on Art. 6(1)(c) GDPR.

6. Payment processing

We work with external payment service providers to process payments.

Which payment providers are used depends in particular on the payment method you select at checkout.

In particular, name, billing address, payment amount, transaction information and the data required to carry out the respective payment may be processed.

Processing is generally carried out to perform the purchase contract pursuant to Art. 6(1)(b) GDPR.

The respective payment service provider's own privacy terms may additionally apply to its processing.

7. Shipping and delivery

To process and deliver your order, we transmit the necessary data to the shipping, logistics and, where applicable, fulfilment service providers we use.

In particular, name, delivery address, order information and – where necessary – email address or phone number may be processed.

Processing is carried out on the basis of Art. 6(1)(b) GDPR.

8. Cookies and consent management

We use cookies and comparable technologies.

Technically necessary technologies may be used insofar as they are required to provide our online shop and functions you have expressly requested.

For technologies that are not technically necessary, we use a consent management system. This allows you to give, refuse and later change or withdraw your consent.

To manage and document your choice, the following information in particular may be processed:

• your consent decision;

• time and, where applicable, version of the consent;

• technical device and browser information;

• pseudonymous identifiers.

Analytics, marketing and tracking technologies that are not technically necessary are generally only activated after you have given your consent.

You can change your selection at any time via the cookie or privacy settings of our online shop.

The specific consent provider currently used may change without the purpose or nature of this processing changing significantly.

9. Analytics, tracking and online marketing

With your consent, we use analytics and marketing technologies to evaluate the use of our online shop, measure the effectiveness of our advertising and optimise our advertising campaigns.

The following data in particular may be processed:

• IP address or information derived from it;

• device and browser information;

• pseudonymous identifiers;

• pages and products viewed;

• interactions with our online shop;

• origin of a website visit;

• shopping cart and purchase events;

• information about the effectiveness of advertisements.

Google

For analytics, measurement and marketing purposes we use services from Google, in particular – depending on the current configuration – Google Analytics, Google Ads and Google Tag Manager or related measurement and conversion technologies.

The information processed may be used to analyse the use of our shop, measure conversions, create target groups and evaluate or optimise advertising campaigns.

For users in the European Economic Area, Google Ireland Limited in particular is involved in connection with various Google measurement services.

Meta

With your consent, we use services from Meta, in particular Meta Business Tools such as the Meta Pixel or comparable measurement and advertising technologies.

This allows us, for example, to understand whether users perform certain actions in our online shop after seeing an advertisement and to measure and optimise our advertising on Facebook and Instagram.

Data may be transmitted to companies of the Meta group, in particular Meta Platforms Ireland Limited.

TikTok

With your consent, we use services from TikTok, in particular TikTok business, measurement and advertising technologies such as the TikTok Pixel or comparable technologies.

These serve in particular to measure the effectiveness of TikTok advertising and optimise campaigns.

For users in the European Economic Area, data may be transmitted to TikTok Technology Limited or affiliated companies.

The use of analytics and marketing technologies that are not technically necessary is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG.

You can withdraw your consent at any time with effect for the future via our cookie settings.

You can also see which specific analytics and marketing technologies are currently activated in the cookie and privacy settings of our online shop.

10. Newsletter and marketing communication

For newsletters, email marketing and other marketing communication, we use in particular Brevo or PushOwl/Brevo.

If you subscribe to our newsletter or comparable marketing communication, we process in particular your email address and any other information you provide.

In addition – where legally permissible and, where applicable, with your consent – technical information on the delivery and use of our messages may be processed, such as delivery status, opens or clicks.

Processing for marketing purposes is generally based on your consent pursuant to Art. 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in our emails.

Transactional and service emails in connection with an order remain unaffected.

11. Forms and contact

If you contact us via a form, by email, by phone or by other means, we process the information you provide to handle your enquiry.

In particular, name, email address, phone number, order number and the content of your message may be processed.

Where your enquiry relates to an existing or planned contract, processing is based on Art. 6(1)(b) GDPR.

For other enquiries, it is based in particular on our legitimate interest in handling enquiries efficiently pursuant to Art. 6(1)(f) GDPR.

We may use external form service providers to technically provide forms.

12. Customer reviews

We use an external review service provider to collect, display and manage product and customer reviews and, where applicable, to send review requests after an order.

The following data in particular may be processed:

• name or display name;

• email address;

• order and product information;

• star rating given;

• review text;

• technical information about the review.

Depending on the specific function, processing is based in particular on Art. 6(1)(f) GDPR or your consent pursuant to Art. 6(1)(a) GDPR.

Our legitimate interest lies in particular in presenting authentic customer experiences and improving our offering.

The specific review service provider used may change without the described purpose of processing changing significantly.

13. Affiliate and referral programmes

We operate affiliate, creator and referral programmes and use external affiliate and referral service providers for this purpose.

If you visit our online shop via an affiliate or referral link, the following information in particular may be processed:

• affiliate or referral ID;

• origin of the website visit;

• pseudonymous technical identifiers;

• information about referred orders and their value.

Where cookies or comparable technologies are used and consent is required, they are only used after your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG.

For affiliate and creator partners, we also process the contact, billing and commission data required to perform the respective contract on the basis of Art. 6(1)(b) GDPR.

The specific affiliate service provider used may change.

14. Security and fraud prevention

We process personal data where necessary to protect our online shop, customer accounts and transactions against fraud, misuse, unauthorised access or other security-related incidents.

For example, IP addresses, device information, login information and order and transaction information may be processed.

The legal basis is in particular Art. 6(1)(f) GDPR.

Our legitimate interest lies in the security of our online shop, the protection of our customers and the prevention of fraud and misuse.

15. Recipients of personal data

Where necessary for the respective purposes, personal data may be disclosed in particular to the following categories of recipients:

• e-commerce and hosting providers;

• IT and technical service providers;

• payment service providers;

• shipping, logistics and fulfilment providers;

• newsletter and communication providers;

• analytics, advertising and marketing providers;

• consent management providers;

• review service providers;

• affiliate and referral providers;

• tax advisors, legal advisors or other professional advisors;

• authorities and public bodies where there is a legal obligation.

Where service providers process personal data exclusively on our behalf, we conclude – where required – data processing agreements with them pursuant to Art. 28 GDPR.

16. International data transfers

Some of the service providers we use or their subcontractors may also process personal data outside the European Economic Area.

Where personal data is transferred to a third country, we ensure – where necessary – appropriate data protection safeguards.

These may include in particular:

• an adequacy decision by the European Commission;

• a valid certification under the EU-US Data Privacy Framework;

• standard contractual clauses of the European Commission;

• where applicable, supplementary technical and organisational measures.

For individual services, data may also technically be processed by affiliated companies outside the European Union.

17. Storage period

We generally only store personal data for as long as necessary for the respective processing purpose or as required by statutory retention obligations.

Order, invoice and business data may be retained for several years due to commercial and tax law obligations.

Data from customer enquiries is generally deleted once the enquiry has been fully processed and there are no legal or legitimate reasons for further storage.

Newsletter data is generally processed until you unsubscribe or withdraw your consent.

Consent information may be stored for an appropriate period where necessary to demonstrate that consent was obtained or withdrawn.

Once the respective purpose no longer applies and statutory retention periods have expired, the data will be deleted or anonymised.

18. Your data protection rights

Subject to the statutory requirements, you have in particular the following rights:

• Right of access pursuant to Art. 15 GDPR;

• Right to rectification pursuant to Art. 16 GDPR;

• Right to erasure pursuant to Art. 17 GDPR;

• Right to restriction of processing pursuant to Art. 18 GDPR;

• Right to data portability pursuant to Art. 20 GDPR;

• Right to object pursuant to Art. 21 GDPR;

• Right to withdraw consent with effect for the future.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Right to object under Art. 21 GDPR

Where we process personal data on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such marketing.

This also applies to profiling insofar as it is related to such direct marketing.

19. Withdrawal of cookie and tracking consents

You can change or withdraw consents for non-essential cookies, analytics, tracking and marketing technologies at any time with effect for the future via the cookie or privacy settings of our online shop.

Withdrawal does not affect the lawfulness of processing carried out up to the withdrawal.

20. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

For companies based in Baden-Württemberg, the competent authority is in particular the:

State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg)

Irrespective of this, you can also contact another data protection supervisory authority that is competent for you.

21. Data of minors

Our online shop is not specifically aimed at children.

We do not knowingly collect personal data from children where a legally required consent has not been given.

Should we become aware that a child's personal data has been processed unlawfully, we will take appropriate measures and delete the data concerned unless there is a legal basis for further processing.

22. External websites and social networks

Our online shop may contain links to external websites and to our profiles on social networks and other platforms.

If you follow such a link, you leave our online shop. The respective provider's own privacy terms apply to subsequent data processing.

Simply linking to an external service does not automatically mean that personal data is transmitted to that provider when you visit our online shop.

23. Changes to this privacy policy

We may amend this privacy policy if our data processing, the services we use or legal requirements change.

The current version is published in our online shop.

The date of the last update can be found at the beginning of this privacy policy.

24. Contact for data protection questions

If you have any questions about this privacy policy, wish to exercise any of your data protection rights or have other questions about the processing of your personal data, please contact:

SCL&DG Labs GmbH
Heimstättenstraße 3
89077 Ulm
Germany

Phone: +49 (0) 17862525-04
Email: hello(at)energypouches.de