Privacy policy

1. Data Controller

The data controller responsible for data processing on this website is:

Unlock You UG (haftungsbeschränkt)
Represented by: Roman Kikos
Rudolfplatz 3
D-50674 Köln
Germany
Email: info@skinless-swim.com

The data controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).

2. Data Collection When Visiting Our Website

When you access our website, information of a general nature is automatically collected. This information (server log files) includes, among other things, the type of web browser, the operating system used, the domain name of your internet service provider, your IP address (shortened where applicable) and similar.

This data is processed in particular for the following purposes: ensuring a smooth connection to the website, ensuring smooth use of our website, evaluating system security and stability, and for other administrative purposes.

We do not use your data to draw conclusions about your person. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest follows from the purposes for data collection listed above. This data is not shared with third parties.

For security reasons, our website uses SSL encryption for the transmission of sensitive data.

3. Hosting and Platform

Our online shop is operated via the Shopify platform (Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify processes personal data on our behalf. Data processing is based on our legitimate interest in an efficient and secure online shop (Art. 6 (1) (f) GDPR). We have concluded a data processing agreement with Shopify. Further information: https://www.shopify.com/legal/privacy

Our domain and email inbox (info@skinless-swim.com) are hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you contact us by email, your message and the personal data it contains are processed on servers operated by STRATO. Data processing is based on our legitimate interest in reliable domain and email operation (Art. 6 (1) (f) GDPR). We have concluded a data processing agreement with STRATO. Further information: https://www.strato.de/datenschutz/

4. Orders and Customer Accounts

When you place an order or create a customer account in our online shop, we collect and process the following personal data: name, address, email address, telephone number where applicable, and payment information. This data is required for the performance of the purchase contract. The legal basis is Art. 6 (1) (b) GDPR (contract performance).

Deletion of your customer account is possible at any time upon request. Your data will be deleted after the expiry of the statutory tax and commercial law retention periods, unless you have expressly consented to further use of your data.

5. Cookies

Our online shop uses cookies. Cookies are small text files that are stored in the internet browser or by the internet browser on the user's computer system. Technically necessary cookies are set on the basis of Art. 6 (1) (f) GDPR, as they are required for the technically error-free and optimised operation of our website. All other cookies (e.g. analytics or marketing cookies) are only set with your express consent in accordance with Art. 6 (1) (a) GDPR.

6. Cookie Consent Tool

We use a cookie consent tool to obtain valid consent for cookies requiring consent. The tool is displayed as an interactive interface when the page is accessed. Cookies requiring consent are only loaded after corresponding consent has been given. The legal basis is Art. 6 (1) (f) and (c) GDPR.

7. Contact

If you contact us (e.g. by email or contact form), we process the data you provide exclusively to handle your inquiry. The legal basis is Art. 6 (1) (f) GDPR or Art. 6 (1) (b) GDPR if your inquiry relates to a contract. Your data will be deleted once the matter has been conclusively resolved.

8. Email Marketing / Newsletter

8.1 Newsletter: If you have subscribed to our newsletter, we use your email address to regularly send information about our offerings. We use a double opt-in procedure. The legal basis is Art. 6 (1) (a) GDPR. You can unsubscribe from the newsletter at any time via the unsubscribe link contained in each newsletter email or by notifying info@skinless-swim.com. For sending newsletters we use Shopify Email (Shopify International Limited, see Section 3).

8.2 Back-in-stock notifications: For temporarily unavailable products, you may request a one-time email notification. We use a double opt-in procedure. The legal basis is Art. 6 (1) (a) GDPR.

8.3 Cart reminders: If you abandon your purchase before completing the order, you may opt in to receive a one-time reminder email. We also use a double opt-in procedure here. The legal basis is Art. 6 (1) (a) GDPR.

9. Order Processing and Payment Providers

9.1 To process deliveries and payments, we pass the necessary personal data to the commissioned shipping companies and payment service providers in accordance with Art. 6 (1) (b) GDPR.

9.2 We use the following payment providers, among others:

PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Legal basis: Art. 6 (1) (f) GDPR.

Shopify Payments: processed via Shopify International Limited and Stripe Payments Europe Ltd. Further information: https://www.shopify.com/legal/terms-payments

Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Where payment methods involving advance performance by Klarna are used, personal data is transmitted for the purpose of a credit check. Legal basis: Art. 6 (1) (f) GDPR.

Apple Pay: Apple Distribution International, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.

Google Pay: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

10. Shipping Service Providers

To process shipping, we pass on your name, delivery address and, where applicable, your email address and telephone number to the commissioned shipping service provider. The legal basis is Art. 6 (1) (b) GDPR (contract performance) and Art. 6 (1) (f) GDPR (legitimate interest in efficient processing).

11. Web Analytics – Google Analytics 4

We use Google Analytics 4 provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Cookies are set that collect information about your use of our website. Your IP address is shortened. Data may also be transferred to Google LLC in the USA; Google has joined the EU-US Data Privacy Framework. Use is based exclusively on your explicit consent pursuant to Art. 6 (1) (a) GDPR. You may withdraw your consent at any time via our cookie consent tool. Collected data is deleted after two months.

12. Retargeting and Conversion Tracking – Meta Pixel

We use the "Meta Pixel" service with advanced matching provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Processing is based exclusively on your consent pursuant to Art. 6 (1) (a) GDPR. You may withdraw your consent at any time via our cookie consent tool. We have concluded a data processing agreement with Meta. Meta has joined the EU-US Data Privacy Framework.

13. TikTok

13.1 TikTok Pixel: We use the TikTok Pixel provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, for conversion tracking. Use is based exclusively on your explicit consent pursuant to Art. 6 (1) (a) GDPR. You may withdraw your consent at any time via our cookie consent tool. We expressly note that TikTok (ByteDance Ltd.) may transfer data to servers in the USA and possibly other third countries, including the People's Republic of China. TikTok relies on Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR for such transfers. Further information: https://www.tiktok.com/legal/page/eea/privacy-policy/en

13.2 TikTok Business Profile: We maintain a business profile on TikTok. TikTok processes personal data as an independent controller in accordance with its own privacy policy. The legal basis for our presence is Art. 6 (1) (f) GDPR.

14. Website Analysis – Microsoft Clarity

We use Microsoft Clarity provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Use is based exclusively on your explicit consent pursuant to Art. 6 (1) (a) GDPR. You may withdraw your consent at any time via our cookie consent tool. Microsoft has joined the EU-US Data Privacy Framework. Further information: https://privacy.microsoft.com/en-us/privacystatement

15. Social Media

We maintain online presences within social networks in order to communicate with customers and interested parties. When you access our social media profiles, data may be processed by the respective platform operators. We refer to the privacy policies of the respective providers.

16. Your Rights as a Data Subject

You have the following rights with regard to your personal data:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent (Art. 7 (3) GDPR)
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Right to object: Where we process your personal data on the basis of a balancing of interests under Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation. If you object, we will cease processing unless we can demonstrate compelling legitimate grounds. Where your data is processed for direct marketing purposes, you have the right to object to such processing at any time.

To exercise your rights, please contact: info@skinless-swim.com

17. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR.

18. Storage Period

Personal data is stored for as long as necessary for the respective processing purpose: for consent-based processing until consent is withdrawn; for statutory retention periods until their expiry; for legitimate-interest-based processing until the right to object is exercised. Otherwise, data is deleted as soon as it is no longer required for the processing purpose.

19. Changes to This Privacy Policy

We reserve the right to adapt this privacy policy to ensure that it always complies with current legal requirements or to implement changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.

Last updated: August 2026