Privacy Policy

Information on the processing of personal data in the Shopify online store Fightora

Controller: CALVERTON sp. z o.o.

Scope: fightora.de, Orders, Customer Account and Customer Service

Stand: 31. August 2026

In accordance with the General Data Protection Regulation (GDPR), we use this privacy policy to inform you about what personal data we process when using fightora.de, for what purposes, to whom data is transferred and what rights you have.

Controller and contact

The controller within the meaning of the GDPR is:

CALVERTON sp. z o.o.

51 Lwowska Street, lok. 409

22-100 Chełm, Poland

KRS: 0000508285  |  NIP: 7792421524  |  REGON: 302713479

E-Mail: info@fightora.de

Website: https://fightora.de

Please use the above e-mail address for data protection inquiries if possible.

What data we process

Depending on how you use our shop, we may process the following data in particular:

•      Master and contact data, such as name, billing and delivery address, e-mail address and telephone number;

•      Order and contract data, such as products, shopping cart, order number, price, returns, complaints and status of delivery;

•      Payment and billing data, such as the selected payment method, payment status and transaction reference. We do not regularly receive complete card or account access data; these are processed by the payment service provider;

•      Account Data when you create a Client Account, including login and preference details;

•      Communication Data from inquiries, support, reviews, or other correspondence;

•      Usage and Device Data, such as IP address, browser type, operating system, timestamp, pages viewed, shopping cart events and technical logs;

•      Consent and preference data, such as newsletter sign-up, cookie selection and objections.

We generally receive this data directly from you, automatically from your device or - if necessary - from payment, shipping and platform service providers.

Purposes and legal bases

Provision of the shop and IT security

When we access the shop, we process technical data in order to deliver pages, provide functions, detect errors and ward off misuse and attacks. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of the shop.

Shopping cart, order, payment and delivery

We process your data in order to provide the shopping cart and checkout, accept your order, process payments, ship goods from Poland, process returns and send contract-related messages. The legal basis is Art. 6 (1) (b) GDPR. Insofar as data is required to comply with statutory accounting, tax, consumer or documentation obligations, the processing is based on Art. 6 (1) (c) GDPR.

Customer account

If you create a customer account, we process the necessary information to set up and manage the account and to display your orders. The legal basis is Art. 6 (1) (b) GDPR. Shopping as a guest remains possible if the shop offers this function in the checkout.

Customer service, complaints and legal claims

We process inquiries and communications in order to support you, to process warranty and consumer rights and to establish, exercise or defend against claims. The legal basis is Art. 6 para. 1 lit. b, c and f GDPR. Our legitimate interest consists in efficient customer service and legal documentation.

Fraud prevention and payment security

To prevent fraud, abuse and payment defaults, order, device and transaction data can be checked and risk signals processed. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in protecting our customers, our systems and our assets.

Newsletters and electronic advertising

As a matter of principle, we only send newsletters and comparable electronic advertising with your consent in accordance with Art. 6 (1) (a) GDPR and the applicable regulations for electronic communications. To the extent legally permissible, advertising for our own similar products to existing customers may be based on our legitimate interest; you can object to this at any time. You can revoke your consent at any time via the unsubscribe link or by e-mail with effect for the future.

Analytics, personalization, and advertising

We only use non-essential analysis, personalization and marketing technologies if you have given your consent via the consent banner. The legal basis for the subsequent processing is Art. 6 (1) (a) GDPR. Your consent is voluntary and can be revoked at any time via "Cookie settings".

Product reviews and content

If a rating function is activated, we process your information for the purpose of publishing and moderating the review and preventing misuse. Depending on the structure, the processing is based on your consent or on Art. 6 (1) (f) GDPR. Do not publish any personal data of third parties.

Necessity of the information

The information marked as mandatory fields is required for the conclusion of the contract, payment or delivery. Without this information, we may not be able to fulfill the order. Voluntary information is marked accordingly or recognizably optional for the respective function.

Recipients and categories of recipients

We only transmit personal data if this is necessary for the purposes mentioned, if there is a legal obligation or if you have consented. Recipients may be in particular:

•      Shopify and affiliates as providers of the store, hosting, checkout, and security infrastructure;

•      the payment service provider selected at the checkout and, where applicable, banks and fraud prevention providers;

•      Shipping, logistics and fulfillment service providers for delivery from Poland and handling returns;

•      IT, support, email, analytics and marketing service providers, to the extent that the respective features are enabled;

•      tax advisors, accountants, legal advisors, insurers and other advisors professionally bound by confidentiality;

•      Authorities, courts or other bodies if we are legally obliged to disclose or if this is necessary for law enforcement.

Insofar as service providers process data exclusively in accordance with our instructions, we conclude the necessary order processing agreements. Some payment or platform services act as independent controllers for certain processing; in these cases, their data protection notices also apply.

Shopify

Our online shop is operated via Shopify. For merchants with a billing address in Poland, Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland is usually the contractual partner. Shopify processes shop and customer data as part of the platform services as a processor in accordance with our instructions.

Shopify may also be responsible for individual of its own or extended services, in particular for Shop Pay, Shop or - if activated - Shopify Network Intelligence and Enhanced Services. Information about interactions with our shop may be used for personalized shopping experiences, measurement and advertising. For more information, please see the Shopify Consumer Privacy Policy. Privacy options vis-à-vis Shopify can  be exercised through the Shopify Privacy Portal.

Data transfers outside the EEA

Shopify, payment, analytics or other service providers may also process personal data outside the European Economic Area (EEA), for example in Canada, the USA or other countries. A transfer will only take place in compliance with Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision, binding internal data protection regulations, the standard contractual clauses of the European Commission or a legal exception. If necessary, additional protective measures will be examined and agreed. You can request information on the relevant safeguards at datenschutz@fightora.de.

Cookies and similar technologies

We use cookies, local storage, pixels and similar technologies. We distinguish between the following:

•      Necessary technologies: They are required for security, shopping cart, checkout, language settings, load balancing and consent storage. Their use is based on Art. 6 (1) (b) or (f) GDPR and - if your device is accessed - on the legal exception for technically necessary processes.

•      Preference, analysis and marketing technologies: They will only be used after your consent. The legal basis is Art. 6 (1) (a) GDPR in conjunction with the applicable regulations on access to terminal equipment, in particular the Polish Prawo komunikacji elektronicznej and, to the extent applicable in Germany, § 25 TDDDG.

An up-to-date overview of the technologies used, providers, purposes and storage periods is displayed in the consent banner under "Cookie settings". There you can change or revoke your selection at any time. Blocking necessary cookies can limit the function of the shop.

Storage period

We only store personal data for as long as is necessary for the respective purposes. After that, it will be deleted or anonymized, unless there are legal retention obligations or legitimate reasons for further storage. As a rule, the following criteria apply:

•      Order, invoice and tax-related documents are generally stored for five years from the end of the relevant calendar or tax year in accordance with Polish commercial, accounting and tax law requirements; longer deadlines may apply in individual cases;

•      Data on warranty, complaints and legal claims will be stored until the expiry of the applicable limitation and proof periods;

•      Customer account data will be stored for the duration of the account and thereafter only to the extent required by legal obligations or legal claims;

•      Support requests are retained until final processing and then for a reasonable period of evidence;

•      Marketing data will be stored until you withdraw your consent or until you object to it. A minimum blocking information can be retained so that your wish is permanently respected;

•      Cookie and log data are stored according to the durations specified in the cookie settings or only for as long as necessary for security and error analysis.

Your rights

Under the legal conditions, you have the following rights in particular:

•      Information about your personal data (Art. 15 GDPR);

•      Correction of inaccurate or completion of incomplete data (Art. 16 GDPR);

•      deletion of your data (Art. 17 GDPR);

•      Restriction of processing (Art. 18 GDPR);

•      Data portability in the case of automated processing based on consent or a contract (Art. 20 GDPR);

•      objection to processing on the basis of Art. 6 para. 1 lit. e or f GDPR as well as at any time to direct marketing (Art. 21 GDPR);

•      Revocation of consent with effect for the future; the lawfulness of the previous processing remains unaffected.

To exercise your rights, write to datenschutz@fightora.de. We may request additional identity verification information in case of reasonable doubt.

Right of appeal

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or alleged infringement. CALVERTON sp. z o.o. is generally responsible in Poland:

President of the Office for Personal Data Protectionul. Stanisława Moniuszki 1A00-014 Warsaw, Poland

Internet: https://uodo.gov.pl

Automated decision-making and profiling

As a matter of principle, we do not make exclusively automated decisions that have a legal effect on you or that similarly significantly affect you. Automated risk signals can be used for fraud prevention or payment security. If a significant decision is not made by the respective payment service provider who is independently responsible, we will check suspicious processes appropriately. Analysis and advertising profiles are only created within the framework of your consent and have no comparable legal effect for you.

Minors

Our shop is aimed at adult buyers. Products for children are ordered by parents or other persons of legal age. We do not ask minors to submit personal data without the consent of their legal representatives.

Data security

We and our service providers use appropriate technical and organizational measures to protect personal data from loss, misuse, unauthorized access, alteration and disclosure. This includes, in particular, encrypted transmission, access and authorization concepts, security measures and procedures for the detection and handling of security incidents. However, no Internet service can guarantee absolute security.

External links and third-party services

Our shop may contain links to external websites, social networks or services. If you call up such a link or actively use a service, the respective provider processes data under its own responsibility. Please note their privacy policy.

Changes to this Privacy Policy

We will update this privacy policy if the shop, service providers used or the legal situation change. The current version is available on fightora.de. In the event of significant changes, we will provide appropriate information via the shop or via other suitable channels.

Applicable data protection framework

In particular, the GDPR, the Polish Data Protection Act of 10 May 2018 and the applicable regulations on electronic communication and terminal access apply to our data processing. Since fightora.de is also aimed at customers in Germany, mandatory rights under German and European law as well as the jurisdiction of other European supervisory authorities remain unaffected.