Privacy policy

Fatboy Bikes Europe GmbH

Date: 10-08-2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Fatboy Bikes Europe GmbH

Hermann-Köhl-Straße 19, 89160 Dornstadt, Germany

Represented by the Managing Directors Vanessa Miller and Eduard Kalinowski

Telephone: +49 176 67414091

Email: hello@fatboybikes.com

We are not required to appoint a data protection officer. For any data protection questions, please use the contact details above.

2. Your rights

You have the following rights in relation to your personal data:

• Access to the data we process (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

A message to the contact details above is enough to exercise these rights. Exercising them is free of charge.

Right to object

Where we process your data on the basis of legitimate interests, you have the right to object at any time on grounds relating to your particular situation. Where we process your data for direct marketing, you may object at any time without giving reasons. We will then no longer process your data for that purpose.

Right to complain

You have the right to complain to a data protection supervisory authority. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany

You may also complain to the supervisory authority in the country where you live or work.

3. Website hosting

Our shop runs on the Shopify platform. The provider for the European Economic Area is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

When you visit our website, data transmitted by your browser is processed automatically, in particular IP address, date and time of access, page accessed, volume of data transferred, browser type and operating system.

Purpose: technical provision, stability and security of the website.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of the website.

Retention: server log files are stored by Shopify only for as long as necessary to provide and secure the website, and are then deleted. Details follow from the data processing agreement with Shopify.

Shopify processes this data on our behalf. A data processing agreement under Art. 28 GDPR is in place.

4. Cookies and consent

We use cookies and similar technologies on our website.

Technically necessary cookies are required to operate the shop, for example for the basket and the order process. The legal basis is Art. 6(1)(f) GDPR together with the applicable national implementation of the ePrivacy Directive.

All other cookies, in particular for statistics and marketing, are only used with your consent. The legal basis is Art. 6(1)(a) GDPR. You can change or withdraw your consent at any time with effect for the future via the cookie settings in the footer.

5. Orders and customer accounts

When you place an order we process your details such as name, address, billing and delivery address, email address, telephone number and your order and payment data.

Purpose: performance of the purchase contract, shipping, invoicing, customer service, guarantee and warranty handling.

Legal basis: Art. 6(1)(b) GDPR for performance of the contract and Art. 6(1)(c) GDPR to meet commercial and tax retention obligations.

Retention: we delete your data once it is no longer needed for the purpose. Invoicing and accounting records are kept for ten years under German commercial and tax law, other business correspondence for six years. You can ask us to delete your customer account at any time.

6. Payment processing

We use payment service providers to process payments. They receive the data needed for processing and handle it under their own responsibility and their own privacy policies. Your full payment details are not disclosed to us.

Legal basis: Art. 6(1)(b) GDPR.

The following payment methods are available:

• Credit card (American Express, Mastercard, Visa), Maestro and UnionPay via Shopify Payments, Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland
• Shop Pay, also via Shopify International Limited
• Apple Pay, Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland
• Google Pay, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg
• Klarna, including pay later and instalments, Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. This payment method is offered through the Shopify checkout.

If you choose a Klarna payment method, Klarna carries out an identity and credit check under its own responsibility. Please see Klarna's privacy information for details and for your rights.

7. Shipping and logistics

To deliver your order we pass your name, delivery address and, where needed for delivery notification, your email address and telephone number to the carrier.

Legal basis: Art. 6(1)(b) GDPR.

We work with DHL Express, a business unit of Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany.

8. Contacting us and customer service

For handling customer enquiries and managing tickets we use Gorgias, provided by Gorgias Inc., 768 Harrison Street, Suite 2, San Francisco, CA 94107, USA. The chat function is used to capture and route enquiries automatically. The system is shared across the group and operated by Fatboy Bikes Australia, so your enquiries may also be processed in Australia.

9. Newsletter

We use Klaviyo, provided by Klaviyo Inc., 125 Summer Street, Boston, MA 02110, USA, to send our newsletter.

When you sign up we process your email address and, to document your consent, the time of sign-up.

We measure whether and when you open our emails and which links you click, in order to tailor our newsletter to your interests.

Legal basis: Art. 6(1)(a) GDPR.

You can unsubscribe at any time using the link in every email or by contacting us. After unsubscribing we keep your email address on a suppression list to make sure you receive no further newsletters.

The service is shared across the group and operated by Fatboy Bikes Australia, so your data may also be processed in Australia.

10. Product reviews

Customer reviews are displayed on our product pages. For this we use Loox, provided by Loox Ltd., 40 Tuval Street, Ramat Gan, Israel. We process your name or chosen display name, your review and any images you upload. Further information is available in Loox's privacy policy: https://loox.app/legal/privacy-policy-end-users

The service is shared across the group and operated by Fatboy Bikes Australia, so your data may also be processed in Australia.

11. Web analytics

We use analytics tools to improve what we offer. They use cookies and similar technologies and are only activated with your consent.

Shopify Analytics: analysis of how our shop is used, by Shopify International Limited, Dublin, Ireland.

Google Analytics 4: a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies that allow your use of the website to be analysed. The data collected may be transferred to Google servers in the USA.

Legal basis: Art. 6(1)(a) GDPR.

12. Advertising and reach measurement

We use tools to target our advertising and measure how well it performs. Data about your usage behaviour may be transmitted to the relevant providers and combined with profiles held there. These tools are only used with your consent.

Google Ads: provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it to measure the success of our ads and to reach visitors to our website again.

Meta Pixel: provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The Meta Pixel lets us understand how effective our ads on Facebook and Instagram are and build audiences. We are joint controllers with Meta for the collection and transmission of the data within the meaning of Art. 26 GDPR. Any further processing by Meta is Meta's sole responsibility.

Klaviyo: in addition to sending our newsletter, we use Klaviyo to analyse usage behaviour on our website so we can tailor our communication to your interests.

Legal basis: Art. 6(1)(a) GDPR.

13. Embedded content and social media

We embed videos from our own YouTube channel on some pages. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The videos are embedded in privacy-enhanced mode. Only when you start a video does your browser connect to YouTube's servers and transmit data, in particular your IP address and information about the device you are using. If you are logged in to YouTube at the same time, YouTube can link your usage to your profile.

Legal basis: Art. 6(1)(a) GDPR.

We also maintain profiles on Instagram, Facebook, YouTube and TikTok. When you visit those profiles, the privacy policies of the respective providers apply. Our website only contains links to them.

14. Transfers outside the European Union

Some of the providers we use process data outside the European Union. Transfers only take place where an adequacy decision of the European Commission exists, where appropriate safeguards such as standard contractual clauses or binding corporate rules are in place, or where you have consented.

Shopify: the contracting party for the European Economic Area is Shopify International Limited in Ireland. Transfers within the Shopify group are based on binding corporate rules. An adequacy decision of the European Commission exists for Canada, where the parent company is based.

Klarna is based in Sweden, within the European Union. Klaviyo and Gorgias are based in the USA. Transfers are based on standard contractual clauses or the EU-US Data Privacy Framework.

Loox is based in Israel. An adequacy decision of the European Commission exists for Israel.

Some systems are shared across the group and operated by Fatboy Bikes Australia, which means data is also transferred to Australia. There is no European Commission adequacy decision for Australia.

15. Automated decision-making

If you choose a Klarna payment method, Klarna carries out an automated identity and credit check under its own responsibility. On the basis of that check, Klarna decides whether the chosen payment method can be offered. Klarna is the controller for this processing. Please see Klarna's privacy information for details and for your rights, in particular your right to contest the decision and to express your point of view.

Otherwise, automated decision-making, including profiling, which produces legal effects concerning you does not take place.

16. Data security

We use an encrypted connection to transmit your data. We take appropriate technical and organisational measures to protect your data against loss and unauthorised access.

17. Changes to this privacy policy

We update this privacy policy when our processing or the legal requirements change. The version published on this page applies.