Privacy
The German version of this privacy policy is legally binding. This translation is provided for convenience only.
Controller
The controller within the meaning of the GDPR is:
Sapple GmbH
Major-von-Morandell-Platz 6
39052 Kaltern an der Weinstraße (BZ)
Italy
Represented by Kassian Goess Enzenberg
Email: info@sapple.com
At a glance
This privacy policy applies to the online shop sapple.com. We only process your personal data as far as necessary to run the shop, handle your orders and for the purposes described below. Services for statistics, marketing and external media are only loaded once you agree in the cookie banner.
Hosting, database and technical support
The shop is hosted by Vercel Inc. (USA). The server functions run in the Frankfurt am Main region (fra1). When you open a page, Vercel processes technically necessary data such as your IP address, your browser identifier and the requested address in order to deliver the page and keep the service secure. Product images and other media are stored in the storage service Vercel Blob. We do not store any customer data there. Vercel also derives your country from your IP address so that we can show the delivery date and shipping costs for your country in advance. We do not store the country, only your browser remembers it for the current session (sessionStorage).
Customer accounts, orders, reviews and submissions from the contact and newsletter forms are stored in a Postgres database by Neon Inc. (USA). The database is located in Frankfurt am Main (AWS region eu-central-1).
Vercel and Neon are based in the USA. Access from the USA, for example as part of support, cannot be completely ruled out. For this case the standard contractual clauses of the European Commission apply (Art. 46(2)(c) GDPR).
Technical support for the shop and for an internal management dashboard, in which we handle orders, customer accounts, enquiries and reviews, is provided by Webfromtom LLC as a service provider acting on our behalf.
The legal basis is the performance of your order (Art. 6(1)(b) GDPR) and our legitimate interest in a secure and reliable operation of the shop (Art. 6(1)(f) GDPR).
Customer account
You can also order as a guest without a customer account. If you create an account, we store your first name, last name, email address and your password. The password is only stored as a hash value, not in plain text. Optionally, your phone number and the addresses in your address book are added. In your account you can see your orders and manage your data. Registration is protected by Cloudflare Turnstile (see below).
If you tick the box for marketing emails during registration, in your profile or at checkout, we store this consent. You can remove it at any time in your profile or via the unsubscribe link in any of our marketing emails.
The legal basis is Art. 6(1)(b) GDPR, and for marketing emails your consent (Art. 6(1)(a) GDPR). If you would like your account deleted, write to us at info@sapple.com.
Orders
For your order we store your name, email address, phone number, billing and shipping address, the products ordered, any discount code used, the chosen payment method and the order status including shipment tracking. We pass your phone number on to the shipping provider for delivery.
The legal basis is the performance of the purchase contract (Art. 6(1)(b) GDPR) and our statutory retention obligations (Art. 6(1)(c) GDPR).
Shipping
We ship your order through the logistics provider OMEST GmbH/SRL in Bolzano. For this we transmit your name, shipping address, phone number, email address, order number and the items ordered via the shipping platform euShipments. OMEST hands the parcel over to a courier, which receives this information for delivery. The legal basis is Art. 6(1)(b) GDPR.
Payment
Payments by card, Apple Pay and Google Pay are processed by Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). You enter your card details directly into Stripe's input fields, we do not see them. We transmit your name, email address, phone number, billing and shipping address, order number and amount to Stripe. Stripe creates a customer record for this. Stripe may also transfer data to the USA and is certified under the EU-US Data Privacy Framework. If you use Apple Pay or Google Pay, Apple or Google additionally process your data under their own privacy policies.
If we offer PayPal as a payment method, we redirect you to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg for the payment. In doing so we transmit the order number and amount. If you pay directly via the PayPal button, we take your name, email address, shipping address and phone number from your PayPal account for the order.
With payment in advance you transfer the amount to our bank account. Your bank passes on the details of the transfer to us, such as name, IBAN and payment reference.
The legal basis is Art. 6(1)(b) GDPR.
Emails
Order confirmation, payment confirmation for bank transfers, shipping confirmation, review request and the password reset email are sent via Resend (Resend Inc., USA) from the address bestellung@sapple.com. Sending runs through servers in Ireland. For this, Resend receives your email address and the content of the respective email. Notifications about orders and form submissions to our own mailbox are also sent via Resend. Any transfer to the USA is based on the standard contractual clauses of the European Commission.
Reviews and review requests
When you order from us, we send you a single email about 14 days after your order asking for a review. The legal basis is our legitimate interest in feedback on the products you bought from us (Art. 6(1)(f) GDPR), within the rules for existing customers. You can opt out with one click at any time and free of charge via the “No more review requests” link in that email, or simply send us a short message.
If you write a review, via the link in the email or with the form on the product page, we store your display name, your email address, your star rating, your text and optionally a title and sport. Anyone can leave a review, no order is required. If you review on the product page, we match your email address against the orders in our online shop. If there is a paid order, we mark the review as “Verified purchase” and link it to that order. Otherwise we only use your email address if we have a question about your review. Only the display name, stars, title, text, sport and date are published. We do not publish your email address. The form on the product page is protected by Cloudflare Turnstile (see below). You can ask us to delete your review at any time.
Contact form
If you write to us via the contact form, we store your name, email address, subject, message and language in our database and forward the enquiry by email to info@sapple.com. We only use this information to answer your enquiry. To prevent spam, the form is protected by Cloudflare Turnstile (see below), an invisible check field and a limit on requests per IP address. For this limit, we only keep the IP address briefly in working memory and do not store it.
The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns an order, otherwise our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR).
Newsletter
If you sign up for the newsletter via the form on the website, we first send you an email with a confirmation link (double opt-in). You are only subscribed once you confirm there. As proof of your consent, we store your email address, the chosen language and the times of signup and confirmation. After confirmation we receive a notification by email. The form is protected by Cloudflare Turnstile (see below).
If you tick the box for email updates when registering a customer account or later in your profile, we send you the same confirmation email. In that case, too, you are only subscribed to the newsletter once you confirm.
If you tick the box “Yes, send me updates about new products and promotions by email” at checkout, this also counts as a newsletter signup, without an additional confirmation email. We then store your email address, language and the time. If you are signed in to your customer account at that moment, we also record the consent there.
We use the address to send you news about sapple, new products and promotions. After a confirmed signup you also receive our welcome series (see Email series).
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, via the unsubscribe link in every email or with a short message to info@sapple.com.
Email series
In addition to the newsletter, we send automated email series. The sender is “Kassian von sapple” with the address bestellung@sapple.com, sent via Resend (see Emails). You receive at most one of these emails per day. They are written in German or Italian.
Welcome series: after your confirmed newsletter signup, we send you three emails within about six days, with a personal discount code. If you order, the series ends.
Cart reminder: as soon as your email address is in the checkout, entered by you or taken from your customer account, we store this address, your first name, the language and the contents of your cart, even if you have not ordered yet. If you do not complete the order within one hour, we send you up to three reminders, after about 1, 24 and 72 hours, from the second one with a personal discount code. The link in the email brings your cart back. If you order, the series ends. After a complete series, the next one is possible at the earliest 30 days later.
After your first order: two emails about 2 and 10 days after the expected delivery, with tips on how to use the gels and a question about your experience.
Reorder reminder: when the gels from your last order are probably used up, we send you up to three emails, from the second one with a personal discount code. If you order again, the series ends.
For the welcome series, the legal basis is your consent (Art. 6(1)(a) GDPR). We send the cart reminder, the emails after your first order and the reorder reminder on the basis of our legitimate interest in reminding you of your purchase and offering you our own products again (Art. 6(1)(f) GDPR, for existing customers under the rules for advertising to one's own customers, Art. 130(4) of the Italian Personal Data Protection Code). You can object at any time.
Unsubscribe: each of these emails contains an unsubscribe link. Many email programs also show their own unsubscribe button that works with one click. Unsubscribing applies permanently to the newsletter and all series. We then remove your address from the newsletter list and also withdraw the marketing consent in your customer account. You will still receive emails about your order, such as the order and shipping confirmation.
Resend tells us when an email permanently cannot be delivered (hard bounce) or is marked as spam. We put such addresses, like unsubscribed ones, on a block list and no longer send them any of these emails. Only the address, the language, the time and the reason for the block remain on the list, so that it applies permanently.
Bot protection with Cloudflare Turnstile
The contact form, the newsletter form, the review form on the product page and the registration of a customer account are protected against automated requests with Cloudflare Turnstile (Cloudflare, Inc., USA). For this, your browser loads a script from challenges.cloudflare.com. Cloudflare checks technical characteristics of your browser and receives, among other things, your IP address. Turnstile does not set any advertising or tracking cookies. Cloudflare also processes data outside the EU and is certified under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in forms free of spam and abuse (Art. 6(1)(f) GDPR).
Statistics with Google Analytics
If you consent to the "Statistics" category, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to analyse how our shop is used. We use Google Consent Mode v2. Before your consent, no analytics data is sent to Google and no analytics cookies are set. The Google tag is only loaded after your consent, and the IP address is processed in shortened form. A transfer to the USA is possible, Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR).
Marketing with the Meta Pixel and Conversions API
If you consent to the "Marketing" category, we use the Meta Pixel (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). It lets us measure the performance of our ads on Facebook and Instagram and show you more relevant ads. The pixel is only loaded after your consent. When it does, data (including your IP address, pages visited and actions taken such as a purchase) is transmitted to Meta, possibly also to the USA. Before your consent, nothing is sent to Meta. You can withdraw your consent at any time via "Cookie settings". The legal basis is your consent (Art. 6(1)(a) GDPR).
In addition to the pixel, we use Meta's Conversions API. If you complete an order after giving your consent, our server reports the purchase directly to Meta. The data transmitted are the order number, order value, products ordered, your IP address, your browser identifier (user agent), the Meta cookies _fbp and _fbc as well as email address, phone number, name, city, postal code and country. Contact and address data are pseudonymised with the SHA-256 method (hashed) before transmission. Meta matches the event with the pixel event so that a purchase is only counted once. Without consent to the "Marketing" category, nothing is transmitted. The legal basis is your consent (Art. 6(1)(a) GDPR).
Google Ads conversion tracking
If you consent to the "Marketing" category, we use Google Ads conversion tracking (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). It lets us measure whether a purchase results from one of our ads on Google. We use Google Consent Mode v2. Before your consent, the Google tag is not loaded for this purpose and no advertising cookies are set. After your consent, Google sets cookies such as _gcl_au and _gcl_aw (lifetime up to 90 days) and receives the order number, order value and your IP address when you make a purchase. For enhanced conversions we additionally pass on your email address, which is hashed before transmission. A transfer to the USA is possible, Google is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time via "Cookie settings". The legal basis is your consent (Art. 6(1)(a) GDPR).
Google Maps
On our contact page we embed a map from Google Maps (Google Ireland Limited). For data protection reasons the map is only loaded once you consent to the "External media" category or actively start the map via "Activate map". When loading, data (including your IP address) is transmitted to Google, possibly also to third countries. The legal basis is your consent (Art. 6(1)(a) GDPR).
Instagram posts
On the home page we show recent posts from our Instagram account. Our server loads the posts via the Instagram interface (Meta Platforms Ireland Limited) and delivers the images itself. When you open the page, your browser therefore does not connect to Instagram. Only when you click on a post or the link to our profile does Instagram open, and Meta's privacy policy applies there.
Storage period
We only store your data for as long as necessary for the respective purpose and then delete it automatically.
We keep orders for 10 years from the end of the calendar year of the order, as Italian law requires for accounting records (Art. 2220 Codice Civile). Abandoned orders without any payment are deleted after one year, once they are cancelled or the payment provider confirms that nothing was ever paid. An open bank transfer order remains until it is cancelled.
We delete a customer account if you have neither signed in nor ordered anything for three years. Contact requests are deleted two years after receipt.
For the email series: we delete the cart contents 30 days after the cart reminder has ended. If you have not signed up for the newsletter, we delete your email series data three years after your last contact with us (cart, order or email of a series). After unsubscribing or a block, after 30 days only the address, language, time and reason remain on the block list, permanently.
Newsletter signups and other consents apply until you withdraw them. Reviews remain as long as they are published. At your request we also delete customer accounts, reviews and form submissions earlier, unless a legal obligation prevents this.
Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability. You can object to processing based on our legitimate interest. You can withdraw a consent at any time with effect for the future. To do so, write to us at info@sapple.com.
You can also lodge a complaint with a data protection supervisory authority, in Italy with the Garante per la protezione dei dati personali (www.garanteprivacy.it).
Last updated: October 2026