Privacy Policy

Last updated: 1 August 2026

This policy applies to the IdealFit country selection website (the "Site") and to nothing else. It is written to meet Regulation (EU) 2016/679 ("GDPR"), which protects every visitor from the seven countries listed on the Site.

1. Who is responsible

The controller for personal data processed through the Site is the operator of this website. Write to contact@your-domain.com for any privacy matter, including to exercise the rights in section 9.

We have not appointed a Data Protection Officer. The Site does not carry out large-scale monitoring or process special category data, so Article 37 does not require one.

2. What the Site does, and where this policy stops

The Site shows a list of countries and forwards you to the official store for the one you pick. It has no shopping cart, no checkout and no order form. We never see your name, delivery address, phone number or payment details, because you never give them to us.

The moment you click a country, you are on a website run by a different company. This policy no longer applies there. That operator is a separate controller, decides on its own what to collect, and publishes its own privacy policy. Read it before you order.

3. What we collect

Data you actively give us

Only if you email us: your email address, any name you sign with, and the contents of your message.

Data collected automatically

• Connection data — IP address, browser and version, operating system, device type, screen size, language preference.
• Usage data — pages opened, time on page, which country you clicked, the page that referred you.
• Campaign parameters — values carried in the address you arrived on, such as utm_source, utm_campaign, gclid, fbclid or ttclid. These identify the advertisement or channel that brought you, not you personally.

What we do not collect

We do not want health data and never ask for it. Do not send us details of any medical condition, medication or diagnosis. If you do, we will delete the message.

4. Why we process it, and under which legal basis

• Delivering and securing the Site — serving pages, keeping server logs, blocking abuse and attacks. Basis: legitimate interest, Art. 6(1)(f). Our interest is operating a functioning, secure website; this is minimal processing that you would reasonably expect from any site you open.
• Replying to your email — handling the enquiry you sent. Basis: legitimate interest, Art. 6(1)(f), in answering people who contact us.
• Measuring advertising — identifying which advertisement led to a visit and to a sale, so campaigns can be evaluated. Basis: consent, Art. 6(1)(a), given through the banner. Nothing in this category stores or reads anything on your device before you accept.
• Passing campaign parameters to the destination store — so the store's operator can attribute the visit to the right campaign. Basis: legitimate interest, Art. 6(1)(f), in accurate commercial reporting between us and the store operator.
• Complying with law — where we are legally obliged to retain or disclose something. Basis: legal obligation, Art. 6(1)(c).

Providing any data is entirely voluntary. Nothing on the Site requires you to identify yourself, and refusing costs you no functionality.

5. Cookies and tracking

Strictly necessary — no consent required

One local storage entry records the choice you make on the banner, so we stop asking on every visit. Without it the banner cannot work, which is why Article 5(3) of the ePrivacy Directive exempts it. It contains a single value and nothing that identifies you.

Advertising — consent required

The Site carries two advertising tags. Neither stores or reads anything on your device until you press "Accept".

• Google Ads (gtag.js, tag ID AW-18260914223), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It measures which advertisement led to your visit and whether a purchase followed, and sets cookies in the _gcl_* family.
• Gateraads, an affiliate tracking service that attributes visits and sales to the correct traffic source so commission is calculated properly.

How consent is enforced technically

We use Google Consent Mode v2. Google's tag loads with ad_storage, ad_user_data, ad_personalization and analytics_storage all set to denied. In that state it writes no cookies and transmits no identifiers. If you accept, the state is updated to granted. If you reject, it stays denied for the whole visit.

The Gateraads script is not present in the page at all until you accept. Rejecting means it is never downloaded.

To withdraw consent, clear cookies and site data for this domain in your browser. The banner returns and you can choose again. Rejecting or withdrawing disables no part of the Site.

6. Who receives your data

• Our hosting and infrastructure provider, as a processor bound by a contract under Art. 28, acting only on our documented instructions.
• Google Ireland Limited and the operator of Gateraads, where you consented, each as a separate controller for the data its own tag collects, under its own privacy policy.
• The operator of the store you select, which receives the campaign parameters carried in the link you click. It receives no contact, address or payment data from us, because we hold none.
• Public authorities, where a binding legal request obliges us to disclose.

We do not sell personal data and do not share it for any purpose beyond those listed above.

7. Transfers outside the EEA

Our hosting provider may process connection data outside the European Economic Area, and Google may transfer advertising data to the United States. Where this happens we rely on an adequacy decision of the European Commission under Art. 45, or on Standard Contractual Clauses under Art. 46(2)(c) together with any supplementary measures the transfer requires. Google relies on the EU-U.S. Data Privacy Framework adequacy decision. Ask us and we will tell you which mechanism covers a given provider.

8. How long we keep it

• Server and security logs — up to 12 months, then deleted.
• Advertising cookies — the lifetime set by the provider, typically up to 90 days for Google's _gcl_* cookies.
• Consent record — kept in your own browser until you clear it. We hold no copy.
• Email correspondence — as long as the enquiry needs, then deleted unless a legal obligation requires us to keep it.

9. Your rights

Under Articles 15 to 22 you may:

• Access — obtain confirmation of whether we process data about you, and a copy of it.
• Rectify — have inaccurate or incomplete data corrected.
• Erase — have your data deleted, where one of the grounds in Art. 17 applies.
• Restrict — have processing paused while a dispute over accuracy or legitimate interest is resolved.
• Port — receive data you provided, in a structured, machine-readable format.
• Object — object at any time to processing we base on legitimate interest, including for direct marketing, for which no balancing test applies and we must stop.
• Withdraw consent — at any time, as easily as it was given. Withdrawal does not affect processing already carried out lawfully.

Write to contact@your-domain.com. We answer within one month, extendable by two further months for complex requests, in which case we tell you within the first month. There is no fee unless a request is manifestly unfounded or excessive.

10. Complaining to a supervisory authority

If you believe we handle your data unlawfully you may lodge a complaint with the authority in your country, without contacting us first:

• Spain — Agencia Española de Protección de Datos (AEPD)
• Portugal — Comissão Nacional de Proteção de Dados (CNPD)
• Germany — the Data Protection Commissioner of your federal state, or the BfDI
• Italy — Garante per la protezione dei dati personali
• Lithuania — Valstybinė duomenų apsaugos inspekcija (VDAI)
• Slovakia — Úrad na ochranu osobných údajov
• Czechia — Úřad pro ochranu osobních údajů (ÚOOÚ)

11. Automated decision-making

We carry out no automated decision-making or profiling that produces legal effects for you or similarly significantly affects you, within the meaning of Art. 22.

12. Children

The Site is aimed at adults and the product is not intended for anyone under 18. We do not knowingly collect data from children. Tell us if you believe a child has sent us personal data and we will delete it.

13. Security

We apply technical and organisational measures appropriate to the risk under Art. 32, including encryption in transit over HTTPS, restricted administrative access, and keeping the data we hold to the minimum described in section 3. No transmission over the internet can be guaranteed completely secure.

14. Changes

We may revise this policy. The version published here is the one in force, and the date at the top shows when it last changed. Where a change materially affects processing based on consent, we will ask for consent again.

15. Contact

Privacy questions and rights requests: contact@your-domain.com