FAST DELIVERY IN 1-3 WORKING DAYS*FREE SHIPPING FROM €8030-DAY RETURNS WITH FREE OPTIONSLOYALTY POINTS: UP TO €10 OFF PER €100

Privacy policy

This English translation is provided for your convenience. Only the German version is legally binding; in case of any discrepancy, the German version prevails.

Privacy Policy

Version: 15 October 2026

1. Privacy at a glance

General information

The following information gives an overview of what happens to your personal data when you visit our online shop thefightcompany.de, order from us or contact us. Personal data is any data that can be used to identify you personally. Detailed information can be found in the following sections of this privacy policy.

Who is responsible for data collection on this website?

The controller is TFC Trading Group B.V., trading as “The Fight Company”. The contact details can be found in section 3 under “Information on the controller”.

How do we collect your data?

On the one hand, we collect data that you provide to us, for example when placing an order, in your customer account, in the returns portal, in the live chat or by e-mail. Other data is collected automatically by our IT systems when you visit the website. This is mainly technical data such as your browser, operating system and the time the page was accessed. We only collect statistics and marketing data with your consent.

What do we use your data for?

We use your data to provide the website without errors, to process your orders, to handle returns and enquiries and – if you have consented – to analyse our shop, show you advertising and send you our newsletter.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data and the restriction of processing, to withdraw any consent given at any time with effect for the future, to object to processing and to lodge a complaint with a supervisory authority. Details can be found in section 3.

2. Hosting and infrastructure

Shopify

Our online shop is hosted by Shopify. The provider is Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). On our behalf, Shopify processes the data generated when you visit the shop and place an order, including your IP address, the pages viewed, your shopping cart, and order and customer data. Shopify may also transfer data to Shopify Inc. in Canada and to service providers in the USA (see “Transfers to third countries”). Processing is based on Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR; our legitimate interest lies in providing our shop securely, quickly and reliably. We have a data processing agreement with Shopify (Art. 28 GDPR).

The fonts used on our website are delivered via Shopify's servers. No connection is made to Google Fonts servers.

Cloudflare

Our returns portal, our live chat and our customer service tools run on the infrastructure of Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA. On our behalf, Cloudflare processes the data you enter there as well as technical connection data such as your IP address. The legal basis is Art. 6(1)(b) and (f) GDPR. Cloudflare is certified under the EU-U.S. Data Privacy Framework.

3. General information and mandatory information

Data protection

We treat your personal data confidentially and in accordance with the statutory data protection regulations, in particular the General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG). Please note that data transmission over the internet (e.g. when communicating by e-mail) may have security gaps.

Information on the controller

TFC Trading Group B.V., trading as “The Fight Company”
Kaskinenweg 7
9723 JL Groningen
the Netherlands

E-mail: info@thefightcompany.de
Telephone: +31 85 060 4427 (telephone customer service in English only)
Commercial register (KvK): 83630562
VAT identification number: NL862940369B01

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data. We are not legally required to appoint a data protection officer. For all questions about data protection, please contact info@thefightcompany.de.

Retention period

Unless a more specific retention period is stated in this privacy policy, we store your data until the purpose of processing no longer applies. If you make a justified request for erasure or withdraw your consent, we will delete your data unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law). In detail:

  • Order, invoice and payment data: 7 years from the end of the financial year (statutory retention obligation under Dutch tax law, Art. 52 of the General State Taxes Act).
  • Customer service requests, chat histories and returns: for as long as you are our customer and this is necessary for handling later enquiries, warranty and return cases and defending legal claims; at your request we will delete this data earlier unless a statutory retention obligation applies.
  • Customer account and loyalty points: as long as the account exists. You can have your account deleted at any time; order data that we are required to retain is stored until the retention period expires.
  • Newsletter: until you unsubscribe; we keep proof of your consent or unsubscription for up to 3 years.
  • Cookies and statistics data: as stated in the cookie settings, at most 26 months (Google Analytics: 14 months).

General information on the legal bases

If you have given consent, we process your data on the basis of Art. 6(1)(a) GDPR. If information is stored on or read from your device (e.g. cookies), this is additionally based on Section 25(1) TDDDG; we set technically necessary cookies under Section 25(2) TDDDG. If your data is required to perform a contract or to take pre-contractual steps, we process it on the basis of Art. 6(1)(b) GDPR. We process data that we need to comply with a legal obligation under Art. 6(1)(c) GDPR. Otherwise, processing may be based on our legitimate interest under Art. 6(1)(f) GDPR. Which legal basis applies in each case is explained in the following sections.

Recipients of personal data

We only pass on your data if this is necessary to perform the contract (e.g. to payment service providers and carriers), if we are legally obliged to do so (e.g. to tax authorities), if we have a legitimate interest in passing it on or if you have consented. Service providers that process data on our behalf are contractually bound under Art. 28 GDPR. In the case of joint controllership, there is an arrangement under Art. 26 GDPR. We do not sell your data.

Transfers to third countries

We also use services of companies that are based outside the European Economic Area or access data from there, in particular in the USA (Google, Meta, Microsoft, Shopify, Stripe, Klaviyo, Gorgias, Cloudflare, Anthropic), in Canada (Shopify) and in Israel (Loox). For Canada and Israel there is an adequacy decision of the European Commission. For the USA there is an adequacy decision for companies certified under the EU-U.S. Data Privacy Framework (DPF). If a recipient is not certified, we base the transfer on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time, e.g. via the cookie settings or by e-mail to us. The lawfulness of the data processing carried out until the withdrawal remains unaffected.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION UNDER ART. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. You can therefore also contact the data protection authority of your German federal state. The lead supervisory authority responsible for us is the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ The Hague, the Netherlands (autoriteitpersoonsgegevens.nl).

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer to another controller, this will only take place insofar as it is technically feasible.

Access, rectification, erasure and restriction of processing

Within the framework of the statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing (Art. 15 GDPR), as well as the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR). An e-mail to info@thefightcompany.de is sufficient. So that we do not disclose your data to unauthorised persons, we may ask you to prove your identity, for example by sending a message from the e-mail address used for your order.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the browser's address bar beginning with “https://” and by the lock symbol in your browser bar.

Objection to advertising e-mails

We hereby object to the use of the contact details published in the legal notice for sending unsolicited advertising and information material.

4. Data collection on this website

Cookies

Our website uses cookies and similar technologies. Cookies are small data packets stored on your device. We set technically necessary cookies, e.g. for the shopping cart, language setting, customer account and checkout, without consent (Section 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR). We only set all other cookies, in particular for statistics and marketing, with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can see which cookies are used in detail in the cookie settings.

Consent with Cookiebot

We use the consent management platform Cookiebot to obtain and document your consent to the storage of certain cookies. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. When you access our website, a cookie is stored containing your choice; for documentation purposes, Cookiebot also processes a shortened IP address, browser information and the time and content of your consent. The legal basis is Art. 6(1)(c) GDPR (obligation to prove consent). You can change your choice at any time via the cookie icon or the “Cookie settings” link.

Server log files

Shopify and Cloudflare automatically collect and store information in server log files that your browser transmits: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the request and IP address. This data is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the technically error-free presentation and the security of our website.

Enquiries by e-mail, telephone, contact form or live chat

If you contact us, we process your enquiry including all resulting personal data (name, contact details, order number, content of the enquiry, photos where applicable) for the purpose of handling it. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR. For e-mails and chats we use the ticket system Gorgias (Gorgias Inc., San Francisco, USA) as a processor. We operate our live chat ourselves on Cloudflare's infrastructure (see section 2). For the retention period, see “Retention period”.

AI-assisted handling of enquiries

To answer your enquiries more quickly, we have messages and the related order and shipping information analysed by an AI system, which produces draft replies and suggestions for handling them. The provider is Anthropic (model “Claude”; Anthropic PBC, USA). We have disabled the use of our data for training the AI models. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in fast and efficient customer service. We do not make decisions that produce legal effects concerning you or similarly significantly affect you solely by automated means within the meaning of Art. 22 GDPR; larger refunds and special cases are reviewed by a member of staff, and you can ask at any time for a person to handle your request.

Customer account

You can create a customer account in our shop. We then store your account data, addresses and orders so that you can view your orders and order more quickly in future. The legal basis is Art. 6(1)(b) GDPR. You can have your account deleted at any time by e-mailing us.

Orders and performance of the contract

To process your order, we process your name, delivery and billing address, e-mail address, telephone number where applicable, the items ordered and payment and order information. We need the mandatory fields in the ordering process to conclude the contract; without them we cannot carry out your order. The legal basis is Art. 6(1)(b) GDPR, and for the retention of invoicing data Art. 6(1)(c) GDPR. Our warehouse management runs on Picqer (Picqer B.V., the Netherlands) as a processor. We send you transactional e-mails about your order, such as the order confirmation and shipping and return information.

Shipping

For delivery, we pass on your name, your delivery address and – where necessary for tracking and delivery notifications – your e-mail address and telephone number to the carrier engaged in each case, in particular DHL, DPD, GLS, PostNL, UPS or FedEx. We create shipping labels via the shipping service providers Innosend and QLS (the Netherlands). The legal basis is Art. 6(1)(b) GDPR.

Returns portal

For returns and exchanges you use our own returns portal. We process your order data, the reason for the return, your choice between a refund, an exchange or a credit, and any photos you upload. The legal basis is Art. 6(1)(b) GDPR (withdrawal, warranty and voluntary return policy).

Loyalty programme and vouchers

If you take part in our loyalty programme with a customer account, we store the points you have collected, your status and the rewards you have redeemed. The legal basis is Art. 6(1)(b) GDPR in conjunction with the programme's terms of participation.

5. Analytics tools and advertising

We only use the following services if you have consented in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Consent can be withdrawn at any time with effect for the future.

Google Analytics 4

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables us to analyse visitor behaviour, e.g. page views, time spent, devices used and where visitors come from. Google Analytics 4 does not store IP addresses; Google may transfer data to the USA and is certified under the EU-U.S. Data Privacy Framework. We have concluded a data processing agreement with Google. The data is deleted after 14 months.

Google Ads and conversion tracking

We use Google Ads (provider as above) to draw attention to our products. Conversion tracking shows us whether a user placed an order after clicking on an ad. With “enhanced conversions”, customer data such as the e-mail address is encrypted (hashed) before being transmitted to Google. Through remarketing we can show you relevant ads on other websites after you have visited our shop.

Meta Pixel (Facebook and Instagram)

The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. With the Meta Pixel we measure the effectiveness of our ads on Facebook and Instagram and can show visitors to our shop relevant ads there. We are jointly responsible with Meta for the collection and transmission of data to Meta (Art. 26 GDPR); the arrangement can be found at facebook.com/legal/controller_addendum. Meta is solely responsible for further processing. Meta is certified under the EU-U.S. Data Privacy Framework.

Microsoft Clarity

The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity creates heatmaps and pseudonymised recordings of sessions (mouse movements, clicks, scrolling) so that we can improve the usability of our shop. Entries in form fields are masked by default. Microsoft is certified under the EU-U.S. Data Privacy Framework.

ProfitMetrics

The provider is ProfitMetrics ApS, Denmark. ProfitMetrics attributes sales to our advertising campaigns so that we can see which ads are profitable, and transmits these conversions to Google and Meta.

Shopify analytics

Shopify (see section 2) produces statistics for us on visits, shopping carts and purchases in our shop. Where non-essential cookies are used for this, this only happens with your consent.

6. Newsletter and prize draw

If you subscribe to our newsletter, we send you offers, new products and personal recommendations by e-mail. The legal basis is your consent (Art. 6(1)(a) GDPR). We store the time of subscription and your IP address so that we can prove your consent. We send the newsletter via Klaviyo (Klaviyo Inc., Boston, USA) as a processor. Klaviyo analyses whether a newsletter was opened and which links were clicked, and links this to your profile so that we can better tailor our content to your interests. Klaviyo is certified under the EU-U.S. Data Privacy Framework.

By subscribing to the newsletter, you take part in our monthly prize draw. We notify winners by e-mail; the prize draw's terms of participation apply.

You can unsubscribe from the newsletter at any time via the unsubscribe link in every e-mail or by sending us a message.

If you have bought goods from us and provided your e-mail address, we may also send you information about our own similar products without a newsletter subscription (Section 7(3) of the German UWG, Art. 6(1)(f) GDPR). You can object to this use at any time without incurring any costs other than the transmission costs at the basic rates; you will find an unsubscribe link in every e-mail.

7. Payment providers

Payments are processed by the payment service providers you choose in the ordering process. We transmit the data required for payment (name, address, amount, order number, e-mail address where applicable) to the respective provider. The legal basis is Art. 6(1)(b) GDPR and otherwise our legitimate interest in secure and common payment methods (Art. 6(1)(f) GDPR). We do not receive full card details.

  • Shopify Payments for credit card, Apple Pay, Google Pay and other payment methods; the processing partner is Stripe Payments Europe Ltd., Dublin, Ireland.
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. PayPal may carry out its own checks to prevent fraud and is itself responsible for this.
  • Klarna, where offered in the ordering process: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may transmit data to credit agencies to verify your identity and creditworthiness and is itself responsible for this.

8. Plugins, tools and reviews

Loox (product reviews)

After an order, we may ask you by e-mail for a product review. For this we use Loox (Loox Ltd., Israel), which receives your name, your e-mail address and the items ordered. Published reviews are shown with your first name or initials. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in genuine customer reviews. You can object to review requests at any time.

Trustpilot

For shop reviews we use Trustpilot (Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark). For review invitations, Trustpilot receives your name, your e-mail address and your order number (Art. 6(1)(f) GDPR). On our website we display a Trustpilot widget that is loaded from Trustpilot's servers; in doing so, your IP address is transmitted to Trustpilot.

Google reviews and Google Maps

On our website we display reviews of our store from Google (the reviewer's name or initials, rating and text). We store the reviews ourselves at Shopify; no connection to Google is made when they are displayed. The legal basis is Art. 6(1)(f) GDPR.

On the page of our store in Amsterdam you can display a map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is only loaded when you click “Load map”; only then is data such as your IP address transmitted to Google and cookies may be set. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

9. Updates to this privacy policy

We will update this privacy policy if our data processing or the legal situation changes. The version published on this page applies.
Back to top