Privacy statement
Privacy Statement
1. Introduction
Through our video platform and webshop, privacy-sensitive data, or personal data, is processed. We attach great importance to the careful handling of personal data and comply with the requirements of the General Data Protection Regulation (GDPR).
That's the Spirit is the data controller for the data processing. In this privacy statement, we explain which personal data we collect, on what basis, and for what purpose we use it.
2. Contact details of the data controller
For questions about this privacy statement or the processing of your personal data, please contact:
That's the Spirit
Email: support@thatsthespirit.nu
No data protection officer (DPO) has been appointed, as the scope and nature of our data processing do not require this under the GDPR.
3. Conditions for processing personal data
In our processing of personal data, we adhere to the requirements of the GDPR. Specifically, this means the following:
• We clearly state for what purposes and on what grounds we process personal data.
• We limit the collection of personal data to what is necessary for legitimate purposes (data minimisation).
• We ask for explicit consent where the law requires it.
• We take appropriate security measures and also lay this down in data processing agreements with third parties.
• We respect your rights: access, rectification, erasure, data portability, restriction of processing, and objection.
4. What personal data do we process?
We process the following categories of personal data:
• Email address
• Name and address details (name, address, place of residence)
• Phone number
• Billing address
• Payment details
• IP address
5. Processing purposes and legal bases
We process personal data solely for the purposes described below and on the basis of one of the legal bases mentioned in the GDPR.
5.1 Processing orders and memberships
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
When entering into a membership or placing an order, we process:
• Personal data: first and last name, street name, house number, postcode, city, phone number, email address.
• Additional data: date/time, payment information, IP address, order number, invoice number, total amounts, delivery information.
5.2 Contact form and customer service
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — the interest to adequately answer customer questions.
We process name and email address. Data is deleted by default within 30 days, unless the handling of your query requires longer retention.
5.3 Newsletter
Legal basis: consent (Art. 6(1)(a) GDPR).
Your email address will only be added to our mailing list after explicit opt-in. Each newsletter contains an unsubscribe link. You can withdraw your consent at any time via support@thatsthespirit.nu.
5.4 Marketing and advertising
Legal basis: consent (Art. 6(1)(a) GDPR).
We will only inform you by email, social media, push notifications or other channels when you have given explicit consent for this. You can withdraw this consent at any time.
5.5 Web analytics (Google Analytics)
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — the interest to improve our website based on anonymized visitor statistics.
We have concluded a data processing agreement with Google. The last octet of the IP address is masked. The 'data sharing with Google' option is disabled. If you do not accept statistical cookies, no Google Analytics cookie will be placed.
✦ Transfer outside the EEA: Google may process data on servers in the United States. The transfer is based on the EU-US Data Privacy Framework (DPF), for which Google is certified.
5.6 Google Ads retargeting
Legal basis: consent (Art. 6(1)(a) GDPR), given via the cookie consent banner.
Through a retargeting cookie, we can show targeted advertisements in Google Search and the Google Network to visitors who have previously shown interest. The cookie does not store direct personal data but links previous website visits to a browser profile.
✦ Transfer outside the EEA: Google may process data on servers in the United States based on the EU-US Data Privacy Framework (DPF).
5.7 Facebook Pixel (Meta)
Legal basis: consent (Art. 6(1)(a) GDPR), given via the cookie consent banner.
The Facebook Pixel allows us to analyze the use of our website and measure the effectiveness of Facebook and Instagram advertisements. The data collected by the pixel is anonymous to us but is stored by Meta in a way that allows it to be linked to a user profile. Meta may use this data for its own advertising purposes in accordance with its own privacy policy.
If you want to prevent tracking by the Facebook Pixel, use Facebook's ad preferences settings or the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout?hl=en
✦ Transfer outside the EEA: Meta (Facebook/Instagram) processes data on servers in the United States. The transfer is based on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF).
6. Transfer of personal data outside the EEA
Some of our service providers process personal data (partially) outside the European Economic Area (EEA). We only use transfers based on a valid legal basis:
Service provider
Google (Analytics, Ads) Country: US | Legal Basis: EU-US Data Privacy Framework (DPF)
Meta (Facebook Pixel) Country: US | Legal Basis: Standard Contractual Clauses (SCC) + DPF
Payment Processor(s) Country: EEA | Legal Basis: Not applicable
7. Disclosure to third parties
We only disclose your personal data to third parties who act on our behalf (processors) with whom we have concluded a data processing agreement. Third parties who independently determine the purposes and means of processing are themselves responsible for a valid legal basis.
We are not responsible for the processing of your data by these independent data controllers. This privacy statement does not apply to their processing.
8. Cookies
Our website uses cookies. On your first visit, we display a cookie banner where you can give consent for placing non-functional cookies. Without consent, we only place functional cookies.
8.1 Functional cookies
Necessary for the website to function, such as remembering login status and shopping cart. No consent is required for this.
8.2 Social media buttons
Share buttons for Facebook, Instagram, Twitter/X and LinkedIn use cookies from those platforms. Please consult their privacy statements for more information.
8.3 Analytical cookies
Google Analytics (anonymized) — legal basis: legitimate interest, provided that consent is not required under the Telecommunications Act.
8.4 Marketing and tracking cookies
Google Ads retargeting and Facebook Pixel — legal basis: consent via cookie banner. These cookies are only placed after your opt-in.
9. Your rights
Under the GDPR, you have the following rights regarding your personal data:
• Right of access (Art. 15 GDPR): you can request what data we process about you.
• Right to rectification (Art. 16 GDPR): you can have inaccurate data corrected.
• Right to erasure (Art. 17 GDPR): you can request the deletion of your data.
• Right to restriction of processing (Art. 18 GDPR): you can request a temporary restriction of processing.
• Right to data portability (Art. 20 GDPR): you can request your data in a structured, commonly used format.
• Right to object (Art. 21 GDPR): you can object to processing based on legitimate interest.
• Right to withdraw consent: when processing is based on consent, you can withdraw it at any time.
You can exercise your rights via support@thatsthespirit.nu. We will respond within four weeks of receiving your request.
10. Retention periods
We do not store personal data longer than necessary:
• Order data: stored for the duration of the warranty period and a maximum of one year thereafter for statistical purposes.
• Payment data: seven years based on the statutory tax retention period.
• Contact form data: standard 30 days, unless further processing requires longer retention.
• Newsletter data: as long as you are subscribed; deleted after unsubscription.
11. Security
We take appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse. These measures are periodically evaluated and adjusted as necessary. We require our processors to implement equivalent security measures.
12. Changes to this privacy statement
We reserve the right to amend this privacy statement. We advise you to consult this statement regularly. In the event of significant changes, we will endeavor to inform you actively.
13. Complaints
Do you have a complaint about how we process your personal data? Please contact us first at support@thatsthespirit.nu.
