Privacy policy
What data an order and an account need, who it is shared with, how long it is kept and how to change or delete it. In force from 15 October 2026.
1. Controller
The controller of personal data is Fitbar Nutrition OÜ, registry code 17517078, Rävala pst 6, 10143 Tallinn, info@myfitbar.ee, +372 5482 9261. Write to that address with any question about your data.
2. What data we process
For an order: name, email, phone, delivery address, the order's contents and total, the chosen payment method and payment status. We never receive or store card or bank account details: payment takes place at the payment service provider. For an account: email, one-time sign-in codes (valid for a few minutes), order history, wishlist, addresses, fitcoin balance and movements, referral code. With Google sign-in: the verified email address, nothing else. For a review: the name you give, the text, rating, photos and a verified-purchase mark. When using the site: necessary cookies (cart, sign-in, language, your cookie choice) and, if you allow all cookies, an anonymous visitor id and the list of products you viewed in the last 30 days.
3. Why and on what basis
Fulfilling the order, delivery, returns, complaints and support — performance of the contract. Invoicing and accounting — a legal obligation (Accounting Act, Taxation Act). Fraud prevention, site security, running the account and the loyalty programme — the legitimate interest of the seller and the buyer. The newsletter and non-essential cookies — only with your consent, which you can withdraw at any time. Personal set recommendations (picked from your cart, wishlist, orders and views) — on the basis of your consent to all cookies; without it you see the same recommendations as everyone.
4. Who receives the data
The fulfilment partner with a warehouse in the European Union (Poland) — name, address, phone, email and the order's contents, to pack and dispatch the parcel. The courier UPS — the same data for delivery. The payment service provider Montonio Finance OÜ (Estonia) — the amount, the payment reference and the email. The hosting provider Hetzner Online GmbH (server in Finland) — all the shop's data, encrypted, on its servers. Google LLC — only if you choose to sign in with Google. Our accountant — invoice data. Public authorities — on a lawful request. Data is never sold and never leaves the European Union, except Google sign-in, which is covered by the European Commission's adequacy decision (EU–US Data Privacy Framework).
5. How long we keep it
Order data and invoices — 7 years from the end of the year of purchase, as the Accounting Act requires. Account data — as long as the account exists; after deletion only the order data we must keep remains. Sign-in codes — until used, 10 minutes at most. Product views — 30 days. Reviews — while the product is on sale or until you ask us to remove them. Cookie consent — 12 months, after which we ask again. Support correspondence — 2 years.
6. Cookies
Necessary cookies hold the cart, the sign-in, the language and your cookie choice; the shop does not work without them and they cannot be switched off. Statistics, marketing and personalisation cookies are used only with your consent. Today the site carries no third-party trackers; your choice also applies to whatever may be added later. You can change it at any time on the Cookies page.
7. Your rights
You have the right to know what data we hold about you, to receive a portable copy, to have it corrected or deleted, to restrict processing, to object to processing based on legitimate interest and to withdraw consent. You can delete your account and the data tied to it yourself in the account area. For anything else write to info@myfitbar.ee; we answer within one month. If you believe we are violating your rights you may turn to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee) or to a court.
8. Security
The connection to the site is encrypted. No passwords are used: you sign in with a one-time code or with Google. Only the people who fulfil orders and answer requests can access order data. Backups are stored encrypted. We will tell you and the supervisory authority about a security breach that may affect your rights, as the law requires.
9. Children
The shop is intended for people aged 18 or over. We do not knowingly collect children's data; if you believe a child has left us their data, write to us and we will delete it.
10. Changes
We update this policy when our processing or the law changes. The current version is published on this page with its effective date.