Privacy policy
As of 14 September 2026
1. Controller and contact
Moodsup GmbH, Opernring 1/E/224–227, 1010 Vienna, Austria. Contact: office@moodsup.at.
2. Visiting the shop
Our shop runs on Shopify. When it is accessed, the IP address, browser and device information, pages accessed and technical request data are processed in particular. This enables provision of the website, cart and checkout, and detection of errors and abusive access. The legal bases are Article 6(1)(b) GDPR for requested contractual services and Article 6(1)(f) GDPR for secure and reliable operation of our shop.
3. Orders, reservations and customer account
When you order or reserve, we process your email address, the contact and address details you provide, your product selection, order and payment status and, where applicable, delivery and billing details. Reservations and subsequent product payments are linked for crediting and processing. Shopify Flow processes order items, amounts, customer tags, cancellations and refunds for this purpose. Transactional emails inform you about your order and its processing.
For your customer account, Shopify processes the data required for sign-in, authentication, stored addresses and order history. Payment data is processed by the payment service providers displayed at checkout. The shipping and logistics providers used receive the data required for delivery. Processing takes place to initiate and perform contracts under Article 6(1)(b) GDPR and to fulfil legal obligations under Article 6(1)(c) GDPR.
4. Newsletter and 8 Hours Club
When you sign up for the newsletter and Club, we process your email address, sign-up source, consent and confirmation status and membership tags. Newsletters are sent on the basis of your consent under Article 6(1)(a) GDPR. You can withdraw your consent at any time using the unsubscribe link or by contacting us. Withdrawal does not affect the lawfulness of prior processing. You receive necessary order messages independently of the newsletter.
To check Club benefits, membership is linked to your customer profile. Confirmed Club members receive free shipping in Austria and Germany from two Night Shield packs or with a confirmed subscription under the applicable offer terms. After newsletter unsubscription, this benefit ends for future purchases. Your customer account and orders already completed remain in place.
5. Sleep Test
The five Sleep Test answers and the result displayed from them are processed in the browser and are not transmitted to Shopify or stored in the customer profile by the test function itself. The test does not provide a diagnosis. Your email address and participation tag are transmitted only when you subsequently submit the sign-up form. This tag and your previous orders are used to check eligibility for SLEEP5. Newsletter sign-up is based on consent; checking the requested benefit serves to process it.
6. Cookies, storage and analytics
Shopify uses cookies and similar technologies for necessary shop functions, such as the cart, security and privacy settings. Our theme also stores during a browser session whether you have closed the Club notice (sessionStorage: ms-club-dismissed). Non-essential analytics and marketing technologies are used only with the consent required in each case. You can change your selection through the privacy settings.
Shopify Network Intelligence may process interactions with our shop for enhanced services, including personalisation and advertising. Further information about Shopify’s own responsibility and your choices can be found in the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.
If you receive relevant notifications or newsletters, contact, product and interaction data may be processed for reminders about abandoned checkouts, carts, items back in stock or price changes. Processing takes place on the basis of your consent where such consent is required.
7. Recipients and international processing
Recipients of your data, to the extent required for the respective purpose, are Shopify as the platform provider, payment service providers, shipping and logistics providers, providers for email delivery and order automation, tax and accounting service providers, and technical service providers authorised by us. These recipients receive only the data they need for their respective tasks.
Processing outside the European Economic Area cannot be entirely ruled out. Where no adequacy decision exists, transfers are based on appropriate safeguards under Chapter V GDPR, particularly standard contractual clauses. Information about processing by Shopify is contained in the Shopify Data Processing Agreement.
8. Contact enquiries and retention
For contact enquiries, we process your contact details and the content of your message to respond, depending on the circumstances under Article 6(1)(b) or (f) GDPR. Please do not send us medical information through the general contact form.
We store personal data only for as long as required for the respective purpose. Contract, order and accounting data are stored for the duration of statutory retention and limitation periods. Newsletter data is processed until consent is withdrawn; evidence of consent and withdrawal may be retained within statutory evidence and limitation periods. Technical log data is deleted once it is no longer required for security and operation.
9. Your rights
Under the statutory requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation, and to direct marketing at any time. You may withdraw consent with effect for the future. To do so, contact the address above. You may also lodge a complaint with the Austrian Data Protection Authority.