Privacy policy

Updated 14 September 2026

1. Controller and contact

Moodsup GmbH, Opernring 1/E/224–227, 1010 Vienna, Austria. Contact: office@moodsup.at.

2. Visiting the store

Our store runs on Shopify. Visits involve processing IP addresses, browser and device information, requested pages and technical request data. This supports website delivery, cart and checkout functionality, error detection and protection against misuse. The legal bases are Article 6(1)(b) GDPR for requested contractual services and Article 6(1)(f) GDPR for our interest in operating a secure and reliable store.

3. Orders, reservations and customer accounts

When you order or reserve, we process your email address, contact and address details, product selections, order and payment status and, where relevant, delivery and billing data. Reservations are linked to subsequent product payments for crediting and fulfilment. Shopify Flow processes order lines, amounts, customer tags, cancellations and refunds for this purpose. Transactional emails keep you informed about your order.

Shopify processes the information required for customer account login, authentication, saved addresses and order history. Payment data is processed by the payment providers shown at checkout. Delivery and logistics providers receive the information required to deliver your order. Processing is based on Article 6(1)(b) GDPR for entering into and performing contracts and Article 6(1)(c) GDPR for legal obligations.

4. Newsletter and 8 Hours Club

For newsletter and Club registration, we process your email address, registration source, consent and confirmation status, and membership tags. Newsletters are sent on the basis of consent under Article 6(1)(a) GDPR. You may withdraw consent at any time using the unsubscribe link or by contacting us. Withdrawal does not affect the lawfulness of earlier processing. Necessary order messages are independent of newsletter subscription.

Membership is linked to your customer profile to determine eligibility for Club benefits. Active Club members receive free shipping within Austria under the applicable offer terms. Unsubscribing ends this benefit for future purchases. Your customer account and completed orders remain intact.

5. Sleep Test

The five Sleep Test answers and the displayed result are processed in your browser. The custom test function does not transmit them to Shopify or store them in your customer profile. The test is not a diagnosis. Only when you submit the subsequent registration form are your email address and a participation tag transmitted. That tag and your previous orders are used to check eligibility for SLEEP5. Newsletter registration is based on consent; eligibility checking serves to provide the requested benefit.

6. Cookies, storage and analytics

Shopify uses cookies and similar technologies for necessary store functions, including cart, security and privacy preferences. Our theme also remembers during a browser session whether you dismissed the Club prompt (sessionStorage: ms-club-dismissed). Non-essential analytics and marketing technologies are used only with the consent required by law. You can change your choices through the privacy settings.

Shopify Network Intelligence may process interactions with our store for enhanced services, including personalisation and advertising. See the Shopify Consumer Privacy Policy and Shopify Privacy Portal for details and your choices.

Where you receive the relevant notifications or newsletters, contact, product and interaction data may be processed for abandoned-checkout, cart, back-in-stock or price-change reminders. Processing is based on consent where consent is required.

7. Recipients and international processing

Where necessary for the relevant purpose, recipients include Shopify as platform provider, payment providers, delivery and logistics providers, email and order-automation providers, tax and accounting providers, and technical service providers authorised by us. They receive only the data required for their tasks.

Processing outside the European Economic Area cannot be ruled out entirely. Where no adequacy decision applies, transfers rely on appropriate safeguards under Chapter V GDPR, in particular standard contractual clauses. See the Shopify Data Processing Addendum.

8. Enquiries and retention

We process your contact details and message content to respond to enquiries, under Article 6(1)(b) or (f) GDPR depending on the context. Please do not send medical information through the general contact form.

We retain personal data only as long as necessary for its purpose. Contract, order and accounting data is kept for statutory retention and limitation periods. Newsletter data is processed until consent is withdrawn; evidence of consent and withdrawal may be retained for statutory accountability and limitation periods. Technical logs are deleted when no longer needed for security and operation.

9. Your rights

Subject to legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation, and to direct marketing at any time. Consent may be withdrawn for the future. Contact us using the address above. You may also complain to the Austrian Data Protection Authority.