-Lemon-Flavored-uitgesneden-image_square.png)
Your cart is empty
Go to the shop
Version 1.0.0 · Last updated 6 August 2026
Victus-Sports B.V., trading as Victus, is responsible for the processing of personal data described in this Privacy Statement.
Victus-Sports B.V. is established in the Netherlands and operates the website victus.sport.
You can contact us about privacy or your personal data at support@victus.team.
In data protection law, Victus-Sports B.V. is the controller where we decide why and how personal data is used. Some companies listed in this statement process data on our instructions. Others, particularly payment providers, advertising platforms and review platforms, may independently determine parts of their processing.
This statement applies when you:
| Category | Examples | How we obtain it |
|---|---|---|
| Identity and contact data | Name, email address, telephone number, billing address, delivery address, city, state or province, postcode and country | Directly from you or from a provider involved in your order or payment |
| Account data | Account identifier, login information, account status, saved details and preferences | Directly from you and generated by our systems |
| Social login data | Name, email address and the account identifier supplied by the provider when you choose to sign in with Google or Facebook | From Google or Meta at the moment you sign in |
| Order and subscription data | Products ordered, quantities, prices, discounts, order history, subscription frequency, renewal dates, pauses, cancellations, refunds and delivery status | Directly from you and generated while administering your orders and subscription |
| Payment data | Selected payment method, payment status, payment and transaction identifiers, refunds and fraud-screening results | From you, Mollie, Stripe and relevant payment-method providers |
| Customer service data | Messages, requests, complaints, returns and other correspondence | Directly from you and generated while handling your request |
| Review data | Your name, the review text you write, the rating and the order it relates to | Directly from you |
| Device and connection data | IP address, browser type, device type, operating system, user agent, timestamps, page URLs and referring URLs | Automatically when you use the website |
| Consent data | Analytics and marketing choices, consent identifier, user identifier where known, notice version, record version, locale, source URL and time of the decision | Generated when you use the consent banner or change your settings |
| Analytics data | Google Analytics client identifier, pages viewed, products viewed, ecommerce activity, order identifiers, order values, subscription renewals, refunds, heatmaps and session recordings | Automatically through analytics services, subject to the consent rules described below |
| Advertising and attribution data | Google click identifiers such as gclid, gbraid and wbraid, Meta fbp and fbc identifiers, affiliate identifiers, advertisement interactions and conversion events | Automatically through advertising and attribution services, subject to the consent rules described below |
| Marketing communication data | Newsletter status, campaign delivery, opens, clicks and unsubscribe status | Directly from you and through ActiveCampaign |
| Security and diagnostic data | Request information, security signals, error messages, application traces, suspicious activity, failed requests and performance information | Generated by our systems and by Cloudflare, Sentry and Laravel Nightwatch |
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and administer your account | Identity, contact, account, social login and preference data | Performance of our contract with you |
| Process orders and subscriptions | Identity, contact, account, order, subscription and payment data | Performance of our contract with you |
| Process recurring subscription payments, renewals and refunds | Account, subscription, order, payment and transaction data | Performance of our contract with you |
| Check and complete a delivery address | Delivery address as entered | Performance of our contract and our legitimate interest in preventing failed deliveries |
| Pack, ship, track and deliver orders | Name, address, contact information, order contents and shipment information | Performance of our contract with you |
| Send transactional email such as order confirmations, shipping notices and login codes | Name, email address and the order or account information the message concerns | Performance of our contract with you |
| Provide customer service and handle returns or complaints | Identity, contact, account, order and correspondence data | Performance of our contract and our legitimate interest in handling customer requests and resolving disputes |
| Process payments and prevent payment fraud | Identity, contact, payment, device and transaction data | Performance of our contract and our legitimate interest in preventing fraud and securing transactions |
| Maintain tax, accounting and transaction records | Order, invoice, payment, refund and customer data | Compliance with our legal obligations |
| Protect the website, accounts and infrastructure | IP address, user agent, request data, account activity, security logs and diagnostic data | Our legitimate interest in preventing fraud, abuse, attacks and technical failures |
| Measure website use and improve the storefront | Analytics identifiers, page activity, ecommerce events, heatmaps and session recordings | Your consent |
| Measure advertisements, attribute conversions and build advertising audiences | Advertising identifiers, click identifiers, page events, product events, order events, contact data and customer identifiers | Your consent |
| Send promotional email | Name, email address, marketing preferences and campaign interactions | Your consent |
| Administer affiliate referrals | Affiliate identifier, referral data, order identifier and conversion value | Your consent for marketing attribution |
| Send review invitations, publish reviews and translate review text into the languages of our storefronts | Name, email address, order information and the review text you wrote | Our legitimate interest in collecting and displaying customer feedback |
| Record and demonstrate your privacy choices | Consent identifier, user identifier where known, choices, notice version, locale, source URL and timestamp | Compliance with our accountability obligations and our legitimate interest in demonstrating which choice was recorded |
| Send limited cookieless signals to Google after consent has been refused | IP address, page URL, technical request information, timestamp and denied consent state | Our legitimate interest in measuring aggregate advertising performance and modelling conversions where cookie-based measurement is unavailable |
We use two optional consent categories: analytics and marketing.
The banner allows you to accept the optional categories or open the preferences dialog. In the preferences dialog, analytics and marketing are shown as separate controls. Both controls are initially selected, but you can turn either or both off before confirming your choice.
Analytics and marketing cookies, browser storage and identifiable tracking do not become active until you confirm a choice.
You can change or withdraw your choice at any time through the cookie-settings button in the website footer.
Every decision is written to a durable consent register. The record contains:
When you withdraw consent, relevant HttpOnly cookies are deleted by our server, browser storage is cleared for the withdrawn category and active session-recording services are stopped. Future browser-side and server-side events requiring that consent are blocked.
Withdrawal does not affect processing that lawfully took place before consent was withdrawn.
We use Google Advanced Consent Mode.
When you refuse analytics and marketing, Google does not receive permission to set or read analytics or advertising cookies. Google tags nevertheless continue to send cookieless pings to Google.
These cookieless pings contain your IP address and the URL of the page you are visiting. They also contain technical request information and your denied consent state.
Google uses these pings to model conversions. This allows Google to estimate advertising conversions and campaign results that cannot be measured directly because analytics or marketing consent was refused.
Refusing consent therefore stops Google Analytics and Google Ads cookies, identifiable analytics measurement, advertising identifiers, enhanced conversions and personalised advertising from this website. It does not stop the cookieless pings containing your IP address and page URL.
We do not describe a refusal as stopping all communication with Google, because that would be incorrect.
With marketing consent, we use the Meta Pixel and Meta Conversions API with dataset 274888676386578.
The events sent to Meta may include:
Depending on the event, Meta may receive hashed versions of your email address, first name, last name, telephone number, city, state, postcode, country and customer identifier.
Meta may also receive your fbp and fbc identifiers, IP address and user agent.
Hashing does not make this information anonymous. Meta may match the hashed values to information already held in its systems.
Meta events are sent from the browser and from Victus servers. Server-side events are sent only while marketing consent is active.
We use Google Analytics 4 through Google Tag Manager container GTM-5B4X3PM.
When analytics consent is active, Google may receive a client identifier, page URLs, device and browser information, ecommerce events, order identifiers and order values.
We also send server-side events to Google Analytics through the Measurement Protocol for subscription renewals and refunds. These identifiable ecommerce events are sent only while analytics consent remains active.
When analytics consent is refused, Google Analytics cookies and identifiers are not set or read. The cookieless pings described in section 6 continue.
With marketing consent, we use Google Ads enhanced conversions.
A purchase may result in hashed email, telephone and address information being sent to Google. Google click identifiers such as gclid, gbraid and wbraid are stored with the order so that a purchase can be attributed to an advertisement.
Enhanced-conversion data and stored click identifiers are not used after marketing consent has been refused or withdrawn.
We provide Google Merchant Center with a product feed. The feed contains product information and is not intended to contain customer personal data.
When you enter a delivery address, we may send it to Google's address validation service to check that it is complete and deliverable. This happens as part of processing your order and is not governed by the analytics or marketing categories.
You may choose to create or access your Victus account using a Google or Facebook account. If you do, that provider confirms your identity to us and supplies your name, email address and an account identifier.
This exchange happens because you chose to sign in that way and is not governed by the analytics or marketing categories. You can avoid it by creating a Victus account with an email address and password instead.
With analytics consent, we use Hotjar site 5240791 and Lucky Orange site 281e6eb1 for session recordings and heatmaps.
These services may record navigation, scrolling, clicks, taps and similar interactions with the storefront.
We mark sensitive parts of our own pages so that these services do not capture them. Delivery addresses, email addresses and account and address forms carry suppression markers that instruct Hotjar and Lucky Orange to exclude their contents from recordings, and this behaviour is covered by automated tests. Payment details are entered in fields hosted by our payment providers and never appear in our own pages.
Recording is stopped when analytics consent is withdrawn.
Reviews written by customers may be translated automatically so that they can be shown on our other language storefronts. To do this, the review text is sent to OpenAI. We send the review content and do not send your name, email address or order details with it.
| Provider | Purpose | Data received | Processing location |
|---|---|---|---|
| Meta | Advertising measurement, attribution, customer matching and audience building through the Meta Pixel and Conversions API, and account sign-in where you choose it | Page and ecommerce events, hashed contact and address information, hashed customer identifier, fbp, fbc, IP address and user agent | European Economic Area and United States |
| Google Analytics and Google Tag Manager | Website and ecommerce analytics, consent signalling and conversion modelling | Client identifier where consented, page URLs, device and connection information, ecommerce events, order identifiers, values, IP address and consent state | European Economic Area and United States |
| Google Ads | Enhanced conversions, advertisement attribution, campaign measurement and audience services | Hashed email, telephone and address information, purchase information, Google click identifiers, IP address and page URL | European Economic Area and United States |
| Google Merchant Center | Publication of the Victus product feed | Product information only; no intended customer personal data | Global Google infrastructure |
| Google Address Validation and Google Sign-In | Delivery address verification, and account sign-in where you choose it | Delivery address as entered; name, email address and account identifier when signing in | Global Google infrastructure |
| Hotjar | Session recordings, heatmaps and storefront usability analysis | Page interactions, browser and device data, connection information and Hotjar identifiers | European Economic Area and United States |
| Lucky Orange | Session recordings, heatmaps and storefront usability analysis | Page interactions, browser and device data, connection information and recording identifiers | United States |
| OpenAI | Automatic translation of customer review text for our other language storefronts | The review text only | United States |
| ActiveCampaign | Email marketing, campaign administration, transactional communication and order synchronisation | Name, email address, marketing status, campaign interactions and relevant order information | United States |
| Our email delivery provider | Sending order confirmations, shipping notices, login codes, review invitations and other messages you have asked for | Name, email address and the content of the message, which may include order and delivery details | European Economic Area |
| Tapfiliate | Affiliate referral and conversion attribution | Affiliate identifiers, referral information, order identifier and conversion value | European Economic Area |
| Mollie | Payment processing, payment status and fraud prevention | Contact, transaction, payment-method, device and fraud-screening information | European Economic Area |
| Stripe | Payment processing, payment status and fraud prevention | Contact, transaction, payment-method, device and fraud-screening information | European Economic Area and United States |
| Sendcloud | Shipment creation, labels, tracking and delivery administration | Name, delivery address, contact information, order and shipment information | European Economic Area |
| Sellercloud | Order, inventory and fulfilment administration for United States orders | Customer, order, product, shipment and fulfilment information | United States |
| Trustpilot | Review invitations and review widgets | Name, email address, order reference and review information | European Economic Area |
| Cloudflare | Content delivery, traffic routing, performance, bot management and website security | IP address, request headers, user agent, requested URL, connection metadata and security signals | Global infrastructure, including the European Economic Area and United States |
| Sentry and Laravel Nightwatch | Error investigation, application diagnostics and performance monitoring | Errors, stack traces, request information, performance data and user or order identifiers where incidentally included | European Economic Area and United States, depending on the provider |
We also run diagnostic tooling on our own servers. That tooling is not a separate recipient, because the data does not leave our infrastructure.
Meta, Google, Hotjar, Lucky Orange, OpenAI, ActiveCampaign, Stripe and Sellercloud may process personal data in, or make it accessible from, the United States.
Cloudflare and configured monitoring providers may also process connection or diagnostic information in the United States.
Where a US recipient has an active certification covering the relevant service under the EU-US Data Privacy Framework, the transfer may rely on the European Commission's adequacy decision for that framework.
Where the EU-US Data Privacy Framework is unavailable or does not cover the relevant transfer, the transfer is covered by the European Commission's Standard Contractual Clauses and, where required, additional safeguards.
Declining analytics and marketing prevents optional transfers to Meta, Hotjar and Lucky Orange. It prevents Google from setting or reading analytics and advertising cookies and prevents enhanced conversions and identifiable server-side ecommerce events.
Declining does not stop Google's cookieless pings. Google continues to receive your IP address and the URL of the page you are visiting for conversion modelling.
Declining optional tracking also does not prevent processing that is necessary to operate the website or complete a service you request. For example:
We keep personal data for as long as it is needed for the purpose it was collected for, and then delete it or reduce it to what remains necessary. Because the right period depends on the purpose, we set it using the criteria below rather than a single fixed term.
| Data category | How we determine how long we keep it |
|---|---|
| Orders, invoices, subscription charges, payments, refunds and fulfilment records | For as long as Dutch tax and accounting law requires us to keep the transaction record |
| Account profile | For as long as your account or subscription is active, and afterwards for as long as we may still need it to handle questions, returns or claims arising from your last order |
| Customer service correspondence | For as long as needed to resolve your request, and longer only where it forms part of a transaction record, dispute, product-safety matter or legal claim |
| Consent records | For as long as we may need to demonstrate which choice applied to you, taking into account the periods in which a complaint or claim about that choice can still be made |
| Analytics data held by Google | According to the data-retention setting configured on our Google Analytics property |
| Session recordings and heatmaps | According to the retention settings configured in our Hotjar and Lucky Orange accounts |
| Marketing and attribution identifiers | For as long as they can still serve advertising attribution, which is bounded by the attribution windows the advertising platforms apply |
| Marketing profile and campaign interactions | Until you withdraw consent or unsubscribe, after which we keep only what is needed to make sure we do not contact you again |
| Security, access, error and performance logs | For as long as needed to investigate and resolve technical and security issues |
| Fraud, abuse, security incident and legal-claim records | Until the matter is resolved and any period in which a related claim can still be brought has passed |
We may keep information longer where this is necessary to comply with law, resolve an active dispute, respond to a product-safety issue, establish or defend a legal claim or comply with a binding request from a competent authority. Where an exception applies, access to the retained information is limited to that purpose.
You can ask us at any time how long we expect to keep a particular category of your data, and you can ask us to delete it. Section 11 explains how.
Where the GDPR applies, you have the rights described below. A particular right may be subject to legal conditions or exceptions.
| Right | What it means | How to exercise it |
|---|---|---|
| Access | You can ask whether we process your personal data and request a copy and information about the processing. | Email us and state that you are making a data access request. Identify the account, order or email address concerned. |
| Rectification | You can ask us to correct inaccurate information or complete incomplete information. | Tell us which information is incorrect and provide the correct information. |
| Erasure | You can ask us to delete information where it is no longer needed, consent has been withdrawn or another legal ground for deletion applies. | Tell us which information or processing activity you want deleted. We will explain if information must be retained by law or for another overriding legal reason. |
| Restriction | You can ask us to stop using information temporarily while its accuracy, lawfulness or an objection is being assessed. | Identify the processing you want restricted and explain why. |
| Data portability | For certain automated processing based on consent or contract, you can request information you provided in a structured, commonly used and machine-readable format. | State that you are making a data portability request and identify the relevant account or service. |
| Objection | You can object to processing based on legitimate interests. We must stop unless we demonstrate compelling grounds or the information is needed for legal claims. An objection to direct marketing is always honoured. | Identify the processing you object to and explain your reasons. For direct marketing, you may also use the unsubscribe link. |
| Withdraw consent | You can withdraw analytics, marketing or email consent at any time without affecting earlier lawful processing. | Use the footer cookie-settings button, use an unsubscribe link or contact us. |
| Automated decision-making | Where applicable, you can request human intervention and contest a decision based solely on automated processing that has legal or similarly significant effects. | Identify the decision and explain why you want it reviewed by a person. |
| Complaint | You can complain to a data protection authority, including the Autoriteit Persoonsgegevens in the Netherlands. | You may contact the Autoriteit Persoonsgegevens directly through its website. You may also complain to the authority in your country of residence, workplace or the place of the alleged infringement. |
Send privacy requests to support@victus.team. Clearly state which right you want to exercise.
We may request information reasonably necessary to confirm your identity and protect your account. We will not request more information than is proportionate for that purpose.
We normally respond within one month. If a request is complex or several requests are made, we may extend the response period by up to two additional months. We will inform you within the first month if an extension is required.
Victus is established in the Netherlands, but visitors and customers in the United States may use our website and purchase our products.
When a US visitor accepts marketing, Meta and Google receive information about the visitor's use of the website.
Depending on the interaction, this information may include IP address, device and browser information, page URLs, advertising identifiers, product views, cart activity, checkout activity, purchases and hashed contact information.
Meta and Google use this information for advertising. This includes:
We do not enable Meta Limited Data Use or Google's Restricted Data Processing for US visitors. Information accepted for marketing is therefore processed under the providers' normal advertising settings rather than being restricted to a limited-service mode.
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies only to businesses that meet its statutory conditions and at least one applicable revenue, consumer-volume or sale-and-sharing threshold.
Victus does not currently meet the applicable annual-revenue threshold, the threshold based on the number of California consumers or households whose personal information is bought, sold or shared, or the threshold based on the percentage of annual revenue earned from selling or sharing personal information.
We therefore do not describe the controls below as statutory CCPA or CPRA rights and do not claim that we provide them because California law requires us to do so.
To stop Meta and Google's cookie-based advertising processing, customer matching and audience building, turn marketing off in the consent banner or use the cookie-settings button in the website footer.
Turning marketing off stops Meta Pixel and Conversions API events, Google advertising cookies, stored Google click identifiers, Google enhanced conversions and the use of Victus website activity for advertising audience building.
To stop Google Analytics cookies, identifiable analytics measurement, Hotjar and Lucky Orange, turn analytics off through the same controls.
These settings do not stop Google's cookieless pings. Because we use Google Advanced Consent Mode, Google continues to receive the visitor's IP address and page URL and uses these to model conversions.
Victus does not currently provide a separate website setting that blocks those cookieless pings.
You may contact support@victus.team with questions about how your information is used.
Material changes are published as a new version with a new last-updated date and changelog entry.
The notice version stored with a consent decision identifies the version that applied when that decision was made.
What changed in this version: Initial version covering orders, subscriptions, consent, analytics, advertising, fulfilment and international data transfers.