Free shipping from €150 in Germany & the EU
Handcrafted from stainless steel in Franconia
Ships in 1–2 business days
Installed in 5 minutes

Privacy Policy

As of: October 24, 2026

1. Data Controller

Outgym GmbH
Bgm.-Georg-Reck-Str. 3
91336 Heroldsbach
Germany
Phone: +49 9190 9958544
Email: support@steam-butler.de
Managing Director: Michael Meindl

We operate this online shop under the brands "Steam Butler" and "MeiWell". If you have any questions about data protection, you can contact us at support@steam-butler.de.

2. Overview and Legal Basis

We only process personal data to the extent necessary to provide our website, process your orders, and communicate with you, or where you have given your consent. The legal bases are:

  • Art. 6(1)(a) GDPR – your consent (e.g., cookies for statistics, newsletters). For access to your device, § 25(1) TDDDG also applies.
  • Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures (orders, shipping, payment, inquiries).
  • Art. 6(1)(c) GDPR – legal obligations (in particular commercial and tax retention requirements).
  • Art. 6(1)(f) GDPR – legitimate interests (secure and stable operation of the website, fraud prevention, smooth delivery, enforcement of claims). For technically essential storage on your device, § 25(2) No. 2 TDDDG applies.

3. Hosting and Shop System (Shopify)

Our shop runs on the platform of Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). On our behalf, Shopify stores and processes all data generated when you visit the shop and place orders (including server log data such as IP address, date and time, page visited, browser, and operating system; order, customer, and payment data). We have a data processing agreement with Shopify (Art. 28 GDPR).

Shopify may transfer data to affiliated companies, in particular Shopify Inc. in Canada and the United States. For Canada, there is an EU Commission adequacy decision; for the United States, transfers are based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.

Legal basis: Art. 6(1)(b) and (f) GDPR. Shopify's privacy notices: https://www.shopify.com/legal/privacy

4. Cookies and Consent

We use cookies and similar technologies (e.g., local storage). We use technically necessary cookies (e.g., shopping cart, checkout, session, storage of your cookie choices, fraud protection) without consent (§ 25(2) No. 2 TDDDG, Art. 6(1)(b) and (f) GDPR).

We only use cookies and services for statistics and marketing (see Section 11) with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Consent is obtained via Shopify's consent management tool (cookie banner). You can withdraw your consent at any time with future effect by changing your cookie choices or by sending us an email at support@steam-butler.de; you can also clear cookies from your browser at any time.

5. Customer Account and Shop Pay

You can create a customer account to view your orders. In doing so, we process your email address and the data you have provided. Optionally, you can sign up for or pay with Shop Pay; Shop Pay is a Shopify service that allows you to save your data for future purchases. Shopify's terms and conditions also apply.

Legal basis: Art. 6(1)(b) GDPR. You can request the deletion of your customer account at any time; statutory retention periods remain unaffected.

6. Orders and Order Processing

Order data: When you place an order, we process your name, billing and delivery address, email address, telephone number (if applicable), order contents, and payment information. Legal basis: Art. 6(1)(b) GDPR.

Order processing and invoicing (Billbee): We use the software of Billbee GmbH, Germany, as a data processor to process orders, issue invoices, and prepare shipments. Legal basis: Art. 6(1)(b) and (c) GDPR.

Shipping (DPD): For delivery, we pass your name and delivery address to DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg (Art. 6(1)(b) GDPR). We also provide DPD with your email address or telephone number so that DPD can inform you about the delivery date and coordinate delivery (Art. 6(1)(f) GDPR – legitimate interest in smooth delivery). You can object to this at any time.

7. Payment Service Providers

Depending on the payment method you choose, we pass the data required for payment (including your name, address, email, order amount, order number, and IP address) to the respective payment service provider. Legal basis: Art. 6(1)(b) GDPR; for fraud prevention, Art. 6(1)(f) GDPR.

  • Shopify Payments (e.g., credit card, Apple Pay, Google Pay, Shop Pay): Payments are processed by Shopify and the payment processor Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. For Apple Pay or Google Pay, the privacy notices of Apple or Google also apply.
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal may perform a credit check for certain payment methods. PayPal Privacy Notices. If we offer PayPal buttons on product pages or in the shopping cart ("Express Checkout"), your browser loads program code from PayPal when you visit these pages; your IP address is transmitted to PayPal in particular. This is necessary to provide you with the PayPal payment method (Art. 6(1)(b) and (f) GDPR, § 25(2) No. 2 TDDDG).
  • Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may perform an identity and credit check to determine which payment methods to offer and may transmit data to credit reporting agencies for this purpose. Klarna Privacy Notices

8. Contact and Contact Form

If you contact us by email, telephone, or via the contact form, we process the information you provide (name, email, telephone number (if applicable), message) to answer your inquiry. The contact form is provided by Shopify (see Section 3). Legal basis: Art. 6(1)(b) GDPR (in connection with a contract or retailer inquiries) or Art. 6(1)(f) GDPR (other inquiries). We delete inquiries once they have been fully processed and there are no retention obligations.

Online Withdrawal Function ("Withdraw from contract")

For the electronic declaration of withdrawal, we use the "EU Withdrawal Button" app by 401layers UG (haftungsbeschränkt), Hilden, Germany. We process the data you provide (name, email address, order number, and details about the items (if applicable)) as well as technical data (IP address, browser, operating system, time) to receive, document, and send you a confirmation of receipt of your withdrawal.

The legal basis is Art. 6(1)(c) GDPR in conjunction with § 356a BGB (statutory obligation to provide a withdrawal function), as well as Art. 6(1)(b) GDPR (performance of the contract). We have a data processing agreement with the provider pursuant to Art. 28 GDPR. The data will be deleted as soon as it is no longer required to process the withdrawal and fulfill statutory retention obligations.

9. Newsletter

If you sign up for our newsletter (e.g., during checkout), we use your email address to send you information about our products, promotions, and new arrivals. We log the sign-up (time, IP address) so that we can prove your consent. The newsletter is sent via Shopify (see Section 3).

Legal basis: Art. 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time using the unsubscribe link in any email or by emailing us.

10. Customer Reviews (Judge.me)

For product and shop reviews, we use the Shopify app Judge.me (Judge.me Ltd.). After placing an order, Judge.me may send you an email on our behalf asking you to leave a review. The legal basis is Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG (requesting a review from existing customers about your own goods). You can object to this at any time, e.g., via the link in the email or by emailing support@steam-butler.de.

If you leave a review, your name or initials, your review, and photos (if applicable) will be published on our website (Art. 6(1)(a) GDPR). You can request the deletion of your review at any time. Data may also be processed outside the EU (see Section 14). Judge.me Privacy Notices: https://judge.me/privacy

We explain how we handle the authenticity of reviews on the Authenticity of Reviews page.

11. Statistics and Marketing (Only with Consent)

Shopify Statistics: Shopify collects data on visitor and purchasing behavior for us (e.g., pages visited, shopping cart events, source of the visit) to provide shop analytics. This is only done with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw your consent at any time as described in Section 4.

Marketing and Advertising Performance Measurement

We run advertising on Meta (Facebook, Instagram) and Google. To measure whether our ads lead to visits and purchases, and to show ads to people who may be interested in our products, we use the following services. They are activated exclusively with your consent via our cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). No data is transmitted to these providers without consent. You can withdraw your consent at any time as described in Section 4.

Meta Pixel and Conversions API: The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). The Meta Pixel collects events on our website (e.g., page views, product views, shopping cart events, purchases with order value) along with technical data such as IP address, browser and device information, and cookie identifiers. In addition, we transmit the same events directly from our shop system (Shopify) to Meta via the Conversions API so that measurement also works reliably despite browser restrictions. As part of "enhanced matching," your email address, telephone number, name, and address may also be transmitted in an encrypted (hashed) form so that Meta can associate the purchase with a user account. Meta uses this data to measure the success of our ads, optimize delivery, and create advertising audiences. We are jointly responsible with Meta for the collection and transmission of the data to Meta (Art. 26 GDPR); you can find the agreement at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for further processing. Meta may transmit data to Meta Platforms, Inc. in the United States; Meta is certified under the EU-U.S. Data Privacy Framework. Meta Privacy Notices: https://www.facebook.com/privacy/policy

Google Ads (Conversion Tracking and Remarketing) and Google Shopping: The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). We promote our products in Google Search, Google Shopping, YouTube, and the Google advertising network. With conversion tracking, Google learns when you complete a purchase (including order value) after clicking on one of our ads; cookies or identifiers, your IP address, and information about your device are processed in doing so. If applicable, we transmit your email address or telephone number in an encrypted (hashed) form for more precise measurement ("enhanced conversions"). Through remarketing, we can show you ads again after you visit our shop. We use Google Consent Mode: No cookies are set for advertising purposes without your consent. Google may transmit data to Google LLC in the United States; Google is certified under the EU-U.S. Data Privacy Framework. Google Privacy Notices: https://policies.google.com/privacy

Integration is carried out via the Shopify sales channels "Facebook & Instagram" and "Google & YouTube". For product ads, we also transmit our product data (e.g., title, images, prices) to Meta and Google; this does not contain personal data. The event data stored by Meta and Google is deleted according to their retention periods (usually after no more than 2 years).

12. Social Media Presence and Links

If we link to profiles on social networks, these are simple links; data is only transmitted when you click the link. If you visit our profiles on these platforms, the operators process your data according to their own privacy policies.

13. Recipients

Only the service providers mentioned in this statement receive your data to the extent necessary for the respective purpose, as well as our tax advisor and authorities, where we are legally obliged to do so. We have data processing agreements with service providers that process data on our behalf pursuant to Art. 28 GDPR.

14. Transfers to Third Countries

Transfers to countries outside the EU or EEA only take place if the EU Commission has issued an adequacy decision for the country (e.g., Canada, or the United States for companies certified under the EU-U.S. Data Privacy Framework) or if appropriate safeguards pursuant to Art. 46 GDPR, in particular EU Standard Contractual Clauses, have been agreed upon.

15. Retention Period

We only store personal data for as long as is necessary for the respective purpose. We retain invoices and accounting records for 8 years due to commercial and tax retention obligations, business letters for 6 years, and books for 10 years (§ 257 HGB, § 147 AO). We store consent data until consent is withdrawn. Cookies are deleted according to the periods specified in the cookie banner.

16. Your Rights

You have the right to

  • information about the data we have stored about you (Art. 15 GDPR),
  • correction of inaccurate data (Art. 16 GDPR),
  • deletion (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • withdrawal of granted consents with future effect (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): If we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. You can object to the processing of your data for direct marketing at any time without giving any reason.

Simply contact support@steam-butler.de.

Right to complain: You can complain to a data protection supervisory authority. We are subject to the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

17. Obligation to Provide

For an order, we require the information marked as mandatory fields during checkout; without it, we cannot conclude the contract. All other information is voluntary.

18. Automated Decisions

We do not make automated decisions, including profiling, pursuant to Art. 22 GDPR. Payment service providers (e.g., Klarna, PayPal) may automatically decide which payment methods are offered to you as part of their credit check.

19. Encryption

Our website uses SSL/TLS encryption. You can recognize an encrypted connection by "https://" and the padlock symbol in the address bar.

20. Changes

We update this privacy policy if our services or the legal situation change. The version published here at the time applies.