Privacy Policy

Last updated: 2026-10-25

1. Controller

Bormann Bioscience LLC, 1065 Southwest 8th Street #1563, Miami, FL 33130, USA. Email: info@getdrinkcheck.com.

2. Data we collect when you visit this site

When you load our website, your browser sends the following automatically: IP address, date/time, HTTP status code, referrer URL, browser string, OS, language, bytes transferred. Legal basis: GDPR Art. 6(1)(f), our legitimate interest in serving the site securely.

3. Cookies

We use necessary cookies and browser storage for the cart, language preference and consent status. Analytics cookies are set only with your consent, which you can withdraw at any time. The rules in Section 6 apply to the partner cookie.

Google Analytics 4 and advertising features

With your analytics consent, we use Google Analytics 4 by Google to understand how our website is used and how campaigns perform. This includes public page and article visits with their titles and URLs, product views, confirmed cart changes, checkout transitions, purchases and successfully submitted business enquiries. We also measure scrolling, downloads, outbound links, language changes and article searches. Data includes pseudonymous browser and session identifiers, device information, language, storefront market, sources and campaign parameters, products, quantities, prices, discounts and currencies. Search terms are checked for recognisable personal information before transmission. Personal contact-form fields (name, email, telephone, address and message) and checkout tokens are not sent to Analytics. Please do not enter personal information in searches; automated text checks cannot recognise every possible personal reference. We do not create individual health profiles.

Advertising is a separate choice. Only with your additional advertising consent do we use Google Signals and advertising personalisation. Google may then link our usage data with information about signed-in Google users who have also enabled personalised advertising with Google. This supports aggregate reports about demographics, interests and use across devices. Google may use first-party and third-party cookies or advertising identifiers. With advertising consent, we also send valid Google advertising click identifiers from the landing URL to associate ads with later actions. Earlier analytics approval does not count as advertising consent. We do not send our own User-ID or hashed contact details to Google.

The Google tag is not loaded before analytics consent or after refusal. Earlier interactions are not sent later. You can change or withdraw your choices through “Cookie settings” in the footer. Further collection is stopped as appropriate, cookies within our control are removed, and the page may reload. Choices apply separately on each domain. Shopify transfers current analytics and advertising choices into checkout in signed form. DrinkCheck purchase measurement is restricted to the corresponding DrinkCheck checkout.

Analytics cookies are configured for up to two years and may be renewed with further use. Browsers may apply shorter limits. User and event data are retained for 14 months; new activity resets the user-data retention period. Aggregate reports may remain longer. Processing is based on the corresponding consent. Google processes data on its infrastructure, potentially including the United States. See Google data processing, international transfers, My Ad Center, My Activity and the Analytics opt-out add-on.

4. Checkout processing

Checkout runs on Shopify infrastructure (parahealth.de, parahealth.com or parahealth-com.myshopify.com). Shopify collects the data required to fulfil your order (name, address, payment details) as our data processor under GDPR Art. 28. Shopify privacy terms: shopify.com/legal/privacy.

5. Forms & transactional email

Messages submitted via contact, wholesale or cities forms are sent via Resend. Resend processes the submitted data (name, email, message body) as our data processor.

6. Affiliate program

Partners recommend DrinkCheck with a personal partner code or partner link and receive a commission in return. New customers get a discount on their first order with the partner code. The following four parts explain what data we process for this. This processing takes place once and to the extent that the affiliate program is running. The recipients at the end of the fourth part apply to all four parts, each for the data it needs for its task.

Orders, existing-customer flag and binding

For the affiliate program, we store every paid order in our shop that contains at least one DrinkCheck item, including orders without a partner code. We store:

your Shopify customer number;
keyed values of your email address and your delivery address: we generate them with a secret key (HMAC), so they are not a mere hash value, and the addresses cannot be read from them;
order number, time of payment and delivery country;
all line items of the order with quantity, net amount and brand, including items of other brands from our shop;
refunds and chargebacks;
whether a company is specified;
the redeemed partner code and the partner to whom we attribute the order.

We use this data to settle commissions, including on follow-up purchases, to check the rule that partner codes apply only to new customers, to detect self-purchases by partners and to exclude bulk orders. The legal basis is GDPR Art. 6(1)(f); our legitimate interest is accurate settlement of the affiliate program that is protected against abuse.

If your customer record in the shop has a paid DrinkCheck order (not cancelled, not a test or draft order, not via Amazon), we automatically mark it with the flag dc-kunde. We can retroactively flag earlier purchases once. The flag remains even after a later cancellation or refund until the customer account is deleted. It is used for the rule that partner codes apply only to new customers; we also record it in our partner database.

If you redeem a partner code on your first paid order, we link you to this partner (binding): they then receive a commission on your later DrinkCheck orders as well, and this does not cost you anything. In the binding, we store your customer number, the keyed value of your email address, the partner, the order with which it began, and its period.

The binding lasts as long as the partnership with this partner. We need it for that period because the commission on follow-up purchases is part of our agreement with the partner and can only be settled through the binding (GDPR Art. 5(1)(e)). It ends earlier in certain cases, including if you object to it, if your customer account in the shop is deleted, or if customer accounts are merged or orders are reattributed. If a binding ends, we remove the customer number and the keyed value of your email address from it as soon as no order needs them for settlement anymore, at the earliest 60 days and at the latest 105 days after its end.

We retain the customer number and keyed values in the order records for as long as the affiliate program runs, because only with them can we tell whether someone has already bought from us. If your customer account in the shop is deleted, we delete your bindings, remove the customer number and keyed values from the order records and delete the entry for the existing-customer flag. Commission entries contain neither customer number nor keyed values; we retain them for the statutory retention periods.

You can object to the binding at any time (GDPR Art. 21), most easily by email to info@getdrinkcheck.com. We will then end the binding; orders you pay for afterwards no longer generate a commission for the partner.

If you request information about your data via the shop, we record as evidence which bindings and how many attributed orders we have reported for your Shopify customer number. We retain this record for as long as the affiliate program runs (GDPR Art. 6(1)(f); our legitimate interest is evidence that we provided the information).

Partner links lead to our shop with a partner’s partner code. We count clicks on them only as a daily total per partner, channel and campaign. Channel and campaign come from the link, not from your device. We do not store the IP address, browser identifier or time of the click for this.

So that the partner’s discount applies to your first order, our shop can remember the partner code. For this, our server sets the cookie dc_pref for 30 days. It contains the partner code, channel, campaign, the time of the click and a signature, and is valid only for the domain on which you receive it.

In the EU, the EEA, the United Kingdom and some other regions, and always when we cannot recognise your country, we set the cookie only with your consent: with the “Remember partner discount” category in the cookie banner, also via “Accept all”, or with a tap on “Activate discount” in the partner discount bar. The legal basis is Art. 5(3) of Directive 2002/58/EC and GDPR Art. 6(1)(a). Without consent, the code applies only during the current page view, and we store neither the code nor channel, campaign or click time, except as a discount code in your cart; if you order, the code is also sent to Shopify in the signed order attribute (dc_aff), as described below.

In other countries, for example in the USA or Switzerland, we set the cookie until you decline the category. The legal basis there is GDPR Art. 6(1)(f); our legitimate interest is remembering the discount for you and attributing the commission to the right partner.

We store your choice in the cookie dc_partner_consent_v1. If you decline, we store nothing except your choice, and we delete any existing partner cookie. You can withdraw your consent at any time via “Cookie settings” in the footer; we will then also delete the partner cookie.

The code appears as a discount code on the order. In addition, a signed order attribute (dc_aff) with the partner code is sent to Shopify, and with consent or in regions without a consent requirement also channel, campaign and click time. We store this information with the order to analyse which channel and which campaign orders come from, and as an audit trail. Attribution to the partner is decided by the partner code and the binding, not by this attribute. The legal basis for channel, campaign and click time is your consent (GDPR Art. 6(1)(a)), and in regions without a consent requirement GDPR Art. 6(1)(f). We delete the channel, campaign and click time of an order no later than 105 days after its payment; the code and partner remain for settlement.

Partners as recipients of pseudonymous data

In the partner portal, partners see only pseudonymous information for each new-customer order attributed to them: an identifier that is not the order number, the day, the net amount, the commission, the status, the type of attribution (via code, via link or manually) and channel and campaign, to the extent we store them under the previous part. They see follow-up purchases only as a monthly total with count, net amount and commission. They also see the clicks per campaign and the number of their bound customers.

Master partners see for their team only totals per team partner and month (orders, net amount and their team commission), not individual orders.

Partners never receive names, email addresses, postal addresses, locations or details of purchased products. The affiliate terms prohibit them from attributing orders to specific persons. The legal basis is GDPR Art. 6(1)(f); our legitimate interest is settlement that partners can verify.

Application, invitation and partner account

If you apply as a partner, we store your name, email address, country, language, your channels and profiles, your follower range, your desired code if provided, and your confirmations (minimum age, affiliate terms, knowledge of this privacy policy) with the time and the versions in force. You confirm your email address via a link we send you. We delete unconfirmed applications 7 days after receipt and rejected ones 6 months after rejection.

If a master partner invites you to their team, you accept the invitation via their link. In doing so, we store your name, email address, country, language, your desired code and your confirmations (minimum age, affiliate terms) with the time and the versions in force. You confirm your email address via a link; we delete unconfirmed acceptances 7 days after this link expires. Your master partner sees your name, your code, your status, the monthly totals of your orders and whether your payout details are missing, but no customer data.

If you are a partner, we maintain a partner account with name, email address, country, language, partner code, your rates, the accepted versions of the affiliate terms and the orders, commissions and credit notes attributed to you. From your email address and postal address we generate keyed values as in the first part, to detect self-purchases. We keep internal notes on your partnership, for example on reviews of posts or on suspensions.

Before your first payout, you enter your payout details and tax status in the partner portal. We store your bank account details or payout destination in encrypted form; we log every access to the decrypted data. We store name, postal address and tax details (tax status, legal form, your statement whether you are a US person for US tax purposes, VAT identification number, tax number, type and status of your tax form) for the credit note and the tax forms. You send Forms W-9 or W-8 to our tax advisor; we do not store the complete forms or the US taxpayer identification number (TIN), we only record whether the form is on file and, for US persons, the last four digits of the TIN. Before the first payout, we check whether you are on a sanctions list.

In the partner portal (partner.getdrinkcheck.com), you log in via a link we send you by email. After that, the cookie __Host-dc_partner_session keeps your login, for at most 30 days and only up to 7 days without use. It is strictly necessary (Art. 5(3) of Directive 2002/58/EC) and applies only to the partner portal.

We process this data to review your application or invitation and to carry out the partnership (GDPR Art. 6(1)(b)). We meet retention obligations under EU or Member State law on the basis of GDPR Art. 6(1)(c). For US persons, we report payments to the US tax authority (IRS) on Form 1099-NEC where the statutory requirements are met; the legal basis is our legitimate interest in fulfilling our US tax obligations (GDPR Art. 6(1)(f)). We also base the sanctions list check, the internal notes and the keyed values for detecting self-purchases on GDPR Art. 6(1)(f); our legitimate interest is a lawful and abuse-free affiliate program. We store partner data for the duration of the partnership and afterwards for as long as statutory retention periods require.

Recipients are our data processors Cloudflare (hosting, database and spam protection Turnstile), Resend (sending emails) and Shopify (discount codes and order data), as well as our tax advisor for the tax forms, the banks or payment service providers through which we pay out, and, for US persons, the US tax authority (IRS).

7. Hosting & CDN

The website is served via Cloudflare Workers. Cloudflare logs technically necessary data (IP, user-agent, request metadata) for abuse prevention and availability.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Please contact info@getdrinkcheck.com.

9. Your rights (CCPA)

California residents have the right to know what personal information we collect, sell or share, to delete that information, and to opt out of sale/sharing. We do not sell personal information. To exercise CCPA rights, contact info@getdrinkcheck.com.

10. Complaint

You have the right to lodge a complaint with a supervisory authority.

11. Last updated

2026-10-25.