Privacy policy

Last updated: 23 October 2026

This policy explains how OÜ Who Wins (trading as Bionic Labs, "we", "us") collects and uses personal data when you visit bioniclabs.co, create an account, place an order or contact us. We process personal data under the EU General Data Protection Regulation (GDPR) and Estonian law.

1. Who is responsible for your data

The controller is OÜ Who Wins, registry code 17156864, Siduri tn 7, 11313 Tallinn, Estonia. For any privacy question or request, email support@bioniclabs.eu or use our contact page.

2. What we collect

  • Order and account details: name, email, phone number, billing and shipping address, order history and account login details.
  • Payment details: the payment method used and confirmation of payment. Card data is handled by the payment provider; we never see or store full card numbers. For bank transfers we receive the payer's name, account and payment reference.
  • Messages: what you send us by email, WhatsApp or the contact form.
  • Technical and usage data: IP address, device and browser type, pages viewed and how you use the site. Analytics and marketing data is only collected if you accept it in the cookie banner.
  • Affiliate data: if you join our affiliate programme, your referral activity and payout details.

We do not ask for, and you should not send us, health information.

3. Why we use it and our legal basis

  • To process and deliver your order, issue invoices, send order and shipping updates, and provide order photos and tracking (performance of a contract).
  • To keep accounting and tax records (legal obligation).
  • To answer your questions and handle claims (contract and legitimate interest).
  • To prevent fraud and keep the shop secure (legitimate interest).
  • To measure and improve the site and, if you allow it, to show relevant ads (consent, which you can withdraw at any time).
  • To send batch alerts and news by email if you subscribe (consent; every email has an unsubscribe link).

4. Who we share it with

We share data only with service providers that help us run the shop, under contracts that require them to protect it:

  • Shopify (store, checkout and customer accounts)
  • Payment providers and our bank (to take and confirm payments)
  • FedEx and other carriers (to deliver your order)
  • Sufio (to create and email invoices)
  • HubSpot (email and customer messages)
  • Microsoft Clarity (site analytics, only with consent)
  • Meta (Facebook and Instagram) and Google (advertising measurement, only with consent)
  • Social Snowball (affiliate programme)
  • WhatsApp (if you choose to message us there)

We may also disclose data where the law requires it, for example to tax authorities. We do not sell personal data.

5. Transfers outside the EU

Some providers process data outside the European Economic Area, for example in the United States. Where they do, the transfer is protected by an EU adequacy decision (such as the EU–US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses.

6. How long we keep it

  • Order, invoice and payment records: 7 years, as required by Estonian accounting law.
  • Customer account: until you ask us to delete it, or after 3 years without activity.
  • Support messages: up to 3 years after the matter is closed.
  • Newsletter: until you unsubscribe.
  • Analytics and marketing cookies: as set out in the cookie banner, at most 13 months.

7. Cookies

Necessary cookies keep the cart, checkout and login working and are always on. Analytics and marketing cookies are only set if you accept them. You can change your choice at any time with the "Cookie preferences" link at the bottom of every page.

8. Your rights

You can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw any consent you gave. Email support@bioniclabs.eu; we reply within one month. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the data protection authority where you live.

9. Age

Our shop is for adults only. We do not knowingly collect data from anyone under 18.

10. Changes

We may update this policy. The date at the top shows the latest version.