PRIVACY POLICY

1. DEFINITIONS

1.1 Personal Data
Personal Data means any information relating to an identified or identifiable natural person. This includes: contact information (name, email address, phone number, postal address); account information (username, password, account creation date, account status); payment information (billing address, payment method type, not full card numbers); transaction data (order history, products purchased, purchase dates, amounts, return/refund information); communication data (emails, support messages, chat logs, feedback, reviews); technical data (IP address, browser type, device type, operating system, cookies, log files); behavioral data (pages visited, products viewed, time spent on site, clicks, search queries); preference data (communication preferences, language preference, product interests); location data (approximate geographic location derived from IP address); and inferred data (preferences, interests, or characteristics inferred from browsing or purchase behavior).

1.2 Sensitive Personal Data
We do NOT intentionally collect Special Categories of Personal Data (also called sensitive data) under GDPR Article 9, including race, ethnicity, health information, biometric data, genetic data, sexual orientation, religious beliefs, trade union membership, or criminal records. If you voluntarily provide such information in product reviews or support messages, we will handle it with maximum confidentiality and will not use it beyond the purpose you intended.

2. DATA WE COLLECT

2.1 Information You Provide Directly
Account Registration: When you create an account, we collect name, email address, phone number (optional), password, and date of birth if applicable.
Purchase Information: When you place an order, we collect shipping address, billing address, payment method information (processed by third-party payment providers), items purchased, quantities, and prices.
Communication: When you email us, complete contact forms, use live chat, submit reviews, or post feedback, we collect the content of your communication, your email address, and metadata (date, time).
Customer Support: If you contact support, we collect information necessary to resolve your issue, including order numbers, product details, and correspondence history.
Surveys and Feedback: If you participate in surveys, polls, or feedback requests, we collect your responses and any personal information you choose to share.
Newsletter Signup: If you subscribe to our mailing list, we collect your email address and preferences (frequency, content type).
Wishlist or Saved Items: If you use wishlist or save-for-later features, we store which products you have saved.

2.2 Information Collected Automatically
Cookies: Our website uses cookies, web beacons, pixels, and similar tracking technologies. Types of cookies we use: Essential/Strictly Necessary Cookies (required for website functionality), Performance and Analytics Cookies (collect information about how you use our website - requires consent in EU/UK), Marketing and Advertising Cookies (track conversions, retarget ads - requires consent in EU/UK), and Preference Cookies (remember your choices). You can control cookies through your browser settings. Disabling cookies may affect website functionality.
Log Files and Server Data: Our web servers automatically log IP address, browser type and version, operating system, referring URL, pages accessed and time spent, requests made and responses received, error messages, and timestamp.
Device Information: When you visit our website or app, we automatically collect device type (mobile, tablet, desktop), screen resolution, language settings, and installed fonts (for fingerprinting detection).
Third-Party Analytics: We use third-party analytics tools, including Google Analytics, to understand user behavior. You can opt out of Google Analytics by installing the Google Analytics opt-out browser extension: https://tools.google.com/dlpage/gaoptout

3. PAYMENT INFORMATION HANDLING

CRITICAL: The Company does NOT store, process, or have access to full credit card numbers, CCV codes, or sensitive payment information. All payment processing is handled by third-party payment processors: Stripe (https://stripe.com) and PayPal (https://paypal.com). These processors comply with PCI-DSS Level 1 and encrypt all payment data. When you enter payment information on our checkout page, that data is transmitted directly to the processor via secure SSL/TLS encryption. The Company receives only a token or confirmation that payment was successful. Your payment information is governed by the processor's privacy policy, not ours. The Company stores only the last 4 digits of your card (e.g., ****1234) and other non-sensitive information needed to fulfill your order.

4. HOW WE USE YOUR PERSONAL DATA

4.1 Contract Performance and Order Fulfillment
Processing orders and payments, shipping products, sending order confirmations and tracking information, processing returns and refunds, providing customer support, and resolving billing and order disputes.

4.2 Legitimate Business Interests
Fraud detection and prevention, compliance with legal obligations (tax, anti-money laundering), improving our website and services, understanding user behavior, personalizing your experience, security monitoring, and establishing legal claims.

4.3 Marketing and Communications (Consent-Based)
We only send marketing emails if you have explicitly opted in. You may unsubscribe by clicking the unsubscribe link in any email, adjusting communication preferences in your account settings, or contacting support@vitayouth.store. We will honor opt-out requests within 10 business days. Note: You will continue to receive transactional emails (order confirmations, shipping notices, support responses) even if you opt out of marketing.

4.4 Analytics and Performance
Analyzing website traffic and user engagement, testing website features, identifying technical issues, and measuring advertising effectiveness.

5. HOW WE SHARE YOUR PERSONAL DATA

5.1 Service Providers and Third-Party Processors
We share personal data with third-party service providers who process data on our behalf under Data Processing Agreements (DPA) that ensure GDPR compliance. These include payment processors (Stripe, PayPal), shipping partners (FedEx, UPS, DHL), email platforms (SendGrid, Mailchimp), analytics providers (Google Analytics), cloud hosting providers, fraud prevention services, and customer support software. All service providers are contractually obligated to process data only as instructed, implement appropriate security measures, not disclose data without authorization, and comply with applicable privacy laws.

5.2 Business Transfers
If the Company is involved in a merger, acquisition, bankruptcy, dissolution, reorganization, or similar transaction, your personal data may be transferred as part of that transaction. We will provide notice before your data becomes subject to a different privacy policy.

5.3 Legal Requirements and Law Enforcement
We may disclose your personal data if required by law or legal process, including court orders, subpoenas, government requests, tax authorities, or sanctions screening. We will disclose only the minimum information required and will notify you unless legally prohibited.

5.4 Aggregate and Anonymized Data
We may share aggregated, de-identified statistics about our users, products, and sales trends with third parties. This data cannot identify you.

5.5 With Your Consent
We will not share your personal data with third parties for purposes other than those described above without your explicit prior consent.

6. DATA RETENTION

We retain personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods: Account information (duration of your account plus 3 years); Order and transaction records (7 years for tax compliance); Payment information (active payment method plus 3 years); Email communications and support tickets (3 years); Log files and analytics data (12 months); Marketing preferences (until you unsubscribe); Legal and compliance records (as long as required by law). After the retention period expires, we delete or anonymize your personal data unless further retention is required by law, you have an outstanding legal claim, or deletion would violate our legal obligations.

7. INTERNATIONAL DATA TRANSFERS

VitaYouth Solutions LLC is based in the United States (Wyoming). If you access our Services from the European Union, United Kingdom, Canada, or another jurisdiction, your personal data will be transferred to and processed in the United States. Data transfers to the United States are necessary to process your orders, host our website, and comply with U.S. legal obligations. We implement appropriate safeguards including Standard Contractual Clauses (SCCs) with our service providers, Data Processing Agreements (DPAs) compliant with GDPR Article 28, and encryption of data in transit. By using our Services, you consent to the transfer of your personal data to the United States and its processing according to this Privacy Policy.

8. YOUR PRIVACY RIGHTS

8.1 GDPR Rights (EU, UK, EEA Residents)
If you are a resident of the European Union, United Kingdom, or European Economic Area, you have the following rights under the GDPR: Right of Access (to obtain a copy of your data), Right to Rectification (to correct inaccurate data), Right to Erasure (to request deletion, also known as Right to Be Forgotten), Right to Restrict Processing (to limit how we use your data), Right to Data Portability (to receive your data in a machine-readable format), Right to Object (to opt out of marketing, analytics, or legitimate interest processing), and Right to Lodge a Complaint (with your national data protection authority). We will respond within 30 days.

8.2 CCPA Rights (California Residents)
If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with: Right to Know (what personal information we have collected), Right to Delete (request deletion of your personal information), Right to Opt-Out of Sale or Sharing (we do NOT sell your personal information, but we use cookies for analytics which may constitute sharing), Right to Correct (inaccurate personal information), Right to Limit Use (of sensitive personal information), and Right to Non-Discrimination (we will not discriminate against you for exercising your rights).

8.3 Other Privacy Laws
If you are a resident of Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) provides you similar rights. If you are a resident of other countries with privacy laws, we respect your rights under those laws.

9. HOW TO EXERCISE YOUR RIGHTS

To exercise any of your privacy rights, submit a request to: support@vitayouth.store or mail to: VitaYouth Solutions LLC, 75 E 3rd St, Sheridan, WY 82801, United States. In your request, please include your full name and email address, the specific right you are exercising, a description of the data involved, and a signature or declaration (if required). We will verify your identity before fulfilling your request. Response timeline: We will respond within 30 days. No fee will be charged unless your requests are excessive or unfounded.

10. SECURITY

We implement comprehensive security measures including SSL/TLS encryption for all data in transit, AES-256 encryption for sensitive data at rest, secure password storage using industry-standard hashing (bcrypt, scrypt), multi-factor authentication (MFA) options, regular security audits and penetration testing, firewalls and intrusion detection systems, access controls limiting employee access, backup and disaster recovery procedures, and employee training on data protection. IMPORTANT: While we use industry-standard security measures, no system is completely secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your password and account credentials.

11. DATA BREACH NOTIFICATION

In the event of a personal data breach (unauthorized access, loss, or disclosure), we will investigate the breach, notify affected individuals without undue delay (typically within 72 hours) if the breach presents a high risk, notify relevant data protection authorities as required by law, and take steps to remediate the breach and prevent future incidents. Notification will include the nature of the breach, data affected, and recommended steps to protect yourself.

12. COOKIES AND TRACKING TECHNOLOGIES

For detailed information on how we use cookies and similar tracking technologies, please see our separate Cookies Policy. In summary: Essential cookies are necessary for website functionality and do not require consent. Analytics and marketing cookies require your consent before they are set. You can withdraw consent at any time or opt out by adjusting your browser settings.

13. CHILDREN'S PRIVACY

Our Services are not directed to children under 18 years of age. We do not knowingly collect personal data from children under 18. If we become aware that we have collected data from a child under 18, we will delete that data immediately and notify the child's parent or guardian. If you are a parent or guardian and believe we have collected data from your child, please contact us immediately at support@vitayouth.store.

14. THIRD-PARTY LINKS

Our website may contain links to third-party websites, including payment processors, shipping carriers, analytics providers, and social media platforms. We are not responsible for the privacy practices of third parties. Each third party has its own privacy policy and terms of use. We recommend reviewing the privacy policies of any third-party sites before providing personal information. Clicking a third-party link means you are leaving our website and our privacy policy no longer applies.

15. DATA PROTECTION OFFICER

While we do not have a formally appointed Data Protection Officer (DPO), one of our senior managers is responsible for overseeing data protection and privacy compliance. If you have privacy concerns or questions, you may contact that person through support@vitayouth.store with "DPO Inquiry" in the subject line.

16. UPDATES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, laws, or other factors. Any updates will be effective when posted to our website. The Effective Date at the top indicates the most recent update. If we make material changes that significantly affect your privacy rights, we will notify you by email or prominent notice on our website. Continued use of our Services after any update means you accept the revised policy.

17. CONTACT INFORMATION

If you have questions about this Privacy Policy, your privacy rights, or our data practices, please contact:

VitaYouth Solutions LLC
75 E 3rd St, Sheridan, WY 82801, United States
Email: support@vitayouth.store
Website: https://vitayouth.store

Response time: We aim to respond to privacy inquiries within 10 business days.

For GDPR complaints, you may also contact your national Data Protection Authority: UK: Information Commissioner's Office (ICO) - www.ico.org.uk; EU: Your national supervisory authority - https://ec.europa.eu/justice/article-29/structure/index_en.htm