Privacy Policy

Last updated: 21 October 2026

1. Introduction

At BrainDrops, we respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect personal data when you visit www.braindrops.eu, purchase our products, manage a subscription or contact us.

We process personal data in accordance with applicable data protection legislation, including the European Union General Data Protection Regulation (GDPR).

2. Data Controller

The data controller responsible for the processing of personal data described in this Privacy Policy is:

Nordic Brain Health ApS
Sankt Markus Alle 5, 4.tv
DK-1922 Frederiksberg C
Denmark
Company registration no. (CVR): 45249824
Email: hello@braindrops.eu

If you have questions about how we process your personal data or wish to exercise your rights, please contact us using the email address above.

3. Personal Data We Collect

Depending on how you interact with our Website, we may collect the following categories of personal data:

• Identity and contact information: Name, email address, telephone number, billing address and delivery address.
• Order information: Products purchased, order history, transaction amounts, shipping information and order status.
• Subscription information: Subscription status, delivery frequency, renewal dates, payment status and changes made to your subscription.
• Payment information: Payment method details and transaction information processed through our payment service providers. We do not normally receive or store complete payment card details.
• Customer service information: Messages, enquiries and correspondence with our customer service team.
• Technical information: IP address, browser type, device information, operating system and information about how you interact with our Website.
• Marketing preferences: Newsletter subscriptions, consent preferences and information about interactions with our marketing communications.
• Cookie and analytics information: Information collected through cookies and similar technologies, subject to applicable consent requirements.

4. How We Use Your Personal Data

We process personal data for the following purposes:

Processing Orders

We use your personal data to process payments, fulfil orders, arrange delivery, provide order confirmations and handle returns or refunds.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR).

Managing Subscriptions

We process personal data to create, administer and renew subscriptions, collect recurring payments, communicate subscription information and process cancellation requests.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR).

Customer Service

We use personal data to respond to enquiries, resolve issues and provide assistance with purchases and subscriptions.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR) or our legitimate interests in providing customer support (Article 6(1)(f) GDPR), depending on the nature of the enquiry.

Legal and Accounting Obligations

We process and retain certain information to comply with applicable accounting, tax, consumer protection and other legal obligations.

Legal basis: Compliance with a legal obligation (Article 6(1)(c) GDPR).

Marketing Communications

Where permitted by applicable law, we may send newsletters, promotional offers and information about BrainDrops products.

We may use information about your purchases and interactions with our communications to make marketing more relevant.

Marketing communications are sent on the basis of consent or another applicable legal basis where permitted by law.

You can unsubscribe from marketing emails at any time using the unsubscribe link included in the email or by contacting us.

Website Analytics and Advertising

We use analytics and advertising technologies to understand how visitors use our Website, improve our services and measure the effectiveness of our marketing.

Where required by law, these technologies are used only after you have provided the relevant consent.

Legal basis: Consent (Article 6(1)(a) GDPR) where required, or legitimate interests (Article 6(1)(f) GDPR) where permitted by applicable law.

5. Cookies and Consent Management

Our Website uses cookies and similar technologies to support essential functionality, improve the shopping experience, analyse Website traffic and support advertising activities.

We use Pandectes as our cookie consent management solution.

Pandectes allows visitors to manage their preferences for cookies and similar technologies, including analytics and marketing technologies.

Where required by applicable law, non-essential cookies and tracking technologies are used only after the visitor has provided consent.

You can change or withdraw your cookie consent through the cookie preferences functionality available on our Website.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Further information about the cookies used on our Website, including their purposes and relevant providers, may be available through our cookie preferences interface.

6. Service Providers and Data Sharing

We share personal data with selected service providers where necessary to operate our business, fulfil orders and provide our services.

These may include:

• Shopify: E-commerce platform, checkout, customer accounts and order management.
• Payment service providers: Secure payment processing and recurring subscription payments.
• Subscription management providers: Administration of subscriptions, renewals and customer subscription preferences.
• Shipping and logistics providers: Order fulfilment, delivery and shipment tracking.
• Klaviyo: Email marketing and customer communications.
• Pandectes: Cookie consent and privacy preference management.
• Analytics and advertising providers: Website analytics, advertising measurement and marketing activities, subject to applicable consent requirements.
• Professional advisers and authorities: Where necessary to comply with legal obligations or protect our legal rights.

We require service providers acting as data processors to process personal data in accordance with applicable data protection requirements and relevant contractual safeguards.

We do not sell personal data to third parties for monetary compensation.

7. International Data Transfers

Some of our service providers may process personal data outside the European Economic Area (EEA).

Where personal data is transferred to countries outside the EEA, we take steps to ensure that appropriate safeguards are in place in accordance with GDPR.

These safeguards may include adequacy decisions adopted by the European Commission or the use of Standard Contractual Clauses, together with additional measures where necessary.

You may contact us for further information about the safeguards applicable to relevant international transfers.

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by applicable law.

Retention periods depend on the type of information and the purpose for which it is processed.

• Order and accounting records: Retained for the period required under applicable accounting and tax legislation.
• Subscription information: Retained while the subscription is active and for a relevant period afterwards where necessary for legal, accounting or customer service purposes.
• Customer service correspondence: Retained for as long as reasonably necessary to handle enquiries, resolve disputes or comply with legal obligations.
• Marketing information: Retained until consent is withdrawn or the information is no longer necessary for the relevant marketing purpose, subject to any lawful retention requirements.
• Cookie consent records: Retained for the period necessary to document and manage consent in accordance with applicable law.

When personal data is no longer required, we delete or anonymise it in accordance with our applicable retention procedures.

9. Your Rights Under GDPR

Subject to applicable conditions and exceptions, you have the following rights regarding your personal data:

• Right of access: Request information about the personal data we process about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of personal data where the legal conditions are met.
• Right to restriction: Request that we restrict certain processing activities.
• Right to data portability: Receive certain personal data in a structured, commonly used and machine-readable format.
• Right to object: Object to processing based on legitimate interests, including processing for direct marketing purposes.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.
• Rights relating to automated decision-making: Exercise applicable rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise your rights, please contact hello@braindrops.eu.

We will respond in accordance with the time limits and requirements established by GDPR.

10. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

These measures include the use of secure e-commerce infrastructure, access controls and appropriate contractual arrangements with relevant service providers.

Although we take reasonable precautions, no method of electronic transmission or storage can be guaranteed to be completely secure.

11. Children's Privacy

Our Website and products are not specifically directed at children.

We do not knowingly collect personal data from children in circumstances where parental consent or another legal basis is required and has not been obtained.

If you believe that we have collected personal data from a child unlawfully, please contact us.

12. Complaints to a Supervisory Authority

If you believe that our processing of your personal data violates applicable data protection legislation, you have the right to lodge a complaint with a competent data protection supervisory authority.

Our lead supervisory authority in Denmark is:

Datatilsynet
The Danish Data Protection Agency
Website: www.datatilsynet.dk

You may also contact the competent supervisory authority in the EU or EEA country where you live, work or where the alleged infringement occurred.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our business operations, data processing activities, service providers or applicable legal requirements.

The latest version will be published on our Website with an updated revision date.

Where required by law, we will provide additional notice or obtain consent before implementing relevant changes.

14. Contact Information

If you have questions about this Privacy Policy or how we process personal data, please contact:

Nordic Brain Health ApS
Sankt Markus Alle 5, 4.tv
DK-1922 Frederiksberg C
Denmark
Company registration no. (CVR): 45249824
Email: hello@braindrops.eu
Website: www.braindrops.eu