Last updated: 27 October 2026
1. Controller
The controller responsible for processing your personal data on this website and in our online shop is:
Hanifly Limited (trading as BodyFrank)
71-75 Shelton Street
London WC2H 9JQ
United Kingdom
Email: info@bodyfrank.com
2. General information
We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR and the UK Data Protection Act 2018. We only process your data where a legal basis permits it, in particular to perform a contract with you (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR), on the basis of our legitimate interests (Art. 6(1)(f) GDPR) or with your consent (Art. 6(1)(a) GDPR).
3. Hosting and server log files
This website is hosted on a server operated by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The server is located in Frankfurt am Main, Germany. We have concluded a data processing agreement with the provider.
When you visit our website, the server automatically records information that your browser transmits: IP address, date and time of the request, the page requested, the referring URL, browser type and operating system. This is necessary to deliver the website and to ensure its security (Art. 6(1)(f) GDPR). Log files are deleted after 14 days at the latest unless they are needed to investigate a specific security incident.
4. Cookies
We only use cookies that are strictly necessary to operate the shop, for example to keep the contents of your shopping cart, to keep you logged in to your customer account and to secure the checkout (e.g. woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*, wordpress_logged_in_*). The legal basis is § 25(2) no. 2 TDDDG and Art. 6(1)(b) and (f) GDPR. We do not use analytics, advertising or tracking cookies. Fonts are hosted on our own server; no connection to Google Fonts is made.
5. Orders and customer account
When you place an order, we process the data required to perform the contract: name, billing and delivery address, email address, telephone number (optional), the products ordered and payment information (Art. 6(1)(b) GDPR). If you create a customer account, we also store your login details and order history until you delete the account.
We keep order and invoice data for as long as required by commercial and tax law (up to 10 years). After that, the data is deleted.
6. Payment
Depending on the payment method you choose, we pass the payment data required to process the payment to the respective payment service provider:
- Southbill – our payment service provider processes card payments and other payment methods offered at checkout. The payment form is loaded directly from our payment service provider; your card details are transmitted to it in encrypted form and are never stored on our servers.
The legal basis is Art. 6(1)(b) GDPR.
7. Shipping
To deliver your order, we pass your name and delivery address to the shipping company commissioned with the delivery. We only pass on your email address or telephone number for delivery notifications if you have consented to this during checkout (Art. 6(1)(a) GDPR). You can withdraw this consent at any time with effect for the future.
8. Contact by email and withdrawal requests
If you contact us by email or use our online withdrawal form, we process the data you provide in order to answer your request or process your withdrawal (Art. 6(1)(b) and (c) GDPR). Our emails are processed by Hostinger International Ltd. (address see section 3).
9. Transfers to third countries
Hanifly Limited is based in the United Kingdom, for which the European Commission has adopted an adequacy decision. If a service provider processes data outside the EU/EEA or the UK, we ensure an adequate level of data protection, for example through the EU standard contractual clauses or the EU-US Data Privacy Framework.
10. Your rights
You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent given at any time with effect for the future (Art. 7(3)).
Right to object: where we process your data on the basis of legitimate interests, you may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, or with the UK Information Commissioner’s Office (ico.org.uk).
To exercise your rights, simply send an email to info@bodyfrank.com.
11. Automated decision-making
We do not use automated decision-making or profiling.
