Free tracked delivery across the EUA daily supplement for menUp to −50% with the 5-bottle packZinc contributes to the maintenance of normal testosterone levels in the blood.Niacin contributes to the reduction of tiredness and fatigue.Pay once. No subscription, ever
EN
Order

Privacy Policy

Last updated: 2026-09-30

We take the protection of your personal data seriously. This policy explains what data we collect when you visit fortavel.com and buy from us, why we collect it, and what rights you have under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

1. Controller

CR OU OÜ Nõmme tee 64-3, 11311 Tallinn, Estonia Registry code: 16778262 Email for all privacy matters: [email protected]

We are not required to appoint a data protection officer. You can reach the person responsible for data protection at the address above.

2. Data we process, purposes and legal bases

2.1 Visiting the website

When you visit our website, our hosting provider and our content delivery network automatically process technical data: IP address, date and time of access, pages viewed, referring page, browser and operating system. We need this data to deliver the website, keep it secure and prevent abuse. Legal basis: our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR). Server logs are deleted after 14 days at the latest, unless needed to investigate a security incident.

2.2 Placing an order

To process your order we collect your name, delivery and billing address, email address, phone number (for delivery notifications), the products ordered, and payment status. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Invoices and accounting records are kept for 7 years as required by the Estonian Accounting Act (Art. 6(1)(c) GDPR). Other order data is deleted when no longer needed, at the latest after the end of the limitation period for contractual claims.

2.3 Payment

Payments are processed directly by our payment service providers: Stripe Payments Europe Ltd. (Ireland), Mollie B.V. (Netherlands), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), Klarna Bank AB (publ) (Sweden). They receive the data required for the payment and act as independent controllers for their own fraud prevention and regulatory obligations. We never receive your full card details. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legitimate interest in fraud prevention (Art. 6(1)(f) GDPR).

2.4 Shipping

We pass your name, delivery address, email address and phone number to our fulfilment partner and to the carrier, only to deliver your order and inform you about the delivery. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

2.5 Customer service

If you contact us, we process the information you give us to answer your request. Legal basis: performance of the contract or pre-contractual steps (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering you (Art. 6(1)(f) GDPR).

2.6 Incomplete checkouts

If you enter your email address or phone number at checkout but do not complete the order, we may send you up to two reminders about your cart, only if you have ticked the consent box for this. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

2.7 Emails and text messages about our products

  • Newsletter and SMS: only with your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every message or by replying STOP.
  • Existing customers: after a purchase, we may email you about our own similar products, for example when your supply is about to run out. This is based on our legitimate interest (Art. 6(1)(f) GDPR) and the exception for existing customers in Article 13(2) of Directive 2002/58/EC. You can object at any time, free of charge, via the link in every email or at checkout.

2.8 Cookies, analytics and advertising

We use cookies and similar technologies. Cookies that are strictly necessary for the shop to work are used without consent. Analytics and advertising technologies are used only if you give your consent in our cookie banner (Art. 6(1)(a) GDPR and Article 5(3) of Directive 2002/58/EC). Details are in our Cookie Policy.

2.9 Visits through partner websites

If you reach us through a link of one of our advertising partners, we record the click: the partner's ID and the reference the partner passes to us, the time, the page you land on, your country, device type, operating system and browser, and pseudonymised (irreversibly hashed) values of your IP address and browser. We use this to credit the partner for a resulting order and to detect fraudulent clicks and orders. If you have accepted measurement cookies, we also set the first-party cookie fv_clk (see our Cookie Policy); otherwise the click is only matched within the same visit or through the pseudonymised values within 24 hours. Partners never receive your name, contact details or address, only their own reference, the order status and the commission. If you enter a partner's discount code at checkout, the order is credited to that partner in the same way. The same applies when you reach us through one of our own advertisements (for example on Taboola, Outbrain, Meta or TikTok): we then also store the click identifier of that advertising platform. Only if you have accepted marketing cookies do we report a resulting purchase directly to that platform (server to server), with its click identifier, the order value and, for Meta and TikTok, your email address in hashed form, your IP address and browser, so that the platform can measure its advertising. The same happens, again only with your consent to marketing cookies, when a partner who brought you through a Meta advertisement has connected their Meta pixel: the purchase is then reported to Meta for that partner's advertising account, with the same data; the partner itself does not receive it. Legal basis: our legitimate interest in paying our partners correctly and preventing fraud (Art. 6(1)(f) GDPR); for the cookie and the reporting to advertising platforms, your consent (Art. 6(1)(a) GDPR). Click data is deleted after 13 months, unless it belongs to an order, in which case it is kept with the accounting records.

2.10 Tester programme

If you apply to our tester programme, we process your first name, email address, delivery country and age range, together with your confirmation that you are at least 18 years old and your consent to be contacted. We use this data to select testers and to email you about the programme. If you are selected, we send you a private order link, and your order and any review you submit are marked as "tester". A review from a tester is published like all other reviews, with your first name and city, and with the label "Tester". We do not use this data for any other marketing. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time, with effect for the future, by writing to [email protected]; for the tester order itself, performance of the contract (Art. 6(1)(b) GDPR). The data is stored with our hosting provider Hetzner Online GmbH (Germany); emails are sent via Resend (USA). Applications that are not selected are deleted after 6 months. For selected testers, the data is kept like order data (see section 2.2).

3. Recipients and processors

We share personal data only with the following categories of recipients, and only to the extent needed:

  • Hosting: Hetzner Online GmbH (Germany)
  • Content delivery network and security: Cloudflare, Inc. (USA)
  • Email delivery: Resend (USA)
  • Payment: Stripe Payments Europe Ltd. (Ireland), Mollie B.V. (Netherlands), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), Klarna Bank AB (publ) (Sweden)
  • Fulfilment and shipping: our fulfilment partner in the European Union and the carriers (national postal services and parcel carriers such as DHL, DPD or GLS)
  • Advertising and measurement, only with consent: Meta Pixel (Meta Platforms Ireland Ltd.), Taboola Pixel (Taboola, Inc. and its affiliates)
  • Accountants and legal advisers, bound by professional secrecy, and authorities where required by law

All processors act on our instructions under a data processing agreement (Art. 28 GDPR).

4. Transfers outside the EU/EEA

Some providers are based in, or may access data from, countries outside the EU/EEA, in particular the United States. We transfer data only where the European Commission has issued an adequacy decision (including the EU-U.S. Data Privacy Framework for certified companies) or where the European Commission's Standard Contractual Clauses are in place (Art. 45 and 46 GDPR). You can request a copy of the safeguards at [email protected].

5. Automated decisions

We do not use automated decision-making, including profiling, that produces legal effects for you. Payment providers may carry out automated fraud checks; you can contact them or us if a payment is declined.

6. Your rights

You have the right to:

  • access your personal data (Art. 15 GDPR);
  • have inaccurate data corrected (Art. 16 GDPR);
  • have your data erased (Art. 17 GDPR);
  • restrict processing (Art. 18 GDPR);
  • receive your data in a portable format (Art. 20 GDPR);
  • object at any time to processing based on our legitimate interests, and to direct marketing in all cases (Art. 21 GDPR);
  • withdraw your consent at any time, with effect for the future (Art. 7(3) GDPR).

To exercise your rights, write to [email protected]. We answer within one month.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee.

7. Is providing data required?

The data marked as required at checkout is necessary to conclude and fulfil the contract. Without it, we cannot process your order. Everything else is voluntary.

8. Security

Our website uses TLS encryption. We protect your data with appropriate technical and organisational measures and restrict access to people who need it.

9. Minors

Our products and website are intended only for adults aged 18 and over. We do not knowingly collect data from minors.

10. Changes

We update this policy when our services or the law change. The current version is always available on this page.