Privacy policy

1Data controller

The controller of your personal data within the meaning of Article 4(7) of the GDPR, that is Regulation (EU) 2016/679, is Nutreasy Sp. z o.o., ul. Adama Mickiewicza 37/58, 01-625 Warszawa, Poland, KRS: 0001165303, NIP: 5253041233, REGON: 54132698400000.

Contact details for matters concerning personal data:

• Email: nutreasycc@gmail.com
• Telephone: +48 780 755 684
• Postal address: Nutreasy Sp. z o.o., ul. Adama Mickiewicza 37/58, 01-625 Warszawa

The controller has not appointed a separate Data Protection Officer. Requests are handled directly by authorised representatives of the controller.

2Categories of personal data processed

The controller processes the following personal data:

1. When an order is placed: first name and surname, telephone number, email address, delivery address (street, building or flat number, entrance, floor, intercom code), postcode, delivery preferences, messenger username (Telegram or WhatsApp), the chosen language of contact and the contents of the order.
2. The “Help me choose” consultation form: first name, telephone number, the chosen channel of contact and the language of contact.
3. Technical data: the date and time of the request, IP address, referring source, session parameters and UTM tags.
4. Meal ratings: comments and scores, linked only to the order number.

3Health data — allergies and dietary exclusions

1. Information about allergies, food intolerances and dietary restrictions is a special category of data, that is data concerning health within the meaning of Article 9(1) of the GDPR.
2. The basis for processing is the explicit consent of the data subject (Article 9(2)(a) of the GDPR), given by voluntarily entering the information in the relevant field of the form.
3. The information is used solely to tailor the meal plan and to prepare the food safely. It is not used for marketing purposes and is not subject to profiling.
4. Consent may be withdrawn at any time, which will mean that exclusions can no longer be taken into account in subsequent deliveries.

4Purposes and legal bases for processing

Processing is carried out on the following legal bases:

1. Performance of the contract for the preparation and delivery of meal plans (Article 6(1)(b) of the GDPR) — accepting the order, preparing and assembling it, delivery and day-to-day contact with the Customer.
2. Processing of health and allergy data (Article 9(2)(a) of the GDPR) — on the basis of the Customer's explicit consent, in order to prepare the meals safely.
3. Compliance with legal and tax obligations (Article 6(1)(c) of the GDPR) — bookkeeping and the retention of financial records under Polish law.
4. The legitimate interests of the controller (Article 6(1)(f) of the GDPR) — establishing, pursuing or defending against civil law claims, and the security of the website.
5. Web analytics and statistics (Article 6(1)(a) of the GDPR) — only where the user has given prior consent through the cookie banner.
6. The legitimate interests of the controller (Article 6(1)(f) of the GDPR) — measuring the performance of its own advertising: sending Meta Platforms Ireland Ltd. information about a submitted order or call-back request (point 4a of the “Cookies and tracking technologies” section). You may object to this processing at any time (Article 21 of the GDPR) by writing to the address given in the “Your rights as a data subject” section.

5Recipients of personal data

Data may be shared only with authorised processors, and only so far as is necessary:

1. Providers of IT infrastructure, hosting and cloud services that keep the systems running.
2. Providers of technical automation and communication platforms used to handle customer enquiries.
3. Payment operators, in particular PayU S.A., to enable secure cashless payment.
4. Courier services and the company's own logistics staff, for the actual delivery of orders.
5. Accounting, financial and legal service providers.

The controller does not sell personal data. Data about activity on the website may be passed to the analytics and marketing providers listed in the “Cookies and tracking technologies” section, and only after consent to cookies has been given. Information about a submitted order or call-back request is sent to Meta Platforms Ireland Ltd. on the basis of the controller's legitimate interests (point 4a of that section). On request, the controller will name the specific companies operating within the categories listed above.

On the home page and the diet pages we display reviews of Nutreasy that customers have published on the company's Google Maps profile. We obtain them through the Google Maps Platform (Places API) and show them as Google provides them: with the author's name, profile photo, rating and date, and a link to the original. This is public content governed by the Google Terms of Service (policies.google.com/terms) and the Google Privacy Policy (policies.google.com/privacy). Displaying the reviews requires no data about the visitor to be sent to Google: the requests to Google are made by the website's server, and the authors' profile photos are served by the website rather than by Google directly.

6Transfers outside the EEA

1. Because the controller uses solutions from global providers whose servers may be located outside the European Economic Area, including in the United States, data may be transferred across borders.
2. Any such transfer takes place in accordance with Chapter V of the GDPR: on the basis of an adequacy decision of the European Commission, in particular the EU-US Data Privacy Framework, or on the basis of Standard Contractual Clauses (SCC) approved by the European Commission.
3. Users have the right to obtain a copy of the safeguards applied by contacting the controller.

7How long data is kept

1. Data relating to orders and to the performance of the contract is kept for the duration of the contract and, after it ends, for the limitation period applicable to civil law claims — as a general rule 3 years for business activity under the Polish Civil Code.
2. Accounting and tax records are kept for 5 years, counted from the end of the calendar year in which the tax payment deadline fell (Article 70 § 1 of the Polish Tax Ordinance, Ordynacja podatkowa).
3. Data processed on the basis of consent is kept until that consent is withdrawn.

Once those periods expire, the data is irreversibly deleted or anonymised.

8Your rights as a data subject

Every user has the right to:

1. Access their personal data and obtain a copy of it (Article 15 of the GDPR).
2. Rectify inaccurate data (Article 16 of the GDPR).
3. Erasure of data, that is the right to be forgotten (Article 17 of the GDPR).
4. Restriction of processing (Article 18 of the GDPR).
5. Data portability (Article 20 of the GDPR).
6. Object to processing (Article 21 of the GDPR).
7. Withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Send requests to nutreasycc@gmail.com. You also have the right to lodge a complaint with the Polish supervisory authority: President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl.

9Cookies and tracking technologies

1. The website uses cookies — small text files stored on the user's device. 2. Strictly necessary cookies: switched on by default and required for the site to work properly, for safe navigation and to remember language settings. 3. Analytics and statistics cookies (Google Analytics, Google Ireland Ltd.): activated only after prior, active consent has been given through the cookie banner. 4. Marketing cookies (Google Ads — Google Ireland Ltd., Meta Pixel — Meta Platforms Ireland Ltd., TikTok Pixel — TikTok Technology Ltd.): activated only after that same consent, and used to measure ad performance and build audiences. These providers also process data about activity on the website as independent controllers, under their own privacy policies. 4a. When you submit an order or a call-back request, the website sends Meta Platforms Ireland Ltd. information about it from its own server (Conversions API): a hashed phone number, the IP address, the browser type, the Meta ad click identifier if you arrived from such an ad and, after consent to cookies, also Meta cookie identifiers. The purpose is to measure ad performance, and the legal basis is the controller's legitimate interests (Article 6(1)(f) of the GDPR); you may object to this processing. To credit the request to the right ad, the website keeps the markers of an arrival from an ad (UTM parameters and click identifiers) in the browser tab until it is closed and, after consent to cookies, on the device for 30 days. Without consent to cookies, the Meta pixel is not loaded on the website. 5. Cookie settings can be changed at any time in the browser, or through the cookie panel on the website.

10Automated decisions and the protection of minors

1. The controller does not take decisions about users based solely on automated processing, including profiling, that produce legal effects within the meaning of Article 22 of the GDPR.
2. The services of this website are not directed at people under 16, and the controller does not knowingly collect data about minors.

11Changes to this Privacy Policy

1. The controller may amend this Policy in response to changes in the law or updates to the services.
2. A new version takes effect on the date it is published on the website, which states the date it was updated.