Datenschutz- und Cookie-Richtlinie

1.      GENERAL

The purpose of this Privacy Policy is to inform individuals, customers, users of products or services, employees and other persons (hereinafter referred to as "the individual or user") who interact with FOODCHAIN d.o.o. (hereinafter referred to as “the company") about the purposes and legal bases, safeguards and rights of individuals with regard to the processing of personal data carried out by our company.

At the company, we highly value your privacy and take the utmost care to protect your data. Our data processing adheres to applicable data protection legislation and other legal requirements that provide the necessary basis for data processing, in particular the General Data Protection Regulation (EU) 2016/679 (the “GDPR “).

As a provider of goods and services through our online shop, www.nutrimana.eu, we are dedicated to safeguarding the confidentiality of personal data and the privacy of our online shop users or customers. The collected personal data is exclusively used to provide our services, and we are committed to protecting it against misuse. 

Any changes to this document will be posted on our website. By using our website, you acknowledge that you have read and understood the entire contents of this Privacy Policy. If you have questions, please review this Privacy Policy carefully or contact us.

2.     USE AND PROCESSING OF PERSONAL DATA

2.1. The data controller 

The data controller is the owner of the online shop www.nutrimana.eu:

FOODCHAIN d.o.o., 

Address: Razvanje, Tržaška cesta 53, 2000 Maribor, Slovenia (EU)

Web address: www.nutrimana.eu

Email: info@nutrimana.eu

The controller does not have a designated data processor officer.

2.2. Personal data

Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

2.3. What personal data do we process?

For the purposes of providing its services, we collect, manage, process and store the following data:

• Your contact information – name, delivery address, mobile or telephone number, email address (username and password in encrypted form), country of residence. If the user is the legal   entity we collect the name of the legal entity and tax number.

• Other information that the user voluntarily enters in the forms in the online shop.

• Purchase details including your choice of payment and transaction number.
• Your order history.
• Customer service information – all kind of communication and correspondence between you and our customer service department (communication archive).
• If you are browsing our website, we may collect your IP address or other device identifier, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, and other portable device information.
• Information regarding the response to our emails (whether the email was opened, which links were clicked on).

The company shall not be held liable for the correctness, completeness and up-to-datedness of the data entered by the user.

2.4. Data we don’t collect or process

We do not store or process data from your credit cards such as card number, expire date or CVS number. We don’t ask you to provide personal identification number. The payment providers are responsible for collecting and processing that kind of data.

2.5. How and why do we collect personal data?

The company collects and processes your personal data on the following legal bases:

• the data subject has consented to the processing of his or her personal data for one or more specified purposes (Article 6(1)(a) of the GDPR);
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) of the GDPR);
• the processing is necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c) of the GDPR);
• processing is necessary for the legitimate interests pursued by the controller or by a third party (Article 6(1)(f) of the GDPR).

We may use your personal data for one or more of the following purposes:

• to enter into a contract and to perform our obligations under that contract (such as handling and delivering your order),
• to create and maintain a customer account – only in cases where you have created an account,
• to be able to handle customer service issues such as questions about our products, returns and complaints,
• to send our newsletter and promotional material – only in cases where you give your consent to it, informing you about the benefits, activities, news, services and events of the company,
• to assert any legal claims and resolve disputes,
• for statistical analysis of the sale of our goods and the use of our websites,
• to adapt online advertisements for retargeting on digital advertising platforms (Facebook, Instagram, AdWords...),
• to optimise your website visit,
• to prevent abuse and/or fraud,
• to meet the requirements of tax and accounting legislation – to declare and count our sales.

Buying goods and services in our online shop

There are many products to choose from in the online shop and we believe you will find the one you are looking for. We look forward to hearing from you.

1.      Guest purchases: 

If you make a purchase (successfully place an order) without logging into your user account, we will process only the data that are strictly necessary for the execution of your order (the purchase contract), business communication and the exercise of the rights and obligations under the concluded contract which includes: first name, last name, shipping address, details of the product ordered and payment details, as well as telephone number and e-mail address, so that we can inform you of the receipt and processing of your order. 

We collect this information to ensure a smooth purchasing process and to review orders for potential risks or fraud. Additionally, if you have shared your preferences with us, we may use this information to provide you with relevant information or advertisements about our products and services.

2.      Registered user purchases:

By registering on www.nutrimana.eu, you enter into a contract with us to provide services to registered users. Your user account is protected by a password that you choose and that we do not have access to, so if you lose it, we can neither send you a new one nor create one for you.

Within your account, you have unlimited access to your personal data and any editing of it. In your account, you can view the history of your completed orders, purchased products, as well as pending orders. You can also store your payment card details in your account, arrange the sending of newsletters and create a 'favourites list' where you can store your favourite products. 

The legal basis for processing the data in the case of purchases is the performance of a contract (Article 6(1)(b) of the GDPR). 

Data collected during your website visits

When you visit our website, we automatically collect various technical data, including but not limited to your IP address, browser type and version, device type, time zone settings, browser plug-in types and versions, operating system, platform, and profile and usage data. The profile and usage data encompasses information about how you use our website, including the specific web pages you viewed or searched for, page response times, download errors, length of your visits, and page interaction information such as scrolling and clicks. This data is used to optimize content organization and provide you with items and information that align with your interests and preferences.

The legal basis for processing the above data is our legitimate interest (Article 6(1)(f) of the GDPR), namely to keep statistics on visits to our website and to ensure network and information security, i.e. to enable the detection and prevention of unauthorised access that may compromise the availability, integrity and confidentiality of stored or transmitted personal data and the security of the related services accessible through these networks and systems.

The data collected will be retained for 30 days from the date of your visit to the site. We process the (personal) data collected in this way separately and do not associate it with any other personal data of our website users, nor do we carry out any profiling of your purchasing behaviour. This information cannot be used by itself to identify or contact you.

If you contact us via the online form

We welcome any message from you. In this case, our communication will be based on our legitimate interest as manifested in the controller's communication with the general public (Article 6(1)(f) of GDPR). If you do not wish to disclose your personal data to us, we regret that we will not be able to answer your question. You can stop the communication at any time (by informing us), which will also mean that we will delete your personal data.

Notifying individuals by e-mail (newsletter)

You can also subscribe to receive notifications and information about our services and activities. For this purpose, Nutrimana d.o.o. may inform you about the products, possible promotions or about prize draws.

You will only receive the marketing e-newsletter ("newsletter") by e-mail if you have subscribed and agreed to it when you registered or in your user profile. The legal basis for sending the newsletter is Article 6(1)(a) of the GDPR or in the case of a customer Article 6(1)(f) of the GDPR, in conjunction with Article 226(2) of the ECom-2 Act.

We will also process your personal data for the purpose of sending you our newsletters and offers if you have purchased a product from us and you have not opted out of receiving communications from us (Article 226(2) of the ECom-2 Act).

If you later no longer wish to receive the newsletter, you can withdraw your consent at any time (with effect for the future). You can unsubscribe from the newsletter by clicking on the unsubscribe button (link can be found in each newsletter), using the "Unsubscribe" function in your user profile or by contacting us. Data collection via the newsletter will be stopped immediately. 

If you receive such e-mail, we process the following data:

• identifying data, specifically your name;
• contact details through which we can communicate with you, specifically your email address;
• demographic data, which we determine/aggregate according to your preferences and online behaviour; gender data and language preference.

If you are participating in a customer prize draw

We may organise interesting prize draws for you to enter via our website or profiles on selected social networks. If you choose to enter the prize draw, we will need certain personal data from you. This is the only way we can draw the winner and get the prize into the right hands. Additionally, tax law may require us to collect additional personal data from the winners.

If you opt not to provide your personal data, it may prevent your entry into the prize draw or the distribution of your prize.

Publication must be public, which means that we may publish selected information about the winner on our websites or on the profile of the specific social network. Any activity or communication with us via social networks and the processing of your personal data will be subject to the principles of personal data processing, which are the responsibility of the controller of the specific social network.

If you enter a prize draw, we process the following personal data:

• identifying data such as first and last name;
• contact details, i.e. your social network profile or email address, which we need in case you win, as well as your postal address, postcode, billing address, telephone number.

The legal basis for running prize draws and promoting our brand/company to the public is established under Article 6(1)(f) of the GDPR. For prize winners: performance of (gift) contract (Article 6(1)(b) GDPR) and legal obligation (tax legislation - Article 6(1)(c) GDPR).

3.      HOW LONG DO WE KEEP YOUR PERSONAL DATA?

The company is committed to retaining personal data only for as long as necessary to fulfil the purpose for which it was collected and processed or required by laws and regulations. The criteria used to determine our retention periods include: (i) the length of time we have a relationship with you and provide the services we agreed to you; (ii) when we have legal obligation to which we are subject; or (iii) as advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

Personal data processed by the company on the basis of a contractual relationship with an individual will be kept by the company for the period necessary for the performance of the contract and until full payment for the purchase has been made, or at the latest until the expiry of the statute of limitations on the individual claim, which may by law range from one to five years.

Invoices shall be kept for 10 years after the end of the year to which the invoice relates in accordance with the law governing value added tax.

Those personal data which are processed by the company on the basis of the individual's personal consent or legitimate interest will be kept by the company until the consent is withdrawn or until a request for deletion of the data is made. Upon receipt of a revocation or a request for erasure, the data shall be deleted without undue delay. The company may also delete the data prior to revocation where the purpose of the processing of the personal data has been achieved or where required by law. In the event that the rights of an individual are asserted, the company shall retain the personal data of that individual until the case has been finally decided and, after the final decision has been taken, in accordance with the final decision in the case.

Exceptionally, a company may refuse a request for erasure on grounds such as: the exercise of the right to freedom of expression and information, compliance with a legal obligation to process, grounds of public interest in the field of public health, archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, the exercise or defence of legal claims. After the retention period has expired, the company will effectively and permanently erase or anonymise the personal data so that it can no longer be linked to a specific individual.

4.      WHO DO WE SHARE YOUR PERSONAL DATA WITH?

The trust you place in us is essential to our business's success. We do not sell your personal data to a third party, and does not provide your personal information to third parties, unless required by law to do so or except for the operational necessities listed below.

The company may entrust individual processing of personal data to a contractual processor on the basis of a contractual processing agreement. Contract processors may process the entrusted data exclusively on behalf of the controller, within the limits of the controller's authorisation, as set out in a written contract or other legal act, and in accordance with the purposes set out in this Privacy Policy.

We rely on third-party service providers to perform various business operations on our behalf. In doing so, we may share your personal information with them. We provide these service providers with only the necessary personal data to execute the services we request and ensure they protect this data from unauthorized use (for instance, infrastructure maintainers, IT system maintainers, online shop providers, email service providers, and software providers, cloud service providers, accounting service, warehouse partner, post/shipment office, social network providers and online advertising providers (Facebook, Instagram,...). etc.) 

In order to improve the overview and control of the contractual processors and the regularity of the contractual relationship between them, the company maintains a list of contractual processors, which lists all the specific contractual processors with which the company cooperates.

We may share data with third parties when required to fulfil legal obligations that FOODCHAIN d.o.o. is subject to. For example, this may include sharing data with the Financial Administration and other state authorities in response to their justified written requests related to specific proceedings.

The company as controller and its employees do not export personal data to third countries (outside the Member States of the European Economic Area - EU Member States plus Iceland, Norway and Liechtenstein) and to international organisations, except to the USA, where the relationship with the contract processors is governed by standard contractual clauses (standard contracts adopted by the European Commission) and/or binding corporate rules (adopted by the company and approved by the supervisory authorities in the EU).

We use Magento (Adobe company) to operate our online shop. Personal data is processed in Magento, Ltd. in accordance with the law in the USA. Data is transferred to USA in accordance with USA law, which the European Commission has found to provide adequate protection for personal data. You can learn more about how Magento uses your personal information here.

We share aggregated and/or anonymous data that does not identify you for Nutrimana business purposes. For instance, we may disclose the number of visitors to Nutrimana sites or services. We may also share such data with our business partners for their own business purposes.

5.      WHAT ARE YOUR DATA PROTECTION RIGHTS?  

By entering your data on the www.nutrimana.eu website, you acknowledge your awareness of your rights regarding your personal data.

At Nutrimana, we are dedicated to maintaining the accuracy of your personal information and providing you with control over your data. You have the following rights and choices regarding your personal data:

• Access: You can view the personal data you provided during online registration by visiting your account or contacting Nutrimana's consumer services at info@nutrimana.eu.
• Accuracy: We aim to keep your personal data accurate, current, and complete. We encourage you to update them in your user account or contact us to let us know if any of your personal data is not accurate or changes so that we can keep your personal data up-to-date.
• Erasure: You have the right to ask us to erase your personal data when the personal data is no longer necessary for the purposes for which it was collected, or when, among other things, your personal data have been unlawfully processed. You can also delete your entire account and all your data yourself in your account under Privacy Tools - Delete Account.
• Objecting: You also have the right to object to the processing of your personal data (eg if any of the information collected is incorrect) and you have the right to restrict the processing of your personal data under certain conditions, such as for direct marketing or profiling if you oppose such processing. You also have the right to revoke a given consent at any time and to refuse different types of marketing.

• Porting: You have the right to request that some of your personal data is provided to you, or to another data controller, in a commonly used, machine-readable format.

• Right to withdraw consent: If you have provided your consent to the collection, processing and transfer of your personal data, you have the right to fully or partly withdraw your consent. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented unless there is another legal ground for the processing. To opt-out of receiving our marketing communications please follow the opt-out links on any marketing message sent to you. Opting out of receiving marketing communications will not affect the processing of personal data for the provision of our services.

• Complaints: If you believe that your data protection rights may have been breached, you have the right to lodge a complaint with the applicable supervisory authority, such as the Information Commissioner's Office (Informacijski pooblaščenec RS, Dunajska 22, 1000 Ljubljana, SI (e-mail: gp.ip@ip-rs.si, webpage: www.ip-rs.si)) or to seek a remedy through the courts.

To exercise these rights and choices or to request access or corrections to your personal information, visit your user account or please contact Nutrimana's consumer services at info@nutrimana.eu. We aim to process your requests within 15 days from the receipt of a complete application, and we will promptly inform you of the completion of the procedure.

6.      COOKIES 

The company's website works with the help of cookies, which are important for the provision of online services and are used to store information about the state of a particular website, to help collect statistics about users and website traffic, etc. Only those cookies that are strictly necessary for the functioning of the website (e.g. for the shopping basket) will be placed on your device when you enter the website. Other cookies will only be placed with the consent of the individual. The individual can change the settings and delete the cookies at any time (instructions can be found on the web pages of the individual browser).

6.1. What are cookies?

Cookies are small text files that most websites store on the devices that users use to access the internet, in order to identify the individual devices that users have used to access the internet. All of us who visit websites have many cookies from different websites stored on our computers, tablets and mobile phones. Their storage is controlled by the user's browser - which can restrict or disable the storage of cookies if desired. Cookies are not harmful and are always time-limited.

6.2. Why cookies are necessary?

Cookies are essential for providing user-friendly online services. Cookies make the interaction between the web user and the website faster and easier. They help the website to remember the individual's preferences and experience, saving time and making browsing more efficient and user-friendly.

Nutrimana uses cookies to assess how our sites are used, to personalize your experience and to deliver you advertising, including online content, tailored to your interests. 

6.3. Types of cookies

Cookies we use on our websites are divided into four groups:

Group 1 cookies:

Group 1 cookies are necessary for the website to function. They are essential and without them the website would not function perfectly. They are set when you interact with the website in any way that goes beyond clicking on simple links (e.g. submit a form, log in, etc.). The use of this group of cookies is automatic and you cannot control the settings of this group.

Nutrimana assigns a cookie to each user at the beginning of each use of the online shop for identification, monitoring of the shopping basket and traceability purposes (the so-called "cookie"), which is stored in the server's memory only for the duration of the visit to the online shop and is deleted after one hour of inactivity. 

Group 2 cookies:

Group 2 cookies are analytical cookies that we use to collect statistics about the use of our websites. We use Group 2 cookies in conjunction with Google Analytics to ensure that personal data is anonymised. The anonymisation of data by Google Analytics is not reversible, which means that it is not possible to reverse-trace or in any way identify an individual user on the basis of the anonymised data. As a result of this process, we receive complete statistical reports on traffic and activity on our websites, but we cannot use the user data for any other purpose, as the user is completely anonymous with this solution. Google Analytics allows us to work with external web analytics providers, in accordance with legal requirements, without any critical impact on the relevance of the metrics obtained. We use our own web cookies ("1st party cookies"), which means that they can only be served and read by our website and not by third parties (e.g. Google). Although the data received is anonymised and cannot be linked to a specific or identifiable user, we offer you the possibility to refuse the use of cookies from this group, 

Group 3 cookies:

Group 3 cookies are cookies from partner services such as Facebook, Instagram, TikTok, Twitter/X, Google, etc. These cookies enable the use of plug-ins and features on our websites that are linked to social networks and other platforms. We use them for marketing purposes and to track your visits to different websites. Their purpose is to show you ads that are relevant and interesting to you, as well as to prevent you from seeing ads that you have already seen. If you do not agree to the use of these cookies, we will not set cookies, but it may be that some interesting features of the website will not be available as a result.

Group 4 cookies:

Group 4 cookies allow you to personalise advertising messages based on your personal interests, which are determined by your previous usage and browsing history on one or more devices. Once you have given your consent, advertising providers will link your web and app browsing history to the accounts you are currently logged into on one or more of your devices (e.g. Google, Facebook, etc.) for this purpose. In this way, any device that you are logged into your advertising provider account with can display the same personalised advertising message from the provider. If you are not logged in to your provider accounts, providers may track your browsing history and display personalised advertising messages separately on each of your devices. If you have this group of cookies enabled, Google Analytics collects advertising IDs that are temporarily linked to our Google Analytics data in order to identify and create target audiences to promote ads on different devices. The collection of the information collected in your Google account data is based solely on your consent, which you can give or withdraw from Google. For data collection that is not aggregated in your Google Account (for example, because you do not have a Google Account or have objected to it), the data collection is based on your consent.    

6.4. Disabling cookies

With the exception of Group 1 cookies, you can choose whether to allow cookies to be stored on your device. You can control and change your cookie settings in your web browser.   

For information about your cookie settings, please select the web browser you are using.        

6.5. Cookies used

The table below lists the cookies we collect and what information they store.