Privacy policy

Last updated:

This policy explains which data we collect when you use this shop, why, how long we keep it, who we share it with and what your rights are.

1. Who is responsible for your data?

Vellanor Nutrition Ltd, 77 Camden Street Lower, Dublin 2, Ireland (company number ). Contact for any question about your data: .

2. Which data, why, on which legal basis?

Processing your order, delivering it, invoicing you: name, delivery and billing addresses, email, phone, products ordered, amounts, order number. Basis: performance of the contract.
Managing your subscription (interval, reminders before shipment, payments, cancellation): the same data, subscription history, payment token kept by the payment provider. Basis: performance of the contract.
Payment and fraud prevention: transaction data, IP address, fraud signals. Basis: performance of the contract; legitimate interest (securing payments).
Your customer account: login details, order history. Basis: performance of the contract.
Withdrawal, guarantee, complaints, customer service: our exchanges, order number, date and time of your requests. Basis: performance of the contract; legal obligation (right of withdrawal).
Accounting and tax: invoices, payments. Basis: legal obligation.
Newsletter: email, language, opens and clicks. Basis: your consent, which you can withdraw at any time (unsubscribe link in every email).
Quiz: your answers are processed in your browser and are not stored. If you ask for your routine by email (first box), we keep your email, first name and routine to send it. Basis: your request. You only join the newsletter if you tick the second box, which is never ticked in advance. Basis: your consent.
Audience measurement and advertising: browsing data, cookie identifiers, events (product view, add to cart, purchase). Basis: your consent through the cookie banner.
Site security: IP address, technical logs. Basis: legitimate interest.

Health data: we never ask for data about your health, a pregnancy or your beliefs. Please do not send us any; if you do, we use it only to answer you and then delete it. We never use your purchases to infer your health or target you with advertising on that basis.

3. Who do we share your data with?

Only with the service providers who need it for the purposes above, bound by a data processing agreement (GDPR art. 28):

: hosting of the shop, orders, accounts, subscriptions, transactional emails.
: payment and fraud prevention.
: delivery of parcels.
Our logistics partner in Germany (): preparation and shipping of orders (name, address, parcel content).
: newsletter.

We may also share data with authorities when the law requires it. We never sell your data.

4. Transfers outside the European Union

Some providers may process data outside the EU (for example in Canada or the United States). These transfers rely on an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework for certified companies) or, failing that, on the Commission's standard contractual clauses with additional measures. You can get a copy of these safeguards by writing to .

5. How long do we keep your data?

Orders and subscriptions: for the business relationship, then to handle complaints and disputes.
Invoices and accounting records: (legal obligation).
Customer account: until you delete it, or after 3 years without an order or login.
Customer service exchanges, withdrawal and guarantee requests: 3 years after the request is closed.
Newsletter: until you unsubscribe, or after 3 years without an open.
Cookies: 13 months at most for cookies that require consent.
Technical logs: .

6. Your rights

You can at any time access your data and get a copy, have it corrected, have it erased (unless we must keep it, for example invoices), restrict its processing, object to processing based on our legitimate interest and to direct marketing, withdraw your consent, and receive the data you gave us in a readable format (portability). Write to ; we answer within one month. We make no automated decision with legal effects on you, apart from payment fraud checks, which may block a transaction; you can then ask for human review.

7. Complaint to an authority

You can lodge a complaint with the data protection authority of the country where you live, or with the Irish Data Protection Commission, lead authority for our company established in Ireland (www.dataprotection.ie).

8. Security

The site uses HTTPS. Payments are processed by our payment provider: we never see your full card numbers. Access to data is limited to the people who need it.