Privacy Policy

1. Introduction

This Privacy Policy explains how Nutriforce ("we", "us", "our") collects, uses, stores, shares and protects your personal data when you access our website, create a customer account, purchase products, leave comments, interact with us or use our services. We prioritise protecting your privacy and comply with applicable regulations, including the UK GDPR and the Data Protection Act 2018.

2. Data Controller

The controller responsible for your personal data is Nutriforce (Nutriforce France, company registration 983 311 416 00017, 61 rue de Lyon, Paris, France). Email: [email protected].

3. Data We Collect

• Identification and contact data: name, email address, password, telephone number, postal address (delivery/billing), login credentials.
• Transaction data: order details (products, amount, date) and payment method used. We do not store full card details — these are handled by secure payment processors.
• Website usage data: comments left on the site (including IP address), navigation data (cookies, IP addresses, connection logs).
• Advertising and profiling data: encrypted email addresses shared with advertising partners for targeted advertising; purchase history and browsing behaviour used to tailor promotions.
• Voluntarily provided data: customer-service messages, email exchanges, contact forms and testimonials.

4. Purposes and Legal Bases

• Account management and order processing — legal basis: performance of a contract.
• Advertising and marketing — legal basis: your consent (marketing communications and advertising cookies) and our legitimate interest (prospecting existing customers, subject to your right to object).
• Comments and interactions — legal basis: legitimate interest in communication and participation.
• Site and service improvement (statistics, performance, bug fixes) — legal basis: legitimate interest.
• Legal compliance (tax, accounting, regulatory) — legal basis: legal obligations.

5. Cookies

• Essential cookies enable site functionality (basket, login sessions). Login cookies are valid for two weeks.
• Functionality cookies remember preferences such as language settings.
• Analytics cookies help us understand site usage to improve our services.
• Advertising cookies collect data for advertising partners (encrypted IP and email) to measure performance.

You can manage or disable cookies via your browser settings. Refusing essential cookies may affect functionality.

6. Retention Periods

• Customer account: retained while your account is active; deletion or deactivation results in erasure or archiving per legal obligations.
• Orders and commercial documents: retained for the minimum periods required by law and tax rules (typically 10 years for accounting records).
• Commercial prospecting: retained for three years from your last contact, unless you object.
• Cookies: vary by purpose (two weeks for login cookies; varying periods for advertising/analytics).

7. Your Rights

Under applicable regulations you have the right of access, rectification, erasure, objection, restriction of processing, and data portability, as well as the right to withdraw consent at any time where processing relies on it. To exercise your rights, contact [email protected]. We may request identity verification and will respond within one month (extendable by two months for complex or numerous requests).

8. Data Sharing

We may share data with service providers and processors (hosting, payment, maintenance) bound by confidentiality and acting only on our instructions; advertising partners (limited to encrypted IP, email and navigation data); legal or administrative authorities where required by law; and commercial partners where you have expressly consented. We share only the minimum necessary data.

9. International Transfers

If data is transferred outside the UK/EEA, we implement appropriate safeguards (such as standard contractual clauses) to protect your information in compliance with applicable regulations.

10. Data Security

We implement appropriate technical and organisational measures, including encrypted transmission (HTTPS), secure server storage, restricted access for authorised personnel, and regular audits. In the event of a data breach we will inform you promptly and meet our legal notification obligations, including to the Information Commissioner's Office (ICO) where applicable.

11. Children

Our services are not intended for under-16s and we do not knowingly collect their data without verifiable parental consent. If you believe we hold a child's data without authorisation, please contact us for removal.

12. Third-Party Links

Our site may link to third-party sites. We do not control their privacy practices and are not responsible for them — please review their own policies.

13. Amendments

We may update this Policy to reflect legal or service changes. Changes are posted here with an updated date. For material changes affecting your rights, we will notify you by email or site notice.

14. Contact

For any question about this Policy or to exercise your rights, email [email protected]. If we do not adequately address your concerns, you may lodge a complaint with the Information Commissioner's Office (ICO).