Privacy Policy for the Website

Introduction

Welcome to NutriSpy's website. This Privacy Policy explains how we collect, use, store, and safeguard your information when you visit our website at nutrispy.de. This policy applies specifically to website visitors and does not cover our mobile application, which has its own separate privacy policy.

Data Controller (Responsible Party)

The data controller responsible for your personal data is App Werkstatt Taudt (Inhaber: Aaron Taudt). For complete company information, please see our Imprint.

For privacy-related inquiries, contact us at: privacy@nutrispy.de

Data Processing Details

When you visit our website, we may collect and process the following data:

Contact Forms and Newsletter Signup

• Personal Data: Name, email address, phone number, company name
• Purpose: To respond to your inquiries, provide requested information, and send newsletters (with consent)
• Storage: Data is stored securely in our CRM system and email marketing platform

Cookies and Session Data

• Essential Cookies: Session management and basic website functionality (automatically managed by your browser)
• Third-Party Cookies: External services such as Google Fonts may set their own cookies (see "External Services and Third-Party Integrations" section)

Log Files and Server Data

• Technical Data: IP address, browser type, device type, operating system, referrer URL
• Usage Data: Pages visited, time spent, navigation patterns, error logs
• Security Data: Failed login attempts, suspicious activities, DDoS protection logs

Legal Basis for Data Processing

We process your personal data based on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): For newsletter subscriptions and marketing communications
• Contract Performance (Art. 6(1)(b) GDPR): To fulfill your requests and provide requested services
• Legitimate Interest (Art. 6(1)(f) GDPR): For website security and service improvement
• Legal Obligation (Art. 6(1)(c) GDPR): To comply with applicable laws and regulations

Analytics Tools and Tracking

With your consent, we use the following services from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to understand how our website is used and to measure the effectiveness of our advertising. None of these services load, and no cookie is set by them, unless you have actively agreed via our consent banner.

• Google Tag Manager: Manages the tags listed below. Tag Manager itself sets no cookies and stores no personal data; it only controls whether the other services are loaded.
• Google Analytics 4: Statistical analysis of website usage — pages viewed, approximate region, device type, and referring source. We have IP anonymisation enabled and have switched off Google Signals, so no cross-device advertising profiles are created.
• Google Ads conversion tracking: Records whether a visit that came from one of our ads resulted in a click on the App Store or Google Play badge. This tells us which ads are worth running; it does not tell us who you are.

The only interaction we record beyond page views is a click on an app store badge. We do not track scrolling, mouse movement, or form input, and we do not use session recording or heatmap tools.

Legal basis: your consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG. You may withdraw it at any time with effect for the future via the Cookie settings link in the footer of every page — withdrawal is as simple as giving consent, and does not affect the lawfulness of processing carried out beforehand.

Consent Mode. We operate Google Consent Mode v2. If you decline, Google's tags are still present on the page but are prevented from setting cookies or reading identifiers; they may transmit an anonymous, cookieless signal that a page was viewed, which cannot be linked to you or to any other visit.

Retention: Google Analytics data is retained for 14 months and then deleted automatically. Google Ads conversion data is retained for the duration of the applicable conversion window (30 days) plus Google's own reporting retention.

Further information: Google Privacy Policy and Google Ads Data Processing Terms.

Consent Management

We use CookieHub (CookieHub ehf., Iceland) to obtain, record and manage your cookie consent. CookieHub stores your choice in a first-party cookie on your device so that we do not have to ask again on every page, and keeps a record of the consent given as required by Art. 7(1) GDPR.

This cookie is strictly necessary to honour your decision and is set on the basis of our legitimate interest in demonstrable compliance (Art. 6(1)(f) GDPR). Iceland is part of the EEA, so no third-country transfer arises.

External Services and Third-Party Integrations

Our website integrates with the following external services:

Website Hosting and Infrastructure

• Render: Static website hosting and infrastructure

Email Marketing and Newsletter

• Brevo: Email marketing and newsletter management

Fonts and External Resources

• Google Fonts: Typography and design consistency (Inter font family)
• Remix Icons: Icon library and visual elements

Data Subject Rights (Your Rights)

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): Request information about what data we process about you
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete data
• Right to Erasure (Art. 17 GDPR): Request deletion of your personal data ("right to be forgotten")
• Right to Restriction (Art. 18 GDPR): Request limitation of data processing under certain conditions
• Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21 GDPR): Object to data processing based on legitimate interests
• Right to Withdraw Consent: Withdraw previously given consent at any time
• Right to Lodge a Complaint: File a complaint with supervisory authorities

To exercise your rights, contact us at privacy@nutrispy.de. We will respond within 30 days.

Data Security Measures

We implement comprehensive security measures to protect your data:

• Encryption: TLS 1.3 encryption for all data transmission
• Access Control: Role-based access management and multi-factor authentication
• Regular Audits: Security assessments and penetration testing
• Data Backup: Encrypted backups with disaster recovery procedures
• Employee Training: Regular privacy and security awareness training

9. Data Retention and Storage

We retain your data only as long as necessary:

• Contact Form Data: 3 years from last interaction
• Newsletter Data: Until consent withdrawal or account deletion
• Log Files: 12 months for security and debugging
• Cookie Data: According to cookie type (session to 2 years)

Data is stored on secure servers located within the European Union (EU) and European Economic Area (EEA).

International Data Transfers

Some of our service providers may process data outside the EU/EEA. We ensure appropriate safeguards through:

• Adequacy Decisions: Countries with EU-approved data protection standards
• Standard Contractual Clauses (SCCs): EU-approved data transfer agreements
• Certification Schemes: The EU–US Data Privacy Framework and comparable certifications

Our contracting party for analytics and advertising is Google Ireland Limited, but data may be transmitted to Google LLC in the USA. Google LLC is certified under the EU–US Data Privacy Framework, for which the European Commission has issued an adequacy decision. Where a transfer nonetheless rests on Art. 49(1)(a) GDPR, it is covered by the consent you give in the cookie banner; we point out that US authorities may be able to access such data and that EU-level legal remedies may be limited.

Cookie Management

We group cookies and comparable technologies into three categories. Only the first is set without asking you.

• Necessary: Session cookies required for basic website functionality, your chosen language and colour theme, and the CookieHub cookie that records your consent decision. These cannot be switched off.
• Analytics: Google Analytics 4. Set only after you agree; controlled by the analytics_storage consent signal.
• Marketing: Google Ads conversion tracking. Set only after you agree; controlled by the ad_storage, ad_user_data and ad_personalization consent signals.

Additionally, external services we use (such as Google Fonts and CDN resources) may set their own cookies. These are subject to the privacy policies of the respective providers.

You can manage your cookie preferences through:

• Cookie settings: The Cookie settings link in the footer of every page reopens the consent dialog, where you can change or withdraw your choice at any time
• Browser Settings: Configure cookie settings in your web browser
• Third-Party Settings: Direct management of cookie settings for external services (e.g., Google Fonts) through the respective providers

Children's Privacy

Our website is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us immediately.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically. For significant changes, we will notify you via email or website notification.

Contact Information

For questions about this policy or to exercise your data rights, contact:
Data Protection Officer:
privacy@nutrispy.de
General Inquiries:
info@nutrispy.de