Nayalor Nutrition — personal data protection
This Policy explains how NAYALOR LDA processes the personal data of visitors, customers, subscribers and people who contact Nayalor Nutrition through the website www.nayalor.com or its official communication channels.
1.Data controller
Controller: NAYALOR LDA
NIPC (Portuguese company tax number): 519 318 188
Registered office: Zona Industrial de Vagos, Lote 87, 3840-385 Vagos, Portugal
Support email: nayalor.nutrition@nayalor.com
2.Data we may process
Identification and contact: name, email, telephone, billing and delivery addresses and tax identification number when provided.
Orders and subscriptions: products, quantities, prices, discounts, frequency, status, returns, complaints and history.
Payments: method chosen, transaction status, references and technical identifiers. Full card details or payment credentials are processed by the payment service provider.
Customer account: account identifier, preferences and information necessary for authentication and security.
Communications: messages sent to customer support, requests, reviews and answers to questionnaires.
Technical data: IP address, device, browser, access logs, security events and information from cookies or similar technologies.
Marketing: consents, preferences, interactions with campaigns and advertising segments, where permitted.
Nayalor does not request health data in the normal purchasing process. The customer should not send unnecessary clinical information through the forms or to customer support.
The data marked as mandatory on the website are necessary to create or manage the account, to conclude and perform the purchase or subscription and to comply with legal obligations. Without those data, Nayalor may be unable to create the account, accept the order, process the payment or make the delivery. Optional data are identified as such, and not providing them does not prevent the purchase.
3.Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing the account and processing orders, payments, deliveries, returns and subscriptions. | Performance of the contract and pre-contractual steps. |
| Issuing invoices, keeping records and complying with tax, accounting, consumer and food safety obligations. | Compliance with legal obligations. |
| Responding to enquiries, handling complaints, preventing fraud and protecting the website, customers and the company. | Performance of the contract and legitimate interest in customer assistance and security. |
| Sending operational communications about orders, subscriptions, security and relevant changes. | Performance of the contract and compliance with legal obligations. |
| Sending newsletters, SMS, WhatsApp messages or personalised advertising. | Consent or, for customers and where the legal conditions are met, legitimate interest in promoting similar own products, always with a simple, free-of-charge right to object. |
| Measuring audiences, improving the website and evaluating campaigns through non-necessary cookies. | Consent. |
| Defending, exercising or establishing rights in administrative, judicial or out-of-court proceedings. | Legitimate interest and compliance with legal obligations. |
Where processing is based on legitimate interest, Nayalor balances its interests against the rights and expectations of the people concerned. You may request further information about this balancing test.
Messages strictly necessary for managing an order, account or subscription are not marketing communications. In promotional communications, the recipient can refuse further messages free of charge using the mechanism indicated in each message.
4.Source of the data
The data are collected directly from the data subject through the website, checkout, customer area, forms, cookie preferences and communications. They may also be received from payment service providers, carriers, technical partners or advertising platforms, to the extent necessary to confirm transactions, provide the service or measure authorised campaigns.
5.Recipients and service providers
Nayalor may disclose data, only to the extent necessary, to the following categories:
EuPago and other payment service providers made available at checkout;
carriers, logistics operators and communication service providers;
providers of website hosting, infrastructure, development, maintenance, security and backups;
providers of invoicing, accounting, auditing and legal advisory services;
email, CRM, customer support, review, SMS or WhatsApp providers actually in use;
Google, Meta and TikTok for advertising, measurement or audience creation, only where there is an appropriate legal basis and, for non-necessary cookies or pixels, consent;
public authorities, courts or ADR (alternative dispute resolution) entities where disclosure is required by law or necessary for the defence of rights.
Providers acting on Nayalor’s behalf are bound by instructions, duties of confidentiality and security, and data processing agreements. Some recipients may act as independent controllers under their respective policies.
Nayalor does not sell personal data. Disclosure to third parties is limited to what is necessary for the purposes described in this Policy or to what is required by law.
6.International transfers
Some technology and advertising providers may process data outside the European Economic Area. Where applicable, Nayalor uses mechanisms recognised by the GDPR (General Data Protection Regulation), such as adequacy decisions, standard contractual clauses and appropriate supplementary measures. You may request information about the safeguards used by writing to nayalor.nutrition@nayalor.com.
7.Retention
| Data | Period or criterion |
|---|---|
| Orders, invoicing and accounting records | For the applicable legal period, which may be up to 10 years. |
| Customer account | While the account is active and, thereafter, for the period necessary to comply with obligations or defend rights. |
| Subscriptions | For the duration of the subscription and for the legal periods applicable to the associated orders and payments. |
| Support, complaints and returns | For the time needed to respond and, as a rule, up to 3 years, without prejudice to any longer legal period. |
| Marketing and preferences | Until consent is withdrawn, an objection is made or inactivity is established, keeping minimal proof of the request where necessary. |
| Cookies and identifiers | For the period indicated in the cookie preference centre. |
| Technical and security logs | For a period proportionate to the purposes of security, incident investigation and legal compliance. |
At the end of the period, the data are deleted, anonymised or kept in restricted (blocked) form where necessary to comply with an obligation or defend rights.
8.Automated decision-making and profiling
Nayalor does not intend to make decisions based solely on automated processing that produce legal effects concerning, or significantly affect, the data subject. With consent, browsing and interaction data may be used to target advertising, measure campaigns or present more relevant content. Consent may be withdrawn at any time.
9.Data subjects’ rights
Under the applicable terms, the data subject may exercise the rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent, as well as the right not to be subject to certain decisions based solely on automated processing.
Requests should be sent to nayalor.nutrition@nayalor.com. Exercising these rights is, as a rule, free of charge. Nayalor may request reasonable information to confirm identity and will, in principle, respond within one month of receipt. That period may be extended by a further two months where the complexity or number of requests justifies it, in which case the data subject will be informed within the first month. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
The data subject may object at any time, and without having to give reasons, to the processing of their data for direct marketing, including any related profiling. The other rights may be subject to the conditions and limitations laid down by law.
The data subject may also lodge a complaint with the Portuguese Data Protection Authority, Comissão Nacional de Proteção de Dados (CNPD).
10.Security
Nayalor adopts technical and organisational measures proportionate to the risk, including access control, permission management, protection of communications, backups and incident response procedures. No transmission or storage is entirely free of risk.
11.Children
Purchases on the website may only be made by persons aged 18 or over. Some products may be intended for children of certain ages, as indicated on the labelling, but ordering and giving the product are the responsibility of an adult. Nayalor does not intend to collect personal data directly from children through accounts, marketing or checkout.
12.Cookies
The use of cookies and similar technologies is explained in the Cookie Policy and in the preference centre accessible from the website footer. Analytics or advertising cookies are only used after consent, where consent is required.
13.Changes and contact
This Policy may be updated to reflect legal, technical or operational changes. The version in force and the date of the last update are published on the website. Materially relevant changes will be communicated by appropriate means.
Questions about privacy or about exercising your rights can be sent to nayalor.nutrition@nayalor.com.