Privacy Notice
Contents
1. Who we are and how to contact us
The controller of your personal data is:
Name | Nutrisslim, proizvodnja in distribucija živil, d.o.o. (abbreviated: Nutrisslim d.o.o.) |
Registered office | Obrtniška ulica 4, 1292 Ig, Slovenia |
Companies register | District Court in Ljubljana, file no. 2010/9888 |
Registration number | 3711676000 |
VAT identification number (EU) | SI42005485 |
Brand | Nature’s Finest |
Website | www.naturesfinest.ie |
Customer support | See the customer support number published on the website |
Support opening hours | Monday to Friday, 8.00 to 16.00 |
Data protection officer |
We have appointed a data protection officer under Article 37 of the General Data Protection Regulation (Regulation (EU) 2016/679, the GDPR) and under section 45 of the Slovenian Personal Data Protection Act (ZVOP-2), which applies to us as a company established in Slovenia. The Irish Data Protection Act 2018 (No. 7 of 2018) does not impose any additional data protection officer duties on a trader in our position. You may contact our data protection officer about any question concerning the processing of your personal data and about exercising your rights.
2. Who and what this notice applies to
This notice describes how we handle the personal data of visitors to the website www.naturesfinest.ie, customers, newsletter subscribers, holders of a customer account, people who contact us through our customer support team or by email, and users of our subscription purchases and our referral programme.
A separate Cookie Notice also applies to cookies, and our Terms and Conditions of Sale and Subscription Terms apply to purchases.
3. What personal data we process
- Identification and contact data: first name and surname, delivery address and billing address, email address, telephone number.
- Order data: the contents of your order, its value, the delivery method, the payment method, purchase history, complaints and returns.
- Payment data: transaction data. We do not store full payment card numbers and have no access to them — they are processed by the payment service provider. For subscription purchases, the payment service provider stores a token for recurring charges.
- Account data: username, encrypted password, settings.
- Communication data: the content of emails and messages, notes of customer support calls, complaint records.
- Consent data: recorded separately for each channel — channel, status, date and time, language, source of the consent, version and wording of the consent, and the date of withdrawal.
- Website usage data: IP address, device and browser type, pages viewed, click paths and traffic source. More detail is in the Cookie Notice.
- Data from questionnaires and personalisation: your answers about your goals and habits.
- Special categories of personal data: for the DNA Nutrigenetic test, genetic data and data concerning health. We process these solely on the basis of your explicit consent.
- CCTV images at the entrances to our business premises.
Because we sell food supplements, information about what you buy can in some circumstances allow inferences to be drawn about your health or lifestyle. We do not treat ordinary purchase history as health data, and we do not use it to draw health conclusions about you. Where we genuinely process data concerning health or genetic data — which happens only in the DNA Nutrigenetic test — we do so only with your explicit consent under Article 9(2)(a) of the GDPR.
4. Purposes of processing, legal bases and retention periods
Purpose | Legal basis | Data | Retention period |
|---|---|---|---|
Concluding and performing the contract of sale — processing the order, delivery, payment, complaints, returns | Performance of a contract (Article 6(1)(b) GDPR) | Identification and contact data, order and payment data | 7 years from performance of the order (conformity and limitation periods) |
Issuing and keeping the invoice | Legal obligation (Article 6(1)(c) GDPR, tax legislation) | Invoice data | 10 years from the end of the year of invoicing |
Customer account | Consent (Article 6(1)(a) GDPR) | Account data and purchase history | Until the account is deleted, or 3 years of inactivity |
Customer support — taking orders, confirmation, complaint handling, assistance | Performance of a contract (Article 6(1)(b) GDPR) | Contact data, content of the conversation, call record | Call recording 12 months; other data together with the order |
Marketing by email and SMS | Consent (Article 6(1)(a) GDPR); for existing customers also our legitimate interest in informing them about our own similar products (Article 6(1)(f) GDPR read with Regulation 13(11) of S.I. No. 336 of 2011) | Name, email address, telephone number, purchase history | Until withdrawal or objection, and in any event no more than 12 months from the last sale where we rely on the soft opt-in; we keep the record of withdrawal for 5 years as evidence |
Marketing by telephone | Consent (Article 6(1)(a) GDPR) for calls to a mobile number; for calls to a landline number, our legitimate interest (Article 6(1)(f) GDPR) subject to Regulation 13(5) of S.I. No. 336 of 2011 and screening against the National Directory Database | Name, telephone number, purchase history, record of consent or objection | Until withdrawal or objection; evidence of consent kept for 5 years after withdrawal |
Personalisation of offers and recommendations | Consent (Article 6(1)(a) GDPR) | Purchase history, questionnaire answers, behaviour on the website | Until withdrawal, or 5 years from the last activity |
Subscription purchases | Performance of a contract (Article 6(1)(b) GDPR) | Subscription data, recurring payment token, charge history | For the duration of the subscription and 7 years after it ends |
Referral programme | Consent (Article 6(1)(a) GDPR) | Name, contact detail, details of the referral and the reward | Until withdrawal, or 2 years from the last activity |
DNA Nutrigenetic test | Explicit consent (Article 9(2)(a) GDPR) read with performance of a contract (Article 6(1)(b) GDPR) | Biological sample (saliva), first name and surname, date of birth, body weight and height, analysis results, contact data | 5 years after the end of the calendar year in which the analysis was carried out, or until withdrawal |
Product reviews and ratings | Consent (Article 6(1)(a) GDPR) | Name or nickname, content of the review, confirmation of purchase | Until withdrawal or removal of the review |
General questions and enquiries | Our legitimate interest in answering questions (Article 6(1)(f) GDPR) | Contact data, content of the message | 3 months after the matter is closed |
CCTV at business premises | Our legitimate interest in protecting property and people (Article 6(1)(f) GDPR) | CCTV images | 3 months |
Preventing abuse and fraud | Our legitimate interest in protection against abuse (Article 6(1)(f) GDPR) | Order data, IP address, behavioural patterns | 2 years |
Establishing and defending legal claims | Our legitimate interest (Article 6(1)(f) GDPR) | Data needed for the claim | Until the proceedings are concluded and the limitation periods have expired |
The legitimate interests we rely on are: protecting property and people, preventing fraud and abuse, answering enquiries, establishing and defending legal claims, and informing existing customers about our own similar products by email and SMS. Before we rely on this basis we assess whether our interest overrides your rights and reasonable expectations. You may object to any processing on this basis at any time.
Do you have to provide data? The data marked as required when you place an order — first name and surname, delivery address, email address and telephone number — are a contractual requirement. Without them we cannot process and deliver your order. Invoice data are a legal requirement. All other data, in particular marketing consents, questionnaire answers and data for the DNA test, are entirely voluntary. If you do not provide them, this has no consequences for your purchase.
5. Marketing by email, SMS and telephone
We record marketing consents separately for each channel. Consent for one channel is not consent for another. Buying from us is never conditional on giving consent.
Electronic marketing in Ireland is governed by the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011), known as the ePrivacy Regulations, which are supervised and enforced by the Data Protection Commission.
5.1 Email and SMS
We send newsletters, special offers and personalised recommendations by email and SMS on the basis of your consent, as required by Regulation 13(1) of S.I. No. 336 of 2011.
If you have already bought from us, we may also send you an offer of our own similar products by email without asking for separate consent. This is the “soft opt-in” permitted by Regulation 13(11) of S.I. No. 336 of 2011. We may only rely on it where all of the following apply: the product marketed is our own; it is similar to what you bought; you were clearly and distinctly given an easy, free opportunity to object both when we collected your contact details and in every message we send; and the sale took place no more than 12 months before we send the message, or we used your details for marketing email within that 12-month window. This 12-month limit is a specific Irish rule. Once it has run out, we will not email you again unless you give consent.
Under Regulation 13(7) of S.I. No. 336 of 2011 we will not include marketing content in a non-marketing SMS (for example a delivery notification) unless you have consented.
5.2 Telephone
Before we make any marketing call we screen the number against the National Directory Database (NDD), the statutory opt-out register kept under Regulation 14 of S.I. No. 336 of 2011 and operated under the supervision of the Commission for Communications Regulation (ComReg). Under Regulation 13(5) it is an offence to make an unsolicited marketing call to a subscriber who has notified us of an objection or whose objection is recorded in the NDD. We also keep our own internal do-not-call list and screen against it.
We call mobile numbers for marketing purposes only where you have given prior consent, as required by Regulation 13(6) of S.I. No. 336 of 2011. Automated calling machines and fax may only be used with your prior consent under Regulation 13(1).
A telephone number you gave us so that we could process and deliver your order is not consent to marketing calls, and we do not use it for that purpose. Consent obtained during a service call or a call about delivery is likewise not consent to marketing.
Our customer support team may call you without any marketing consent, but only in connection with your order — confirming the order, arranging delivery, handling a complaint or return, or answering your query. That is not marketing.
At the beginning of every marketing call we tell you which company is calling, on whose behalf, and what the commercial purpose of the call is, as required by Regulation 13(10) of S.I. No. 336 of 2011, and we offer to add you to our do-not-call list. We act on an objection immediately and permanently.
Breaches of Regulation 13 are criminal offences prosecuted by the Data Protection Commission under Regulation 26. Each message sent or call made is a separate offence. The penalties are a class A fine (currently up to €5,000) on summary conviction and, on conviction on indictment, a fine of up to €250,000 for a body corporate or €50,000 for an individual. We take these obligations seriously.
5.3 How to stop marketing
You may withdraw your consent at any time and free of charge: through the link in every email, by replying to an SMS, in your customer account, by email to [email protected], or during a telephone call. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
You may object to processing for direct marketing purposes at any time and without any condition, whatever the legal basis, under Article 21(2) of the GDPR. After you object we no longer process your data for marketing.
6. Personalisation and profiling
If you have consented, we build a profile of your interests — for example health, beauty, detox or weight management — based on your purchase history, your questionnaire answers and your behaviour on the website. We use this profile to show and send you offers and recommendations that are more likely to be relevant to you, and to limit content you are not interested in.
The logic involved. We place products into content categories, link your past purchases, answers and pages viewed to those categories, and calculate which categories are most likely to interest you. We do not assess your creditworthiness, state of health or similar characteristics.
What it means for you. Profiling affects only which offers and content you see. It has no legal effects and no similarly significant effects within the meaning of Article 22 of the GDPR. The price of a product, its availability and the conditions of purchase do not change on the basis of your profile. We do not carry out automated decision-making that would produce legal effects or similarly significant effects for you.
You may object to profiling or withdraw your consent at any time. If you do, you will continue to see our general offering, but not the personalised one.
If you have taken the DNA Nutrigenetic test, the results are used for recommendations solely within the test service and only on the basis of your explicit consent. We do not use genetic data for general marketing profiling and we do not disclose it to advertising platforms.
7. Where we get data that we did not obtain from you
We obtain most data directly from you. In the following cases we may obtain it elsewhere:
- Referral programme. If an existing customer referred you to us, we receive your name and email address or telephone number from that customer. The existing customer must assure us that they have your agreement. We tell you about this at first contact and give you the opportunity to refuse further contact.
- Payment service providers and delivery companies. Data on the status of payment and shipment.
- Marketplaces and business partners. If you bought a product through a marketplace or a partner, we receive from them the data needed for delivery and complaint handling.
- Publicly available sources. For business partners, data from public commercial registers.
We do not buy or rent personal data from third parties for marketing purposes.
8. Who we disclose personal data to
Inside our organisation, only those employees who need your data for their work have access to it, and only to the extent needed. All of them are bound by confidentiality.
Outside our organisation we disclose data to the following recipients:
Recipient | Purpose | Establishment |
|---|---|---|
Klaviyo, Inc. | Sending newsletters and SMS messages, personalising messages | United States of America |
Stripe, Inc. and Stripe Payments Europe, Ltd. | Processing card payments and recurring charges, fraud prevention | Ireland and the United States of America |
PayPal (Europe) S.à r.l. et Cie, S.C.A. | Processing payments through PayPal | Luxembourg |
General Logistics Systems (GLS) and our contracted delivery partners | Delivering your order and notifying you about the shipment | Slovenia, Ireland and the European Union |
Mention Me Ltd. | Operating the referral programme and tracking referrals | United Kingdom |
Google Ireland Ltd. | Traffic measurement and advertising — only with your consent to cookies | Ireland (with possible processing in the United States of America) |
Meta Platforms Ireland Ltd. | Advertising and measuring advertising performance — only with your consent to cookies | Ireland (with possible processing in the United States of America) |
Microsoft Ireland Operations Ltd. | Analysis of website usage — only with your consent to cookies | Ireland (with possible processing in the United States of America) |
Functional Software, Inc. (Sentry) | Detecting and fixing technical errors on the website | United States of America |
Provider of website hosting and maintenance | Operation of the webshop and technical support | European Union |
Genetic analysis laboratory | Carrying out the DNA Nutrigenetic test | Denmark and the United Kingdom |
Accounting, audit and legal advisers | Bookkeeping, audit, legal advice | Slovenia |
Public authorities | Where required by law | Courts, tax and inspection authorities in Ireland and Slovenia |
We have concluded data processing agreements with all processors in accordance with Article 28 of the GDPR. We do not sell personal data.
You may request an up-to-date list of processors at any time at [email protected].
9. Transfers to third countries
Most processing takes place within the European Economic Area. The transfer of data to Denmark, where part of the genetic analysis may be carried out, is not a transfer to a third country, because Denmark is a Member State of the European Union.
Transfers outside the European Economic Area take place on the basis of the following mechanisms:
- United States of America. The transfer takes place on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU-US Data Privacy Framework, where the recipient is certified under that framework. Where the recipient is not certified, the transfer takes place on the basis of the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, together with supplementary safeguards and a transfer impact assessment.
- United Kingdom. Some of our processors are established in the United Kingdom. The transfer takes place on the basis of Commission Implementing Decision (EU) 2021/1772 of 28 June 2021 on the adequate protection of personal data by the United Kingdom, as extended by the decision of the European Commission in December 2025.
You may obtain a copy of the safeguards used free of charge by making a written request to [email protected].
10. Cookies
We do not set cookies that are not strictly necessary for the operation of the website without your consent, as required by Regulation 5(3) of S.I. No. 336 of 2011. You may change or withdraw your consent at any time using the “Cookie settings” button in the footer of the website. A detailed list of cookies with the name, provider, purpose and duration is in the Cookie Notice.
11. Security of personal data
We have put in place technical and organisational measures appropriate to the risk: encrypted data transmission using TLS, encrypted storage of passwords, access control on a least-privilege basis, access logging, regular backups, contractual arrangements with processors and regular staff training.
Additional measures apply to special categories of personal data — the genetic and health data from the DNA Nutrigenetic test: separate storage, encryption at rest, a named and restricted group of people with access, and processing logs, in accordance with the GDPR and the Data Protection Act 2018.
12. Your rights
In relation to your personal data you have the following rights:
- Access. The right to know whether we process your data and to receive a copy of that data (Article 15 GDPR).
- Rectification. The right to have inaccurate data corrected and incomplete data completed (Article 16 GDPR).
- Erasure. The right to have data erased where it is no longer needed, where you withdraw consent and there is no other legal basis, where you successfully object to the processing, or where the data has been processed unlawfully (Article 17 GDPR).
- Restriction of processing. The right to ask us to restrict processing temporarily (Article 18 GDPR).
- Portability. The right to receive the data you provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller (Article 20 GDPR).
- Objection. The right to object to processing based on legitimate interests, including profiling (Article 21(1) GDPR). You may object to processing for direct marketing purposes at any time and without any condition, whatever the legal basis (Article 21(2) GDPR). After such an objection we no longer process your data for marketing.
- Withdrawal of consent. The right to withdraw a consent you have given at any time (Article 7(3) GDPR).
- Complaint to a supervisory authority. See point 14.
For the DNA Nutrigenetic test you also have the right to ask us not to disclose particular results to you, and the right to ask for your biological samples to be destroyed.
Send your request to [email protected] or [email protected]. We reply within one month of receipt. If the request is complex, or if we receive a large number of requests, we may extend that period by up to two further months and will tell you within the first month. Exercising your rights is free of charge. To keep your data safe, we may ask for additional information to confirm your identity.
Sections 60 and 71 of the Data Protection Act 2018 allow certain rights to be restricted in limited circumstances, mainly where this is necessary to establish, exercise or defend legal claims or to protect the rights of others. We rely on such a restriction only where it genuinely applies, we apply it as narrowly as possible, and we tell you when we do.
13. Withdrawing consent
Where processing is based on your consent, you may withdraw it at any time, and as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. We record consents separately by channel, so withdrawing for one channel does not withdraw for the others. If you want all marketing to stop, tell us and we will withdraw every consent.
14. Complaint to a supervisory authority
If you consider that the processing of your personal data breaches data protection law, you have the right to lodge a complaint with a supervisory authority. As a person in Ireland you may always complain to the Irish Data Protection Commission:
Supervisory authority in Ireland | Data Protection Commission (DPC) |
Address | 6 Pembroke Row, Dublin 2, D02 X963, Ireland |
Also at | Canal House, Station Road, Portarlington, Co. Laois, R32 AP23, Ireland |
Telephone | 01 765 0100 · 1800 437 737 |
Website | dataprotection.ie |
Because Nutrisslim d.o.o. has no establishment in Ireland and its main establishment is in Slovenia, the lead supervisory authority for our cross-border processing under the one-stop-shop mechanism in Article 56 of the GDPR is the Slovenian Information Commissioner. The Data Protection Commission will, where appropriate, pass your complaint to that authority and remain your point of contact.
Lead supervisory authority | Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia) |
Address | Dunajska cesta 22, 1000 Ljubljana, Slovenia |
Telephone | +386 1 230 97 30 |
Website | www.ip-rs.si |
You may also lodge a complaint with the supervisory authority in the country where you live or where the alleged infringement took place. We would be glad if you came to us first — most questions can be resolved quickly and directly.
15. Children
We sell our products and services to adults. We do not offer information society services directly to children. Where processing is based on consent, the digital age of consent in Ireland is 16 years, set by section 31(1) of the Data Protection Act 2018 for the purposes of Article 8 of the GDPR. For anyone younger, the consent of the holder of parental responsibility is required.
The DNA Nutrigenetic test for a minor is possible only with the explicit consent of their legal guardian.
16. Changes to this notice
We may change this notice when our services, our technology or the law change. Every version carries a version number and the date it takes effect. We will tell you about significant changes by email or by a notice on the website at least 15 days before they take effect. Where a change requires your consent, we will ask for it separately.
Nutrisslim d.o.o., Obrtniška ulica 4, 1292 Ig, Slovenia · Privacy Notice, version 2.0 · in force from 12 August 2026 · replaces the previous version
