Privacy Policy

Nutrio Group, Coolsingel 104, 3011 AG Rotterdam, The Netherlands, is the data controller for personal data processed through this website. Questions or requests: info@nutrio-group.com.

• Name, email address, shipping and billing address, and phone number if you give it.
• Order details: what you bought, the amount paid, and your order history with us.
• Payment data processed by Shopify Payments and its payment providers. We receive a confirmation of payment and the last digits of the card, never the full card details.
• Basic technical data your browser sends to our hosting provider, such as IP address, for security and to keep the site running.

To take and deliver your order, handle payment, provide customer service, process returns and refunds, and meet our legal obligations such as tax record keeping. The legal bases are performance of a contract, our legal obligations, and our legitimate interest in a secure, working shop. We only send marketing email if you asked for it, and you can unsubscribe at any time.

Only parties needed to fulfil your order: Shopify (shop and checkout), our payment providers, our shipping carrier, and our accountant. They act on our instructions or under their own legal duties. Where data is processed outside the EU, it is covered by the EU Standard Contractual Clauses. We never sell your data.

This website sets no advertising or tracking cookies. Checkout runs on Shopify's own domain and uses the cookies Shopify needs to keep your cart and complete payment. Details are in our Cookie Policy.

You can ask for access to your data, correction, deletion, restriction of processing, data portability, and you can object to processing based on legitimate interest. Email info@nutrio-group.com and we will respond within one month. If you are unhappy with our response, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own country.

Order and invoice records are kept for 7 years because Dutch tax law requires it. Customer service correspondence is kept for 2 years. Marketing consent is kept until you withdraw it. After that, data is deleted or anonymised.

Data is transmitted over encrypted connections and access is limited to the people who need it. If a data breach affects you and carries a high risk, we will inform you and the supervisory authority as required by law.