PREAMBLE
The security and protection of your Personal data is one of the top priorities of FoodFix Tech LTD, a company duly incorporated under the laws of the United Kingdom (England and Whales), with company registration number 14433407 and official address at 41 DEVONSHIRE STREET, GROUND FLOOR, W1G 7AJ, LONDON (“Company”, “We” or “Us”), which operates websites hosted at the URL www.foodfix.tech (the “Website”). Remember that your use of FoodFix’ Service is at all times subject to our Terms of Use, which incorporates this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Service. If you have a disability, you may access this Privacy Policy in an alternative format by contacting [email protected].
1. DEFINITIONS
‘Consent’ shall mean any freely given, specific and informed indication of his or her wishes by which a Data subject signals agreement to the Processing of Personal data relating to him or her.
‘Data controller’ shall mean the natural or legal person, which, alone or jointly with others, determines the purposes and means of the Processing of Personal data and who is in charge of this Processing.
‘Data subject’ shall mean natural or legal persons whose data is processed, whether it is a User or a Visitor.
‘Disclosure’ shall mean making Personal data accessible, for example by permitting access, transmission or publication.
‘Personal data’ shall mean all information relating to an identified or identifiable person.
‘Personal data breach’ shall mean a breach of security leading to the accidental or unlawful destruction, loss or alteration of – or to the unauthorised Disclosure of, or access to – Personal data transmitted, stored or otherwise processed.
‘Processing’ shall mean any operation or set of operations – by automated and other means – that is performed upon Personal data or sets of Personal data, such as collecting, recording, organising, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmitting, disseminating or otherwise making available, aligning or combining, or erasing.
‘Recipient’ means third, public authority, agency or other body – that is, someone or something other than the Data subject or the Company – to which the Personal data is disclosed.
2. COVERAGE
This Privacy Policy covers how we treat Personal Data that we gather and subsequently process when you access or use our Service. This Privacy Policy does not cover the practices of companies we don’t own or control or people we don’t manage.
3. DATA WE COLLECT
This list details the categories of Personal Data that we collect and have collected over the past 12 months as well as data we subsequently process:
Customer Information
This is information about you that we use to manage your account, for example your name, address, email address and telephone number. We use this data to: Manage your account. Decide whether particular national or state laws apply, for example to allow us to decide whether we need to involve a physician or other medical practitioner in collecting certain samples. Enable testing (such as blood tests) where some personal information is required for the service to be provided with the oversight of a physician or other medical practitioner. To input relevant information into our analysis, for example your geographical location.
We need this information in order to deliver the service to you which means that you will not be able to sign up to an account without providing it. We use your email address, telephone number, first name, last name, birth date, zip or postal code, and country to improve our use of Facebook advertising, see the “Facebook” section below.
Emails
We may also use your email address, in order to send you emails for the following purposes: Providing you with information about our products or services. Keeping in touch with you about the app and its performance as well as about new versions of the app or similar apps we may develop. Sending you updates on our latest developments and scientific discoveries. Inviting you to register for webinars we host in relation to our research.
Our legal basis for doing so is our legitimate interest in promoting our services. For more information, see the “User Research” and “Mailing Lists” sections below.
How long do we keep customer information for? We keep this information for a period of 6 years after the end of your visit or account deletion Keeping it for this length of time allows us to recognise you if you wish to subscribe again, and is also necessary for us in case we need to resolve any legal disputes that might arise.
Self-reported Health Information
This is information such as height, weight, what you eat, and pre-existing health conditions. We use this data to: Determine your eligibility for our services. Input relevant information into our analysis, for example what you eat. Allow us to carry out general scientific research.
Device & Browser Data
If you visit our website, or use our apps, then we will also collect information about you. Some of this information is direct: such as your IP address, the type of browser you are using, the make of your mobile phone and the contents of cookies we set (see our Cookie Policy). We also use third party analytics providers such as Google Analytics, who collect similar information and then supply us with further analysis derived from it.
We process this data in order to: Locate errors in our systems or problems our systems may be facing with other systems (such as compatibility with a web browser) Improve the functioning of our Service Prevent fraud or other criminal activity
This information is automatically sent to us – although there are technical ways you can prevent us from receiving this information (for example by changing the information your browser supplies to us) – the way in which browser and app software works means it is inevitable that we process it.
We routinely delete our web server logs after 90 days, unless we are aware of any serious problem that requires investigation (for example fraud or a hostile attack to our systems), in which case we may preserve any information necessary for that investigation for as long as it is needed. Once the investigation is concluded, we will delete the data.
Our use of cookies is a little more complicated, so we have written a detailed Cookie Policy, explaining what cookies are; our additional reasons for processing them and explaining in detail how we process different kinds of cookies.
We may also include information linked to you in any URL (web link) that we share with you. We use this to enable us to present personalised information to you when you visit our website.
For example, if you fill in an initial quiz and have the results of that quiz emailed to you. The email contains a link that allows you to create an account. That link will contain additional information that will allow us to associate the answer to the health quiz with your account. If we do it this way, it will save you having to enter the information again.
Correspondence
Where you directly correspond with us (such as sending us an email, online chat message, or call us) we will process information about you concerned with that correspondence, including your email and our responses. We keep that information for as long as necessary to deal with the correspondence – for example if you have made a complaint, as long as needed to deal with the complaint – and then for a further 6 years, in case we need it to defend or establish a legal claim.
4. PURPOSE FOR USING PERSONAL DATA
We have explained specific reasons for processing categories of personal data above. Our core purpose is research into nutrition, food recipes, diets, healthcare and into the link between them.
We may process any of the information you provide us for the purposes of providing support and assistance in using the Service.
We may also process your personal information if we are legally required to do so in circumstances where this cannot be reasonably resisted.
We will not collect additional categories of Personal Data or use the Personal Data we collected for different purposes without providing you notice.
5. PERSONAL DATA SHARING
We do not share Personal Data with anyone else, other than with:
Our group (FoodFix Ltd, based in the United Kingdom, and FoodFix Ltd, based in the British Virgin Islands). Contractors providing us services we use for processing Personal Data, which include: Hosting, technology and communication providers. Security and fraud prevention consultants. Analytics providers. Support and customer service vendors. Payment processors Our professional advisors, such as if we need to consult an attorney for legal advice. In all cases these will be advisors under a professional duty of confidence.
6. BUSINESS TRANSFERS
All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part). Should one of these events occur, we will make reasonable efforts to notify you before your information becomes subject to different privacy and security policies and practices.
7. DATA THAT IS NOT PERSONAL DATA
We may convert Personal Data into anonymous data, that is data which can no longer be linked with identifiable individuals, for example by aggregation of data about multiple individuals. We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user.
We may use such anonymous data and share it with third parties for our lawful business purposes, including to analyze, build and improve the Service and promote our business, provided that the data remains anonymous. We do not delete anonymous data on any particular timetable. You may assume that we could keep it indefinitely.
8. TRACKING TOOLS, ADVERTISING AND YOUR RIGHT TO OPT OUT
General tracking
The Service uses cookies and similar technologies such as pixel tags, web beacons, clear GIFs and JavaScript (collectively, “Cookies”) to enable our servers to recognize your web browser, tell us how and when you visit and use our Service, analyze trends, learn about our user base and operate and improve our Service. Cookies are small pieces of data – usually text files – placed on your computer, tablet, phone or similar device when you use that device to access our Service. We may also supplement the information we collect from you with information received from third parties, including third parties that have placed their own Cookies on your device(s). Please note that because of our use of Cookies, the Service does not support “Do Not Track” requests sent from a browser at this time.
For more information about our use of cookies, please see our Cookie Policy.
Mailing Lists
You can subscribe to our mailing lists to get the latest updates on our scientific discoveries or information about our products without creating a FoodFix account and we will use the data you provide us with for these purposes.
We process this data because you have consented to us doing so. If you do not wish to receive emails from us regarding this information, then you can opt out by clicking “unsubscribe from this list” at the bottom of our email. If you unsubscribe from our mailing lists, we will need to keep just enough information on file to make sure we respect your preferences in the future.
User Research
If you are a FoodFIx customer, we may email you to invite you to answer some questions regarding our products or services or share feedback with you from customer surveys, interviews or focus groups.
9. DATA SECURITY AND RETENTION
We seek to protect your Personal Data from unauthorized access, use and disclosure using appropriate physical, technical, organizational and administrative security measures based on the type of Personal Data and how we are processing that data. You should also help protect your data by appropriately selecting and protecting your password and/or other sign-on mechanism; limiting access to your computer or device and browser; and signing off after you have finished accessing your account. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure. The periods for which we retain individual categories of Personal Data are explained under the heading “Data we collect”, but in some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation.
10. PERSONAL DATA OF CHILDREN
We do not knowingly collect or solicit Personal Data about children under 18 years of age (or under 19 years of age if they live in Alabama or Nebraska). If you are a child under the age of 18, please do not attempt to register for or otherwise use the Service or send us any Personal Data. If we learn we have collected Personal Data from a child under 18 years of age, we will delete that information as quickly as possible. If you believe that a child under 18 years of age may have provided Personal Data to us, please contact us at [email protected].
11. EUROPEAN UNION DATA SUBJECT
Our headquarters, at FoodFix Tech Ltd, are in the United Kingdom. As a result, you are protected by the United Kingdom’s General Data Protection Regulation ("GDPR"), regardless of your citizenship or where you live in the world. You may have additional rights under the GDPR with respect to your Personal Data, as outlined below. For this section, we use the terms “Personal Data” and “processing” as they are defined in the GDPR, but “Personal Data” generally means information about a person, and “processing” generally covers actions that can be performed in connection with data such as collection, use, storage, amendment, deletion and disclosure. FoodFix will be the controller of your Personal Data processed in connection with the Service. If there are any conflicts between this section and any other provision of this Privacy Policy, the policy or portion that is more protective of Personal Data shall control to the extent of such conflict. If you have any questions about this section or whether any of the following applies to you, please contact us at [email protected].
Personal Data Use and Processing Grounds
The “Our Purposes for Using Personal Data” section above explains the purposes for which we process your Personal Data. We will only process your Personal Data if we have a lawful basis under the GDPR for doing so. Lawful bases for processing include: Consent: Except for the specific situations explained below, we process your customer information and self-reported information by consent. You may withdraw your consent at any time and we will stop processing your Personal Data in this way. Contractual Necessity: In order to be able to perform our contract, we need to collect customer information we have marked as required and all payment information. Compliance with a legal obligation: As explained above, we will sometimes have to process personal data in order to comply with a legal obligation imposed on us. Where those obligations are imposed by UK law, that law will provide us with a lawful ground for processing. Legitimate Interest: We process the following categories of Personal Data when we believe it is in our legitimate interest to do so and we do not believe that your rights of freedoms will be unduly interfered with by our processing: Device data is justified by our legitimate interest in maintaining a reliable and secure system, free from errors and external security threats. Where we are required to process personal data due to a legal obligation in the United States of America, we believe that justifies our processing your data. Cookies, for the reasons set out in our Cookie Policy.
All information about your health, which we would normally be forbidden from processing by the GDPR, is processed by us because you have consented to us doing so.
Data Subject Rights
You have certain rights with respect to your Personal Data, including those set forth below.
For more information about these rights please see the UK Information Commissioner’s guide to data subject rights. To submit a request to exercise any of these rights, or to ask for more information, please email us at [email protected].
Some of the rights below apply only in specific circumstances. In other situations, we may not be able to fully comply with your request, for example if it would be impossible or would involve a disproportionate effort; or if it jeopardises the rights of others; but in those circumstances, we will still respond to notify you of such a decision. In some cases, we may also need you to provide us with additional information, which may include Personal Data, if necessary to verify your identity and the nature of your request. Access: You can request more information about the Personal Data we hold about you and request a copy of such Personal Data. Rectification: If you believe that any Personal Data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data. Erasure: In some situations you may have a right to request that we erase some or all of your Personal Data from our systems. Withdrawal of Consent: If we are processing your Personal Data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time. Please note, however, that if you exercise this right, you may have to then provide express consent on a case-by-case basis for the use or disclosure of certain of your Personal Data, if such use or disclosure is necessary to enable you to utilize some or all of our Service. Portability: You can ask for a copy of your Personal Data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible. Objection: You can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes. Restriction of Processing: You can ask us to restrict further processing of your Personal Data. Right to File Complaint: You have the right to lodge a complaint about FoodFix’s practices with the UK’s Information Commissioner.
Our Data Protection Officer is contactable at [email protected]
12. CALIFORNIA RESIDENT RIGHTS
If you are a California resident, you have the rights set forth in this section. Please see the “Exercising your rights” section below for instructions regarding how to exercise these rights. Please note that we may process Personal Data of our customers’ end users or employees in connection with our provision of certain services to our customers. If we are processing your Personal Data as a service provider, you should contact the entity that collected your Personal Data in the first instance to address your rights with respect to such data. If there are any conflicts between this section and any other provision of this Privacy Policy and you are a California resident, the portion that is more protective of Personal Data shall control to the extent of such conflict. If you have any questions about this section or whether any of the following rights apply to you, please contact us at: [email protected]
Access
You have the right to request certain information about our collection and use of your Personal Data over the past 12 months. In response, we will provide you with the following information: The categories of Personal Data that we have collected about you. The sources from which that Personal Data was collected. The business or commercial purpose for collecting or selling your Personal Data. The categories of third parties with whom we have shared your Personal Data. The specific pieces of Personal Data that we have collected about you.
If we have disclosed your Personal Data to any third parties for a business purpose over the past 12 months, we will identify the categories of Personal Data shared with each category of third party recipient. If we have sold your Personal Data over the past 12 months, we will identify the categories of Personal Data sold to each category of third party recipient.
Deletion
You have the right to request that we delete the Personal Data that we have collected about you. Under the California Consumer Privacy Act (CCPA), this right is subject to certain exceptions: for example, we may need to retain your Personal Data to provide you with the Service or complete a transaction or other action you have requested. If your deletion request is subject to one of these exceptions, we may deny your deletion request.
Exercising your rights
To exercise the rights described above, you or your Authorized Agent (defined below) must send us a request that (1) provides sufficient information to allow us to verify that you are the person about whom we have collected Personal Data (we will use our existing authentication practices (your username and password) as the mechanism for verifying your identity, or if such information is unavailable then we will use alternative validation data to verify your identity to a reasonable degree of certainty), and (2) describes your request in sufficient detail to allow us to understand, evaluate and respond to it. Each request that meets both of these criteria will be considered a “Valid Request.” We may not respond to requests that do not meet these criteria. We will only use Personal Data provided in a Valid Request to verify your identity and complete your request. You do not need an account to submit a Valid Request.
We will work to respond to your Valid Request within 45 days of receipt. We will not charge you a fee for making a Valid Request unless your Valid Request(s) is excessive, repetitive or manifestly unfounded. If we determine that your Valid Request warrants a fee, we will notify you of the fee and explain that decision before completing your request. You may submit a Valid Request by emailing us at [email protected].
You may also authorize an agent (an “Authorized Agent”) to exercise your rights on your behalf. To do this, you must provide your Authorized Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorized Agent when they make a request on your behalf.
Personal Data sales opt-out and opt-In
We will not sell your Personal Data, and have not done so over the last 12 months. We Will Not Discriminate Against You for Exercising Your Rights Under the CCPA We will not discriminate against you for exercising your rights under the CCPA. We will not deny you our goods or services, charge you different prices or rates, or provide you a lower quality of goods and services if you exercise your rights under the CCPA. However, we may offer different tiers of our Service as allowed by applicable data privacy laws (including the CCPA) with varying prices, rates or levels of quality of the goods or services you receive related to the value of Personal Data that we receive from you.
13. OTHER PRIVACY RIGHTS
California resident rights
Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of Personal Data to third parties for such third parties’ direct marketing purposes; in order to submit such a request, please contact us at [email protected].
Your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and services that you do not wish such operators to track certain of your online activities over time and across different websites. Our Service does not support Do Not Track requests at this time. To find out more about “Do Not Track,” you can visit www.allaboutdnt.com.
Nevada resident rights
If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Data to third parties who intend to license or sell that Personal Data. You can exercise this right by contacting us at [email protected]. with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your account. Please note that we do not currently sell your Personal Data as sales are defined in Nevada Revised Statutes Chapter 603A.
14. CHANGES TO THE PRIVACY POLICY
The Company may modify this Notice from time to time, and will post the most current version on the Website(s). If a modification reduces your rights, a pop-up window will inform you immediately when you will browse our Website and you will have to accept the changes.
15. CONTACT
If you wish to contact us please do so at the following address: 41 Devonshire Street, Ground Floor, W1G 7AJ, London, United Kingdom or at the following e-mail address: [email protected].