Privacy Policy

Last updated: 15/9/26

 

1. Who we are — Data Controller

The controller of your personal data is:

Company name: NUTRIGLOW LAB E.E.

Legal form: E.E. (limited partnership)

Registered office: PAVLOU MELA 28, 54622, THESSALONIKI

VAT No.: 802923480 — Tax Office: D THESSALONIKI

GEMI No.: 185421506000

Legal representative: ALEXIADOU AGGELIKI

Phone: 25210 30380

Contact email for personal data matters: HELLO@ALEXIADOUAGGELIKI.GR

(hereinafter «the business», «we»)

 

This Policy concerns the website www.alexiadouaggeliki.gr (hereinafter «the website») and applies exclusively to data collected through it. It does not cover data collected by other means or by third-party websites.

 

A separate, more specific Privacy Policy applies to the Patient Portal (https://nutritioniq.gr/portal), supplementing this one. In case of conflict between the two texts, that policy prevails as regards data collected through the Portal.

 

2. What data we collect

Data you give us:

• Full name
• Company name (optional)
• Postal address (country, region, city, street, number, postcode)
• Email address
• Phone number
• Order details and chosen payment method
• Any comments or notes you optionally fill in
• The content of the messages you type into the website’s AI digital assistant, including any information about your health that you choose to mention (see section 5A)

 

Data collected automatically while browsing:

• Your device’s IP address
• Date and time of visit
• Operating system and browser
• Referring website (referrer URL)
• Pages you visited within the website

 

3. For what purposes and on what legal basis

We process your data only for specific purposes and always on a legal basis, in accordance with article 6 of Regulation (EU) 2016/679:

 

Purpose: Fulfilling the order and providing the service you requested

Legal basis: Performance of a contract (article 6(1)(b))

 

Purpose: Communicating with you about your order or request

Legal basis: Performance of a contract (article 6(1)(b))

 

Purpose: Issuing receipts/invoices and meeting tax obligations

Legal basis: Compliance with a legal obligation (article 6(1)(c))

 

Purpose: Sending a newsletter

Legal basis: Consent (article 6(1)(a))

 

Purpose: Statistical analysis of traffic and improvement of the website

Legal basis: Consent via cookies (article 6(1)(a))

 

Purpose: Operating the AI digital assistant and producing personalised food supplement suggestions

Legal basis: Explicit consent (article 6(1)(a) in conjunction with article 9(2)(a), where you mention health data)

 

Purpose: Website security and fraud prevention

Legal basis: Legitimate interest (article 6(1)(f))

 

Purpose: Establishing, exercising or defending legal claims

Legal basis: Legitimate interest (article 6(1)(f))

 

4. How long we keep the data

Order and receipt data: for as long as tax legislation requires

 

Customer account data: for as long as the account remains active and for 10 years after your last activity

Newsletter data: until you withdraw your consent

Contact data (forms, email): for 10 years from completion of the request

Conversations with the AI digital assistant:

«Conversations are kept for 10 years for service improvement and security purposes and are then deleted.»

 

IP address recorded when using the assistant: 10 years, in accordance with the log retention policy

Log files and cookies: in accordance with the Cookies Policy

 

After the above periods, the data are securely deleted or anonymised, unless further retention is required by law or is necessary to support legal claims.

 

5. Health data and special categories

In providing dietetic services we process data concerning your health (for example: anthropometric data, dietary and medical history, family history, symptoms, laboratory test results). These data belong to a special category under article 9 of the Regulation.

 

Their collection is necessary: without this information it is not possible to draw up a safe and personalised meal plan.

 

We distinguish two cases, with different legal bases:

 

• Data you give us in the context of dietetic follow-up (questionnaire, appointments, tests): we process them for the purpose of providing health care by a health professional bound by professional secrecy, in accordance with article 9(2)(h) of the Regulation.
• Health data you mention to the AI digital assistant in order to receive a supplement suggestion: we process them exclusively on the basis of your explicit consent, in accordance with article 9(2)(a) of the Regulation (see section 5A).

 

In all cases we apply enhanced technical and organisational security measures and limit access strictly to the necessary staff, who are bound by a duty of confidentiality.

5A. AI digital assistant

The website has a digital assistant powered by artificial intelligence technology. The assistant answers your questions and suggests food supplements available from our online shop.

 

What is collected

Whatever you type in the chat field, together with the assistant’s replies, as well as your device’s IP address. Because your questions may concern symptoms, conditions, medication, pregnancy or other health matters, the content of the conversation may include special category data.

 

What is NOT collected

Using the assistant does not require an account, registration or identification. We do not ask for or record your name, email, phone number or address. The only element technically linked to your conversation is the IP address.

 

Inability to identify (article 11 of the Regulation)

Because we do not keep data that identify you, we are not able to link a specific conversation to you. Consequently, we cannot fulfil a request for access, rectification, erasure or portability concerning the content of conversations with the assistant, unless you provide us with additional information that makes identification possible (article 11(2) of the Regulation). We are not obliged to collect additional data solely to make it possible to identify you.

 

Legal basis

Explicit consent (article 6(1)(a) and article 9(2)(a) of the Regulation). Consent is given through a separate, non-pre-ticked option before the conversation starts and can be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal. If you do not give your consent, the assistant does not work, with no other consequence for you — the other services of the website remain fully available.

 

Where the data are sent

To produce the reply, the text of the conversation is transmitted to artificial intelligence service providers, who act as processors on our behalf:

• Anthropic PBC (United States)
• OpenAI (United States)

 

Access is via the providers’ application programming interface (API), under business terms of use. Transfers are made with the safeguards of Chapter V of the Regulation (Standard Contractual Clauses and/or adequacy decision). Data processing agreements under article 28 of the Regulation have been concluded with these providers, and your data are not used by them to train their models.

 

Minimisation

Only the text of the conversation is sent to the providers. Your IP address and any other identifying element are not transmitted, for the simple reason that we do not keep such data. We recommend that you do not write your full name or other personal identifiers in the conversation.

 

Limits of the assistant

The assistant is not a medical device and does not provide medical diagnosis, treatment or prescriptions. Its suggestions are for information purposes and do not replace the advice of a doctor or dietitian. If you are taking medication, are pregnant or breastfeeding, or suffer from a chronic illness, consult your treating doctor before taking any food supplement.

 

Human intervention

You have the right to ask for your request to be examined by a human, to express your point of view and to contest the assistant’s suggestion, by contacting us using the details in section 11.

 

6. Minors

The website’s services are not aimed at minors. We do not knowingly collect data from minors without the consent of the holder of parental responsibility, where this is required. If such collection is discovered, the data are deleted immediately.

 

Under Law 4624/2019, the age limit for giving valid consent in Greece is fifteen (15) years.

 

7. Who receives your data

Your data are not sold and are not transferred to third parties for their own purposes. They may be shared only with:

• Website hosting and maintenance service providers
• Payment service providers, to carry out the transaction
• Courier companies, to ship the order
• Accounting firm, to meet tax obligations
• Email and newsletter service providers
• Artificial intelligence service providers, exclusively for the operation of the digital assistant (see section 5A)
• Public authorities, where required by law

 

All of the above act as processors and are bound by a contract under article 28 of the Regulation.

Google Customer Reviews. After completing a purchase, you may be invited by Google to take part in a satisfaction survey about our store. Participation is optional. Only if you accept, we share with Google LLC your email address, the order number, the delivery country and the estimated delivery date, so that the survey can be sent to you. Google’s processing of this data is governed by the Google Privacy Policy.

 

8. Transfers outside the European Economic Area

Some providers we use may be established outside the EEA or store data outside the EEA.

This category includes the artificial intelligence service providers of section 5A (Anthropic PBC, OpenAI), which are established in the United States.

 

In these cases the transfer is made with the safeguards of Chapter V of the Regulation, i.e. on the basis of an adequacy decision of the European Commission or Standard Contractual Clauses. You can request a copy of the relevant safeguards by contacting us.

 

9. Data security

We apply appropriate technical and organisational measures to protect your data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

 

Despite these measures, the transmission of information over the internet is not completely secure and we cannot guarantee absolute security.

 

It is your responsibility to keep the equipment and software you use secure and to protect your passwords.

 

10. Your rights

You have the following rights regarding your data:

• Access: to be informed which of your data we process and for what purpose
• Rectification: to request the correction or completion of inaccurate or incomplete data
• Erasure: to request the deletion of your data, where the legal conditions are met
• Restriction: to request the restriction of processing
• Objection: to object to processing based on legitimate interest
• Portability: to receive your data in a structured, commonly used format
• Notification of recipients: to be told to whom we have communicated any rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort (article 19 of the Regulation)
• Human intervention: to ask for any automated suggestion concerning you to be examined by a human (see section 15)
• Withdrawal of consent: to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal
• Complaint: to lodge a complaint with the Hellenic Data Protection Authority

 

Exception: regarding conversations with the digital assistant, which operates without an account and without identification data, the limitation of article 11 of the Regulation described in section 5A applies.

 

11. How to exercise your rights

You can contact us:

By email at: HELLO@ALEXIADOUAGGELIKI.GR

By post at our registered office: PAVLOU MELA 28, 54622, THESSALONIKI

By phone: 25210 30380

 

We reply within one (1) month of the request being submitted. This period may be extended by two (2) further months if the request is complex, with prior notice to you. The reply is provided free of charge. In the case of a manifestly unfounded, excessive or repetitive request, a reasonable fee may be charged or we may refuse to act on it, informing you accordingly.

 

12. Supervisory Authority

Hellenic Data Protection Authority

1-3 Kifisias Ave, postcode 115 23, Athens

Phone: +30 210 6475600

Email: [email protected]

Website: www.dpa.gr

 

13. Cookies

The website uses cookies. These are small text files stored in your browser that serve for recognition, easier navigation, statistical analysis and improvement of our services.

 

On your first visit an information message appears, through which you can accept or reject non-essential cookies. You can also set your browser to refuse cookies, which may affect the operation of some services.

 

Details in the Cookies Policy.

 

14. Newsletter

You can subscribe to our newsletter to receive news and offers. Subscription is only with your consent and you can unsubscribe at any time by following the link in each message.

 

Messages may contain tracking pixels, which let us know whether a message was opened and whether a link was clicked, for statistical purposes and content improvement.

 

15. Automated decision-making and profiling

The digital assistant of section 5A produces food supplement suggestions automatically, without human intervention at the time of the reply.

 

The logic involved

The assistant matches the information you give it (for example: dietary goals, symptoms, eating habits, any conditions you mention) with the characteristics and indications of the products in our catalogue and suggests those it considers relevant. It does not assess your creditworthiness, does not place you in risk categories and does not make decisions that deprive you of access to a service.

 

Significance and consequences

The assistant’s suggestion is for information. It does not bind you, does not create an obligation to buy and does not affect the price or the terms on which the products are provided to you. The decision whether or not to buy remains entirely yours.

 

Your safeguards

Because the processing may concern health data, it is carried out only with your explicit consent (article 22(4) in conjunction with article 9(2)(a) of the Regulation). You retain the right to request human intervention by our dietitian, to express your point of view and to contest the suggestion.

 

Apart from the above, we do not take decisions concerning you based solely on automated processing.

 

16. Links to third-party websites

The website may contain links to third-party websites. These websites are not under our control and we are not responsible for their content, practices or privacy policies. This Policy does not apply to them. We recommend that you read the privacy policy of every website you visit.

 

17. Video-conferencing and messaging services

Third-party services may be used for remote communication (for example: Viber, Zoom, Webex, Skype, Messenger, Instagram). Each such service has its own terms of use and privacy policy. We are not responsible for technical malfunctions due to these services or to your internet connection. If the service cannot be provided for such reasons, a new date and time are agreed.

 

18. Changes to this Policy

The Policy is revised whenever necessary. Each revision is posted on the website with an updated date. In case of material changes we will inform you by any appropriate means before they take effect. We recommend that you check this page periodically.