Privacy Policy

Who we are

In this privacy policy we, UAB “InnoDiets”, company code 305493571, registration address at Aludarių g. 3, LT-01113 Vilnius, Lithuania (“Company”, “we”, “us” or “our”), explain how we handle your personal data when you visit our website, use our services, or contact us through our official social media pages or email.

When processing personal data, the Company is guided by and complies with Regulation (EU) 2016/679 (“GDPR”) and any other applicable legal acts governing the protection of your personal data.

The Company acts as a data controller of your personal data. You may contact our Data Protection Officer regarding all privacy related issues by email: hello@gettabletales.com.

All definitions used in this privacy policy have the same meaning as prescribed in the Company’s General Terms and Conditions unless expressly provided otherwise. If this policy is translated into other languages and there are differences between the English version and such translation, the English version shall prevail.

1. How we use your personal data

1.1. This section sets out the categories of personal data we process, the source of data we did not obtain directly from you, the purposes of processing, and the legal bases of the processing.

1.2. We process information relating to the purchase and sale of our products (“purchase data”). Purchase data may include your name and surname, contact details (such as your email address, country or region), your full address, purchase history, and whether you are purchasing a product for yourself or for a third party. If you are purchasing our product for a third party as a gift, we will also collect the first name and surname and email address of the recipient, the date when the recipient should receive the gift, your name and your message for the recipient. You are responsible for the information you provide to us and confirm that you have the right to provide it, including permission of the gift recipient or any other third party. Purchase data is processed to provide our products and to keep proper records of those transactions. The legal basis is the performance of a contract between you and us and/or taking steps at your request to enter into such a contract, and our legitimate interests, namely the proper administration of our website and business.

1.3. We may process information that you provide for the purpose of subscribing to our email messages and newsletters (“messaging data”). Messaging data is processed to send you relevant messages and newsletters. The legal basis is your consent. If we have already sold products to you via our website and you do not object, we may also process messaging data on the basis of our legitimate interest, namely maintaining and improving customer relations and suggesting similar products to you.

1.4. We may process information relating to any communication that you send to us (“correspondence data”). Correspondence data may include the communication content (e.g. email address, content of the message) and metadata associated with the communication (e.g. device system name, system version, model, display). It is processed for the purposes of communicating with you and record-keeping. The legal basis is your consent and/or our legitimate interests, namely the proper administration of our website and business, ensuring uniform and high-quality consultation practice, and investigating disputes.

1.5. We may process information on your use of our website as well as on your device (“device data”) when you browse our website. Device data may include IP address, mobile network information, geographical location, browser type and version, operating system, device type, logging information, screen resolution and (if you agree to share it) your location data, as well as information about the timing, frequency and pattern of your service use. We obtain such data through cookies and similar technologies. Device data is processed to enhance the website, set default options, understand how you use our website and secure it. The legal basis is our legitimate interest in the proper management of our website and business, and your consent.

1.6. We may process any of your personal data identified in this notice where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The legal basis is our legitimate interests, namely the protection and assertion of legal rights.

1.7. We may process any of your personal data where necessary for obtaining or maintaining insurance coverage, managing risks, or obtaining professional advice. The legal basis is our legitimate interests, namely the proper protection of our business against risks.

1.8. In addition to the specific purposes set out in this section, we may also process your personal data where necessary for compliance with a legal obligation to which we are subject.

1.9. Should the purpose or legal basis of data processing change, we will inform you and, if consent was the legal basis, will re-obtain your consent.

1.10. Sometimes we may aggregate, anonymise or de-identify your personal data so that it cannot reasonably be used to identify you. Such data is no longer personal and may be used without restriction in any way allowed by law.

1.11. We follow the principle of data minimisation: personal data processed is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.

1.12. Personal data is stored either on the servers of the Company or of our contractors, who are bound by specific contractual clauses regarding the processing of personal data as well as by confidentiality obligations.

1.13. We use a number of technical and organisational means to protect your personal data. Organisational measures include restricting access solely to authorised persons with a legitimate need, signing confidentiality agreements, arranging trainings, and implementing relevant policies and procedures. Technical measures include actions to address online security, risk of data loss, alteration of data or unauthorised access, access control and authentication tools, and physical security.

2. When we provide your data to others

2.1. We may disclose your personal data to any member of our group of companies insofar as reasonably necessary for the purposes set out in this notice, including internal administration purposes and the provision or sharing of IT, payment or marketing services or data centres in the group.

2.1.1. Depending on the payment method chosen by you, your personal data may be disclosed to and processed by our group company Karma Processing Incorporated, company code 7138602, registered address 16192 Coastal Highway, Lewes, Delaware 19958, County of Sussex, office address 1000 West Street, Suite 1200, Wilmington, Delaware, email: hello@gettabletales.com, insofar as reasonably necessary for collecting, processing and administrating payments for the services.

2.2. We may disclose your personal data to our insurers and/or professional advisers insofar as reasonably necessary for obtaining or maintaining insurance coverage, managing risks, obtaining professional advice, or the establishment, exercise or defence of legal claims.

2.3. We may disclose your personal data to our anti-fraud, risk and compliance providers insofar as reasonably necessary for protecting your personal data and fulfilling our legal obligations.

2.4. To order our products you will be required to provide certain financial information (e.g. cardholder name, surname, card number, date, CVV) to facilitate the processing of payments. We use third party payment processor services, so we do not collect and store card information. Your card information is received directly by the payment service providers as data controllers. We only receive information about the payment status and store only the last 4 digits of your card.

2.5. To offer you Klarna’s payment methods, we might pass your personal data in the form of contact and order details to Klarna at checkout, so Klarna can assess whether you qualify for their payment methods and tailor those payment methods for you. That data is processed by Klarna as a data controller, in line with Klarna’s own privacy notice.

2.6. We may disclose your personal data to other service providers insofar as reasonably necessary to provide specific services (including providers of servers and their maintenance, email service providers, development service providers, providers used for data analysis or marketing, call centres, customer satisfaction surveys or market research). We take all necessary measures to ensure such subcontractors implement proper organisational and technical measures and are bound by contractual clauses regarding the processing of personal data and by confidentiality obligations.

2.7. We may transfer your personal data to other business subjects in case of a transfer of the Company’s business and/or services or part thereof, a merger with another legal entity or an acquisition, including subjects carrying out legal due diligence.

2.8. We may disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.

2.9. Persons or legal entities indicated in this section may be established outside the Republic of Lithuania, the European Union and the European Economic Area. In case we transfer your personal data to such persons, we will take all necessary measures to ensure your privacy remains properly secured, including, where appropriate, signing standard contractual clauses. For more information about appropriate safeguards, contact us at hello@gettabletales.com.

3. How long we store your data

3.1. Your personal data processed for any purpose shall not be kept for longer than is necessary for that purpose. In any case it shall be kept for no longer than: (1) purchase data — 5 (five) years following the end of provision of our products; (2) messaging data — 2 (two) years following the provision of consent, or, where sent to present clients to maintain and improve customer relations, 2 (two) years following the end of provision of the respective services, unless you withdraw consent earlier or object; (3) correspondence data — 6 (six) months following the end of such communication; (4) device data — 2 (two) years following the provision of your consent, or, where based on our legitimate interest, as long as necessary to fulfil that legitimate interest.

3.2. After the end of the applicable retention period, or upon your request, personal data is irreversibly destroyed using overwriting or physical destruction (when applicable) methods.

3.3. Notwithstanding the other provisions of this section, we may retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, and/or in order to protect vital interests.

4. Marketing communication

4.1. If you consent, we will contact you via email or phone to inform you about what we are up to. Your consent is not a condition of any purchase. Also, if we have already provided our products and/or services to you and you do not object, we will inform you about other products of our Company or group companies that might interest you.

4.2. When contacting you by phone, SMS/text messages from us will be received through your wireless provider to the mobile number you provided. Messages may be sent using an automatic telephone dialling system or other technology. Message frequency varies. Message and data rates may apply.

4.3. You may opt out of receiving any marketing communications at any time by choosing the relevant link in any of our marketing messages or contacting us via means provided on our website. If you receive both email and phone marketing communications, you will need to opt out separately.

4.4. Once you have opted out, we will update your profile to ensure you will not receive our marketing communication in the future.

4.5. We will immediately stop sending marketing communications to you. However, as our business activities consist of a network of closely related services, in certain cases it may take a few days until all systems are updated, so you may continue to receive marketing communication while we process your request.

4.6. Opting out of marketing communications will not stop you from receiving communication directly related to the provision of services.

5. Your rights

5.1. In this section we have summarised the rights you have under data protection laws. Some of the rights are complex, so we only provide the main aspects. You should read the relevant laws (first and foremost the GDPR) and guidance from the regulatory authorities for a full explanation.

5.2. Your principal rights under data protection law are: (1) the right to be informed about processing of personal data; (2) the right to access data; (3) the right to rectification; (4) the right to erasure; (5) the right to restrict processing; (6) the right to object to processing; (7) the right to data portability; (8) the right to complain to a supervisory authority; (9) the right to withdraw consent; and (10) the right to request not to be subject to a decision based solely on automated processing, including profiling.

5.3. The right to be informed. You have the right to obtain information about the personal data processed by us, the sources of the personal data, the purposes of the processing, the legal grounds, the retention period, data recipients or data processors, and your rights.

5.4. The right to access data. You have the right to confirmation as to whether or not we process your personal data and, where we do, access to that data together with certain additional information, including the purposes of the processing, the categories of personal data concerned and the recipients. Providing the rights and freedoms of others are not affected, we will supply a copy of your personal data. The first copy is free of charge; additional copies may be subject to a reasonable fee.

5.5. The right to rectification. You have the right to have any inaccurate personal data about you rectified and, taking into account the purposes of the processing, to have any incomplete personal data completed.

5.6. In some circumstances you have the right to erasure of your personal data, including when: the data is no longer necessary in relation to the purposes for which it was collected; you withdraw consent and there is no other legal basis; you object to the processing under certain rules; the processing is for direct marketing purposes; or the data has been unlawfully processed. Exclusions apply where processing is necessary for exercising the right of freedom of expression and information, for compliance with our legal obligation, or for the establishment, exercise or defence of legal claims.

5.7. In some circumstances you have the right to restrict processing: when you contest the accuracy of the data; processing is unlawful but you oppose erasure; we no longer need the data but you require it for legal claims; or you have objected to processing pending verification. Where processing has been restricted, we may continue to store your data, but will only further process it with your consent, for legal claims, for the protection of the rights of another person, or for reasons of important public interest.

5.8. You have the right to object to our processing of your personal data on grounds relating to your particular situation, to the extent the legal basis is the performance of a task carried out in the public interest or our legitimate interests. If you object, we will cease processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is for legal claims.

5.9. You have the right to object to our processing of your personal data for direct marketing purposes. If you object, we will cease to process your personal data for this purpose.

5.10. You have the right to object to processing for scientific or historical research purposes or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

5.11. The right to data portability. Where the legal basis for our processing is consent, or performance of a contract or steps taken at your request prior to entering into a contract, you have the right to receive your personal data from us in a structured, commonly used and machine-readable format. This right does not apply where it would adversely affect the rights and freedoms of others.

5.12. If you consider that our processing infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority. You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. Our data processing is supervised by the State Data Protection Inspectorate of the Republic of Lithuania, registered office at L. Sapiegos St. 17, LT-10312 Vilnius, email ada@ada.lt, www.vdai.lrv.lt.

5.13. Where the legal basis for our processing is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.

5.14. You have the right to request not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Exclusions apply where the decision is necessary for entering into or performing a contract between you and us, is authorised by EU or member state law with suitable safeguards, or is based on your explicit consent.

5.15. In addition to the measures provided in this section or on the website, you may exercise any of these rights by contacting us at hello@gettabletales.com. We undertake to respond within 1 month of receipt. This may be extended by 2 months for complex or multiple requests, and we will inform you of any extension.

6. About cookies

6.1. Cookies are small text files containing an identifier that is sent by a web server to your web browser and stored by the browser. The identifier is then sent back to the server each time the browser requests a page.

6.2. We will ask you to consent to our use of cookies in accordance with the terms of this and our cookie notices when you first visit our website.

6.3. Cookies do not typically contain any information that personally identifies a user, but personal information we store about you may be linked to information stored in and obtained from cookies.

7. Cookies that we use

On the website we use cookies of three main types: (1) Required cookies — to ensure proper performance of the website, security of customers and their data, and provision of high-quality services; (2) Functional cookies — to enhance the user experience, analyse the use of the system and improve the provision of services; (3) Advertising cookies — to observe user online behaviour and optimise marketing campaigns.

8. Cookies used by our service providers

8.1. Our service providers use cookies and those cookies may be stored on your computer when you visit our website.

8.2. We may use: Google Analytics cookies to observe website traffic; YouTube cookies to display content uploaded on YouTube; Twitter cookies to display content posted on Twitter; Google Maps cookies to determine a user’s location if permitted; Doubleclick cookies to control the display of ads; Facebook cookies to manage the display of ads; Google Tag Manager cookies to control advertising cookies; Hotjar cookies to observe how users use our website; and Visual Website Optimiser cookies to collect information on how visitors interact with pages on the website. You can view each provider’s privacy policy on their own website.

9. How can you manage cookies

9.1. Most browsers allow you to refuse to accept cookies and to delete cookies. The methods vary from browser to browser and version to version. You can obtain up-to-date information about blocking and deleting cookies via the relevant browser website, for example Chrome, Firefox, Internet Explorer or Safari.

9.2. Blocking all cookies will have a negative impact upon the usability of many websites.

9.3. If you block cookies, you will not be able to use all the features on our website.

10. Third party websites

On the website you may find links to and from partner sites, information sources and related party websites. Such third-party websites have their own privacy policies and we take no responsibility regarding them. We recommend familiarising yourself with the privacy policies of such websites before providing any personal data to them.

11. Children’s personal data

11.1. Our website and services are targeted at persons over the age of 18.

11.2. If we have reason to believe that we hold personal data of a person under that age in our databases without consent from the parental rights holder, we will delete that personal data.

12. California Privacy Addendum

If you are a California consumer or resident, in addition to the information provided in this privacy policy, you may have additional rights under the California Consumer Privacy Act:

1. We do not knowingly sell personal information nor share it with third parties for direct marketing purposes. However, if we do so in the future, you will be notified and have the right to opt out of the “sale” of personal information.

2. We will retain, use, or disclose personal information we collect or process on your behalf only for the purposes described in this privacy policy, and will notify you if this changes.

3. You have the right not to be subject to discrimination if you exercise any of your rights.

4. We do not currently recognise or respond to browser-initiated Do Not Track signals.

13. Updating your data

Please let us know if the personal information that we hold about you needs to be corrected or updated.

14. Contacts

In case of any inquiries, or if you would like to exercise any of your rights provided in this notice, you may submit such inquiries and requests by the following contact details:

UAB InnoDiets, company code 305493571. Registration address: Aludarių str. 3, Vilnius, Lithuania. Office address: Aludarių str. 3, Vilnius, Lithuania. Email address: hello@gettabletales.com.

15. Changes to the notice

Any changes to this notice will be published on the website and, in case of material changes, we may inform you via email or by other means we deem the most fitting. Any changes to the privacy policy shall come into force from the date of their publication, i.e. from the date they are posted on the website.