GDPR Privacy
GDPR Privacy – XNutrion
Effective: October 4, 2026 | Last Updated: October 4, 2026 | Applies to: xnutrion.com
GDPR at a Glance
- This page is for visitors in the European Economic Area (EEA), the United Kingdom, and Switzerland.
- We process your data only with a valid legal basis. Cookies for analytics, ads, and affiliate tracking need your consent.
- You can access, correct, delete, restrict, export, and object to the use of your data, and withdraw consent at any time.
- We reply to requests free of charge within 30 days.
- We do not sell your data and do not make automated decisions that significantly affect you.
- Contact: contact@xnutrion.com
1. Purpose and Scope
This policy explains how XNutrion complies with the EU General Data Protection Regulation (EU) 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection. It applies to personal data of people in those regions who use www.xnutrion.com (“the Website”).
It supplements our Privacy Policy, which lists in full the data we collect, and our Cookies Policy. If anything conflicts for EEA, UK, or Swiss users, the stricter protection applies.
2. Data Controller
XNutrion is the data controller for personal data collected through the Website.
Email: contact@xnutrion.com
Contact form: www.xnutrion.com/contact-us
We have not appointed a Data Protection Officer, because our activities do not require one under GDPR Article 37. All privacy requests go to the contact above.
3. Our Data Protection Principles
We follow the principles of GDPR Article 5:
- Lawfulness, fairness, and transparency. We tell you clearly what we do with your data.
- Purpose limitation. We use data only for the purposes we state.
- Data minimization. We collect only what we need.
- Accuracy. We correct inaccurate data when we learn of it.
- Storage limitation. We keep data only as long as necessary (see Section 7).
- Integrity and confidentiality. We protect data with appropriate security.
- Accountability. We can show how we comply.
4. Legal Bases for Processing
| Activity | Legal basis |
|---|---|
| Newsletter and recipe updates | Consent (Art. 6(1)(a)) |
| Publishing and moderating comments | Consent (Art. 6(1)(a)) |
| Analytics (Google Analytics) | Consent (Art. 6(1)(a)) |
| Advertising (Google AdSense) | Consent (Art. 6(1)(a)) |
| Affiliate referral tracking | Consent (Art. 6(1)(a)) |
| Replying to your messages | Legitimate interest (Art. 6(1)(f)) |
| Security, spam, and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Legal and tax obligations | Legal obligation (Art. 6(1)(c)) |
Legitimate interest. Where we rely on it, we have weighed our interests against your rights and concluded that the processing is necessary and proportionate. You can object at any time (see Section 5).
Consent. It is freely given, specific, informed, and unambiguous. You can refuse without any penalty, and withdrawing is as easy as giving it, using “Cookie Settings” in the footer or the unsubscribe link in any email.
Special category data. We do not intentionally collect it (GDPR Article 9). Please do not send health information through comments or the contact form.
5. Your GDPR Rights
| Right | What it means |
|---|---|
| Access (Art. 15) | Get a copy of your data and information about how we use it. |
| Rectification (Art. 16) | Have inaccurate or incomplete data corrected. |
| Erasure (Art. 17) | Ask us to delete your data, for example when it is no longer needed or you withdraw consent. |
| Restriction (Art. 18) | Ask us to pause the use of your data while a dispute is resolved. |
| Portability (Art. 20) | Receive your data in a structured, common, machine-readable format. |
| Objection (Art. 21) | Object to processing based on legitimate interest, and to direct marketing at any time. |
| Withdraw consent (Art. 7) | Withdraw at any time. Earlier processing remains lawful. |
| No automated decisions (Art. 22) | We do not make decisions based solely on automated processing that significantly affect you. |
| Complaint (Art. 77) | Lodge a complaint with a supervisory authority (see Section 10). |
Some rights have legal limits. For example, we may keep data we must retain by law, or that we need to defend legal claims.
6. How to Exercise Your Rights
- Send your request to contact@xnutrion.com, or use the Contact page. Write “GDPR Request” in the subject and say which right you want to use.
- Verify your identity. We may ask for details to confirm it is you, so that we do not give your data to someone else. We ask only for what is needed.
- We respond within 30 days of receiving your request. If it is complex or we receive many requests, we may extend by up to two more months and we will tell you why.
- It is free. We may charge a reasonable fee or refuse only if a request is clearly unfounded or excessive, and we will explain.
If we cannot act on your request, we tell you why and how to complain.
7. Data Retention
| Data | Retention |
|---|---|
| Newsletter email | Until you unsubscribe or ask for deletion |
| Contact form messages | Up to 12 months |
| Comments | Until you ask for deletion or we remove the comment |
| Google Analytics data | No longer than 26 months |
| Server logs | Up to 90 days |
| Advertising and affiliate data | As set by Google, Amazon, or the partner |
After this, we delete the data or make it anonymous.
8. Data Sharing and Processors
We share data only with processors and partners that help us run the Website:
- Google LLC (Analytics and AdSense)
- Amazon.com, Inc. (Associates affiliate program)
- WordPress and our hosting provider
- Our email newsletter provider
Where a provider acts on our behalf, we use a data processing agreement (GDPR Article 28). Google and Amazon may act as independent controllers for their own purposes under their own privacy policies. We never sell your data.
9. International Transfers
We operate from the United States, and our providers may process data there. For transfers from the EEA, UK, or Switzerland, we rely on GDPR Chapter V safeguards:
- The EU-US Data Privacy Framework (and the UK Extension and Swiss-US framework) for certified providers such as Google and Amazon.
- Standard Contractual Clauses approved by the European Commission, with the UK Addendum where needed.
- Adequacy decisions of the European Commission.
You can ask us for information on the safeguards in use.
10. Security and Data Breaches
We use appropriate technical and organizational measures, including SSL/TLS encryption, regular updates and monitoring, restricted access, and reputable processors.
If a personal data breach is likely to put your rights and freedoms at risk, we will notify the competent supervisory authority within 72 hours of becoming aware (GDPR Article 33). If the risk is high, we will also tell affected people without undue delay (Article 34).
11. Children
The Website is not directed at children. We do not knowingly collect data from children under 16 (or the lower age set by your country, no lower than 13). If a parent or guardian thinks their child has given us data, email contact@xnutrion.com and we will delete it.
12. Complaints
We would like the chance to fix any problem first, so please contact us. You also always have the right to complain to a supervisory authority:
- EU/EEA: find your authority at edpb.europa.eu
- United Kingdom: Information Commissioner’s Office (ICO), ico.org.uk
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch
13. Changes to This Policy
We update this page when the law or our practices change. The “Last Updated” date shows the latest revision. For significant changes, we will give a clear notice and ask for new consent where required.
14. Contact Us
Email: contact@xnutrion.com
Contact form: www.xnutrion.com/contact-us
Related pages: Privacy Policy · Cookies Policy · Terms and Conditions · Affiliate Disclosure
Frequently Asked Questions
Does XNutrion comply with GDPR?
Yes. We process data on a valid legal basis, ask for consent before non-essential cookies, and honor your rights.
What are my rights under GDPR?
Access, rectification, erasure, restriction, portability, objection, withdrawing consent, and the right to complain to a supervisory authority.
How do I ask XNutrion to delete my data?
Email contact@xnutrion.com with “GDPR Request” in the subject. We reply within 30 days.
Is there a fee to use my rights?
No. It is free, except for requests that are clearly unfounded or excessive.
Does XNutrion transfer my data outside the EU?
Possibly to the United States, under safeguards such as the EU-US Data Privacy Framework and Standard Contractual Clauses.
How do I withdraw my consent?
Use “Cookie Settings” in the footer, the unsubscribe link in newsletters, or email us.
Who do I complain to if I am not satisfied?
Your national data protection authority. Contact us first so we can try to solve it.
© 2026 XNutrion. All rights reserved.