Privacy Policy

1. Controller

The controller within the meaning of Art. 4 (7) GDPR is NUTRAVER LLC, 1110 Brickell Ave, Ste 430, Miami, FL 33131, United States, represented by [Managing director]. Email for data protection matters: privacy@nutraver.com.

If we are legally required to appoint a data protection officer, we will do so and publish the contact details here. Until then, please send all data protection requests to privacy@nutraver.com.

2. Overview

We process the following categories of data:

• Connection data when you visit the website (IP address, time, requested URL, browser identification).
• Contact and content data you enter into our forms (name, email, company, message, details of an abuse report or application).
• Account, contract and billing data of customers (name, company, VAT ID, address, email, ordered services, invoices, payment status, login and security data such as two-factor settings).
• Technical data of the services you use (IP addresses assigned to you, reverse DNS entries, support tickets).

We receive this data directly from you, from your browser, or — in the case of abuse reports — from third parties who report an incident concerning an IP address assigned to you.

3. Visiting the website

When you open our website, our servers automatically record server log files: IP address, date and time, requested URL, HTTP status, transferred data volume, referrer and user agent. We use this data to deliver the website, to detect and defend against attacks and to fix errors. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the secure and stable operation of the website. Log files are deleted after 14 days at the latest, unless a specific security incident requires longer retention.

Fonts are served from our own domain. The website makes no requests to third-party servers, uses no tracking, no advertising technologies and no analytics tools.

4. Contact form, abuse reports and VPN applications

When you use one of our forms or write to us by email, we process the data you provide to answer your request. For enquiries relating to a contract or pre-contractual measures, the legal basis is Art. 6 (1) (b) GDPR; otherwise Art. 6 (1) (f) GDPR, our legitimate interest being to answer enquiries.

Abuse reports are processed to stop misuse of our network and to meet our legal obligations (Art. 6 (1) (c) and (f) GDPR). We may forward the content of a report to the customer to whom the affected IP address is assigned. We disclose the identity of the reporter only with their consent, unless we are legally required to do so. Reports concerning child sexual abuse material can be submitted without name or email address.

Applications for volume terms are processed to prepare an offer (Art. 6 (1) (b) GDPR).

We delete form data once the request is completed and no statutory retention obligations apply, as a rule no later than 12 months after the last contact. Abuse reports are kept for up to 3 years to document how they were handled.

5. Customer account, orders and billing

To create and manage your account, accept and fulfil orders, provision servers, issue invoices and provide support, we process your account, contract and billing data. The legal basis is Art. 6 (1) (b) GDPR and, for tax and commercial record-keeping, Art. 6 (1) (c) GDPR.

Login and security data (password hash, two-factor settings, session information) is processed to protect your account (Art. 6 (1) (b) and (f) GDPR).

Invoices and accounting documents are retained for 10 years, commercial letters for 6 years, in accordance with § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB). Other account data is deleted after the end of the contract once no claims remain outstanding.

6. Payments

For card payments, SEPA transfers and crypto payments we use payment service providers [providers to be named]. They process your payment data as independent controllers under their own privacy policies. We receive only the information required to allocate the payment (e.g. payment status, reference, last digits of a card).

7. Service providers (processors)

We use carefully selected service providers for hosting, email delivery and support tools [providers to be named]. They process personal data only on our behalf and according to our instructions, on the basis of a data processing agreement under Art. 28 GDPR.

8. Transfers outside the EU/EEA

We do not plan to transfer personal data to countries outside the European Union or the European Economic Area. If a transfer becomes necessary, it will only take place on the basis of an adequacy decision of the European Commission or appropriate safeguards such as the EU Standard Contractual Clauses (Art. 44 et seq. GDPR), and we will update this policy accordingly.

9. Storage period

We store personal data only for as long as necessary for the purposes described or as required by statutory retention obligations. When the purpose ceases to apply and no retention obligation exists, the data is deleted or anonymised.

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7 (3) GDPR).

Right to object: where we process data on the basis of Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, write to privacy@nutraver.com. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), for example the authority responsible for us: [Data protection authority of the federal state].

11. Security

All connections to our website are encrypted with TLS. Access to personal data is restricted to employees who need it for their tasks. Customer accounts can be protected with two-factor authentication.

12. Changes to this policy

We update this policy when our services or legal requirements change. The current version is always available on this page; the date of the last update is shown at the top.