PRIVACY POLICY

Below, we provide information about how your personal data is processed when you use the PlanEat website or application. This information covers the initial questionnaire and the preparation of your plan, the purchase and management of your subscription, account management, the operation of the website and application, and the provision of nutritional and dietary services. Certain purposes, such as marketing communications, the publication of testimonials, or advertising measurement, will only apply when the conditions explained in the relevant sections are met.

1. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA?

The company responsible for processing your data is CORREOMASTER, S.L., with its registered address at Filá Cordón 36, Polígono Industrial Cotes Altes, Alcoy (Spain), telephone number: 965 051 063, and email address: info@correomaster.com.

You can contact the Data Protection Officer (DPO) at dpo@correomaster.com.

2. WHAT IS THE PURPOSE OF PROCESSING YOUR DATA AND WHAT IS THE LEGAL BASIS FOR DOING SO?

Depending on the features you use and the services you purchase, we will process your data for the following purposes:

Purpose 1: To create and manage your PlanEat account, enable registration and access, maintain your session, and administer associated features. The legal basis is the performance of a contract or the implementation of pre-contractual measures requested by you (Article 6(1)(b) of the GDPR).
Purpose 2: To provide and personalize the nutritional and dietary services you have purchased: assess your needs, create or adapt nutritional plans, menus, recipes, shopping lists, and recommendations, monitor your progress, and answer questions related to the service. Depending on your plan, this may include physical activity guidelines, personalized exercises, or video calls. The legal basis for processing the ordinary personal data required is the performance of a contract (Article 6(1)(b) of the GDPR).
Purpose 3: To process health-related data when necessary to personalize or monitor the service. This data will only be processed with your explicit consent (Articles 6(1)(a) and 9(2)(a) of the GDPR). You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. If you prefer not to provide this data or withdraw your consent, we will be unable to offer personalization or monitoring features that require such information.
Purpose 4: To respond to inquiries, incidents, and support requests received by email or through the chat integrated into the application. The chat may include an automated chatbot designed to provide guidance and motivational support; it does not provide nutritional or medical advice. The legal basis is the performance of the contractual relationship (Article 6(1)(b) of the GDPR).
Purpose 5: To ensure the technical operation, stability, availability, and security of the website and application; detect and resolve errors; and prevent unauthorized access, fraud, or misuse. The legal basis is the legitimate interest of [ COMPANY NAME ] in protecting and maintaining the website, application, and user accounts (Article 6(1)(f) of the GDPR).
Purpose 6: To measure app installation attribution and advertising campaign performance, and analyze application usage or conversion events, such as registration, creation of the first plan, scanning a meal, starting a trial, or purchasing a subscription. This purpose requires your consent (Article 6(1)(a) of the GDPR). We do not intend to use your health data or the nutritional information you provide for this purpose. On iOS devices, access to the advertising identifier and the corresponding tracking also depend on the authorization you grant through Apple's system.
Purpose 7: To send you marketing communications about our own products or services similar to those you have previously purchased, provided that a prior contractual relationship exists and applicable regulations permit such communications. The legal basis is legitimate interest (Article 6(1)(f) of the GDPR), in accordance with Article 21.2 of the Spanish Information Society Services and Electronic Commerce Act (LSSI). You may object at any time; we will include a simple option allowing you to stop receiving these communications.
Purpose 8: To use images, videos, testimonials, comments, or information about your experience and results to promote our services, only with your consent. Such materials may be published on our website, social media, marketing communications, and other channels. The legal basis is your consent (Article 6(1)(a) of the GDPR). If the material reveals health-related data, we will also require your explicit consent to process that information (Article 9(2)(a) of the GDPR). This purpose is separate from the use of photographs that may be necessary to provide the service.
Purpose 9: To create custom or lookalike audiences on social media. To improve the effectiveness of our advertising campaigns, we create custom or lookalike audiences using identifiers belonging to our users, such as email addresses or telephone numbers, which are transformed using hashing techniques before being shared with these platforms. For custom audiences, the platform matches these identifiers against those held within its systems to display our company's advertisements to matching individuals. For lookalike audiences, the platform uses the reference audience to identify people with similar characteristics. The legal basis is our legitimate interest in improving the effectiveness of our advertising campaigns (Article 6(1)(f) of the GDPR). Before carrying out this processing, we have assessed our interests against the potential impact on your rights and freedoms. You may object to your data being used for this purpose.
Purpose 10: To manage your subscription and associated payments, including registration, renewals, modifications, cancellations, and termination, as well as charges, refunds, and invoicing. The legal basis for managing your subscription and its payments is the performance of a contract (Article 6(1)(b) of the GDPR). The management and retention of accounting and tax documentation are based on compliance with the legal obligations of CORREOMASTER (Article 6(1)(c) of the GDPR).
Purpose 11: To manage your voluntary subscription to our newsletter and send you email communications about nutrition, food, wellness, recipes, updates, educational content, and promotional information about our products or services. When you request push notifications, we will also manage their delivery through the channel you have authorized. The legal basis is your consent (Article 6(1)(a) of the GDPR), in accordance with Article 21.1 of the LSSI. You may withdraw your consent or unsubscribe at any time without affecting your subscription to or use of the service. We will not use your health data to segment these communications.
Purpose 12: To analyze website navigation and usage, measure visits, sessions, pages viewed, and interactions, evaluate the performance of the purchase journey, and improve website content and functionality. We may also use information about your visits and interactions to display PlanEat advertisements to you again and optimize our advertising campaigns. The legal basis is your consent (Article 6(1)(a) of the GDPR), in conjunction with Article 22.2 of the LSSI regarding the use of cookies, pixels, and other tracking technologies that require consent. You may separately accept or reject analytics and advertising purposes, as well as modify or withdraw your consent at any time through the cookie settings panel. This purpose does not include using your responses to the nutritional questionnaire or your health data for analytics or advertising. Information about the technologies used, their providers, and their duration can be found in the Cookie Policy.

3. WHAT DATA DO WE PROCESS?

Depending on the features you use, we may process the following categories of data:

Identification and account data: First and last name, email address, telephone number if provided, user ID, credentials managed through authentication mechanisms, and account status.
Data from the pre-purchase questionnaire and data necessary to provide the service: Date of birth or age, sex when necessary, weight, height, and other anthropometric data; eating habits, preferences, and schedules; physical activity level; goals, plans, menus, recipes, and progress; inquiries and communications with professionals; mood or other information you provide during follow-up.
Health-related data: Information you provide or that is obtained through follow-up, such as medical conditions, ailments, allergies or intolerances, medical history, and medication treatments relevant to adapting the service.
Technical and security data: IP address, device type and model, operating system, browser, technical identifiers, access and activity logs, dates and times of access, errors and technical incidents, or unauthorized access attempts.
Usage and conversion data: Data used for advertising measurement.
Subscription and payment data: Subscription plan purchased, subscription status and dates, renewals, modifications, cancellations, and termination; information about charges and refunds; and data necessary to manage invoicing and retain accounting and tax documentation.
Service-related data: Information about the service purchased and information necessary to respect your preferences, such as an unsubscribe request or your objection to receiving marketing communications.
Advertising audience identifiers: Identifiers used to create custom or lookalike audiences on social media, such as email addresses or telephone numbers transformed using hashing techniques before being shared with these platforms.
Images, voice recordings, testimonials, and results: Photographs you provide for service monitoring and, only if you consent to their promotional use, images, videos, voice recordings, testimonials, and information about your experience and results.
Communication subscription data: Email address, name when requested for personalization, authorized communication channel, subscription date and status, records demonstrating consent and its withdrawal or cancellation, and push notification identifiers or tokens when you authorize this channel.
Website navigation and tracking data: Visits, sessions, pages viewed, clicks and other interactions, checkout initiation or purchase events, cookie or session identifiers, browser and device information, and approximate geographical location, depending on the authorized tools described in the Cookie Policy.

Data marked as required during registration or when using a particular feature is essential for creating your account or using that feature. If you do not provide it, we may be unable to offer the functionality that requires it.

Providing health data is voluntary: you may choose not to provide it, although recommendations or monitoring that depend on this information may be less personalized.

Data used to measure advertising campaigns will be processed with your consent. You are not required to consent to the promotional use of images, testimonials, or results in order to purchase or use the service.

4. WITH WHOM WILL WE SHARE YOUR DATA?

If you consent to the measurement of app installation attribution and advertising campaign performance, application usage and conversion data, such as the events described in this policy, will be shared with Google through Firebase Analytics and with Meta Platforms Ireland Ltd. through Meta App Events.

We do not intend to use your health data or the nutritional information you provide for this purpose.

If we use your identifiers to create custom or lookalike audiences, we may share them, after transformation using hashing techniques, with social media networks and other advertising platforms we use, such as Meta, TikTok, or Google.

If you authorize the promotional publication of images, videos, testimonials, comments, or information about your experience and results, these materials may be publicly visible through the channels indicated to you.

If you purchase a paid subscription, payment service providers, banking institutions, and, where applicable, app stores or platforms managing the subscription may be involved. We may also share data with public authorities when legally required to do so.

Technology providers offering services necessary for the website and application (hosting, maintenance, support, authentication, security, or communication delivery) may access the data required to provide those services, in accordance with their responsibilities as data processors.

If you authorize website analytics or advertising cookies and technologies, the providers of the corresponding tools, identified in the Cookie Policy, may receive data depending on the services and options you have authorized.

Providers responsible for managing the newsletter and push notifications may access the data necessary to send communications as data processors, where applicable.

International Data Transfers

Some providers may process data outside the European Economic Area (EEA). This may occur in connection with newsletter delivery and other communications, in-app campaign measurement, website analytics and remarketing, advertising audience creation, or the publication of promotional materials on social media and other platforms.

To manage and send our newsletter, we use ActiveCampaign, LLC, as a data processor. Transfers to the United States covered by its certification are based on the European Commission's adequacy decision regarding the EU–US Data Privacy Framework (DPF), in which ActiveCampaign participates.

Where applicable, the Standard Contractual Clauses approved by the European Commission and any necessary supplementary measures will be implemented.

Regarding website analytics and remarketing providers, information about their identities, international data transfers, and the mechanisms supporting those transfers can be found in the Cookie Policy.

All other international data transfers will be carried out based on an adequacy decision or appropriate safeguards provided for in Chapter V of the GDPR, depending on the provider and service used.

5. HOW LONG WILL WE RETAIN YOUR DATA?

Account-related data: For as long as your account remains active and, following account termination, for the period necessary to address potential liabilities arising from the contractual relationship or the use of the website or application.
Technical data and logs: For the period strictly necessary to maintain the website and application, investigate incidents, and address potential liabilities.
Nutritional service and health data: For as long as the contractual relationship remains in effect and the data is necessary to provide and monitor the service. After the relationship ends, this data will only be retained for the periods necessary to comply with legal obligations or address potential liabilities. Health data will be subject to restricted processing and access for the applicable retention periods.
Subscription, payment, and billing data: For as long as the subscription remains active and, after its termination, for the period necessary to manage charges, refunds, or potential liabilities. Accounting and tax documentation will be retained for the legally required periods.
Advertising measurement data: For as long as you maintain your authorization and for the period necessary to measure, attribute, or analyze the events described. Subsequent retention periods applied by Google or Meta will depend on the specific services used.
Marketing communications data: For as long as the prior relationship permitting such communications remains applicable and you have not objected. Following an objection, we will retain the minimum data necessary to respect your decision and demonstrate that it has been processed.
Promotional images, videos, and/or testimonials: For as long as you maintain your consent. When you withdraw it, future use will cease, and the materials will be removed from channels under our control.
Advertising audience data: Files containing hashed identifiers will be retained only for as long as necessary to keep the audience active and will subsequently be deleted.
Customer support data: For the period necessary to manage and resolve your inquiry, request, or incident and, subsequently, to demonstrate the support provided and address potential liabilities.
Consent and objection records: We will retain the minimum information necessary to demonstrate your decisions, address potential liabilities, and respect your objections, preventing further communications or uses to which you have objected.
Newsletter and push notification data: For as long as you remain subscribed to the corresponding channel and do not withdraw your consent or request to unsubscribe. Subsequently, we will retain only the minimum information necessary to demonstrate consent, unsubscription, or withdrawal and address potential liabilities. Push notification identifiers or tokens will be deleted when they are no longer valid or necessary for sending notifications.
Website analytics and remarketing data: For the retention periods established for each tool and detailed in the Cookie Policy. Cookies and identifiers will remain active for the durations specified there. Remarketing audiences will be maintained for as long as necessary for the authorized campaign or purpose and while your consent remains valid. If you withdraw your consent, future processing based on that consent will cease, without prejudice to retaining the minimum information necessary to demonstrate your decision and address potential liabilities.

When data is no longer necessary for these purposes, it will be deleted or, where applicable, retained with restricted processing and access for the legally required periods.

6. WHAT ARE YOUR RIGHTS WHEN YOU PROVIDE US WITH YOUR DATA?

You may request access to your personal data, its rectification or deletion, restriction of processing, and, where applicable, data portability.

You may also object to processing based on legitimate interest and withdraw any consent you have given at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

To stop receiving marketing communications, you can use the unsubscribe link included in those communications.

You may exercise your rights by writing to CORREOMASTER, S.L. at C/ Filá Cordón nº 36, Polígono Industrial Cotes Altes, Alcoy (Spain), or by contacting our Data Protection Officer at dpo@correomaster.com.

If we have reasonable doubts about your identity, we may request additional information to verify it.

If you believe your rights have not been properly respected, you may file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at www.aepd.es