Privacy Policy

What is this privacy policy and who is your data controller?
In this privacy policy (the ‘Privacy Policy’) we, UAB Keto Diets, company code 305493532 (“Company”, “we”, “us” or “our”), explain how we, as a data controller, handle your Personal data (the ‘Personal data’) when you visit our website / websites (the ‘Website’), use our mobile app / apps (the ‘Mobile App’), contact us through our official social media pages or email, and / or use our services.

If you purchase multiple products through our website, please note that the privacy policies of all such products will apply. In the event of any discrepancy or conflict between this Privacy Policy and the privacy policy of any specific product, the terms of the product-specific privacy policy shall take precedence with respect to that product.

What are personal data?
We care about the safety and security of your Personal data and make every effort to ensure it. Personal data refer to any information relating to an identified or identifiable natural person (e.g. your name, email address, etc.).

When processing your Personal data, the Company is guided by and complies with General Data Protection Regulation 2016/679 (the ‘GDPR’), California Consumer Privacy Act and any other applicable statutory regulations governing the protection of your Personal data.

All the definitions used in this Privacy Policy have the same meaning as prescribed in the Company’s General Terms and Conditions unless expressly provided otherwise in this Privacy Policy.

Do you have any questions or inquiries related to privacy?
In case of any questions or inquiries, or in case you would like to exercise any of your rights provided in this Privacy Policy, you may submit such inquiries and requests by means provided in the Contacts section of this Privacy Policy and / or you may also contact our Data Protection Officer regarding all privacy related issues by email: [email protected].

In this Privacy Policy you will find information about:

Personal data processing principles we follow (Section 3);

Personal data we collect, processing purposes, legal grounds and retention periods (Section 4);

Personal data retention periods (Section 5);

to whom we provide your Personal data (Section 6);

direct marketing and other marketing operations (Sections 7 and 8);

AI tools (Section 9);

security of your Personal data (Section 10);

your rights related to Personal data you possess (Section 11);

other privacy matters that you should take into account (Sections 12–18).

We adhere to the general data processing principles established in the relevant privacy legal acts, including but not limited to the following principles:

Lawfulness, fairness and transparency — we process Personal data in a lawful, fair and transparent manner;

Purpose limitation — we process Personal data for specified, explicit and legitimate purposes and we do not further process in a manner incompatible with those purposes;

Personal data minimization — we process Personal data that are appropriate, relevant and only necessary for the purposes for which they are processed;

Accuracy — we process accurate and updated Personal data;

Limitation of storage period — we keep Personal data in a form which permits identification of you for no longer than is necessary for the purposes for which the Personal data are processed;

Integrity and confidentiality — we process Personal data in such a way as to ensure, through appropriate technical or organisational measures, adequate security of Personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

We process the following Personal data for the purpose of:

offering a personalized plan for you, we may process test quiz data (which may include your responses to the onboarding questions and your age). We obtain such data directly from you. The legal basis for this data processing is your consent (Art. 6(1)(a) of the GDPR). You have a right to withdraw your consent at any time. Your Personal data processed for this purpose will be retained for no longer than 2 (two) years following your last update on the account or until you withdraw your consent.

subscribing to our services and provision of our services to you, we may process your name, surname, email address, phone number, certain bank account details and transaction details, purchase history, and other data you provide while registering. We obtain such data directly from you. Such data is processed to provide services as well as to keep proper records of those transactions. The legal basis for this processing is the performance of a contract between you and us and / or taking steps, at your request, to enter into such a contract (Art. 6(1)(b) of the GDPR). Your Personal data processed for this purpose will be retained for no longer than 5 (five) years following the end of provision of the respective services, unless the law requires to retain certain data for a longer term (e.g. for accounting purposes).

subscribing to our email messages and newsletters, we may process your email address and your purchase history. The latter Personal data are processed to send you the relevant messages and newsletters. The legal basis for this data processing is your consent (Art. 6(1)(a) of the GDPR). You have a right to withdraw your consent at any time. Also, if we have already sold goods or provided services for you via our Website and / or App, and you do not object, we may also process your email address on the basis of our legitimate interest, namely seeking to offer to you similar goods or services to those you have purchased. You have a right to object to such processing at any time (Art. 21(2)(b) of the GDPR). Your Personal data processed for this purpose will be retained for no longer than 2 (two) years following the provision of consent or, where the messaging is sent to present clients to maintain and improve customer relations, for no longer than 2 (two) years following the end of provision of the respective services, unless you withdraw your consent earlier or object to such processing.

customer service (i.e. managing your requests, enquiries, complaints or other communications with the Company), we (and through our service providers when applicable) may process your email address, content of the request, metadata associated with your communication, and other account information that is necessary to fulfil your request or answer your questions. The legal basis for this data processing is your consent (Art. 6(1)(a) of the GDPR). You have a right to withdraw your consent at any time. Please note that in some cases we may process Personal data indicated in this paragraph to fulfil our legitimate interest, for example, to ensure uniform and high-quality consultation practice and for investigating disputes between you and the Company (Art. 6(1)(f) of the GDPR). Your Personal data processed for this purpose will be retained for no longer than 3 (three) years following the provision of consent or until you withdraw your consent, unless the data is processed on a legitimate interest basis or is needed for the purposes stated in clause 4.1.8, in which case data shall be processed as long as necessary to fulfil our legitimate interest, or as long as court proceedings continue, or to defend our rights, respond to claims and so on.

managing and administering our social media accounts (e.g. Facebook, Instagram, TikTok, LinkedIn), we may process the profile name, photo, and reactions (likes, comments, shares) of users who interact with us through our social media pages. The legal basis for this data processing is your consent (Art. 6(1)(a) of the GDPR). In some cases, we may process this information on the basis of our legitimate interest, for example for investigating disputes (Art. 6(1)(f) of the GDPR). Your Personal data will be retained for as long as the Company’s or your social network account is valid, unless you express your wish to delete it earlier.

administering and securing the Website and the Mobile App, ensuring their functionalities, and performing statistical analysis to find out how you use them, we may process your device data (IP address, geographical location, browser type and version, operating system, device type, screen resolution, and — if you agree — your location and motion-activity data), along with information on how you use our website and apps (referral source, length of visit, page views, navigation paths, timing, frequency and pattern of service use). We obtain such data using cookies and similar technologies. The legal basis for this data processing is your consent (Art. 6(1)(b) of the GDPR) or our legitimate interest (Art. 6(1)(f) of the GDPR). Your Personal data will be retained for no longer than 2 (two) years following the provision of your consent or, where processing is based on our legitimate interest, for as long as necessary to fulfil it.

the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure, we may process your Personal data that is necessary for the specific purpose. The legal basis is legal obligation and / or our legitimate interests (Art. 6(1)(e), Art. 6(1)(f) of the GDPR). Your Personal data will be retained for as long as it is necessary to fulfil our legitimate interest and legal obligation (e.g. for as long as court proceedings continue).

obtaining or maintaining insurance coverage, managing risks, or obtaining professional advice, we may process your Personal data necessary for the specific purpose. The legal basis is our legitimate interests (Art. 6(1)(f) of the GDPR) and / or legal obligation (Art. 6(1)(e) of the GDPR). Your Personal data will be retained for as long as required by applicable legal acts and / or as long as necessary to fulfil our legitimate interest and you do not object.

compliance with legal obligations to which we are subject, we may process your Personal data necessary to comply with a specific legal obligation (Art. 6(1)(e) of the GDPR). Your Personal data will be retained for as long as required by the applicable legal acts.

Should the purpose or legal basis of data processing activities indicated in this paragraph change, we will inform you.

Your Personal data that we process for any specific purpose shall not be kept longer than is necessary for that specific purpose. Specific Personal data retention terms are specified in Section 4 of this Privacy Policy.

After the end of the applicable retention period, or upon your request, Personal data are destructed using overwriting or physical destruction (when applicable) methods.

Sometimes we may aggregate, anonymize or de-identify your Personal data in such a way that it cannot reasonably be used to identify you. Such data is no longer personal. We may use such data without restriction in any way allowed by law, including sharing with partners or research institutions, in articles, blog posts and scientific publications, and aggregating statistics about certain activities to help identify patterns across users and to evaluate or modify our services.

Notwithstanding the other provisions of this Section, we may retain your Personal data to the necessary extent where such retention is necessary for compliance with a legal obligation (e.g. accounting, tax) or where we need to protect our interest (e.g. exercise or defence of legal claims).

We may disclose your Personal data to any member of our group of companies (including our subsidiaries, our ultimate holding company and all its subsidiaries) insofar as reasonably necessary for the purposes set out in this Privacy Policy and we have a legal ground to do so. This may include internal administration purposes as well as provision / sharing of IT, payment or marketing services or data centres in the group.

Subject to your consent or on the basis of the performance of a contract concluded with you, we may share your account data across different products within our Group of companies when you purchase multiple products. Sharing data within our Group will help us optimize your experience and ensure easy integration of new products into your account. Should you choose not to consent (when consent is needed), you will have the option to enter the required data manually for each product.

We may disclose your Personal data to our insurers, bailiffs, auditors, attorneys, notaries and / or other professional advisers insofar as reasonably necessary for obtaining or maintaining insurance coverage, managing risks, obtaining professional advice, or the establishment, exercise or defence of legal claims.

We may disclose your Personal data to our anti-fraud, risk and compliance providers insofar as reasonably necessary for the purposes of protecting your Personal data and fulfilling our legal obligations.

We may disclose your Personal data to AI service providers insofar as reasonably necessary for the provision of AI chatbot or customer support functionalities. Our partners adhere to strict data protection regulations, and we ensure that any data transfers comply with privacy regulation requirements.

To order our services, you will be required to provide certain financial information (e.g. cardholder name, surname, card number, date, CVV) in order to facilitate the processing of payments. We use third-party payment processor services, so we do not collect and store card information. Your card information will be directly received by the specific payment service provider as a data controller. We will only receive information about the payment status and store only the last 4 digits of your card.

Depending on the payment method chosen by you, your Personal data may be received and processed directly by our group companies, insofar as reasonably necessary for collecting, processing and administering payments for the services. Such companies act as separate data controllers.

To offer you Klarna’s payment methods, we might in the checkout pass your personal data in the form of contact and order details to Klarna, in order for Klarna to assess whether you qualify for their payment methods and to tailor those payment methods for you. Your Personal data will be processed by Klarna, as your Personal data controller, and in line with Klarna’s own privacy notice: klarna.com/international/privacy-policy.

We may disclose your Personal data to other service providers insofar as reasonably necessary to provide specific services (including providers of servers and their maintenance, email service providers, data-analysis or marketing providers, call centres, customer satisfaction surveys, market research and others). We will conclude necessary agreements with those third parties and ensure they are bound by specific contractual clauses regarding the processing of Personal data and by confidentiality obligations. We also require third-party service providers to take all necessary measures to implement proper organizational and technical measures to ensure the security and privacy of your Personal data.

In addition to the specific disclosures of Personal data set out in this Section, we may disclose your Personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject (e.g. by the lawful request of law-enforcement authorities or other public authorities).

Persons indicated in this Section may be established outside the Republic of Lithuania, the European Union (EU) and the European Economic Area (EEA). In case we transfer your Personal data to such persons, we will take all the necessary measures indicated in the legal acts to ensure that your privacy remains properly secured, including where appropriate signing European Commission approved Standard Contractual Clauses for the transfer of data. More information: commission.europa.eu — Standard Contractual Clauses.

Also, your Personal data may be transferred to Personal data recipients established outside the EU or EEA on other legal grounds compatible with the requirements of Articles 45–49 of the GDPR.

To find out more information regarding appropriate safeguards, you may contact us.

We may contact you via email or phone to inform you on what we are up to (we may send newsletters, the latest information about our products and services, special offers, marketing campaigns). Also, we may inform you about our similar products and services that might interest you via email. You have a right to object to such Personal data processing at any time.

We may share your contact information with our group companies for direct marketing purposes.

When contacting you by phone (if you agreed to receive marketing communications via phone), SMS / text messages or phone calls from us will be received through your wireless provider to the mobile number you provided. SMS / text messages may be sent using an automatic telephone dialing system or other technology. Message frequency varies. Message and data rates may apply.

We may use your Personal data used to create your account and related to your use of our services to personalize marketing messages and advertisements presented to you. The legal basis for this processing is our legitimate interest to present you with marketing messages that we consider relevant to you (Art. 6(1)(f) of the GDPR).

You may opt out of receiving marketing communications at any time. You may do so by choosing the relevant link in our marketing messages or by contacting us via means provided on our website, or by email. If you are receiving both email and phone marketing communications and you wish to opt out of receiving them, you will need to opt out separately.

Upon you having fulfilled any of the provided actions, we will update your profile to ensure that you will not receive our marketing communication in the future.

In case you opt out of receiving marketing communications, we will immediately stop sending marketing communications to you. Nevertheless, please be informed that as our business activities consist of a network of closely related services, in certain cases it may take a few days until all the systems are updated, so you may continue to receive marketing communication while we are still processing your request.

In any case, the opt-out of marketing communications will not stop you from receiving communication directly related to the provision of services.

We may use marketing tools of social media platform operators (e.g. Google LLC, Meta Platforms Inc.) or other third parties and therefore share your Personal data relevant for marketing operations to such social media platform operators or other third parties for marketing purposes.

For EU residents: please note that social media platform operators may be established outside the EU and EEA, thus your Personal data may be transferred outside the EU and EEA. In this case, your Personal data will be protected by concluding Standard Contractual Clauses approved by the European Commission.

We also use cookies. More information about cookies can be found in our Cookie Policy.

Telemarketing based on Established Business Relationship Rule:

We may contact you via phone on the basis of the Established Business Relationship Rule (as provided in TCPA § 310.4 (b)(iii)(B)) to check on your order status.

During the call we may also suggest you acquire other similar goods and / or services offered by us. In case you agree to buy any other similar goods and / or services offered by us, we will need to collect your payment data (name and surname, credit card number, CVV code, card expiry date) to proceed with your order.

Please note that the phone call will be automatically recorded, and the record of the call, including information such as time of call, duration of call, number of calls (“Phone call record data”) will be stored for 5 years as required by applicable legislation.

You may opt out from telemarketing calls at any time. You may express your will during the call or you may send us a message via email.

We may disclose your personal data to our service providers insofar as reasonably necessary to perform telemarketing calls. We take all the necessary measures to ensure that such contractors and their subcontractors would implement proper organizational and technical measures to ensure the security and privacy of your personal data and would be bound by specific contractual clauses regarding the processing of personal data as well as by confidentiality obligations.

We may use third-party artificial intelligence (“AI”) tools to help operate, secure and improve our services and to power customer-support features. The scope of data processed by these tools depends on the nature of your request or inquiry and any information you choose to provide. Both personal and non-personal data may be processed.

Data processed by these AI tools may be shared with the third-party providers powering the functionality. We ensure that these providers adhere to data protection laws and maintain the confidentiality and security of the shared information, and that any data transfers comply with applicable privacy regulations.

We are using a number of appropriate technical and organisational measures to protect your Personal data. Organisational measures include restricting access solely to authorised persons with a legitimate need to access Personal data, signing confidentiality agreements, arranging training, and creating and implementing relevant policies and procedures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, implementing access control and authentication tools, and ensuring physical security.

Personal data is stored either on the servers of the Company or of our contractors, who are bound by specific contractual clauses regarding the processing of Personal data as well as by confidentiality obligations.

Regardless of technical and organizational measures taken by us to protect your Personal data, we cannot objectively guarantee the full security of it.

In this Section we have summarized the rights that you have under data protection laws. Some of the rights are complex, so we only provide the main aspects. You should read the relevant laws (first and foremost the GDPR) and guidance from the regulatory authorities for a full explanation.

Your principal rights under data protection law are the following:

Right to be informed about the processing of Personal data. You have the right to obtain information about the Personal data processed by us, the sources, purposes, legal grounds, retention periods, data recipients or data processors, your rights, etc.

Right to access data. You have the right to confirmation as to whether or not we process your Personal data and, where we do, access to the Personal data together with certain additional information. The first copy will be provided free of charge; additional copies may be subject to a reasonable fee.

Right to rectification. You have the right to have any inaccurate Personal data rectified and incomplete Personal data completed.

Right to erasure in certain circumstances (including when the Personal data are no longer necessary, you withdraw consent and no other legal basis applies, you object to processing under applicable data protection laws, the processing is for direct marketing purposes, or the data have been unlawfully processed). Exclusions apply, including where processing is necessary for freedom of expression, compliance with a legal obligation, or legal claims.

Right to restrict processing in circumstances such as when you contest data accuracy, processing is unlawful but you oppose erasure, we no longer need the data but you need it for legal claims, or you have objected to processing pending verification.

Right to object to processing on grounds relating to your particular situation, where the legal basis is the performance of a task carried out in the public interest or legitimate interests. If you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

Right to object to direct marketing, including profiling for direct marketing purposes. If you make such an objection, we will cease processing your Personal data for this purpose.

Right to object to processing for scientific or historical research or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Right to data portability where our processing is based on consent or on the performance of a contract. You have the right to receive your Personal data in a structured, commonly used and machine-readable format.

Right to lodge a complaint with a supervisory authority responsible for data protection if you consider our processing infringes data protection laws. Our data processing is supervised by the State Data Protection Inspectorate of the Republic of Lithuania, registered office at L. Sapiegos St. 17, LT-10312 Vilnius, email address [email protected], www.vdai.lrv.lt.

Right to withdraw consent at any time where processing is based on consent. Withdrawal will not affect the lawfulness of processing before the withdrawal.

Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you. Exclusions apply, e.g. where the decision is necessary for entering into or performing a contract, authorised by EU or member-state law, or based on your explicit consent.

In addition to specific measures provided in this Section or the website, you may also exercise any of the rights indicated herein by contacting us by email. Please note that we have a legal obligation to verify your identity before exercising your rights. We undertake to respond to your inquiry within 1 month after it is received. This response time may be extended by 2 months for complex or multiple requests. In case of such an extension, we will inform you additionally.

On the website you may find links to and from partner sites, information sources and related-party websites. Please take note that such third-party websites have their own privacy policies and we take no responsibility regarding them. We recommend familiarising yourself with privacy policies of such websites before providing any Personal data.

Our Website and Mobile App are targeted only at people over the age of 18.

If we have reason to believe that we hold Personal data of a person under that age in our databases without having consent from the parental rights holder, we will delete that Personal data. If you become aware that your child has provided us with Personal data without your consent, please contact us via email.

If you are a California consumer or resident, in addition to the information provided in this Privacy Policy, you may have additional rights and information under the California Consumer Privacy Act:

We do not knowingly sell personal information nor share it with third parties for direct marketing purposes. However, if we do so in the future, you will be notified and have the right to opt out of the “sale” of personal information.

We will retain, use or disclose personal information we collect or process on your behalf only for the purposes described in this Privacy Policy, and will notify you if this changes.

You have the right not to be subject to discrimination if you exercise any of your rights.

We do not currently recognize or respond to browser-initiated Do Not Track signals.

If you believe that your rights have been violated, you may always contact us by email. Also, you may file a complaint with the supervisory authority in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. Our data processing is supervised by the State Data Protection Inspectorate of the Republic of Lithuania, registered office at L. Sapiegos St. 17, LT-10312 Vilnius, www.vdai.lrv.lt.

Please note that the automated data collection, also known as data scraping, from our Website is strictly prohibited without explicit written consent from us. This includes, but is not limited to, the use of software, bots, scripts, or any other automated methods to collect, extract, or replicate content, data, or information from our Website.

Please let us know if the personal information that we hold about you needs to be corrected or updated.

We reserve the right to change this Privacy Policy at any time. Any changes to this Privacy Policy will be published on the Website and, in case of material changes, we may inform you about it via email or by other means which we will deem the most fitting in a particular case.

Any changes to the Privacy Policy shall come into force from the date of their publication, i.e. from the date they are posted on the Website.

In the event this Privacy Policy is translated into other languages and there are differences between the English version and such translation, the English version shall prevail, unless otherwise provided.

In case of any inquiries or if you would like to exercise any of your rights provided in this Privacy Policy, you may submit such inquiries and requests to us via email at [email protected].