Who processes your data
Controller
Fitore s. r. o.
I provide nutrition consulting through this company. I have not appointed a Data Protection Officer — neither the scale nor the nature of what I do requires one. For any question about your data, write to me directly at the email above and I will reply within one month.
What data, and what for
I don’t collect anything I don’t need. Here is the complete list.
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| The “Get in touch” form | name, email, phone, topic and the text of your message | so that I can reply to you and arrange a consultation | your consent and steps taken before entering into a contract |
| The food label guide form | name, email | so that I can send you the guide and occasionally a nutrition tip | your consent |
| The review form | name, email, review text, rating | publishing the review on this site | your consent |
| While we work together | intake form, measurements, progress photos, the course of our work | building and running a plan made for you | performance of a contract; for health data, explicit consent |
| Invoices | billing details and a record of payment | the legal obligation to keep accounts | compliance with a legal obligation |
Health data deserves its own section
To build your plan I need to know about your intolerances, diagnoses, any medication you take and your blood test results. Under the law this is a special category of personal data and stricter rules apply to it than to ordinary contact details. That is why I don’t collect it through the website — I only receive it in the intake form, which you sign by hand and send me as a PDF. By signing it you give explicit consent to its processing, and without that we don’t begin.
I do not share this data with anyone. Nutrition consulting is not medical care — if it turns out your condition belongs with a doctor, I will tell you, but I do not send your records to a doctor unless you ask me to.
Photos and reviews
I never publish transformation photos or private messages automatically. I always ask first and publish only what you agree to. You can withdraw that agreement at any time with a single email and I will remove the content from the site.
How long I keep it
- An enquiry that doesn’t lead to working together — one year from the last message, then I delete it.
- An email address from a guide request — until you withdraw your consent. Every email has an unsubscribe link.
- A review — until you ask me to remove it. I keep the email address only to verify it really was you.
- Records from our work together, including health data — three years after it ends, so I can pick up where we left off if you come back. I will delete them sooner on request.
- Invoices and accounting records — ten years. This period is set by law and I cannot shorten it, even at your request.
Who your data reaches
I do not sell personal data and do not share it for advertising. It reaches only those without whom the service would not work:
- Formspree (USA) — delivers messages from the forms on this site to me.
- MailerLite (Lithuania, EU) — manages the list of people who requested the guide and sends it to them. Unsubscribing takes one click in the footer of every email.
- The hosting provider — the space this site runs on, and the mailbox my email arrives in.
- My accountant — billing details, to the extent needed to keep the accounts.
- Public authorities — only where the law requires it.
Formspree is based in the United States. The transfer is covered by the Standard Contractual Clauses approved by the European Commission, or by the EU–US Data Privacy Framework.
Cookies and website analytics
This site does not use cookies for tracking or advertising, which is why there is no irritating consent banner here. Your browser remembers exactly one thing locally — that you already closed the guide pop-up, so it doesn’t appear again. That stays on your device and is never sent anywhere.
I measure traffic with Plausible Analytics — a tool that uses no cookies, stores no IP addresses and builds no visitor profiles. All I see are aggregate numbers: how many people opened the site and which part held their attention. I cannot identify an individual from it.
What you can do at any time
You have full rights over your data and you don’t need to give a reason. Just write to me:
- Access — I’ll tell you what I hold about you and give you a copy.
- Rectification — if anything is wrong or incomplete, I’ll correct it.
- Erasure — I’ll delete whatever the law doesn’t require me to keep.
- Restriction of processing — I’ll keep the data but stop working with it.
- Portability — I’ll give it to you in a common format so you can take it elsewhere.
- Objection — to processing I carry out on the basis of legitimate interest.
- Withdrawal of consent — at any time, without explaining yourself. Processing up to that point remains lawful; after it, it stops.
Write to fit@erikamala.sk. I’ll reply within one month, usually much sooner.
If you’re not happy with how I handle it
You have the right to lodge a complaint with the supervisory authority:
Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, Slovakia,
statny.dozor@pdp.gov.sk,
dataprotection.gov.sk
Changes to this policy
If I change how I work — a new tool or a new service — I’ll update this document and change the date at the top. If it’s a significant change and I have your contact details, I’ll let you know by email.