Privacy Policy

Our Company prioritizes the respect of your personal data and implements appropriate measures for the compliance with applicable legislation, with regards to the protection of your personal data. The following is a detailed informative policy with regards to the collection and processing, from the Company, of the personal data of the users of the MyHabeats Application (hereinafter referred to as the “Application”).

1. Who is the Data Controller?

• 1.1. The Data Controller of your personal data is the Company under the name MYHABEATS, with its registered seat in ILIOUPOLIS, GREECE, with Tax Registration Number 801091600 (Tax Authority of ILIOUPOLIS(Iroon Politechniou 84,info@myhabeats.co), hereinafter referred to as the “Company”. You may address on the above contact details any request pertaining to your personal data, as well as the exercise of your legal rights.
• 1.2. Contact details:

For any matter relating to this present Privacy Policy and the processing of your personal data you may contact us in one of the following ways:

1. Telephone number: Monday to Sunday, 09:00-17:00
2. E-mail address: info@myhabeats.co (Katie Milioni)

2. What personal data does the Company process, for what purpose and on which legal basis?

2.1. Registration and opening of account

User registration to the Application is voluntary. For the purpose of registering to the Application, the User inserts the following information:

• Full name
• Email
• Password

The User may, additionally, register through his/her personal account on Facebook. In such case, the Company collects the User’s full name at the social network, gender and profile picture.

Such data is absolutely necessary, relevant and adequate for the purposes of requesting and receiving the services offered by the Application. The User determines which data he/she inserts voluntarily and he/she is responsible for the truth, accuracy and update of such data, in order to allow for the request and provision of services through the Application.

For the creation of his/her profile, the User provides optionally the following data:

• Gender
• When and if he/she was submitted to a bariatric procedure
• Type of bariatric procedure to which he/she was submitted
• Age
• Height
• Weight
• Intended weight

The creation of a User profile is absolutely optional, on the basis of the User’s explicit consent, through the optional submission of the above data.

2. What personal data does the Company process, for what purpose and on which legal basis?

2.2. Application operation and provision of services to the User

In order to make use of the Application, the User submits, optionally at his/her own discretion, in addition to the information (under 2.1) above, the following data:

• Time, type and quantity of the meal, as well as the feeling created after such meal
• The User’s activities pertaining to exercise, interpersonal relations, self-control and the User’s body image

The Company processes the above data in order to enable the User to make use of the services provided through the Application and monitor his/her nutritional habits and activities, for the purposes of maintaining their weight after their submission to a bariatric procedure.

The processing of the above (under 2.1 and 2.2) personal data and special categories of personal data is based on the User’s prior explicit free consent, by accepting this present Privacy Policy which the User is invited to read.

For the completion of the User’s registration the double opt-in process must be followed. More specifically, an e-mail is sent to the User in order to activate his/her registration to the Application through the link provided in such e-mail. In case the User does not proceed to the activation as per the above, the Company will delete his/her data within forty-eight (48) hours and the User must commence the registration process anew.

2.3. Processing of personal data for the performance of our contractual relation

We process the personal data you provide to us through the Application for the performance of our contractual relation and the provision to you of the services, through the Application.

2.4. Processing of personal data for statistical purposes

The Company processes the Users’ personal data for research and/or analysis, to better understand the Users’ needs, for the evaluation and improvement of the existing and the development of new services.

For such purposes, the Company may further process all data it collects within the framework of the scopes analysed above, only in the form of aggregated and statistical data, implementing all appropriate safeguards to ensure that the data subjects are no longer identifiable.

The lawful basis for the above processing is the Company’s legitimate interest for the further compatible processing of aggregated data for the purposes of statistical analysis for the improvement of its services, implementing all necessary safeguards for the collection and processing of data that do not allow for the identification of the data subject and protect the Users’ rights and freedoms.

2.5. Processing of communication data for the delivery of newsletters

By granting your informed consent, our Company is entitled to process the communication data (e-mail) which you provide us at the point of your registration to the Application, for the purposes of commercial communication (newsletters).

You may withdraw the consent you have granted to us for receiving commercial communication, by contacting our Company at the contact details provided herein, or by clicking on the unsubscribe link on the e-mail or sms. The withdrawal of consent is valid for any future communications.

3. For how long does the Company keep my data?

• 3.1. We will retain your information for the period which is necessary for the processing purposes for which the data is collected. After such period we will delete your information and we shall not use such information unless the Company is bound to retain such data for the execution of a contract and/or to comply with a legal obligation (for example taxation data).
• 3.2. The retention period shall vary according to each processing purpose for which the data is collected. It must be noted that in some cases, you may request us to delete your personal data, pursuant to article 4 below.
• 3.3. The data you store to your personal account are kept for as long as you make use of the Application and your account. Your data containing information about your meals and activities shall be deleted twelve (12) months after their collection.
• 3.4. In case you request the deletion of your Account, the Company shall delete your Account, as well as all data stored therein, with the exception of any data which the Company must retain pursuant to paragraph 3.1 above.
• 3.5. In the event you don’t use the Application for more than six (6) consecutive months, our Company shall send you a reminder via e-mail and, if after such a reminder, you do not proceed to any action with regards to your Account on the Application, our Company shall delete all data stored therein and shall maintain your Account in an inactive status for six (6) more months (Inactive Account). If after the second six (6) month period you make no use of the Application, your Account shall be completely deleted and paragraph 3.4 above shall apply.
• 3.6. Your contact details and the information on your personal choices and preferences for the purposes of commercial communication are kept for three (3) years from the provision of your consent (at which point the Company will notify you and ask for the renewal of your consent) or until you withdraw your consent for each of the above processing purposes, in which case the Company will delete your personal data and shall no longer use them, with the exception of the data which must be kept by the Company pursuant to paragraph 3.1 above.

4. What are my rights with regards to the processing of my personal data and how can I exercise them?

Our Company fully respects your rights with regards to the processing of your personal data.

You may exercise your rights to one of the Company’s following contact points:

1. By telephone, Monday to Friday 09:00-17:00
2. By email, at info@myhabeats.co
3. By mail, at 84 Iroon Politechniou Street – 16341 Ilioupolis, Attiki, Greece

Your rights, pursuant to the European General Regulation 679/2016 for the protection of personal data, are the following (as each time be applicable):

• Right of information (Articles 13 and 14 of the Regulation)
• Right of access (Article 15 of the Regulation)
• Right of erasure (“right to be forgotten”) (Article 17 of the Regulation)
• Right to rectification (Article 16 of the Regulation)
• Right to restriction of processing (Article 18 of the Regulation)
• Right to data portability (Article 20 of the Regulation)
• Right to object (Article 21 of the Regulation)
• Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her (Article 22 of the Regulation)

Supervisory authority:

You may lodge a complaint with the supervisory authority in your country, with regards to the protection of personal data. In Greece, the supervisory authority for the protection of personal data is the Hellenic Data Protection Authority – HDPA (www.dpa.gr).

Our intention is to reply to all valid requests within, the latest, one (1) month from their receipt, unless your request is very complicated or in case you have submitted more requests, in which case we will try to reply within three (3) months. We will notify you in case we need more than one (1) month to reply, for the reasons stipulated above. We might ask you to tell us what is exactly that you need, or what concerns you. Furthermore, our Company reserves the right to reject any unfounded or undue or abusive requests or requests submitted in bad faith, within the provisions of the applicable legal framework.

5. Recipients of your personal data and relation with third parties – Transfer of data to third countries

• 5.1. Within the course of the Application’s operation and the provision of services, our Company cooperates with third companies that obtain access only to the data which are absolutely necessary for your registration to the Application and the management of your account, the provision of services, the operational and technical organization of the Application and the optimization of our services. Upon transferring your data to such third-party companies, we ensure at all times the highest level of safety. As such, your personal data are transferred only to service providers and cooperating companies which have been diligently selected and which are contractually bound.
• 5.2. More specifically, in order for the Application to operate and for us to provide our services to the users, we cooperate with various companies such as information system providers, website and application hosting providers, banking companies etc.
• 5.3. Some of the above companies work with as external associates that process personal data and, as such, they only process the data provided under our explicit instructions.
• 5.4. For example: (a) our Company cooperates with a third-party company which, as a data processor acting on behalf and under the instructions of our Company, hosts and manages the Application’s platform, (b) our Company further works with third-party consultants for the development of the Application and the provision of services.
• 5.5. Our Company stores the personal data mainly within the EEA. In case of a transfer of data to third countries outside the EEA, for which there is no adequacy decision, or to International Organizations, the Company implements all appropriate safeguards as provided by the applicable legal framework for the protection of personal data with regards to the transfer to third countries and all necessary information shall be made available at the Company’s website www.myhabeats.co.
• 5.6. Through the Application you may obtain access to websites and/or applications of third parties, which may or may not be our associates. In such cases, our Company has no responsibility and/or involvement to any collection and processing of personal data which may be conducted by the providers of the third-party websites and/or applications which you access. In view of the above, in order to ensure that you are fully informed about the processing of your personal data from such third-party providers, you are advised to consult the respective privacy policy uploaded on the third-party website and/or application that you visit.

6. How are my personal data secured?

The Company implements all necessary security measures for the protection and safeguard of your personal data, such as indicatively and not exclusively [encrypted application]. The information you provide to the Company is processed exclusively by specifically authorized personnel under the Company’s control and instructions, as well as the recipients of the personal data when necessary. For the processing, the Company appoints persons with the respective professional skills to provide appropriate safeguards in terms of technical knowledge and personal integrity to ensure privacy and protection of personal data. The Company, through the respective contractual commitments and its associates, implements all necessary security measures for protecting and ensuring privacy and confidentiality, as well as the integrity of personal data. In any case, the security of personal data in the platform environment is subject to factors beyond the Company’s sphere of control, as well as factors relating to technical, functional or other problems of the network or reasons of force majeure or events of chance.

You are responsible not to disclose the data/passwords you have set for the access to your account and, more specifically to safeguard the use/access to your account from third parties. Your account to the Application is personal and non-transferable.

7. Amendments to this Privacy Policy

We reserve the right to amend this present Privacy Policy, for example when this is necessary to comply with new requirements imposed by applicable laws, guidelines or technical requirements, or in the course of a revision of our processes and practices. We will notify you of any amendment to our Privacy Policy through the Application and our website www.myhabeats.co