Privacy Policy

Data controller

The data controller is The Nutri Fixers (Nikoleta Koulouri), with nutrition practices in Glyfada and Petroupoli, Athens.

For any question about your data, contact us at contact@thenutrifixers.gr.

What data we collect

Through the contact form we collect the details you provide:

• •Full name
• •Email address
• •Phone number
• •Service you're interested in (optional)
• •Your message
• •Technical data (IP address and time of submission, for security and spam prevention)

The nutrition assessment form

The nutrition assessment form collects the more detailed information needed to build a personalised plan: your contact and demographic details, body measurements and physical activity, dietary habits, your relationship with food, sleep and stress levels — and health data, such as medical conditions, blood test results, medication and supplements, and, where they apply to you, questions about your menstrual cycle and reproductive health.

Health data is a special category of personal data under Article 9 GDPR. We process it only on the basis of your explicit consent (Article 9(2)(a) GDPR), which you give by ticking the consent box before submitting, and solely to prepare and deliver your personalised nutrition plan. We never use it for marketing and never pass it to third parties.

You can withdraw your consent at any time by emailing contact@thenutrifixers.gr, and we will delete the assessment you sent us.

Why we process it & lawful basis

We process your data solely to respond to your enquiry, arrange appointments and prepare your nutrition plan. For the contact form the lawful basis is your consent (Article 6(1)(a) GDPR), which you give when you submit the form; for the health data in the assessment form it is your explicit consent (Article 9(2)(a) GDPR).

Please do not send sensitive health data through the contact form — use the nutrition assessment form, which is built for it, or share it during your appointment.

Data stored on your device

While you are filling in the nutrition assessment form, your answers are saved temporarily in your browser's session storage, so that switching language or reloading the page does not lose what you have typed. They stay on your device and are not sent to us until you submit the form. They are erased as soon as the form is submitted successfully and, in any case, when you close the browser tab — so if you are using a shared or public computer, close the tab when you are done.

If you begin on the contact form and continue to the assessment form, the name, phone number and email you entered are carried across in the same way and cleared immediately once they have been filled in for you.

We store two functional cookies of our own. heroLast lasts 24 hours and only remembers which homepage image you last saw. nf_signed_in lasts 30 days and records nothing but the fact that you are signed in to our client portal in this browser — it contains a single character, holds no name, email or account identifier, and gives access to nothing. It is set by the portal when you sign in, removed when you sign out, and read only so that the notices on this site can be relevant: someone who already has an account is not shown a message inviting them to open one. Google advertising cookies are set only if you accept them in the cookie notice — see “Advertising with Google Ads” below. Some pages do embed content from other companies, which can set storage of their own — these are listed below.

Traffic is measured in two ways, neither of which identifies you. Vercel Analytics is cookieless. We also count page views ourselves, so that we can see which services, products and articles people actually read: when you open a page, your browser tells our own server the address of that page, its language, whether it is the first page of your visit, and — for that first page only — the site you arrived from, reduced to its name (for example google.com), and — if you arrived through a campaign link or one of our Google ads — the campaign name, or simply the label “google-ads”. The click identifier Google adds to the address is not sent to us. Your device type and your country are added from the connection. Nothing else is recorded: no IP address, no cookie, no device identifier, and nothing that links one page you read to another. So that a single visit is not counted twice, a marker holding no information about you is kept in your browser's session storage and is discarded when you close the tab; it is never sent to us. What we keep is a daily count per page, and we delete it after two years.

Content and services from other companies

Some pages load content or tools provided by other companies. When that happens your browser connects to them directly, so they can see your IP address and may store data on your device under their own terms — we cannot see or control what they store. These are the only ones we use:

• •Instagram and TikTok feeds on the home page, embedded through Elfsight. Loading them contacts Elfsight and the two platforms. If you would rather not, avoid the home page or block third-party content in your browser — nothing else on the site depends on them.
• •Google Maps, embedded on the contact page and on your order confirmation when you choose to collect, so you can find the practice. It is a Google frame and loads when the page does.
• •Cloudflare Turnstile on the contact and assessment forms, which checks that the sender is a person and not an automated script. When you submit a form, your IP address is sent to Cloudflare for that check alone.
• •The BoxNow locker picker in the shop checkout, shown only if you choose locker delivery, so you can pick a locker on their map.
• •Viva Payments for card payments. You are taken to Viva's own secure page to pay and returned afterwards; your card details are entered there and never reach this website or us.

Advertising with Google Ads

We advertise on Google and use Google Ads (Google Ireland Ltd) to measure which of our ads actually bring visits and enquiries. For this the website loads the Google tag, which tells Google when you open a page and when you complete one of these actions: sending the contact form, sending the DIY assessment form, booking an appointment, tapping our phone number, email address or a directions link to an office, and paying for an e-shop order (together with the order amount and number).

Google learns only that the action happened — not what you wrote. The content of our forms, and in particular your assessment answers and any health data, is never sent to Google.

Advertising cookies (such as _gcl_au, which lasts 90 days, and Google's own cookies on its domains) are set only if you click “Accept” in the cookie notice. The lawful basis is your consent (Article 6(1)(a) GDPR). If you click “Reject” or don't answer, no advertising cookie is set; the tag sends Google only anonymous, cookieless signals without any ad-click identifier (Google's “Consent Mode”), which Google uses for aggregate estimates. As with any connection to another company, Google sees your IP address.

You can change your choice at any time from the “Cookie settings” link at the bottom of every page. For how Google handles this data, see policies.google.com/privacy; you can manage personalised ads at adssettings.google.com.

Who has access

Contact and assessment submissions are delivered to our mailbox through the email provider that hosts our domain (Papaki / securemail.pro), within the European Union. They are read only by The Nutri Fixers. We do not sell your data, and what you write in our forms is never passed to anyone. The only information that reaches an advertiser is the Google Ads measurement described above.

Everything you send us — contact messages, assessment answers, orders — is stored in our practice management system at portal.thenutrifixers.gr, which we operate ourselves and which is hosted in the EU. The page counts described above are kept there too.

Transfers outside the EU

Form data stays within the EU. The website is hosted on Vercel; any related processing is governed by appropriate Standard Contractual Clauses (SCCs). Google Ads measurement data may be processed by Google LLC in the United States, under the EU–US Data Privacy Framework and Google's Standard Contractual Clauses.

Retention

We keep enquiry data for as long as needed to respond to and manage your request, and for a reasonable period if you become a client. Assessment forms are kept for as long as we are supporting you nutritionally, and deleted afterwards. You can request deletion at any time.

Your rights

Under the GDPR you have the right to:

• •Access your data
• •Rectify inaccurate data
• •Erasure (the 'right to be forgotten')
• •Restrict or object to processing
• •Data portability
• •Withdraw your consent at any time — for advertising cookies, from the “Cookie settings” link at the bottom of the page

Making a complaint

To exercise your rights, email contact@thenutrifixers.gr. If anything about the way your data is handled concerns you, please raise it with us first — you can write directly to Nikoleta Koulouri at nikoletakoulouri02@gmail.com and we will look into it.