Privacy policy

Last updated: 30 July 2026

1. Who processes your data

The controller of the personal data collected through this website is Huxia, Lda., with registered office at Rua dos Ferradores 39 B e C, Zona Industrial de Vilamoura, 8125-498 Quarteira, Portugal, corporate registration number 516 021 818, trading under the brand Zelthy Nutrition.

For any question about this policy, or to exercise your rights, write to wecare@zelthynutrition.com or to the address above.

2. What data we collect

What you give us directly: name, e-mail address, delivery and billing address, telephone number, tax identification number where requested for invoicing, and the content of the messages you send us.

Generated by your use of the store: order history, products viewed, cart contents, reviews you publish, and technical data such as IP address, device type, browser and pages visited.

Received from third parties: payment confirmation and the outcome of anti-fraud checks, from the payment provider. We neither receive nor store your full card details.

We do not intentionally collect special categories of data. We do not ask you about your health, and you should not include such information in the messages you send us. If you do so spontaneously, we process it only to reply to you and delete it as soon as it is no longer needed.

3. Why we use the data, on what basis and for how long

Purpose Data Lawful basis Retention
Processing, delivering and invoicing the order, including returns, guarantee and complaints Identification, tax number, contact, address, order, payment, related correspondence Performance of the contract, and legal obligation under tax and accounting law 10 years from the end of the year in which the invoice was issued
Managing the customer account Identification, contact, history Performance of the contract For as long as you keep the account. If you ask for deletion, we erase within 30 days, except data that tax law requires us to keep
Managing subscriptions and recurring charges Identification, contact, tokenised payment method Performance of the contract While the subscription is active. Each delivery follows the retention applied to orders
Answering customer support requests Contact and content of the message Legitimate interest in providing support 3 years
Sending marketing communications Name, e-mail, purchase history Consent; or legitimate interest for our own customers in relation to similar products Until consent is withdrawn. Profiles with no interaction at all are suppressed after 3 years
Publishing product reviews Name or pseudonym, review content, link to the order Consent For as long as the review remains published
Preventing fraud and keeping the store secure Technical data, order, payment Legitimate interest in protecting the business 2 years
Measuring audience and improving the website Technical and browsing data Consent (non-essential cookies) See Cookie Policy
Advertising and remarketing Browsing and device identifiers Consent See Cookie Policy

Once the period has elapsed, the data is deleted or irreversibly anonymised.

Are you obliged to give us this data?

It depends on the purpose.

Identification, contact and address data are necessary for us to enter into the contract with you. Without them we cannot accept or deliver the order. You are not obliged to provide them, but we will not be able to sell you the product.

The tax identification number is required by legal obligation when you ask for an invoice showing it.

Everything else is optional. Not subscribing to the newsletter, not creating an account or refusing non-essential cookies has no consequence whatsoever for your purchase, the price you pay or the service you receive.

4. Who we share it with

We do not sell your personal data.

We share only what is necessary, and only with those who process the data on our behalf and on our instructions:

  • Shopify, which hosts the store and processes orders and payments.
  • Carriers, to make the delivery: Nacex, CTT Expresso and UPS.
  • Klaviyo, for marketing communications and transactional marketing e-mails.
  • Judge.me, for collecting and publishing product reviews.
  • Seal Subscriptions, for subscription management.
  • GemPages, for building and displaying pages.
  • Pandectes, for cookie consent management and the record of that consent.
  • UpPromote, for the affiliate programme.
  • Meta, Google and TikTok, for audience measurement and advertising, only where you have given consent.
  • Certified accountants, for compliance with tax obligations.

We also share where the law requires it, in particular with tax, judicial or supervisory authorities.

5. Transfers outside the European Economic Area

Some of the providers listed above are established outside the European Economic Area, notably in the United States. In those cases, the transfer relies on an adequacy decision of the European Commission, where one applies to the provider, or on Standard Contractual Clauses approved by the Commission, together with supplementary measures.

You may ask us for a copy of the applicable safeguards using the contact details in section 1.

6. Your rights

You have the rights of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, write to wecare@zelthynutrition.com or use the Personal data request page. We reply within one month, extendable by two months for complex requests, in which case we will tell you.

We may ask you for additional information to confirm your identity, but only where there are reasonable doubts as to who is making the request.

Right to object to direct marketing

You have the right to object, at any time and without giving any reason, to the processing of your data for direct marketing purposes, including profiling related to that marketing. If you do so, we stop processing your data for that purpose immediately.

Simply click «unsubscribe» in any message we send you, or write to wecare@zelthynutrition.com.

Complaint to the supervisory authority

If you consider that the processing of your data breaches the law, you may lodge a complaint with:

Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority
Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon, Portugal
www.cnpd.pt

7. Cookies and similar technologies

The use of cookies and similar technologies is described in our Cookie Policy, where you can also change or withdraw your consent at any time.

8. Automated decision-making

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

We do carry out segmentation for marketing purposes, grouping customers by criteria such as purchase history or interest in product categories. That segmentation relies on your consent and you may object to it at any time.

9. Children

The store is not directed at children under 16 and we do not knowingly collect their data. If we become aware that we have collected data from a child without the authorisation of the holder of parental responsibility, we delete it.

10. Security

We adopt appropriate technical and organisational measures to protect your data, including encryption in transit, access control and the use of providers offering adequate guarantees. In the event of a data breach likely to result in a high risk to your rights, we will inform you without undue delay, in accordance with Article 34 of the GDPR.

11. Changes to this policy

We may update this policy. The version in force is always the one published on this page, with the update date shown at the top. Substantial changes will be communicated to customers with an active account.