Privacy policy
Last updated: 09/30/2025
We place particular importance on the protection of your personal data. This policy describes the processing we carry out, your rights, and the measures put in place to guarantee the security and confidentiality of your information.
1. Data Controller
Company N LAB – SAS - Chairman / legal representative: Théo Copolata - Share capital: €13,256.22 - Registered office: 38 rue de Berri, 75008 Paris, France - Paris Trade Register (RCS): 845 402 494 - Intra-EU VAT number: FR01845402494 - Contact: [email protected] | +33 1 59 58 07 94 - Website: www.nutrimuscle.com
The data controller is Nutrimuscle / CDO for all customer and prospect data.
DPO contact: [email protected]
2. Data Collected and Purposes
| Purpose | Data collected | Legal basis | Sub-processors | Retention period | Processing location |
| Customer order management | Identity, orders, addresses, emails | Contract performance | Shopify, PayPlug, PayPal, Shopify Payment | 5 years after last order | EU / Canada / USA |
| Newsletters & offers | Email, first name, opening behavior | Consent (opt-in) | Klaviyo, Yotpo, Shopify | 3 years or until unsubscribed | EU / USA |
| Purchasing behavior analysis & BI | Orders, browsing, pseudonymized data | Legitimate interest | Fivetran, Google BigQuery, Tableau, Content Square, Webyn | 3 years | France / EU / USA |
| Customer support | Identity, content, order history | Legitimate interest | Gorgias, Shopify, iAdvise Chat | 3 years | EU / USA |
| Loyalty program | Identity, email, order history, loyalty points | Contract performance / Legitimate interest | Yotpo, Shopify | 3 years after last activity | EU / USA |
| Abandoned cart follow-up | Email, first name, product cart | Legitimate interest / Consent | Klaviyo, Shopify | 13 months | EU / USA |
| Predictive marketing / marketing targeting | Orders, browsing, segmentation, email | Legitimate interest | Fivetran, BigQuery, Klaviyo | 3 years | EU / USA |
| Merchandising / email personalization | Browsing, order history, preferences | Legitimate interest | Nosto, Webyn, Klaviyo | 3 years | EU / USA |
| Product recommendations | Orders, browsing, preferences | Legitimate interest | Nosto, Webyn, BigQuery | 3 years | EU / USA |
| B2B sales | Identity, contact details, orders | Contract performance | Salesforce / ERP | 10 years | EU |
| Customer service information | Identity, orders, tickets, emails | Legitimate interest | Gorgias, Shopify, iAdvise Chat | 3 years | EU / USA |
| SEO / SEA / targeted advertising | Anonymized identifiers, behavior | Legitimate interest | Semrush, Google Ads, Meta Ads, TikTok Ads, Snapchat Ads | 3 years | EU / USA |
3. Cookies and Tracking
We use cookies and tracking tools for:
- Analytics and improving the user experience (Google Analytics, Content Square, Tableau)
- Personalizing display and recommendations (Nosto, Webyn)
- Marketing and targeted advertising (Klaviyo, Google Ads, Meta Ads, TikTok Ads, Snapchat Ads)
Retention period: 13 months for marketing and personalization cookies. You can manage your preferences via the site's cookie banner.
- Managed via a GDPR/EU-compliant banner
- Categories: necessary, performance, marketing, social media
- Consent required for marketing cookies and tracking
- Consent can be changed or withdrawn at any time
- More information at Cookie Policy
4. Transfers Outside the EU
Some data is processed by service providers located outside the EU (USA, Canada, Israel). These transfers are governed by Standard Contractual Clauses (SCC) or DPAs to guarantee a level of protection equivalent to that of the EU.
5. Data Security
We implement the following measures:
- Encryption of data in transit and at rest (HTTPS, SSL, AES)
- Access control and strong authentication (2FA, IAM management)
- Audit logs and network monitoring
- Pseudonymization for analytical data
6. Your Rights
In accordance with the GDPR, you may:
- Access your personal data
- Request rectification or deletion
- Obtain portability of your data
- Object to certain processing or withdraw your consent
- File a complaint with the CNIL
To exercise your rights : [email protected]
7. Changes to This Policy
This policy may be updated regularly. The latest version will always be available on the site.
8. Contact
For any question regarding personal data or the exercise of your rights: - Email: [email protected] - Phone: +33 1 59 58 07 94 - Address: 38 rue de Berri, 75008 Paris, France