Privacy Policy
§ 1 Controller
SWADN GmbHFriedrich-Ebert-Anlage 36
60325 Frankfurt am Main
Germany
Email: Suneel.Durgavajhala@swadn.com
A data protection officer has not been appointed; this is not legally required.
§ 2 Data processed and purposes
2.1 Registration and authentication
To create a user account, we process your first name, last name, email address and, optionally, your phone number. Authentication is performed by means of an encrypted authentication token.
Legal basis: Article 6(1)(b) GDPR (performance of a contract)
Retention: Until you delete your account
Providing this data is necessary to set up and use a user account (Article 13(2)(e) GDPR). Without it, no account can be provided. Providing dietary and health data (see § 2.3) is, by contrast, voluntary.
2.2 Age verification and age information
During registration we collect your date of birth in order to verify the statutory minimum age of 18. The day and month of the date of birth are not stored after the check.
From the date of birth we derive only the year of birth and store it. Age is a necessary component of our personalised nutrition service, as it materially determines calorie and nutrient requirements; without this information the service cannot be provided in the contractually agreed, personalised form. Storing only the year rather than the full date of birth reflects the principle of data minimisation (Article 5(1)(c) GDPR).
Legal basis for age verification: Article 6(1)(c) GDPR (legal obligation)
Legal basis for storing the year of birth: Article 6(1)(b) GDPR (performance of a contract)
Retention of the year of birth: Until you delete your account
2.3 Personalised dietary recommendations
For the AI-assisted dietary recommendations we process the year of birth derived from your date of birth (see § 2.2) as well as dietary preferences, dietary goals and any intolerances or allergies that you voluntarily provide.
Where such information constitutes health data within the meaning of Article 9 GDPR (e.g. medically motivated dietary restrictions), it is processed solely on the basis of your explicit consent (Article 9(2)(a) GDPR). This consent can be withdrawn at any time; withdrawal does not affect the lawfulness of processing carried out before it.
Legal basis: Article 6(1)(b) GDPR; Article 9(2)(a) GDPR for health data
Retention: Until you delete your account or withdraw your consent
Processing for the AI recommendations takes place exclusively on servers within the European Economic Area (EEA).
No automated decision-making in individual cases: The AI-assisted recommendations are non-binding suggestions. There is no solely automated decision producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22(1) GDPR.
The recommendations do not replace medical advice and do not constitute a medical service.
2.4 Server logs
When the website is accessed, our servers automatically log: IP address (shortened), the URL requested, the HTTP status code, and the time of access.
Legal basis: Article 6(1)(f) GDPR (legitimate interests: operational security and troubleshooting)
Retention: 3 days (automatic deletion)
§ 3 Processors (Article 28 GDPR)
We use the following categories of processors, with each of which a data processing agreement pursuant to Article 28 GDPR is in place:
| Recipient category | Purpose | Server location |
|---|---|---|
| Hosting provider | Hosting and delivery of the website | Frankfurt am Main, Germany (EEA) |
| Authentication provider | User authentication | Ireland (EEA) |
| Database provider | Storage of account and profile data | Frankfurt am Main, Germany (EEA) |
| AI infrastructure provider | Processing of the AI recommendations | Netherlands (EEA) |
All personal data is stored and processed on servers within the European Economic Area. Some processors belong to corporate groups headquartered in the USA. Insofar as this may, in individual cases, entail access from a third country, such access is safeguarded by EU Standard Contractual Clauses (SCC) pursuant to Article 46(2)(c) GDPR and — where applicable — by certification under the EU-US Data Privacy Framework (DPF).
§ 4 Retention periods
| Data | Retention period |
|---|---|
| Account data (name, email, preferences) | Until the account is deleted |
| Date of birth — day and month | Not stored (used only for age verification) |
| Year of birth (dietary profile) | Until the account is deleted |
| Server logs | 3 days (rolling deletion) |
§ 5 Rights of data subjects
Data subjects have the following rights vis-à-vis SWADN GmbH:
- Access to the data processed (Article 15 GDPR)
- Rectification of inaccurate data (Article 16 GDPR)
- Erasure of data (Article 17 GDPR)
- Restriction of processing (Article 18 GDPR)
- Data portability (Article 20 GDPR)
- Objection to processing based on Article 6(1)(f) GDPR (Article 21 GDPR)
- Withdrawal of consent given, with effect for the future (Article 7(3) GDPR)
To exercise these rights, please contact: Suneel.Durgavajhala@swadn.com
§ 6 Right to lodge a complaint (Article 77 GDPR)
Data subjects have the right to lodge a complaint with the competent data protection supervisory authority:
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
datenschutz.hessen.de
§ 7 Changes to this policy
We reserve the right to amend this Privacy Policy where necessary. The current version is available at this URL at all times. In the event of material changes, we will inform registered users by email.
This is an English translation provided for convenience. In case of any discrepancy, the German version prevails.