Last updated: 23 June 2026.
1. Data controller
The data controller is MYNUTRILAB, a société par actions simplifiée à associé unique (SASU) whose registered office is at 12 rue du Charme, 93240 Stains, France. General contact: contact@mynutrilab.com. Data protection contact: dpo@mynutrilab.com.
2. Data collected
- Identity and contact details: surname, first name, address, e-mail, telephone.
- Account: login credentials, connection history, preferences and saved formulas.
- Order: products, composition, nominal dosage, format, flavour, price, promotions, subscription, invoices, returns and complaints.
- Payment: status, transaction identifier, means used and anti-fraud information; MYNUTRILAB does not receive the full card number.
- Delivery: address, pickup point, tracking and transport incidents.
- Customisation: weight, sport practised, sporting goal, desired stimulation level, formula proposed, formula confirmed and answers to the questionnaire.
- The questionnaire is not designed to collect diagnoses, medical conditions, treatments, pregnancy information, allergies or other medical data. Customers are asked not to enter such information.
- Customer service: messages, attachments, records of the actions taken and the outcome.
- Browsing: IP address, device, browser, pages viewed and trackers, depending on cookie choices.
- Marketing: proof of consent or objection, opening of and interaction with campaigns where the law allows it.
- Reviews: rating, text, product concerned, verified purchase status and moderation data.
3. Why, and on what legal basis?
| Purpose | Main legal basis | Recommended retention period / criterion |
|---|---|---|
| Creating and managing the account | Performance of the contract | Until the account is deleted or 3 years after the last activity, save where archiving is necessary. |
| Configuring, manufacturing and retrieving a formula | Pre-contractual measures and performance of the contract. The questionnaire is not intended to collect health data. | Formula and traceability data: for as long as is necessary for the contract, for safety and for the defence of legal rights; detailed sensitive answers: 12 months after the last interaction, unless withdrawn earlier or a demonstrated need exists. |
| Handling payment, delivery, returns and after-sales service | Performance of the contract; legal obligations; legitimate anti-fraud interest | Duration of the relationship, then evidential archiving for up to 5 years; accounting documents and invoices for up to 10 years. |
| Ensuring traceability, managing a recall or a product incident | Legal obligation and legitimate safety interest | A period matched to the shelf life of the batch, to traceability obligations and to limitation periods. |
| Responding to requests and complaints | Performance of the contract or legitimate interest | Until closure, then archiving for up to 5 years depending on the litigation risk. |
| Sending offers by e-mail or SMS | Consent, save where a strictly applicable legal exception applies | Until withdrawal or 3 years after the last active contact; proof of objection kept in order to prevent any further approach. |
| Measuring audience and personalising advertising | Consent for non-essential trackers | In accordance with the cookie policy; trackers in principle for a maximum of 13 months, with consent choices renewed periodically. |
| Preventing misuse and securing the site | Legitimate interest and security obligations | Logs kept for a proportionate period, generally 6 to 12 months, save in the event of an incident. |
| Publishing and moderating reviews | Consent or legitimate interest depending on the arrangement | For the duration of publication, then archiving limited to evidence and the handling of disputes. |
4. Customisation questionnaire and artificial intelligence
The questionnaire asks for weight, sport, goal and desired stimulation level in order to propose a customised formula. Certain answers are transmitted in pseudonymised form to Anthropic in order to generate a proposal using Claude Haiku. MYNUTRILAB does not transmit the Customer’s name, e-mail address or order number.
The answers and formulas are stored in Shopify, linked to the account, and can be viewed and re-used. They are deleted when the account is deleted, apart from items necessary for traceability, for legal obligations or for the defence of legal rights.
5. Automated customisation and human involvement
The proposal combines automatic rules and Claude Haiku. It does not, on its own, produce legal effects or similarly significant effects: the Customer can view it, modify it or refuse it. Automatic rules check its consistency and a person verifies each formula before manufacture.
6. Recipients and service providers
The data is accessible only to those who need it and may be passed on to the following categories:
- Shopify and its affiliated companies for hosting, the account, the basket, payment, security and Shopify Network Intelligence, which is enabled on the store.
- Payment providers and wallets: Shopify Payments and its processors where that service is used, PayPal, Apple Pay, Google Pay and Shop Pay.
- Carriers and pickup point networks, selected to fulfil the order, according to the options displayed at checkout.
- Shopify Subscriptions for the management of instalments, changes, suspensions and terminations.
- Anthropic, via the Claude Haiku API, receives the weight, the sport, the goal and the stimulation level without name, e-mail or order number. The responses are stored in Shopify.
- Klaviyo for e-mails and SMS; Shopify Messaging and Shopify Forms for messages, forms and notifications.
- Judge.me for reviews. Reviews imported from the former site are kept together with proof of purchase, published automatically and then moderated following a report; negative reviews are published as well.
- Shopify Analytics, Microsoft Clarity, Meta/Facebook and Instagram, Google and YouTube, TikTok and Wishlist Plus, depending on cookie choices and the configuration of the store.
- The laboratory, the packer, and quality or product recall providers, to the extent necessary and according to their respective roles.
- Advisers, insurers, authorities and courts where an obligation or the defence of legal rights so requires.
MYNUTRILAB does not sell personal data. Every processor must be bound by a contract compliant with Article 28 of the GDPR and must process the data only on instructions, except where it acts as an independent controller for its own obligations.
7. Transfers outside the European Economic Area
Shopify and certain providers may process data in Canada, in the United States or in other countries. Where the country does not benefit from an applicable adequacy decision, the transfer must be governed by a recognised mechanism, in particular the European Commission’s standard contractual clauses, together with the necessary supplementary measures.
8. Cookies
Cookies strictly necessary for the operation of the basket, security, payment and privacy choices may be placed without consent. Non-exempt audience measurement, advertising or personalisation cookies are only placed after consent has been given. Refusing must be as easy as accepting. Choices can be changed via “Cookie preferences”. For further details, see the Cookie Policy.
9. Your rights
Subject to the conditions laid down by the GDPR, you may request access to your data, its rectification or erasure, the restriction of processing and data portability, object to certain processing operations, withdraw your consent at any time and give directions as to what is to happen to your data after your death. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.
Send your request to dpo@mynutrilab.com or by post to MYNUTRILAB, 12 rue du Charme, 93240 Stains, France. Proof of identity may be requested only in the event of reasonable doubt and in a proportionate manner. A response is provided within the legal time limit. You may also lodge a complaint with the CNIL.
10. Security
MYNUTRILAB implements appropriate technical and organisational measures, in particular access management, authentication, encryption of communications, backups, data minimisation and incident management. No system, however, offers absolute security. In the event of a breach presenting a risk, the notifications provided for by the GDPR are made.
11. Minors
The site is not specifically aimed at children. An unemancipated minor must hold the authorisation of their legal representative where such authorisation is required. For a marketing sign-up by a person under the age of fifteen, the joint consent of the minor and of their legal representative is required. MYNUTRILAB does not currently ask for age in its forms.
12. Updates to this policy
This policy may be updated to reflect changes in processing operations, in service providers or in the law. A significant change is notified in an appropriate manner. The date shown at the top indicates the version in force.
