Privacy Policy

Nutris Ingredients & Functional Gummies — Last updated: May 2026

1. Data Controller

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR), Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and other applicable data protection legislation, we hereby inform you of the following:

Data Controller: Nutris We Care About You S.L. (trading as Nutris Ingredients & Functional Gummies)

Tax ID (CIF): B28563047

Registered address: C/ Marzo 58, 28022 Madrid, Spain

Registered in: Mercantile Registry of Madrid. Volume 27,322, Book 0, Page 206, Section 8, Sheet M-104.289, Entry 1

Factory: Ctra. de Pinto, km 0,700, 28320 Pinto, Madrid, Spain

Phone: +34 910 325 627

Email: info@nutris.es

Website: www.nutris.es

2. Processing Activities, Purposes, Legal Basis and Retention

2.1 Contact and Brochure Request Forms

When you complete a contact or brochure download form on our website, we collect the following personal data: name, phone number, email address, and your acceptance of this Privacy Policy.

Purpose: To respond to your enquiry, send you the requested product documentation, and, with your consent, send you commercial communications about Nutris products and services.

Legal basis: Execution of pre-contractual measures at your request (Art. 6.1.b GDPR) and your freely given, specific, informed and unambiguous consent (Art. 6.1.a GDPR) for commercial communications.

Retention: For the duration of the commercial relationship and up to 3 years after its termination, or until you withdraw your consent for commercial communications.

2.2 Newsletter Subscription

If you subscribe to our newsletter on our website, we collect your name, email address, and company name, as well as optional preference data (area of interest, preferred language, and region) provided through our subscription preferences form.

Purpose: To send you news, updates, and information about Nutris and the nutraceutical sector, personalised according to your stated preferences.

Legal basis: Your freely given consent (Art. 6.1.a GDPR). You may unsubscribe at any time using the link included in every email.

Retention: Until you withdraw your consent or unsubscribe.

2.3 Job Applications (Careers)

Through the Careers section of our website, candidates may submit their application for open positions at Nutris. We collect personal data included in the CV and any accompanying documents, which may include: name, contact details, professional experience, educational background, skills, and other information voluntarily provided by the candidate.

Purpose: To evaluate your suitability for current or future positions within Nutris and to manage the recruitment process.

Legal basis: Pre-contractual measures at your request (Art. 6.1.b GDPR) and, where applicable, your consent for retention of your CV for future vacancies (Art. 6.1.a GDPR).

Retention: For the duration of the selection process. If no position is offered, CVs will be retained for a maximum of 12 months, after which they will be securely deleted unless you renew your consent.

Candidates must not include special categories of data (e.g. health, political opinions, religious beliefs) in their application unless strictly required by the role and explicitly requested by Nutris.

2.4 Ethical Channel

The Ethical Channel is a confidential reporting mechanism available to employees, external collaborators, clients, suppliers, and any other interested party, allowing them to report concerns or irregularities related to our Code of Ethics. This channel is governed by Law 2/2023 of 20 February on the protection of persons who report regulatory infringements and anti-corruption measures (the Whistleblowing Act).

Purpose: To receive, manage, investigate, and resolve reports of possible violations of Nutris’s Code of Ethics, internal policies, or applicable legal obligations.

Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR) pursuant to Law 2/2023; and, where reports involve special categories of data, substantial public interest (Art. 9.2.g GDPR).

Confidentiality: The identity of the reporting person will be treated with strict confidentiality and will only be disclosed to investigating authorities where legally required. Anonymous reports are accepted.

Retention: Reports and related personal data will be retained for no longer than 3 months from the date of receipt unless an investigation is opened, in which case they will be retained for the duration of the investigation and any subsequent legal proceedings.

The Ethical Channel is managed through the platform at nutris.factorial.es/complaints. For detailed information, please refer to the specific Privacy Policy of the Internal Information System, available in the Documentation & Policies section of the Ethical Channel page.

2.5 Website Browsing and Cookies

When you visit our website, certain technical and analytical data may be collected automatically through cookies and similar technologies, including IP address, browser type, pages visited, and time spent on the site.

Purpose: To ensure the proper functioning of the website, analyse traffic and user behaviour, and improve the user experience.

Legal basis: Legitimate interest for strictly necessary cookies (Art. 6.1.f GDPR); consent for analytical and marketing cookies (Art. 6.1.a GDPR).

Retention: As specified in our Cookies Policy.

3. Recipients and International Transfers

Your personal data will not be sold, rented, or transferred to third parties except in the following circumstances:

Dinahosting S.L. (Spain) — web hosting provider acting as data processor. Processes personal data incidentally as part of hosting services for nutris.es.
Brevo SAS (France, within the EEA) — email marketing and newsletter platform acting as data processor. Processes subscriber data for newsletter delivery and management. Brevo is subject to French and EU data protection law.
Factorial HR — HR and ethical channel platform acting as data processor for job applications and whistleblowing reports submitted through nutris.factorial.es/complaints.
Public authorities or law enforcement agencies where required by law or court order.
In the context of the Ethical Channel, the platform provider (Factorial) acts as a data processor. Notifications may be communicated to competent authorities where legally required under Law 2/2023.

Where service providers are located outside the European Economic Area (EEA), Nutris ensures that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR), or that the transfer is made to a country with an adequacy decision (Art. 45 GDPR).

4. Your Rights

Under the GDPR and applicable Spanish data protection law, you have the following rights in relation to your personal data:

Right of access (Art. 15 GDPR): to obtain confirmation of whether we process your data and, if so, to receive a copy.
Right to rectification (Art. 16 GDPR): to request correction of inaccurate or incomplete data.
Right to erasure / ‘right to be forgotten’ (Art. 17 GDPR): to request deletion of your data where no longer necessary for the purpose collected, or where you withdraw consent.
Right to restriction of processing (Art. 18 GDPR): to request that processing is limited in certain circumstances.
Right to data portability (Art. 20 GDPR): to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to object (Art. 21 GDPR): to object to processing based on legitimate interests, including direct marketing.
Right to withdraw consent (Art. 7.3 GDPR): where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.
Right not to be subject to automated decisions (Art. 22 GDPR): Nutris does not make decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, please send a written request to info@nutris.es, including a copy of your national identity document or equivalent identification. We will respond within one month of receipt of your request, which may be extended by a further two months where necessary.

If you consider that we have not addressed your request appropriately, you have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos, AEPD) at www.aepd.es, or with the supervisory authority of your country of residence within the EU.

5. Security Measures

Nutris We Care About You S.L. has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Art. 32 GDPR. These measures include encryption of data in transit (TLS/SSL), access controls and authentication mechanisms, regular security assessments, staff training on data protection, and data minimisation and pseudonymisation where applicable.

In the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of individuals, Nutris will notify the affected data subjects without undue delay, in accordance with Art. 34 GDPR.

6. Minors

Our website and services are not directed at individuals under the age of 14. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data without verified parental consent, we will take steps to delete such data promptly. If you believe a minor has submitted data to us, please contact us at info@nutris.es.

7. Consent and Withdrawal

Where processing is based on your consent, you have the right to withdraw it at any time without prejudice to the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent will not affect the provision of services not dependent on it.

To withdraw consent for commercial communications, you may use the unsubscribe link in any email we send, or contact us directly at info@nutris.es.

8. Updates to This Privacy Policy

This Privacy Policy may be updated periodically to reflect changes in applicable law, our processing activities, or our organisational structure. The date of the last update is indicated at the top of this document. We encourage you to review this policy regularly. Where changes are material, we will notify you by email or through a prominent notice on our website.

9. Contact

For any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data, please contact us: