Privacy Policy
Last updated: 11 July 2026 · In case of any discrepancy, the Slovak version prevails.
1. Controller
The controller is Healthy fresh box s.r.o., Smaragdová 1944/5, 900 46 Most pri Bratislave, Slovakia, Company ID (IČO): 56192932, Tax ID (DIČ): 2122235522, VAT ID: SK2122235522, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No.: 177674/B.
Privacy contact: info@healthyfreshbox.sk, phone +421 902 179 235. We process personal data in accordance with GDPR (EU) 2016/679 and Slovak Act No. 18/2018 Coll.
2. Orders and contract performance
Data: name, phone, e-mail, delivery address, chosen program, variant and period; optionally an order note and a referring customer's surname.
Purpose: receiving and fulfilling orders, delivery, order-related communication, recording pauses and changes. Legal basis: contract performance or pre-contractual measures (Art. 6(1)(b) GDPR).
Retention: for the duration of the customer relationship and 5 years after the last order.
3. Accounting and tax documents
Billing data are processed to comply with legal obligations (Art. 6(1)(c) GDPR) under the Accounting Act No. 431/2002 Coll. and tax law. Retention: 10 years following the relevant year. Recipients: tax authorities and public bodies during inspections.
4. Complaints
Identification and contact data and the subject of the complaint are processed under the Consumer Protection Act No. 250/2007 Coll. Retention: 5 years after resolution.
5. Allergy information
Allergy information is provided voluntarily so that we can prepare your meals safely; by providing it you consent to its processing for this purpose. Consent may be withdrawn at any time.
6. Customer referral
A referring customer's surname is processed solely to verify discount eligibility, based on legitimate interest (Art. 6(1)(f) GDPR), and is not used for any other purpose after verification.
7. Contact and pause forms
Data from the contact form (name, e-mail, message) and the pause form (name, phone, e-mail, pause period) are processed to handle the request — legal basis: contract performance or pre-contractual measures. Retention: 1 year after resolution.
8. Data subject requests
Records of data subject rights requests (Arts. 15–22 GDPR) are kept for 1 year after resolution.
9. Recipients
We do not sell data or share it for marketing. We deliver exclusively ourselves — delivery data never leaves our company.
Processors: our e-mail service provider (Websupport s.r.o.) and our web application hosting provider (Vercel Inc.). Once you consent to cookies, our measurement-tool providers Google Ireland Limited (Google Analytics 4) and Meta Platforms Ireland Limited (Meta Pixel) also process data, each under their own privacy policy — see section 12. Public authorities may receive data where required by law.
No transfers outside the EU/EEA beyond GDPR safeguards; no automated individual decision-making or profiling.
10. Security
We apply appropriate technical, organisational and personnel measures to ensure confidentiality, integrity and availability, including encrypted communication (HTTPS), access control and incident-recovery procedures, and we review them regularly.
11. Your rights
You have the right to: access and obtain a copy of your data; rectification; erasure (unless statutory retention applies); restriction of processing; data portability in a machine-readable format (contract/consent bases); objection to processing based on legitimate interest; and withdrawal of consent where processing is based on consent.
Exercise your rights in writing or by e-mail at info@healthyfreshbox.sk. You may also lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava (dataprotection.gov.sk).
13. Marketing
We do not send newsletters or marketing messages. Should this change, we will ask for your consent first.