PRIVACY POLICY

We take your privacy seriously. This Privacy Policy explains how Geneto OÜ (we) treats the Personal Data processed when using the Services. Unless specified differently herein, Personal Data should be understood broadly, including also Sensitive Personal Data and Genetic Data. The Privacy Policy does not apply to entities that we not own or control, or persons that we do not employ or manage. Unless defined differently herein, all capitalised terms should be defined as in our Terms of Service.

1. Responsible Person

The Services are owned, operated and offered by Geneto OÜ, a private limited company incorporated in the Republic of Estonia, registry code 14091673, address Narva mnt 3/9, 51009 Tartu, Republic of Estonia, who is responsible for the processing of your Personal Data.

2. Collecting Your Personal Data

We may collect the following Personal Data in the following ways:

You may provide us your Personal Data yourself upon:

• registration via Facebook (e.g. name, image, email),
• contacting us (e.g. name, contact details, content of your message, etc),
• or otherwise using the Services (e.g. age, height, weight, level of activity, Genetic Data, etc).

Please note that the latter may also include, either alone or in combination with other Personal Data, Sensitive Personal Data. First and foremost, the Genetic Data transmitted to us is considered Sensitive Personal Data. Also other information you may choose to provide us may be considered Sensitive Personal Data as it may be related to your state of health or disability, or reveal your ethnic or racial origin. Sensitive Personal Data may also be included in the Results. We only use your Sensitive Personal Data upon your prior consent.

Note that we only require the provision of some Personal Data upon registration or contacting us (e.g. your name and e-mail address). The provision of other Personal Data, especially Sensitive Personal Data, and the consent for the processing thereof, is voluntary.

We also collect certain data by automated means (e.g. nutrition, sports tracking, weight data, etc).

3. Using Your Personal Data

We may use your Personal Data for the following purposes:

• to perform our obligations under the Agreement, i.e. to provide the Services, including to analyse the Genetic Data together with other Sensitive Personal Data and create the Results,
• to contact you regarding the Services,
• to provide assistance regarding the Services,
• to collect feedback regarding the Services,
• to personalise the Services, monitor and analyse the effectiveness of the Services,
• to exercise any rights and obligations arising from the law.

We use your Personal Data for any other purposes only with your prior consent.

4. Service Providers (Data Processors)

We may use service providers (data processors) in processing your Personal Data. In doing so, we remain responsible for your Personal Data and take all necessary measures to protect your Personal Data. One of those service providers is Amazon who provides us data hosting services.

5. Disclosing Your Personal Data

We only disclose your Personal Data to third parties without your prior consent if and as provided in the Privacy Policy, our Terms of Service, or the law. We may disclose your Personal Data to the following third parties:

• Local service providers, who have concluded resale agreement for our services.
• an acquirer, or successor or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets,
• supervisory authorities,
• our lawyers, auditors, accountants.

We are not responsible for when you yourself decide to disclose your Personal Data to third parties or the public. Please note that the Results may include Sensitive Personal Data and you should therefore handle the further distribution of the Results with care.

6. International Data Transfers

We (including our service providers) do not transfer or store your Personal Data in any third country outside the EU.

7. Data Retention

We only store your Personal Data as long as necessary for the purposes of the collected data and as long as required by applicable law (e.g. for tax purposes). In general, we store your Personal Data as follows:

• Genetic Data – until the client has writtenly asked us to delete his or her genetic data,
• Personal Data needed for tax and bookkeeping purposes - 7 years from the end of the financial year when the relevant data was provided to us,
• Personal Data related to the fulfilment of the Agreement – 10 years (in accordance with the maximum period for raising claims from transactions),
• other Personal Data – until your Account is terminated.

At the end of the retention period, we have the right to permanently delete your data from our databases. Please make sure that you have a copy of the Genetic Data and the Results saved for your own purposes if needed. Please note that deleting the data from our backup databases may take a bit longer.

8. Security

We implement appropriate organisational, technical and physical safeguards to protect your Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access and against all unlawful forms of processing.

Regardless of the foregoing, you should also exercise proper care and security measures yourself and prevent any unauthorised persons from accessing your device containing your Personal Data. You should be especially careful in protecting your Sensitive Personal Data, including Genetic Data, as disclosing thereof may bring about serious consequences for you.

9. Your Rights

You have all the rights of a data subject as provided in the applicable law. This includes the right to obtain information and Personal Data concerning you and to demand the correction of inaccurate Personal Data. If processing of Personal Data is not permitted on the basis of law, you have the right to demand termination of the processing of the Personal Data, termination of the disclosure or enabling access to the Personal Data and/or deletion or closure of the collected Personal Data. You also have the right to turn to the Data Protection Inspectorate or the court to safeguard your rights.

Please note, however, that this does not apply to any processing done by any other entities besides us. You should familiarise yourself with the data processing practices of any other entities that process your data, including your rights therein.

10. Direct Marketing

We only send you direct marketing messages upon your prior consent. You have the right at any time to refuse from receiving any further direct marketing messages by clicking on the ‘unsubcribe link’ at the end of each message or by contacting us at: info@geneto.com

11. Changes to this Privacy Policy

Should we decide to make changes to this Privacy Policy we will notify you thereof as provided in the Terms of Service. Such changes may be a result of changes in the applicable law or in our data processing practices.

12. Personal Data in the User Content

Note that if your Content includes any personal data of others, you are solely responsible for such personal data and considered the data controller thereof. We, on the other hand, act in the capacity of the data processor as regards such personal data.

13. Deleting Personal Data

You can delete your Personal Data from our mobile app under My account view (clicking on cog icon) or by writing to our customer support: info@geneto.com.

14. Contact

If you have any questions, comments, complaints or requests related to the Privacy Policy or the processing of your Personal Data, you can contact us via: info@geneto.com