Privacy Policy

NUTR8™ (“we”, “us”, or “the Company”) respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy explains our practices in respect of the collection, use, disclosure, and retention of personal data, and the rights available to you under the Jamaican Data Protection Act, 2020 (JDPA), applicable United States state privacy laws (including the California Consumer Privacy Act, as amended by the CPRA), and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

By accessing this website or subscribing to our services, you acknowledge that your personal data will be processed in accordance with this Policy.

Company Contact

NUTR8™ is the data controller responsible for your personal data. For any privacy-related enquiry, you may contact us using the details below:

• Company Name: [PLACEHOLDER — Legal Entity Name]
• Registered Address: [PLACEHOLDER — Registered Office Address, Jamaica]
• General Email: [PLACEHOLDER — privacy@nutr8.com]
• Telephone: [PLACEHOLDER — +1 (876) XXX-XXXX]

Data Protection Officer (DPO)

Our Data Protection Officer oversees compliance with this Policy and applicable data protection law. To exercise any right under this Policy, or to raise a complaint, contact the DPO directly:

• DPO Name: [PLACEHOLDER — Data Protection Officer Name]
• DPO Email: [PLACEHOLDER — dpo@nutr8.com]
• Postal Address: [PLACEHOLDER — As above, marked for the attention of the DPO]

We collect the following categories of personal data:

• Identification & Contact Data: name, email address, postal address, and telephone number submitted via the contact or newsletter forms.
• Account Data: email and password where you create an account to manage a subscription.
• Communication Data: the contents of enquiries, reviews, and messages you send us.
• Technical & Usage Data: IP address, browser type, device type, pages visited, and approximate location derived from your device.
• Location Data: device geolocation used only to display nearby stockists when you activate the “Find Near Me” feature.
• Marketing Data: your preferences in receiving marketing and your engagement with our communications.

We do not collect special categories of personal data (such as health, racial origin, or biometric data) unless you voluntarily provide it.

We process your personal data for the following lawful purposes:

• Performance of a contract: to set up and manage subscriptions and deliver order confirmations.
• Consent: to send you newsletters and marketing communications you have opted into.
• Legal obligation: to comply with Jamaican, US, and Canadian tax, consumer-protection, and record-keeping laws.
• Legitimate interests: to operate, secure, and improve the website, prevent fraud, and analyse usage trends.

We will not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

We retain personal data only as long as necessary for the purposes set out in this Policy and to satisfy legal, accounting, or reporting requirements:

• Newsletter / marketing data: retained until you unsubscribe, or for a maximum of 24 months of inactivity.
• Account & subscription data: retained for the life of the account plus 7 years for financial records.
• Contact-form enquiries: retained for 24 months after resolution.
• Technical & usage data: retained for up to 13 months.

When retention is no longer required, data is either permanently deleted or anonymised so it can no longer identify you.

Your personal data may be transferred to, and processed in, countries outside of Jamaica — including the United States and Canada — for example where we use cloud hosting, email, or analytics providers located in those jurisdictions.

Safeguards for transfers out of Jamaica

In accordance with the JDPA, we do not transfer personal data outside of Jamaica unless:

• The receiving country or organisation ensures an adequate level of protection recognised under applicable law;
• We have put in place appropriate safeguards such as Standard Contractual Clauses (SCCs) or other legally recognised transfer mechanisms; and
• You have consented to the transfer after being informed of the possible risks where no adequacy determination exists.

A copy of the safeguards relied upon is available on request from the Data Protection Officer.

Depending on where you reside, you have the following rights regarding your personal data. These rights apply to Jamaican, United States, and Canadian residents alike:

• Right of access: to be informed whether we process your data and to receive a copy of it.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure (“right to be forgotten”): to request deletion of your data, subject to legal retention obligations.
• Right to restriction: to request that we limit processing of your data in certain circumstances.
• Right to data portability: to receive your data in a structured, machine-readable format and to transmit it to another controller.
• Right to object: to object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: at any time, without affecting the lawfulness of processing before withdrawal.
• Right not to be subject to automated decision-making: with legal or similarly significant effects.

To exercise any right, contact the Data Protection Officer using the details in Section 2. We will respond within 30 days, extendable by a further 60 days where reasonably necessary, with notice of the extension.

We implement appropriate technical and organisational measures — including encryption in transit, access controls, and regular review — to protect your personal data against unauthorised access, loss, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We use essential cookies to operate the website and optional analytics cookies to understand usage. You can control cookies through your browser settings. Disabling essential cookies may affect site functionality.

Our services are not directed to individuals under 16 (Jamaica), under 13 (US COPPA), and we do not knowingly collect personal data from children. If you believe a child has provided data to us, contact the DPO and we will delete it.

If you remain dissatisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority:

Office of the Information Commissioner (OIC), Jamaica

• Office of the Information Commissioner, Jamaica
• Address: [PLACEHOLDER — OIC Jamaica postal address]
• Telephone: [PLACEHOLDER — OIC contact number]
• Website: [PLACEHOLDER — www.oic.gov.jm]

Residents of the United States may contact their state Attorney General, and Canadian residents may contact the Office of the Privacy Commissioner of Canada (OPC).

We may update this Policy from time to time. We will notify you of material changes by posting the updated Policy on this page with a revised “Last updated” date.