GDPR and your rights

01Who is responsible

GalaxyXplore is a brand of Ovongiz AS, a company registered in Norway. Ovongiz AS is responsible for your personal data (the ‘data controller’ under the GDPR); see the legal information page. What we keep and why is in the privacy policy.

02Your rights

Under the GDPR you have these rights over your personal data. They are the same on every plan.

• Access: get a copy of the personal data we hold about you.
• Rectification: have wrong or incomplete data corrected.
• Erasure: have your data deleted.
• Restriction: have us limit how we use your data, for example while a question about it is sorted out.
• Portability: get the data you gave us in a common, machine-readable format.
• Objection: object to how we use your data where we rely on our legitimate interest.
• Withdraw consent: stop the health-data processing you agreed to in the app, at any time. It doesn’t affect what happened before.
• Automated decisions: not to be subject to a decision based solely on automated processing that has legal or similarly significant effects for you.

03How to use them

In the Nutrition app, export your data and withdraw consent in the Privacy Centre, and delete your data under More › Account › Delete my data. On galaxyxplore.com, delete your account under Your account.

For anything else, such as a copy of your shop data or a correction, write to us through the contact form and choose Privacy and my data. The privacy support page says what to include and how we check it’s you.

04How fast we answer

We answer within one month of receiving your request. If a request is complex, or you send many, we may need up to two more months. If so, we tell you within the first month and explain why.

05Automated decisions

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. Some checks are automatic: the age rule for your country at sign-up, and the eligibility rules of an offer or the referral programme. If you think one got it wrong, write to us and a person will look at it.

06Data sent outside the EEA

Meal photos you scan are analysed by our AI service provider in the USA. Before our server sends a photo, it removes its location data, and we never send your name or email. The transfer is covered by the EU’s standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework. [FOUNDER: confirm the AI service provider’s data processing agreement and transfer basis]

07Complaints

You can complain to a data protection authority. In Norway that is Datatilsynet: Postboks 458 Sentrum, 0105 Oslo, www.datatilsynet.no.

You can also complain to the authority in the country where you live or work, or where you think the problem happened. In Italy that is the Garante per la protezione dei dati personali, www.garanteprivacy.it.

We’d like the chance to put things right first, so please write to us, but you don’t have to.