1. Who is responsible
Genius Nutrition SRL, trading as Vitaminlabs is the controller of personal data processed for the purposes described in this notice. Our contact address is Tamasi 20, 070000 Buftea, Ilfov, Romania, European Union. For privacy enquiries and rights requests, contact [email protected]. Company information is available in our Legal Notice.
2. Scope of this notice
This notice covers this website and communications arising from its project enquiry form, email links and contact options. It is not a privacy notice for a finished supplement sold under a customer’s brand. Separate notices or agreements may apply where a project proceeds to an ongoing commercial relationship.
3. Information you provide
The project form asks for your name, email address, development route, product format and a description of your idea. A brand or company name is optional. We also record that you acknowledged reading this notice. We process the contents of related correspondence and contact details you provide when communicating with our team. If you act for a business, please provide your business contact details and only information you are entitled to share.
4. Required information and sensitive material
We need the required form fields to receive and respond to your enquiry; without them, the form cannot be submitted. Selecting an open development route or format is acceptable if you have not decided. Do not send medical records, identification documents, payment card details or other sensitive personal information through the form. Share detailed confidential formulations through a separately agreed channel where appropriate.
5. Technical information
When you access the website, hosting infrastructure processes connection and request information such as IP addresses, request times and requested URLs. Our application uses validated client IP information for abuse prevention. It stores keyed hashes of IP addresses and request keys, message fingerprints, submission identifiers and delivery states in a private Redis service. Security counters do not contain your project brief. A separate private delivery queue stores your submitted contact details and brief so temporary email failures do not discard your enquiry. Browser and operating-system information may also be present in provider access logs.
6. Purposes and legal bases
We answer enquiries, assess requested product development and prepare follow-up discussions. For individuals seeking a contract themselves, this is based on requested pre-contractual steps, where applicable. For business representatives, we rely on legitimate interests in business communication and evaluating prospective projects. Security and abuse prevention serve our legitimate interests in protecting this service. Applicable legal obligations may require specific records; legitimate interests may support handling legal claims. These bases are assessed for the particular processing, not used interchangeably.
7. Form delivery and confirmation
When you submit, your brief is processed on Railway and sent through Google Workspace to our sales and information mailboxes, accessible to authorised team members. A separate acknowledgement is sent to the email address you entered. It confirms receipt; it is not an order acceptance. Replies to the acknowledgement go to our sales team. The form does not automatically enrol you in a newsletter or an advertising audience. Its privacy acknowledgement is not marketing consent.
8. People and services receiving information
Railway supplies website hosting and the private security datastore. Google Workspace supplies email delivery and mailbox services. Information is available to personnel who need it to handle the enquiry or operate and secure the service. Where required or justified, relevant records may be disclosed to competent authorities or professional advisers for legal compliance or the handling of claims. This website does not sell enquiry data or automatically send form submissions to an advertising platform.
9. Processing outside the EEA
The current Railway deployment is hosted in the United States. Google Workspace and infrastructure providers may also process data outside the European Economic Area. The applicable transfer arrangements must be assessed for the relevant provider and service; the location of the provider alone does not establish a lawful transfer mechanism. Contact [email protected] for information about the arrangements applicable to your data and how to obtain relevant safeguards.
10. Retention
Application abuse-control counters expire after their configured short windows, and completed delivery receipts expire within 30 days; older security and confirmation-attempt records expire within 24 hours. Pending enquiries are retained in a private delivery queue for retry and operational recovery. The queued contact details and brief are removed after delivery and any enabled confirmation succeed; unresolved failures require operational review and are not automatically discarded. The form’s editing state is held in browser memory and is lost when you leave or refresh. Enquiry emails are held separately in our mailboxes; the website does not automatically delete them. The criteria for retaining correspondence are whether the enquiry remains active, whether it develops into a business relationship, and any applicable record-keeping or legal-claim requirements. Provider log and backup retention is separate from the application’s 24-hour security records.
11. Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. You may withdraw consent for processing that actually relies on consent, without affecting earlier lawful processing. These rights are subject to their legal conditions. Write to [email protected] with enough information to identify your request; we may seek proportionate identity verification where needed.
12. Responding to requests
We respond without undue delay, normally within one month. Where permitted, complexity or the number of requests may justify up to two additional months; we will explain any extension within the first month. Requests are generally free. If we decline a request, we will explain the reasons and available remedies as required by law.
13. Complaints
You may complain to a competent supervisory authority, including where you live, work or the alleged infringement occurred. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP). See ANSPDCP complaint information. This does not limit your right to seek a judicial remedy.
14. Automated processing and security
The website uses automatic validation, rate limits and duplicate-request checks to protect the contact service. It does not make automated decisions about credit, employment, access to manufacturing services or similar matters with legal or comparably significant effects. Technical and organisational controls support secure handling, but no internet service can guarantee absolute security.
15. External services, updates and contact
WhatsApp and email links open services outside this website; their providers’ notices also apply to those services. Read our Cookies section for browser technologies. We will update this notice when relevant data handling changes. For questions, contact [email protected].
17. What cookies and similar technologies are
Cookies are small pieces of information a website can store in a browser and receive on later requests. Similar technologies include local browser storage and tracking pixels. They can have different purposes, from providing a requested function to measuring activity or advertising. A normal browser cache stores copies of resources to help pages load; it is not, by itself, an advertising profile.
18. Technologies in the current application
The application code currently sets no first-party cookies and includes no analytics tags, advertising pixels or third-party embedded players. It does not store form entries or search selections in localStorage or sessionStorage. There is no visitor account, shopping cart or payment session. No optional analytics or advertising category is currently offered by this implementation.
19. Temporary page state and URLs
While a page remains open, browser memory holds form entries, the selected product format and interactive page state. This information is not a persistent cookie and is cleared when the page is refreshed or closed. A product choice may appear in the URL query or fragment so the relevant format can be linked directly. Browser history or bookmarks may retain that URL under your browser’s own settings.
20. Fonts, images and videos
The website serves its fonts, images, logos and videos from its own deployment. Displaying a retailer logo does not load that retailer’s website. The hero video is a hosted media file, not an embedded YouTube or Vimeo player. Your browser may cache these assets and make media range requests during playback.
21. Hosting and security
Railway handles incoming connections and provides security infrastructure. The application’s server-side rate-limit and duplicate-request records are not browser cookies. Infrastructure controls may differ from application code, for example if a provider presents a security challenge. Information about any additional browser technologies will be provided when those technologies are introduced.
22. Optional technologies and consent
If we introduce technologies that require consent, we will explain their purposes and obtain consent before activating them. A contact-form privacy acknowledgement is not consent to analytics or advertising. Necessary technical operations do not become optional marketing simply because they involve data; each technology must be assessed for its actual function. Any future optional choice must allow refusal and later withdrawal.
23. Links to other services
Choosing a WhatsApp or email link takes you to a separate application or service. Those services may use their own cookies and storage under their own policies. The presence of a link does not mean that its provider loads tracking on this page before you choose it.
24. Your browser choices
You can inspect and remove stored site data or change cookie settings in your browser. Blocking all storage or scripting may affect some website features. Browser controls do not replace consent controls where those are required. Contact [email protected] for questions or concerns about a technology you observe on our website.