Privacy Policy

1. Data Controller

The data controller responsible for your personal data is Olbek, operating from 56 Rivington Street, EC2A 3QP London, United Kingdom. You can contact us regarding any data protection matter by email at [email protected] or by telephone at +44 20 7349 8156.

2. Data We Collect

We collect personal data only where it is necessary for the purposes described in this policy. The categories of personal data we may collect include:

• Contact data: Name, email address, and telephone number provided when you submit an enquiry via the contact form or by direct correspondence.
• Programme engagement data: Information you provide during consultations, including eating records, lifestyle context, and nutritional objectives. This information is used solely to deliver the programme you have engaged with.
• Technical data: IP address, browser type, device identifiers, pages visited, and time spent on the site, collected automatically when you use this website.
• Cookie data: Preference and consent data related to your cookie choices. See our Cookie Policy for full details.

3. Legal Basis for Processing

We process personal data on the following legal bases under UK GDPR:

• Contractual necessity (Article 6(1)(b)): Processing necessary to respond to your programme enquiry, deliver a consultation, or fulfil an engagement you have entered into with us.
• Legitimate interests (Article 6(1)(f)): Processing for the purposes of improving our services, maintaining the security of this website, and analytical purposes, where those interests are not overridden by your rights and freedoms.
• Consent (Article 6(1)(a)): Where you have given specific, informed consent to processing — for example, in relation to certain categories of cookies or optional communications.
• Legal obligation (Article 6(1)(c)): Processing necessary to comply with applicable legal requirements.

4. How We Use Your Data

We use your personal data for the following purposes:

• To respond to enquiries submitted through the contact form or by direct correspondence.
• To deliver the programme or consultation services you have engaged with, including producing and maintaining programme documentation records.
• To communicate with you regarding your programme — scheduling, documentation updates, and follow-up correspondence.
• To maintain and improve the security and functionality of this website.
• To analyse aggregate, anonymised usage data for the purposes of understanding how visitors engage with this site.
• To comply with applicable legal obligations.

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data with third parties for their own marketing purposes. We may share your data in the following limited circumstances:

• Service providers: Trusted third-party service providers who assist in operating this website or delivering our services (for example, hosting providers and email routing services). These providers are contractually required to handle your data in accordance with applicable data protection law and may only use it for the specified purpose.
• Legal requirements: Where we are required to disclose data by law, court directive, or regulatory authority, we will do so in compliance with applicable requirements.
• Business transfer: In the event of a merger, acquisition, or transfer of all or part of our business, personal data may be transferred to the acquiring party, subject to equivalent data protection obligations.

6. Data Retention

We retain personal data for no longer than is necessary for the purposes for which it was collected, taking into account applicable legal obligations.

• Enquiry correspondence: Retained for 12 months from the date of the last communication, unless a programme engagement was initiated, in which case programme retention terms apply.
• Programme documentation records: Retained for 3 years from the programme close date, after which they are sesupportly deleted unless you request retention for a longer period.
• Technical and analytical data: Retained in anonymised or aggregated form for up to 24 months.
• Cookie consent records: Retained for 12 months from the date of consent.

7. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: To request a copy of the personal data we hold about you.
• Right to rectification: To request correction of inaccurate or incomplete personal data.
• Right to erasure: To request deletion of your personal data where there is no longer a lawful basis for processing it.
• Right to restrict processing: To request that we restrict processing of your data in certain circumstances.
• Right to data portability: To receive your personal data in a structured, commonly used format where processing is based on consent or contractual necessity.
• Right to object: To object to processing carried out on the basis of legitimate interests.
• Rights related to automated decision-making: We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.

To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month of receipt of your request.

8. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures are reviewed and updated as necessary to reflect the current risk environment.

While we take reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely sesupport. We cannot guarantee absolute security, and by using this website you acknowledge this inherent limitation.

9. Cookies

This website uses cookies. For detailed information about the types of cookies used, their purpose, and how to manage your preferences, please refer to our Cookie Policy.

10. Third-Party Links

This website may contain links to third-party websites. We are not responsible for the privacy practices of those sites, and this Privacy Policy does not apply to them. We recommend reviewing the privacy policy of any external site you visit.

11. Complaints

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection matters. Details of how to contact the ICO are available at ico.org.uk.

We would, however, welcome the opportunity to address any concern directly before you contact the ICO. Please reach us first at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this document will reflect the date of the most recent revision. Where changes are material, we will make reasonable efforts to notify users. Continued use of this website following an update constitutes acceptance of the revised policy.