Privacy notice
Your privacy, explained.
This notice explains the personal data involved in visiting healthierlifetoday.com and contacting GRZ. You can read our articles and recipes without creating an account or accepting optional analytics.
Last updated:
Google Analytics is configured. It loads only after you accept analytics.
Who is responsible?
The controller is Verein für Gesundheitsförderung und Reduktion von zugesetztem Zucker e.V. (GRZ), Kantstr. 97, 10627 Berlin, Germany. The association is registered at Amtsgericht Charlottenburg, VR 42817 B. Its board represents it under §26 BGB; two board members act jointly.
For enquiries and data protection requests, email info@healthierlifetoday.com or write to the address above. GRZ has not designated a data protection officer. This notice covers our website and correspondence. Separate information will be provided when membership applications, donations or event registrations are introduced.
Visiting the website and keeping it secure
Our hosting and delivery provider, Vercel, processes technical request information such as IP address, requested URL, time, browser/user-agent, referrer, response status and diagnostic information. This enables delivery, troubleshooting and protection against misuse. The basis is Article 6(1)(f) GDPR: our legitimate interest in a reliable and secure information service.
The application does not deliberately log contact message bodies. Its contact rate limiter temporarily keeps a truncated IP address and an attempt count in server memory for up to ten minutes. This protection resets when the server instance restarts. Hosting infrastructure can separately keep request and security logs.
Technical logs are retained for the provider's configured operational and security periods and removed when no longer needed for those purposes. Records needed to investigate a specific security incident may be kept until it is resolved or applicable claims expire. You can request information about the retention settings applying to your enquiry from our privacy contact.
Contact enquiries and email
After receiving your enquiry, we send a transactional acknowledgement to the email address you provided. It does not subscribe you to marketing.
When you use our form, we process your name, email address, message and, if supplied, telephone number with its selected calling code. The country selector helps format the number; it does not determine your location. Name, email and message are required to handle a form enquiry; a phone number is optional. You can also contact us directly by email or post.
Brevo transmits form enquiries to info@healthierlifetoday.com. We handle the resulting correspondence in Google Workspace. Your address is used as Reply-To so we can respond. The form does not subscribe you to marketing, create a public account or save your message in our Payload content database.
For general enquiries, our basis is Article 6(1)(f) GDPR, our legitimate interest in receiving and answering messages. Where an enquiry concerns a contract with you or steps you request before entering one, Article 6(1)(b) applies. Legal obligations may require particular records under Article 6(1)(c). Submitting the form is not consent to analytics or advertising.
Ordinary enquiries and associated correspondence are deleted six months after resolution. Where documents must be retained for a specific statutory obligation or to establish, exercise or defend legal claims, the relevant records are retained only for that obligation or claim period. Delivery logs and backups follow the applicable provider's operational retention and deletion cycles. Please do not send medical records or other sensitive personal information through this general contact form.
Service providers and international processing
Our website uses Vercel for hosting and content delivery, Neon (a Databricks service) for the content database and media storage, Brevo for transactional email delivery and Google Workspace for our mailbox. These providers may receive the technical or communication data needed for their respective services. Authorised GRZ staff and service providers may access data as needed for those purposes; disclosures required by law remain possible.
CMS data includes editorial content and staff account information. Published images can be delivered from Neon storage, which receives the associated technical request data. A database or storage region in the EU does not by itself mean all support, security or subprocessor operations occur exclusively in the EU.
Some providers or their subprocessors process data outside the EU/EEA, including in the United States. Transfers must use the applicable safeguards under Articles 44–49 GDPR, such as a valid adequacy decision where applicable or contractual safeguards including the EU standard contractual clauses and any necessary supplementary measures. Contact us for details and copies of safeguards relevant to your data. Provider privacy information and processing terms are linked below.
Optional Google Analytics
If Analytics is configured, we ask before loading the Google tag. Rejecting it does not limit access to the website. After consent, GA4 can process pseudonymous cookie identifiers, visit timestamps, browser/device information, approximate geographical information and public page categories. The recipient is Google, including Google Ireland Limited and Google LLC and their service providers where applicable.
Our integration sends page categories rather than individual article or recipe identifiers. It excludes URL query strings and fragments, form values, names, email addresses and telephone numbers from its event payloads. Advertising features and Google Signals are not enabled by our integration. The analytics cookies _ga and _ga_* are configured to expire after 180 days without renewal on each visit. We limit GA4 user/event data retention to two months; aggregate reports can have different retention.
The legal basis is your consent under Article 6(1)(a) GDPR and §25(1) TDDDG. You can reject optional analytics, or withdraw consent at any time using Privacy settings in the footer or on this page. Withdrawal stops further tracking and removes accessible Analytics cookies; it does not affect the lawfulness of processing before withdrawal. You can also request deletion of relevant data by contacting us. Analytics remains off until a valid property is configured and an affirmative choice can be saved.
Search Console and links to other websites
We use Google Search Console to understand how this website appears in Google Search, using Google's search-performance and indexing reports. DNS ownership verification does not install an Analytics tag or a visitor cookie on our pages. Search Console is distinct from the optional on-site Analytics integration.
Our educational pages link to external sources. Those websites process data under their own notices when you follow a link. Our public pages do not require embedded social feeds, maps or videos to read the content. Future third-party embeds or new data collection will require an updated assessment and notice before activation.
Staff accounts and content administration
Only authorised staff need a Payload account. We process account email, optional display name, password hashes, session information and editorial activity to manage website content and protect access. The legal basis is Article 6(1)(f) GDPR, subject to any applicable employment or contractual rules. Passwords are not stored as plain text.
Staff access is removed when no longer authorised. Account information is deleted or restricted when no longer needed for access, accountability or applicable obligations; editorial attribution may remain with published material. Backups are removed through the provider's backup cycle. Public images and biographies must be reviewed before publication because they may contain personal data.
Your rights and how to exercise them
Depending on the circumstances, you have rights of access (Article 15 GDPR), rectification (16), erasure (17), restriction (18) and data portability (20). Portability applies where the legal conditions are met, particularly automated processing based on consent or a contract. These rights can be limited by applicable obligations and the rights of others.
RIGHT TO OBJECT: where processing relies on legitimate interests under Article 6(1)(f), you may object on grounds relating to your particular situation under Article 21. We then stop that processing unless overriding legitimate grounds or the establishment, exercise or defence of claims justify continuing it. You may object to direct marketing at any time; this contact form does not enrol you in it.
You may withdraw consent at any time without affecting prior lawful processing. Use Privacy settings for Analytics, or contact info@healthierlifetoday.com for other requests. We respond without undue delay, normally within one month. If an extension of up to two further months is permitted because of complexity or the number of requests, we inform you within the first month and explain why. We may request proportionate identity information where necessary to prevent disclosure to someone else.
You may complain to a supervisory authority, particularly in the EU country of your habitual residence, workplace or the alleged infringement. The Berlin Commissioner for Data Protection and Freedom of Information is the local authority for our Berlin-based association; its contact page is linked below. We do not use your enquiry to make solely automated decisions producing legal or similarly significant effects.
Changes to this notice
We update this notice when our services, processing activities or legal requirements change. The date above identifies this version. We request a fresh choice when an update materially changes the purposes covered by analytics consent. A privacy notice describes processing; it does not replace the practical steps needed to protect and delete data.
Legal and provider information
Questions or a privacy request?
Email our privacy contact ↗info@healthierlifetoday.com
Kantstr. 97, 10627 Berlin, Germany