Privacy Policy
Last updated: October 2026
Protecting your data matters to me. This policy explains which personal data I collect when you visit my website, contact me or become a MeryMeal client, what I use it for and what rights you have. The EU General Data Protection Regulation (GDPR) and the Cyprus data protection law (Law 125(1)/2018) apply.
1. Controller
Meryem Güven, MeryMeal
Sinasi Bay 55, Block B, Apt. 203, 8015 Paphos
Cyprus
Email: merymeal.cy@gmail.com
WhatsApp/Phone: +357 95 115 140
A data protection officer is not legally required. For any privacy questions, contact me directly using the details above.
2. Legal bases
I only process your data where one of the following legal bases applies:
- Contract and pre-contractual steps (Art. 6(1)(b) GDPR): e.g. handling your enquiry, planning and delivering your meals.
- Consent (Art. 6(1)(a) GDPR), and for health data explicit consent (Art. 9(2)(a) GDPR): e.g. information on allergies, intolerances or medical requirements.
- Legal obligation (Art. 6(1)(c) GDPR): e.g. tax record-keeping duties.
- Legitimate interest (Art. 6(1)(f) GDPR): e.g. secure and stable operation of the website.
3. Hosting and server log files
This website is hosted by an external hosting provider. When you visit the site, the server automatically stores technical data: IP address, date and time, page visited, browser and operating system, and the referring page. I need this data to provide the website securely and without errors (legitimate interest, Art. 6(1)(f) GDPR). It is not combined with other data and is deleted after 30 days at the latest, unless needed to investigate a security incident. A data processing agreement is in place with the hosting provider.
4. Contact form
When you send an enquiry through the form, I process the information you enter, e.g. name, email, phone number, location, your goals, preferences and any allergies or intolerances. I use it only to answer your enquiry and make you a suitable offer (Art. 6(1)(b) GDPR). For information on allergies, intolerances or health, you give your explicit consent via a checkbox (Art. 9(2)(a) GDPR). This information is voluntary.
5. Contact via WhatsApp, phone or email
If you contact me via WhatsApp, phone or email, I process your contact details and the content of your message to handle your request (Art. 6(1)(b) GDPR).
WhatsApp is a service of WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, a Meta group company. Messages are end-to-end encrypted, but WhatsApp processes metadata (e.g. phone number, time of message) and may transfer it to the USA. If you prefer not to use WhatsApp, please contact me by email or through the form. More information: whatsapp.com/legal/privacy-policy-eea.
6. Enquiries via Facebook and Instagram ads (Meta Lead Ads)
I run ads on Facebook and Instagram. If you fill in an enquiry form there, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland ("Meta") passes on to me the information you choose to submit (e.g. name, email, phone number). I use it to contact you and answer your enquiry (Art. 6(1)(b) GDPR). Meta is responsible for processing on its own platform. Details are in Meta's privacy policy: facebook.com/privacy/policy.
7. Client relationship: nutrition profile, planning and delivery
When you become a client, I create a personal profile so I can tailor your meals precisely to you. It includes your name, contact details, delivery address and times, goals (e.g. weight loss, muscle gain), calorie and macro targets, likes and dislikes, and billing details.
Health data: Information on allergies, intolerances or medical requirements is specially protected data. I only process it with your explicit consent (Art. 9(2)(a) GDPR) and solely to prepare your meals safely. Only I and staff involved in preparing your meals, who are bound to confidentiality, have access. You can withdraw your consent at any time. In that case, however, I can no longer adapt your meals to these requirements.
I do not sell your data or share it with third parties for advertising purposes.
8. Cookies and tracking
I use technically necessary cookies so the website works (Art. 6(1)(f) GDPR). All other cookies and tracking tools, e.g. the Meta Pixel for measuring ad performance, are only loaded if you agree in the cookie banner (Art. 6(1)(a) GDPR). For the Meta Pixel, Meta and I are joint controllers for the data collection (Art. 26 GDPR). You can withdraw your consent at any time via the cookie settings in the footer.
9. Recipients and service providers
I work with carefully selected service providers who process data only on my behalf and according to my instructions:
- Website hosting: external hosting provider
- Client management and planning: Google Workspace (Google Ireland Limited, Ireland) and Airtable (Formagrid Inc., USA)
- Communication: WhatsApp (WhatsApp Ireland Limited)
- Advertising and performance measurement: Meta Pixel (Meta Platforms Ireland Limited), only with your consent
- Accounting and tax advisors, where legally required
10. Transfers to third countries
Some providers (Meta, Google, Airtable) may also process data in the USA. Transfers are based on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses (Art. 46 GDPR).
11. Retention periods
- Enquiries that do not lead to a client relationship: deleted after 12 months at the latest.
- Nutrition profile and health data: deleted no later than 3 months after the client relationship ends, or immediately after you withdraw consent.
- Invoices and tax-relevant records: kept as long as Cyprus tax law requires (usually 6 years).
12. Your rights
You have the right at any time to:
- Access the data stored about you (Art. 15 GDPR)
- Rectify inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restrict processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing based on legitimate interests (Art. 21 GDPR)
- Withdraw consent with effect for the future (Art. 7(3) GDPR)
A short message to merymeal.cy@gmail.com or via WhatsApp is enough.
13. Right to lodge a complaint
You can lodge a complaint with the competent supervisory authority:
Office of the Commissioner for Personal Data Protection
Iasonos 1, 1082 Nicosia, Cyprus
Email: commissioner@dataprotection.gov.cy
Website: dataprotection.gov.cy
14. Changes
I update this privacy policy when my services or the legal situation change. The version published on this page applies.