As of: November 2026. Legal framework: General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
1. Controller
Responsible for data processing on this website:
NUI – Genossenschaft für Gesundheit und Wohlbefinden eG
Schulgasse 70, 6850 Dornbirn, Austria
Phone: +43 5572 721040 · Email: hello@nui-vital.com
Authorised managing board member: Enrico Mandl · Commercial register: FN 605146x, Landesgericht Feldkirch · VAT: ATU79569557
2. General information on data processing
We process personal data only insofar as this is necessary to provide a functional website as well as our content and services, or where you have given your consent. The legal bases are in particular:
- Art. 6(1)(a) GDPR – consent (e.g. newsletter, non-essential cookies, chatbot, support from your NUI partner)
- Art. 6(1)(b) GDPR – performance/initiation of a contract (order processing, customer account)
- Art. 6(1)(c) GDPR – legal obligation (e.g. retention obligations)
- Art. 6(1)(f) GDPR – legitimate interest (secure, optimised operation of the website)
A transfer to third countries (in particular the USA) takes place only on the basis of adequacy decisions (EU-U.S. Data Privacy Framework), standard contractual clauses (SCC) or your explicit consent. Data processing agreements (DPA) pursuant to Art. 28 GDPR have been concluded with all processors.
3. Hosting
Our website is hosted by ALL-INKL.COM – Neue Medien Münnich (Hauptstraße 68, 02742 Friedersdorf, Germany). The server location is Germany (EU). The provider processes inventory, contact, content, usage and metadata on our behalf (Art. 6(1)(f) GDPR). Email is also sent via the host’s mail server (EU).
4. Server log files
The hosting provider automatically collects server log files transmitted by your browser (browser type/version, operating system, referrer URL, host name, time of the request, IP address). These data are not merged with other data sources and are deleted or anonymised after a short time. Legal basis: Art. 6(1)(f) GDPR.
5. Cookies & consent management
We use cookies and comparable technologies. We set technically necessary cookies on the basis of Art. 6(1)(f) GDPR or § 165(3) TKG 2021. We set all non-essential cookies only with your consent (Art. 6(1)(a) GDPR), which you can revoke at any time with effect for the future. For management we use Borlabs Cookie (Borlabs GmbH, Hamburg). Your consent settings are stored locally; you can adjust them at any time via the “Cookie settings” link.
6. SSL/TLS encryption
For security reasons, this page uses SSL/TLS encryption, recognisable by “https://” and the padlock symbol in the address bar.
7. Order processing & customer account
The shop is operated with WooCommerce (incl. WooCommerce Germanized). When you place an order, we process the data required to perform the contract (name, address, billing/delivery address, email, phone if applicable, order and payment data) on the basis of Art. 6(1)(b) GDPR. We only pass on these data insofar as this is necessary to process the contract (payment service provider, shipping service provider, ERP, tax advisor if applicable), where we are legally obliged to do so or where you have consented (support from your NUI partner, section 14a). Tax and commercial retention periods (usually 7 years) remain unaffected. A customer account is optional and can be deleted at any time.
8. Payment methods
Payment data are processed for the performance of the contract (Art. 6(1)(b) GDPR).
- Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) is our payment service provider; it handles credit card, Stripe Link, Klarna, Amazon Pay and Sofort. Also applicable is the Stripe privacy policy. Stripe can transfer data to the USA (SCC/DPF).
- Klarna / Sofort: Klarna Bank AB (publ.), Stockholm, Sweden – Klarna privacy notice.
- Amazon Pay: Amazon Payments Europe S.C.A., Luxembourg.
- PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) – PayPal privacy notice.
- Prepayment/bank transfer, SEPA direct debit, purchase on account, cash on delivery – processing of the respectively required payment data.
9. Shipping
For delivery, we transmit the name and delivery address to the commissioned shipping service provider (Art. 6(1)(b) GDPR). For shipping notifications, the email address may also be transmitted.
10. Contacting us
When you contact us by email or form, we process your details to handle the request (Art. 6(1)(b) or (f) GDPR). The data are deleted as soon as they are no longer required and no retention obligations apply.
11. Newsletter / email marketing (Klaviyo)
For sending newsletters we use Klaviyo (Klaviyo Inc., Boston, USA). Registration takes place using the double opt-in procedure; the legal basis is your consent (Art. 6(1)(a) GDPR), which you can revoke at any time via the unsubscribe link. Processed in particular are the email address, registration data as well as open/click data. Klaviyo processes data in the USA (SCC/DPF).
11a. WhatsApp newsletter and contact via WhatsApp (Superchat)
Via our WhatsApp number +43 660 6536947 you can subscribe to our WhatsApp newsletter, ask us questions and find out about our partner programme. For this we use the communication platform Superchat of SuperX GmbH (Prenzlauer Allee 242–247, 10405 Berlin, Germany) and the WhatsApp Business Platform of Meta (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). Both process the data on our behalf (Art. 28 GDPR).
Newsletter: You subscribe by sending us a keyword (e.g. “START”) and then confirming your subscription in a second message (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR). We inform you about promotions, new products and news about NUI. You can unsubscribe at any time by sending “STOPP”; the withdrawal takes effect for the future.
Enquiries and partner programme: If you write to us via WhatsApp – for example with a question or with “PARTNER” – we process your message and your details in order to reply to you or to prepare a possible partnership (Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR – our interest in answering enquiries).
Data processed: phone number, WhatsApp profile name, content and time of the messages, time and source of the subscription (e.g. website, shop, parcel insert), country, subscription and unsubscription status, delivery and read receipts, and any information you provide voluntarily.
Storage location: Superchat stores the data on servers in Germany (Frankfurt). Meta retains messages for up to 30 days for delivery and may also process data in the USA; this is based on the EU-U.S. Data Privacy Framework or standard contractual clauses. The use of the WhatsApp app itself is additionally subject to WhatsApp’s privacy policy.
Storage period: We store newsletter data until you unsubscribe. We then keep proof of your consent and unsubscription for a further three years in order to be able to demonstrate that we acted lawfully. We delete conversation histories as soon as they are no longer required and no statutory retention obligations apply.
12. ERP integration (Odoo)
For order, purchasing and inventory management, we transmit order and customer data to our ERP system Odoo (Art. 6(1)(b) GDPR; DPA pursuant to Art. 28 GDPR).
13. Online appointment booking (consultation)
On our “Consultation” page you can choose a slot for a personal consultation yourself, using an embedded booking form. The form comes from our own appointment system (Odoo, operated on Odoo.sh in the EU) and is embedded in the page. In the process your IP address and cookies that are technically necessary for the booking (session, language selection) are processed; no third-party provider receives data as a result.
When you book an appointment, we process your name, your e-mail address, your telephone number, the selected slot and any optional information you provide in the form. The purpose is to arrange, hold and follow up the consultation, including the confirmation and reminder e-mail (Art. 6(1)(b) GDPR – pre-contractual measure at your request).
The appointment is added to the work calendar of the person advising you, which is kept in Microsoft 365 (Outlook). The recipient in this respect is Microsoft Ireland Operations Ltd.; transfers to the USA are based on standard contractual clauses or on certification under the EU-U.S. Data Privacy Framework. No further disclosure takes place.
We delete the appointment data as soon as it is no longer required for the consultation and its follow-up and no statutory retention obligations apply. You can cancel a booked appointment at any time, informally, by e-mail or by telephone.
14. Sign-up via our entry pages (funnel)
On our entry pages (“Welcome”, “Everyday check”, “Invitation to the talk” and “Try NUI”) you can answer a few short questions and give us your contact details so that a contact person can get in touch with you. The pages are provided on our behalf via the Qonverts platform of XENTARA LTD (Larnaca, Cyprus). According to the provider, the platform is operated via Lovable GmbH and Supabase Inc. with servers in the EU.
We process your first name, your email address, on request your phone number and a partner code, your answers to the questions, the time and source of the sign-up, and your consents (wording and time). We do not ask for health data.
We and your contact person at NUI (employees or independent sales partners) contact you by email to help you get started with NUI; the legal basis is your consent (Art. 6(1)(a) GDPR). If you additionally consent, we also contact you via WhatsApp or phone (see the section “WhatsApp newsletter and contact via WhatsApp (Superchat)”). Consent to email is required for signing up via the form; with “Continue without contact” you can use the page without providing any details. We use your answers to send you suitable content. If you request a trial pack or a consultation, we also process the data to answer your request (Art. 6(1)(b) GDPR).
You can withdraw your consent at any time with effect for the future, informally by email to hello@nui-vital.com, by message to your contact person or via the unsubscribe link in our emails.
Recipients are your contact person at NUI and the service providers working on our behalf: Qonverts (see above), Klaviyo for emails (see the section “Newsletter / email marketing (Klaviyo)”), Superchat for WhatsApp messages if you have consented, and an automation server operated by us in Germany that forwards sign-ups to these services.
We store your data until you withdraw your consent, at the latest 24 months after our last contact with you. We then delete it, unless statutory retention obligations apply.
14a. Partner programme: referral and support from your NUI partner
NUI works with independent sales partners (“partners”). They recommend NUI and receive a commission from us for doing so. Your purchase contract is always concluded with NUI.
Assignment: If you come to us via a partner’s referral link, QR code or referral code, we store which partner referred you. For this we use the shop plugin AffiliateWP; it runs on our own web server (see the section “Hosting”) and, when a referral link is opened, sets a cookie that is stored for 30 days (see the section “Cookies & consent management”). With your first order we permanently assign you to this partner in our ERP system Odoo. The assignment applies to all purchases from NUI, including in the shop and by telephone. The purpose is the calculation of the commission. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in remunerating our partners correctly) and Art. 6(1)(c) GDPR (obligation to account to the partner under § 16 of the Austrian Commercial Agents Act). For this accounting your partner only receives the date, document number and net amount of your orders, without your name and without the products purchased.
Support – only with your consent: If you agree at checkout or in your customer account, your partner additionally sees your name, email address, telephone number and your purchases from NUI (date, products, amount) in their partner area, and may contact you by email, telephone or WhatsApp to advise you and remind you about reorders. They do not see your delivery address. Because purchased products can allow conclusions to be drawn about your health, we obtain your explicit consent for this (Art. 6(1)(a) and Art. 9(2)(a) GDPR). Consent is voluntary and not a condition for placing an order.
Who receives your data: The recipient is the partner assigned to you. They are contractually obliged to use your data only for supporting you with NUI, not to pass them on and to delete them as soon as you withdraw your consent or their partnership ends. If their partnership ends, another partner or NUI itself takes over your support in accordance with our partner terms. We will tell you the name by email; your consent then applies to the new partner, and you can withdraw it at any time.
Withdrawal: You can withdraw your consent at any time with effect for the future: with the switch in your customer account, informally to hello@nui-vital.com or via your partner. From the withdrawal onwards your partner only sees you anonymously as described above. The lawfulness of processing carried out until then remains unaffected.
Storage period: We store the assignment for as long as the customer relationship exists; documents are kept in accordance with the statutory periods (usually 7 years). We keep proof of your consent (wording, time, where you consented) for three years after a withdrawal.
15. Remote website maintenance
For the technical maintenance of the website, we use iThemes/Solid Sync (StellarWP, USA) (Art. 6(1)(f) GDPR). In doing so, technical status/access data may be transferred to the USA (SCC).
16. Data backup
For data backup we use UpdraftPlus. The backups are stored locally at the host (EU).
17. Spam protection
To protect against spam, we use Antispam Bee (pluginkollektiv, Germany). The plugin works in a data-efficient manner and by default does not transmit any IP addresses to third parties.
18. Reviews (ProvenExpert)
For customer reviews we use ProvenExpert (Expert Systems AG, Berlin). Also applicable is the ProvenExpert privacy policy.
19. AI product advisor “Professor Nuno”
On the website we offer an AI chatbot (“Professor Nuno”) for product advice. When you use the chat, your inputs are transmitted, in order to generate the response, to Anthropic, PBC (San Francisco, USA) and processed there (Art. 6(1)(a)/(b) GDPR; transfer via SCC, data processing addendum). Please do not enter any sensitive personal data in the chat.
20. Your rights
You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) as well as objection (Art. 21). You can revoke consents given at any time with effect for the future. Contact: hello@nui-vital.com.
21. Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority, in Austria with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, DSB), Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at.
22. Storage period
We store personal data only for as long as is necessary for the respective purpose or as long as statutory retention periods (usually 7 years) exist. The data are then deleted.
23. Advertising to existing customers
If you have purchased a product from us, we use the e-mail address you provided to inform you about our own similar products – for example with a reminder when your supply is calculated to be running low.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in direct marketing to existing customers) in conjunction with Section 174(4) of the Austrian Telecommunications Act 2021 (TKG 2021) and Section 7(3) of the German Act against Unfair Competition (UWG). Our legitimate interest lies in providing information about our own products similar to your purchase.
You can object to this use at any time – via the unsubscribe link in every e-mail or informally to hello@nui-vital.com. This does not incur any costs other than the transmission costs according to the basic rates. After an objection, we will no longer use your address for advertising; the processing of existing orders remains unaffected.
Storage period: We use the address for this purpose as long as the customer relationship exists, but no longer than three years after your last purchase.
Processor: The e-mails are sent via Klaviyo (Klaviyo Inc., Boston, USA) on the basis of the EU standard contractual clauses; see section 11 for details.
