Privacy Policy

Last updated: 02.11.2026.

This is a translation. In case of any discrepancy, the Serbian version prevails.

NUTRIBOX KETERING D.O.O. (hereinafter "Nutribox", "we") is committed to protecting the privacy of your personal data in accordance with the Law on Personal Data Protection ("Official Gazette of the Republic of Serbia", No. 87/2018).

1. DATA CONTROLLER

NUTRIBOX KETERING D.O.O.

Company Registration Number: 22320378

Tax ID: 115841962

Headquarters: CARA DUŠANA 158, 11080 BELGRADE (ZEMUN), Serbia

Email: kancelarija@nutribox.rs

Phone: 0800 001 007

2. WHAT DATA WE COLLECT

2.1. Information you provide to us directly:

Full name
Email address
Phone number
Delivery address
Dietary preferences and restrictions (allergies, intolerances)
Payment information (we do not store your card number — processing is handled by an authorized payment processor)

2.2. Automatically collected data:

IP address
Browser and device type
Website usage data (pages visited, time spent)
Cookies (see Cookie Policy)

3. PURPOSE OF DATA PROCESSING

We process your data for the following purposes:

a) Performance of a contract (Article 12, paragraph 1, item 2 of the Law):

Meal preparation and delivery
Meal personalization based on your needs
Payment processing
Communication regarding your order/subscription
Handling complaints

b) Compliance with legal obligations (Art. 12, para. 1, item 3 of the Law):

Maintaining business books and records
Issuing invoices
Complying with requests from competent authorities

c) Legitimate interest (Art. 12, para. 1, item 6 of the Law):

Improving service quality
Website usage analytics
Preventing misuse

d) Consent (Art. 12, para. 1, item 1 of the Law):

Sending promotional messages and notifications (only with your consent)
Use of optional cookies

4. SHARING DATA WITH THIRD PARTIES

We may share your data with:

Payment processor — for processing card transactions
Delivery service — name, address, and phone number for meal delivery
Accounting service — for bookkeeping purposes
Hosting provider — for data storage on servers

We do not sell or rent your personal data to third parties for marketing purposes.

5. MOBILE APPS

This policy also applies to the "Nutribox – healthy meals" mobile app (for Nutribox package users) and the "Nutribox Drivers" mobile app (for drivers delivering for Nutribox).

The user app processes:

account data: first and last name, phone number, and email address;
delivery addresses and instructions (floor, intercom, contactless delivery, call before delivery);
dietary preferences, excluded ingredients, and allergens you enter — we use these only to prepare your meals;
package, deliveries, pauses, payments, and purchase history;
ratings and comments on meals;
device token for push notifications and selected language;
technical data about how the app works (errors, performance, and screen usage), linked to your account for troubleshooting purposes.

The driver app processes the driver's name, email address, and phone number, delivery records (delivery confirmation, failed delivery and notes, cash collected), and technical data regarding app performance. The camera is used only for scanning the QR code on the bag; images are not saved or sent. The route for today and tomorrow (addresses and delivery notes) is stored encrypted on the driver's phone and is deleted upon logout. Driver accounts are created and closed by the Nutribox office.

Data processors for the applications:

Amazon Web Services (EU, Frankfurt) – sending emails and SMS messages with login codes and notifications;
Expo (650 Industries, USA), Apple, and Google Firebase – delivery of push notifications;
Google Cloud (EU) – automatic translation of nutrition and delivery notes, as well as comments for the kitchen and delivery staff;
Raiffeisen banka a.d. Beograd – card payments on the bank's website (we do not see the card number, except for the masked version);
Fiscomm – issuing fiscal receipts;
Hetzner (Germany, Finland) – the servers on which our systems run.

Measuring ad performance: when you pay for a package, Meta Platforms Ireland receives a purchase event with a one-way encrypted (hashed) email, phone number, name, gender, date of birth, city, and zip code, while Hyros (USA, via the Make.com service) receives your first name, last name, email, package, and price. On iPhone devices, we only share this data if you allow it when the app asks (Apple "App Tracking Transparency"); you can change this choice in your phone settings. You may object to this processing at any time by emailing kancelarija@nutribox.rs.

International transfers: Expo, Apple, Google, Meta, Hyros, and Make.com may process data outside of Serbia and the EU, using the safeguards these service providers apply in accordance with data protection regulations.

Account deletion: in the app under Profile → Delete Account, or by calling 0800 001 007 / emailing kancelarija@nutribox.rs. We permanently delete personal data 30 days after the request. Details: https://www.nutribox.rs/brisanje-naloga

The applications are not intended for persons under 18 years of age.

6. INTERNATIONAL DATA TRANSFERS

Your data is primarily stored on servers within the European Union.

In the event of data transfer outside the EU, we ensure an appropriate level of protection in accordance with the Law.

7. DATA RETENTION PERIOD

Active user data: We retain it as long as your account is active
Account deletion: When you request account deletion, your personal data is permanently deleted 30 days after the request; we retain fiscal and accounting records as required by law.
Financial data (invoices, transactions): 5 years in accordance with accounting regulations
Complaint data: 2 years from the resolution of the complaint
Marketing consents: Until consent is withdrawn

After the specified periods expire, the data is deleted or anonymized.

8. YOUR RIGHTS

In accordance with the Law, you have the following rights:

a) Right of access — You have the right to request information on whether we are processing your data and to obtain a copy of that data.

b) Right to rectification — You have the right to request the correction of inaccurate data or the completion of incomplete data.

c) Right to erasure — You have the right to request the deletion of your data ("right to be forgotten"), except where there is a legal obligation to retain it. How to request account deletion: https://www.nutribox.rs/brisanje-naloga

d) Right to restriction of processing — You have the right to request the restriction of the processing of your data in certain circumstances.

e) Right to data portability — You have the right to receive your data in a structured, commonly used, and machine-readable format.

f) Right to object — You have the right to object to the processing of your data based on legitimate interests.

g) Right to withdraw consent — Where processing is based on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of the rights listed above, please contact us at: kancelarija@nutribox.rs

We will respond to your request within 30 days.

9. RIGHT TO FILE A COMPLAINT

If you believe that the processing of your data is in violation of the Law,

you have the right to file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection:

Commissioner for Information of Public Importance and Personal Data Protection

Bulevar kralja Aleksandra 15, 11120 Belgrade

office@poverenik.rs

www.poverenik.rs

10. DATA SECURITY

We implement appropriate technical and organizational data protection measures, including:

SSL encryption for data transmission
Data access control
Regular updates to security systems
Employee training on data protection

11. CHANGES TO THE PRIVACY POLICY

Nutribox reserves the right to change this Privacy Policy. You will be notified of any significant changes via email or through a notice on our website.

12. CONTACT

For any questions regarding the protection of your data:

NUTRIBOX KETERING D.O.O.

Email: kancelarija@nutribox.rs

Phone: 0800 001 007