Privacy Policy

We take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data. 

Effective: 05th September 2024

Archived versions

We take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data. 

If you have a disability, you may access this Privacy Policy in an alternative format by contacting dpo@joinzoe.com.

1. What this Privacy Policy covers

This Privacy Policy covers how we treat “Personal Data” that we gather and subsequently process when you access or use our website, our personalised nutrition programme (our “Service”), or purchase goods (such as Daily30+) from us. “Personal Data” means any information about you where the fact that it is about you could be discovered. It includes information referred to as “personally identifiable information” or “personal information” which are terms used by other privacy or data protection laws. 

This Privacy Policy does not cover the practices of companies we don’t own or control or people we don’t manage.

2. What personal data we collect

2.1 Categories of Personal Data we collect

This section is about the categories of Personal Data that we collect and have collected over the past 12 months as well as data we subsequently process. We use your data for different purposes, and we have split this section up so it is clear what our reason for collecting each category of data is.

2.1.1 Customer Information

This is information about you that we collect in order to manage your account, for example your name, address, email address and telephone number. We use this data to:

• Send goods (such as the test kit or Daily30+ packages) or information to you as part of our Service.

• Decide whether particular national or state laws apply, for example to allow us to decide whether we need to involve a physician or other medical practitioner in collecting certain samples.

• Enable testing (such as blood tests) where some personal information is required for our Service to be provided with the oversight of a physician or other medical practitioner.

• Manage your contract with us, including any subscription you may have. 

• Generally operate an account for you (eg by referring to your name or using your email to permit you to login).

We need this information in order to deliver our Service and any products you purchase to you. For reference: this means our GDPR “legal basis” is article 6(1)(b) “necessary for the performance of a contract”. But, having collected it, we also use it for other purposes that are discussed in more detail in their own section:

• We may use some of this information to improve our analysis of your self-reported health information, for example your geographical location. If so, we treat it in the same way as other information in the same category.

We use your email address, telephone number, first name, last name, birth date, zip or postal code, and country to improve our use of Meta advertising, see the “Meta” section below.

2.1.1.1 Emails: additional uses 

We may also use your email address, in order to send you emails for the following purposes:

• Providing you with information about our products and services.

• Keeping in touch with you about the app and its performance as well as about new versions of the app or similar apps we may develop.

• Sending you updates on our latest developments and scientific discoveries.

• Inviting you to register for webinars we host in relation to our research.

• Inviting you to participate in one or more scientific research studies. See the “Scientific Research Studies” section below.

Our legal basis for doing so is our legitimate interest in promoting our products and services. For more information, see the “User Research” and “Mailing Lists” sections below.

2.1.1.2 How long do we keep customer information for?

We keep this information for a period of 6 years after the end of your subscription. Keeping it for this length of time allows us to recognise you if you wish to subscribe again, and is also necessary for us in case we need to resolve any legal disputes that might arise.

The laboratories who conduct testing (such as blood tests) may hold information for longer depending on locally applicable law. See under the heading “Samples” below.

Where you have opted in to participate in Research you may be asked to use devices for measuring physiological data (such as blood sugar monitors). The manufacturer and/or distributor of such devices use data management systems and software to transfer data from the devices (sensor and/or reader) to Zoe. This may require us to set up an account on your behalf with these manufacturers and/or distributors to facilitate the transfer of data. Where possible we will use an anonymous code to replace your personal details (name, email, phone number, full address) when sharing information with such manufacturers and/or distributors so that your physiological data on their systems is de-identified/anonymised.

2.1.2 Self-reported Health Information

This is information such as height, weight, what you eat, or any pre-existing health conditions, that you contribute to us by inputting the information into our website or the app.

We use this data to:

• Determine your eligibility for our Service or scientific research studies. 

• Facilitate testing of samples (see below) by third party laboratories we partner with.

• Input relevant information into our analysis, for example what you eat.

• Improve our service (for example, our food scores and recommendations) and to develop new products and services.

• Train our coaching teams.

• Carry out general scientific research.

• Investigate any complaints or incidents with our Service or products.

2.1.3 Samples

These are biological samples, such as blood samples, that you have sent to third party labs for testing. We do not receive the samples ourselves, only the Test Results (see below). The laboratories are under contract to us and are required by those contracts not to share information about you with any third party except subcontractors who are essential to the carrying out of their work and who are also bound to confidentiality in the same way.

The laboratories will keep samples for different lengths of time depending on the requirements of the locally applicable law (for example, of your country or state). How long a sample is kept may depend on factors such as whether a test is successful or not. If you want further information about this, please contact the individual laboratories.

2.1.4 Test Results

These are the results we receive back from the laboratories that have analyzed your samples, or - if applicable - from devices that measure your physiological data (such as a blood sugar sensor), possibly via intermediate data management systems managed by the manufacturer/distributors of the devices, and which transfer data from the devices to ZOE. An example of a Test Result is the concentration of glucose in your blood. 

We keep this data for as long as you have an account with ZOE, but we will delete it if you specifically request it. The laboratories will keep Test Results for different lengths of time depending on locally applicable law, and could be kept on file for up to 11 years. Some laboratories only receive anonymised/de-identified samples, others require some personal details to conduct the tests. Device manufacturers/distributors hold anonymised/de-identified Test Result data in their data management systems which are used to transfer the data from the sensors to ZOE. 

Analysis of stool samples includes the extraction and sequencing of DNA found in the samples. In a healthy person, almost all of this will be DNA relating to your microbiome - for example enabling us to identify populations of bacteria in your gut. There may be some fragments of your own DNA included in this mix. These will be sequenced along with all other DNA fragments. We may not be able to identify that some fragments are human DNA; nor do we try to use information about your own DNA at present.

In rare cases, for example where someone suffers from gastrointestinal bleeding, there may be more human DNA than usual.

2.1.5 Wearable devices

We may make use of information from a wearable device, such as an Apple Watch or a fitness tracker. We will only collect this information if you consent to us doing so - and your device should not permit us to do so without your agreement anyway. 

Once collected, we will treat the information in exactly the same way as for self-reported health information - including why we process it, what we do with it and how long we will keep it.

2.1.6 Device & Browser Data

Everyone: If you visit our website, or use our app, then we will also collect information about you. Some of this information is sent directly by your device to us, for example: your IP address, the type of browser you are using, the make of your mobile phone and the contents of cookies we set (see our Cookie Policy). We also use third party analytics providers such as Google Analytics, who collect similar information and then supply us with further analysis derived from it.

We process this data in order to:

• Locate errors in our systems or problems our systems may be facing with other systems (such as compatibility with a web browser)

• Improve the functioning of our Service

• Prevent fraud or other criminal activity

This information is automatically sent to us – although there are technical ways you can prevent us from receiving this information (for example by changing the information your browser supplies to us) – the way in which browser and app software works means it is inevitable that we process it.

We routinely delete our web server logs after 90 days, unless we are aware of any serious problem that requires investigation (for example fraud or a hostile attack to our systems), in which case we may preserve any information necessary for that investigation for as long as it is needed. Once the investigation is concluded, we will delete the data.

Customers and quiz: We also extract IP address and device data that we receive at the time you make a purchase or interact with our quiz. We use this in order to help us understand more about our customers - for example where we are receiving orders from - to enable us to do a better job of marketing; and also in case we need to troubleshoot an order or detect fraud. We delete this data after seven days.

Our legal basis for collecting and using device and browser data is our legitimate interests in running and improving a commercial service over the Internet, and in providing a better quality of service than we would otherwise be able to if we were not analyzing device and browser data.

Cookies: Our use of cookies is a little more complicated, so we have written a detailed Cookie Policy, explaining what cookies are; our additional reasons for processing them and explaining in detail how we process different kinds of cookies.

URLs we share: We may also include information linked to you in any URL (web link) that we share with you. We use this to enable us to present personalised information to you when you visit our website. 

For example, if you fill in an initial health quiz and have the results of that quiz emailed to you. The email contains a link that allows you to create an account. That link will contain additional information that will allow us to associate the answer to the health quiz with your account. If we do it this way, it will save you having to enter the information again.

Meta: We make use of various Meta (formerly known as Facebook) tools that will result in the collection and processing of information, including your browser and device data. Some of this may be sent by our systems to Meta; in other cases your browser may automatically make a web connection to Meta which will include information sent automatically by your browser. Our Meta section (below) explains this in detail.

2.1.7 Payment Information

This is information that is necessary in order for payments to be processed by our third party payment processor. For example the amount of the payment, payment card type, payment card number, and your billing address. 

For your security our payment processor only shares the last 4 digits of your payment card number with us.

We retain this data as long as necessary to comply with our legal obligations under tax and corporate law. As soon as we no longer need the information, we delete it.

2.1.8 Correspondence

Where you directly correspond with us (such as sending us an email, online chat message, or call us) we will process information about you concerned with that correspondence, including your email and our responses. We keep that information for as long as necessary to deal with the correspondence – for example if you have made a complaint, as long as needed to deal with the complaint – and then for a further 6 years, in case we need it to defend or establish a legal claim.

2.1.9 Scientific Research Studies

You may, from time to time, be invited to participate in one or more scientific research studies. Participation is entirely voluntary and subject to an additional sign up process, which is managed by an ethics review board. This privacy policy may not accurately describe the data processing carried out during such a research study but if that is the case, the information you receive before participating in the study will explain any differences.

2.1.10 ZOE Communities

If you participate in the ZOE Communities features of our app, the information you share in groups (like Support Groups and Clubs) will be visible to us and other participants. We will also routinely log information about how you interact with these features.

We use this information to:

• provide and personalise the service to you.

• analyse usage of the service, including to improve it. For example, we may identify trends or themes or specific actions we might want to recommend to other members (on an anonymous basis). These might include identifying the most shared recipes and most logged foods, and which group challenges members participate in and how they perform.

• monitor the service for moderation and safety purposes.

• train our staff.

• train our machine learning models on the best recommendations to make to members.

You also have the option of creating a public profile where other members can see your progression, how long you have been a ZOE member, meal plans, recipes and other elements of your ZOE journey. There may be good reasons for us to have to remove parts of, or all of, a conversation at any time. For example if someone in the conversation asks us to delete information about them; or there is a breach of our community guidelines.

We do not plan to keep conversations forever. We will keep conversations in Support Groups for a maximum of 36 months.

We think that conversations in ZOE Clubs could form a useful archive of information helpful to other ZOE members, but we want to balance having an archive with keeping private information longer than necessary. After we have some experience of ZOE Clubs has been working, we will decide how long to retain conversations after that .

2.1.11 Scores

As part of our service, we create scores of particular foods based on information we collect about you. We do not retain those scores and so they will not be available if you make a data subject request.

2.2 Our purposes for using Personal Data

We have explained specific reasons for processing categories of personal data above. Our core purpose is research into diet, into health and into the link between the two. For those purposes we process your self-reported health information, samples (processed on our behalf by third parties), Test Results and some customer information.

We may also process any of the information you provide us for the purposes of providing support and assistance in using the Service.

We may also process your personal information if we are legally required to do so in circumstances where this cannot be reasonably resisted.

We will not collect additional categories of Personal Data or use the Personal Data we collected for different purposes without providing you notice.

3. How we share your Personal Data

If you are a member of our Service, we share information about you only with the following:

• Our group (Zoe Limited, based in the UK, and ZOE US Inc, based in the United States).

• Others carrying out research into diet and/or health including academic research organisations (such as universities) and pharmaceutical companies, for example to assist in the development of new medications. When we do this an anonymous code will always be used to replace your personal details (name, email, phone number, and full address).

• Laboratories engaged by ZOE to carry out tests. These laboratories may use physicians to sign off on authorization on behalf of customers to conduct tests in certain jurisdictions that restrict the sale of direct-to-consumer lab tests without physician authorization (which include most US states). ZOE will share any information that is necessary to obtain an authorization (including self-reported health information and other Test Results) with these laboratories and their physicians.

• Providers of physical devices used to obtain physiological information - for example a continuous glucose monitor.

• Delivery and fulfilment providers we use to send you goods, such as the test kit, and to transport samples

• Contractors providing us services we use for processing Personal Data, which include:

  • Hosting, technology and communication providers.

  • Security and fraud prevention consultants.

  • Analytics providers. 

  • Support and customer service vendors.

  • Payment processors.

• Our professional advisors, such as if we need to consult an attorney for legal advice. In all cases these will be advisors under a professional duty of confidence.

If you purchase goods (such as Daily30+) from us, we share information about you only with the following:

• Our group (Zoe Limited, based in the UK, and ZOE US Inc, based in the United States).

• Delivery and fulfilment providers we use to send you those goods

• Contractors providing us services we use for processing Personal Data, which include:

  • Hosting, technology and communication providers.

  • Security and fraud prevention consultants.

  • Analytics providers. 

  • Support and customer service vendors.

  • Payment processors.

• Our professional advisors, such as if we need to consult an attorney for legal advice. In all cases these will be advisors under a professional duty of confidence.
  

Business Transfers

All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part). Should one of these events occur, we will make reasonable efforts to notify you before your information becomes subject to different privacy and security policies and practices.

Data that is not Personal Data

We may convert Personal Data into anonymous data, that is data which can no longer be linked with identifiable individuals, for example by aggregation of data about multiple individuals. We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. 

For example, we use your self-reported health information, Test Results and some of your customer information to improve our models of the interaction of diet and health. The models we create have no individual information about you, being the aggregation of data from many individuals. 

We may use such anonymous data and share it with third parties for our lawful business purposes, including to analyse, build and improve the Service and other future products and services, and promote our business, provided that the data remains anonymous. We do not delete anonymous data on any particular timetable. You may assume that we could keep it indefinitely. 

4. Tracking tools, advertising and your rights to opt-out

4.1 General tracking

The Service uses cookies and similar technologies such as pixel tags, web beacons, clear GIFs and JavaScript (collectively, “Cookies”) to enable our servers to recognize your web browser, tell us how and when you visit and use our Service, analyze trends, learn about our user base and operate and improve our Service. Cookies are small pieces of data – usually text files – placed on your computer, tablet, phone or similar device when you use that device to access our Service. We may also supplement the information we collect from you with information received from third parties, including third parties that have placed their own Cookies on your device(s). Please note that because of our use of Cookies, the Service does not support “Do Not Track” requests sent from a browser at this time.

For more information about our use of cookies, please see our Cookie Policy.

4.2 Meta

We advertise our Service in a number of places. One of those is Meta (formerly Facebook). In order to make sure that our adverts reach the most appropriate people, we use two of Meta’s “Business Tools”: Meta Pixel and Conversions API. 

For Metak Pixel, we include a small script on our web page, which causes your browser to send a message to Meta whenever it is loaded. Metawill receive:

• Information automatically transmitted by your browser (such as IP address and the version of browser you are using)

• Your ZOE customer ID (which will be meaningless to Meta) and a “Meta browser ID” which is a number intended to be unique to your browser stored in a cookie called “_fbp”.

• A “hashed” version of your email address, telephone number, first name, last name, birth date, zip code, and country. Meta will not be able to convert these back into your original data, but if you have told Meta these pieces of information, Meta will recognise you. 

We also include scripts in the webpage that will cause your browser to send a message to Meta when a page is viewed and if you make a purchase. In both cases, Meta will receive the same information as for Meta Pixel (see above) and for the purchase it will know that you have made a purchase and for how much.

Conversions API works in almost the same way except that we send the information directly to Meta, rather than the information being sent by your browser. This may include your IP address and browser version.

For the purposes of the GDPR, we and Meta Ireland, are joint controllers of at least some of this information. Meta makes use of some of this information for its own purposes. For further information on how Meta Ireland processes personal data, including the legal basis Meta Ireland relies on and the ways to exercise Data Subject rights against Meta Ireland, can be found in Meta Ireland's Data Policy at https://www.facebook.com/about/privacy.

Our legal agreement with Meta governing this processing may be found at https://m.facebook.com/legal/technology_terms. Since the processing is covered by the GDPR, it incorporates a document Meta calls the “Controller Addendum”, which may be found at https://www.facebook.com/legal/controller_addendum. 

Since we are joint controllers (both Meta and we determine the purposes and means of the processing of your data) we are required by the GDPR to agree on which of us is responsible for particular obligations under the GDPR. The Controller Addendum does that. In particular:

• It requires us to give you some of the information in this section.

• We and Meta Ireland have agreed that Meta Ireland is responsible for enabling Data Subjects' rights under Articles 15-20 of the GDPR with regard to the personal data stored by Meta Ireland after we have stopped processing it jointly with them.

Meta gives you some control over the way it targets advertising (see: https://www.facebook.com/help/568137493302217 for instructions) and there are a number of organizations that allow you to opt out of advertising more generally, for example: http://www.aboutads.info/choices and http://www.youronlinechoices.eu/.

See under section 7 below for more information about your rights. If any of the above is unclear, we would be happy to answer questions about it.

Our purpose in using your data in this way is to make sure we do not wastefully advertise to people who are unlikely to be interested in our products. Our legal basis for doing so is our legitimate interest in promoting our services.

4.3 Communicating with you

If you complete the Quiz or purchase our Service or other products, we may contact you from time to time via email to communicate with you about products, services, offers, promotions, rewards, and events offered by us and provide news and information that we think will be of interest to you. 

Alternatively, you can subscribe to our mailing lists to get the latest updates on our scientific discoveries or information about our products and services without creating a ZOE account and we will use the data you provide us with for these purposes. We may also use your data to invite you to live events and ask you to participate in surveys. 

Our legal basis for doing so is, depending on the context, our legitimate interest in promoting our services, or your consent.

Opt-out options: You can always opt out of receiving emails by unsubscribing via the “unsubscribe” link contained in the email. Opting out of these emails or notifications will not end the transmission of service-related emails that are necessary to your use of our service. 

If you unsubscribe from, we will need to keep just enough information on file to make sure we respect your preferences in the future.

4.4 User Research

If you are a ZOE customer or former customer, we may email you to invite you to answer some questions regarding our products or services, participate in new product or service trials, or share feedback with you from customer surveys, interviews or focus groups.

5. Data security and retention

We seek to protect your Personal Data from unauthorised access, use and disclosure using appropriate physical, technical, organisational and administrative security measures based on the type of Personal Data and how we are processing that data. You should also help protect your data by appropriately selecting and protecting your password and/or other sign-on mechanism; limiting access to your computer or device and browser; and signing off after you have finished accessing your account. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.

The periods for which we retain individual categories of Personal Data are explained under the heading “Categories of Personal Data we collect”, but in some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation.

6. Personal data of children

As noted in our Terms of Service, we do not knowingly collect or solicit Personal Data about children under 18 years of age (or under 19 years of age if they live in Alabama or Nebraska). If you are a child under the age of 18, please do not attempt to register for or otherwise use the Service or send us any Personal Data. 

If we learn we have collected Personal Data from a child under 18 years of age, we will delete that information as quickly as possible. If you believe that a child under 18 years of age may have provided Personal Data to us, please contact us at dpo@joinzoe.com. 

7. Your rights as a European Union Data Subject 

7.1 Introduction

Our headquarters, at Zoe Limited, are in the United Kingdom. As a result, you are protected by the United Kingdom’s General Data Protection Regulation ("GDPR"), regardless of your citizenship or where you live in the world. You may have additional rights under the GDPR with respect to your Personal Data, as outlined below.

For this section, we use the terms “Personal Data” and “processing” as they are defined in the GDPR, but “Personal Data” generally means information about a person, and “processing” generally covers actions that can be performed in connection with data such as collection, use, storage, amendment, deletion and disclosure. ZOE will be the controller of your Personal Data processed in connection with the Service.

If there are any conflicts between this section and any other provision of this Privacy Policy, the policy or portion that is more protective of Personal Data shall control to the extent of such conflict. If you have any questions about this section or whether any of the following applies to you, please contact us at dpo@joinzoe.com.

7.2 Personal Data We Collect

The “Categories of Personal Data We Collect” section above details the Personal Data that we collect from you.

7.3 Personal Data Use and Processing Grounds

The “Our Purposes for Using Personal Data” section above explains the purposes for which we process your Personal Data.

We will only process your Personal Data if we have a lawful basis under the GDPR for doing so. Lawful bases for processing include:

• Consent: Except for the specific situations explained below, we process your customer information, self-reported health information; samples and Test Results by consent. You may withdraw your consent at any time and we will stop processing your Personal Data in this way.

• Contractual Necessity: In order to be able to perform our contract, we need to collect customer information we have marked as required and all payment information. In order to be able to provide ZOE Communities, we need to be able to process your conversations in order to provide messaging functionality.

• Compliance with a legal obligation: As explained above, we will sometimes have to process personal data in order to comply with a legal obligation imposed on us. Where those obligations are imposed by UK law, that law will provide us with a lawful ground for processing. For example, we moderate ZOE Communities in order to comply with online safety legislation.

• Legitimate Interest: We process the following categories of Personal Data when we believe it is in our legitimate interest to do so and we do not believe that your rights of freedoms will be unduly interfered with by our processing:

  • Device data is justified by our legitimate interest in maintaining a reliable and secure system, free from errors and external security threats.

  • In relation to ZOE Communities, our processing of data (excluding information about your health) for analytics and product improvement purposes is justified by our legitimate interest in providing you with a better service.

  • Where we are required to process personal data due to a legal obligation in the United States of America, we believe that justifies our processing your data. We believe your rights and freedoms are protected by a combination of US law and the contract between our UK parent company and our US subsidiary.

  • Cookies, for the reasons set out in our Cookie Policy.

All information about your health, which we would normally be forbidden from processing by the GDPR, is processed by us because you have consented to us doing so.

7.4 Sharing Personal Data

The “How We Share Your Personal Data” section above details how we share your Personal Data with third parties. 

7.5 Data Subject Rights

You have certain rights with respect to your Personal Data, including those set forth below. For more information about these rights please see the UK Information Commissioner’s guide to data subject rights. To submit a request to exercise any of these rights, or to ask for more information, please email us at dpo@joinzoe.com. Alternatively, you can submit a request to access or erase your data directly, via https://privacy.zoe.com/zoe. 

Some of the rights below apply only in specific circumstances. In other situations, we may not be able to fully comply with your request, for example if it would be impossible or would involve a disproportionate effort; or if it jeopardises the rights of others; but in those circumstances, we will still respond to notify you of such a decision. In some cases, we may also need you to provide us with additional information, which may include Personal Data, if necessary to verify your identity and the nature of your request.

• Access: You can request more information about the Personal Data we hold about you and request a copy of such Personal Data.

• Rectification: If you believe that any Personal Data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data. 

• Erasure: In some situations you may have a right to request that we erase some or all of your Personal Data from our systems.

• Withdrawal of Consent: If we are processing your Personal Data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time. Please note, however, that if you exercise this right, you may have to then provide express consent on a case-by-case basis for the use or disclosure of certain of your Personal Data, if such use or disclosure is necessary to enable you to utilize some or all of our Service. 

• Portability: You can ask for a copy of your Personal Data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible. 

• Objection: You can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes.

• Restriction of Processing: You can ask us to restrict further processing of your Personal Data.

• Right to File Complaint: You have the right to lodge a complaint about ZOE’s practices with the UK’s Information Commissioner.

Our Data Protection Officer is contactable at dpo@joinzoe.com.

7.6 International Transfers of Personal Data

ZOE is based in the United Kingdom, but also has operations in the United States. In providing the Service, we will transfer Personal Data between the UK, European Union and the USA and possibly other countries. For example, Zoe Limited needs to transfer Personal Data to ZOE US Inc, as well as to third party suppliers. Personal Data in the USA will be governed by US law and in other countries by the law of those countries. Because the protection of Personal Data is very different in the USA (and other countries) from the UK and the European Union, the GDPR requires us to put in place safeguards which will ensure that your GDPR rights continue to be respected in the USA and those other countries.

When transferring Personal Data outside the UK and the EU, ZOE typically implements standard contractual clauses (requiring the recipient to comply with high standards of data protection and giving data subjects rights to sue the recipient for failure to do so). Where required, ZOE also conducts risk assessments on the transfers and the protections available in the destination countries. Alternatively, we may or rely on current adequacy regulations made by the Information Commissioner’s Office, for example those that hold that the protection of personal data in the European Union is “adequate” (or in other words it is up to the standards of the UK GDPR so that no additional safeguard is needed).

If you wish to see a copy of the standard contractual clauses we use, please contact us at the contact information given at the end of this privacy policy.

If, in the future, there are alternative means of giving you equivalent protection to the GDPR when we transfer data outside the UK, for example of statutory codes of practice are approved for our use, then we may use those methods instead of any described above, but in all cases we will satisfy ourselves that your Personal Data will be protected.

8. California resident rights

If you are a California resident, you have the rights set forth in this section. Please see the “Exercising your rights” section below for instructions regarding how to exercise these rights. Please note that we may process Personal Data of our customers’ end users or employees in connection with our provision of certain services to our customers. If we are processing your Personal Data as a service provider, you should contact the entity that collected your Personal Data in the first instance to address your rights with respect to such data.

If there are any conflicts between this section and any other provision of this Privacy Policy and you are a California resident, the portion that is more protective of Personal Data shall control to the extent of such conflict. If you have any questions about this section or whether any of the following rights apply to you, please contact us at dpo@joinzoe.com.

8.1 Access

You have the right to request certain information about our collection and use of your Personal Data over the past 12 months. In response, we will provide you with the following information:

• The categories of Personal Data that we have collected about you.

• The sources from which that Personal Data was collected.

• The business or commercial purpose for collecting or selling your Personal Data.

• The categories of third parties with whom we have shared your Personal Data.

• The specific pieces of Personal Data that we have collected about you.

If we have disclosed your Personal Data to any third parties for a business purpose over the past 12 months, we will identify the categories of Personal Data shared with each category of third party recipient. If we have sold your Personal Data over the past 12 months, we will identify the categories of Personal Data sold to each category of third party recipient.

8.2 Deletion

You have the right to request that we delete the Personal Data that we have collected about you. Under the California Consumer Privacy Act (CCPA), this right is subject to certain exceptions: for example, we may need to retain your Personal Data to provide you with the Service or complete a transaction or other action you have requested. If your deletion request is subject to one of these exceptions, we may deny your deletion request. 

8.3 Exercising your rights

To exercise the rights described above, you or your Authorised Agent (defined below) must send us a request that (1) provides sufficient information to allow us to verify that you are the person about whom we have collected Personal Data (we will use our existing authentication practices (your username and password) as the mechanism for verifying your identity, or if such information is unavailable then we will use alternative validation data to verify your identity to a reasonable degree of certainty), and (2) describes your request in sufficient detail to allow us to understand, evaluate and respond to it. Each request that meets both of these criteria will be considered a “Valid Request.” We may not respond to requests that do not meet these criteria. We will only use Personal Data provided in a Valid Request to verify your identity and complete your request. You do not need an account to submit a Valid Request.

We will work to respond to your Valid Request within 45 days of receipt. We will not charge you a fee for making a Valid Request unless your Valid Request(s) is excessive, repetitive or manifestly unfounded. If we determine that your Valid Request warrants a fee, we will notify you of the fee and explain that decision before completing your request.

You may submit a Valid Request using the following methods:

• Email us at: dpo@joinzoe.com 

• Portal for data access and erasure requests only: https://privacy.zoe.com/zoe

You may also authorise an agent (an “Authorised Agent”) to exercise your rights on your behalf. To do this, you must provide your Authorised Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorised Agent when they make a request on your behalf.

8.4 Personal Data sales opt-out and opt-In

We will not sell your Personal Data, and have not done so over the last 12 months.

We Will Not Discriminate Against You for Exercising Your Rights Under the CCPA

We will not discriminate against you for exercising your rights under the CCPA. We will not deny you our goods or services, charge you different prices or rates, or provide you a lower quality of goods and services if you exercise your rights under the CCPA. However, we may offer different tiers of our Service as allowed by applicable data privacy laws (including the CCPA) with varying prices, rates or levels of quality of the goods or services you receive related to the value of Personal Data that we receive from you.

9. Other privacy rights

California resident rights

Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of Personal Data to third parties for such third parties’ direct marketing purposes; in order to submit such a request, please contact us at dpo@joinzoe.com.

Your browser may offer you a “Do Not Track” option, which allows you to signal to operators of websites and web applications and services that you do not wish such operators to track certain of your online activities over time and across different websites. Our Service does not support Do Not Track requests at this time. To find out more about “Do Not Track,” you can visit www.allaboutdnt.com.

Nevada resident rights

If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Data to third parties who intend to license or sell that Personal Data. You can exercise this right by contacting us at dpo@joinzoe.com with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your account. Please note that we do not currently sell your Personal Data as sales are defined in Nevada Revised Statutes Chapter 603A. 

10. Changes to this Privacy Policy

We’re constantly trying to improve our products and services, which includes collecting new kinds of data or carrying out new analyses on that data, so the information on this page may need to change from time to time.

11. How to contact us:

If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your Personal Data or your choices and rights regarding such collection and use, please do not hesitate to contact us at dpo@joinzoe.com. 

For more general enquiries, please can contact us at hello@joinzoe.com. 

You may contact our Data Protection Officer at dpo@joinzoe.com.

To submit a data access or erasure request, please go to https://privacy.zoe.com/zoe.