Privacy Policy

Our box is built from what you tell us: tastes, what you avoid, allergies, votes. So we owe you clarity about what we do with that data. This policy says it in plain English, without leaving anything out. Version of 27 September 2026.

1. Who is responsible

Obviously Magic S.A., registered office at Parque de Ciência e Tecnologia da Ilha Terceira, S/N, Terra Chã, 9700-702 Terra Chã, Portugal, company number 516315781, owner of the Oh!My Snacks brand. Email: hello@ohmysnacks.net. Data protection officer: Júlio Silva, julio@ohmysnacks.net. We comply with Regulation (EU) 2016/679 (GDPR) and Portuguese Law 58/2019 and, for UK residents, with the UK GDPR and the Data Protection Act 2018.

2. What data we process

• Account and orders: name, email, mobile number, delivery and billing addresses, tax number if you ask for it on the invoice, order and subscription history. Card details are handled by the payment provider and are never stored on our systems.
• Quiz: your answers about tastes, categories and flavours, goals and, if you give them, allergies, intolerances and health conditions. The latter are health data, a special category of data, and we only process them with your explicit consent, asked for in the quiz itself.
• Votes and preferences: what you vote on each snack through the QR code or in your account, the snacks you fix to always come, and the decisions you make when one preference clashes with another.
• Chat: the messages you exchange with the nutrition team in your account. They may contain health data, because that's where customers tell us about it. Messages are stored encrypted.
• Communications: the emails we send you, whether you open them and which links you click, when your marketing consent is on.
• Browsing: technical data and cookies, described in the Cookie Policy.

We don't process data of people under eighteen: the account belongs to an adult, even when the box is for a child.

3. What we use it for, and on what basis

• Composing, invoicing and delivering your box, and managing the subscription and the account: performance of the contract.
• Choosing the snacks from your quiz and votes, including keeping out what your allergies and conditions rule out: performance of the contract and, for health data, your explicit consent. Without that consent we can't compose the box safely, and we don't sell it.
• Answering you on the chat and in support: performance of the contract.
• Sending you service emails (confirmation, dispatch, notice before each charge, failed payment, subscription changes) and the emails that personalise your box (requests to vote and notices about what goes into your next box): performance of the contract. These emails don't depend on marketing consent.
• Sending you news and offers by email: your consent, given at registration or in the quiz and withdrawn whenever you like, in any email or in your account.
• Improving the range with votes, in aggregate and without identifying you: our legitimate interest in improving the product. We never publish your vote linked to you.
• Security, fraud prevention and tax and accounting obligations: legitimate interest and legal obligation.
• Measuring the site and showing you relevant advertising: your consent, given in the cookie manager.

We don't make automated decisions with legal effects about you. Composing the box uses tools that propose snacks from your answers, but a nutritionist on our team always approves each box.

4. Who we share it with

Only with those who need it for the service to work, and always under a processing agreement:

• Shopify, the shop and account platform, and Appstle, which manages subscriptions and renewals.
• Payment providers (Shopify Payments, PayPal, Google Pay), which receive payment data directly.
• Klaviyo, for service emails and, with your consent, marketing emails.
• Microsoft Azure and DigitalOcean, where our systems and databases run, in data centres in the European Union.
• Couriers, which receive name, address and mobile number for delivery, and Huboo Technologies Ltd, our warehouse in Bristol, for deliveries in the UK.
• Invoicing software, to issue the invoices the law requires.
• Google, Meta, TikTok and Microsoft Clarity, only with your cookie consent, to measure the site and advertising.

Some of these providers process data outside the European Union, mostly in the United States, and, for UK residents, outside the UK. When that happens, we rely on adequacy decisions or on the standard contractual clauses approved by the European Commission and the UK equivalents. We don't sell data to anyone.

5. How long we keep it

• Account, quiz, votes and chat: for as long as the account exists. If you cancel the subscription, we keep your preferences and votes for ten years, the same period as invoices, so you can come back without starting from scratch, and delete or anonymise them after that, unless you ask sooner.
• Orders and invoices: ten years, as tax law requires.
• Marketing consent and emails sent: until you withdraw consent or up to two years without any interaction from you.
• Enquiries from people who aren't customers: twelve months after the reply.
• Consent records: for as long as needed to prove the consent existed.

6. Your rights

You can ask us for access to your data, its rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest; and you can withdraw any consent at any time, without affecting the processing done until then. Write to julio@ohmysnacks.net or hello@ohmysnacks.net; we reply within a month. If you think we've handled your data badly, you can complain to the Portuguese data protection authority, CNPD (www.cnpd.pt); if you live in the UK, to the Information Commissioner's Office (ico.org.uk); if you live in Spain, to the Agencia Española de Protección de Datos (www.aepd.es).

7. Security

Data travels encrypted, chat messages are stored encrypted, access to systems is restricted to the team that needs it and logged, and payment data never touches our servers. No system is infallible; if we detect a data breach that may affect you, we notify you and the authority within the legal deadlines.

8. Changes

When this policy changes, we publish the new version with its date and, if the change affects you in a meaningful way, we email you.