Privacy Policy

This Privacy Policy explains how Gluten Freedom Compass ("we", "us", "our") collects, uses and protects personal data when you visit our website, join our waitlist, purchase the Food-Freedom Protocol, book a consultation, or order from the Bakehouse. It is written to align with the EU / UK General Data Protection Regulation (GDPR) and Kenya's Data Protection Act, 2019.

1. Who we are (Data Controller)

Gluten Freedom Compass, based in Nairobi, Kenya. Contact: wellness@glutenfreedomcompass.com · +254 798 078 809.

2. What personal data we collect

• Contact details: name, email, phone.
• Account & platform data: login credentials, profile, and content you create in the tracking dashboard (daily food logs, symptom notes, progress entries).
• Health-related information you volunteer: symptoms, dietary responses and progress notes.
• Transaction data: purchases, orders, invoice details (payment card data is handled by our payment processors — we do not store card numbers).
• Technical data: IP address, browser, device and pages visited.

3. Why we process it (legal bases)

• Contract: to deliver the protocol, platform access, consultations and bakery orders you buy.
• Consent: for marketing emails, optional cookies, and any explicit health-related tracking you enable. You may withdraw consent at any time.
• Legitimate interests: to secure our website, prevent fraud, and improve our services.
• Legal obligation: to keep tax, accounting and other records the law requires.

4. Your rights (GDPR)

You have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate data or complete incomplete data.
• Ask us to erase your data ("right to be forgotten") where the law allows.
• Restrict or object to certain processing.
• Receive a portable copy of your data in a common electronic format.
• Withdraw consent at any time (without affecting past lawful processing).
• Lodge a complaint with a supervisory authority (in Kenya: the Office of the Data Protection Commissioner).

To exercise any of these rights, email wellness@glutenfreedomcompass.com. We respond within 30 days.

5. Sharing with third parties

We share personal data only with processors who help us run the service — for example, hosting, email delivery, payment processing and analytics. These providers are bound by data-processing agreements and may only use your data on our instructions. We do not sell personal data.

6. International transfers

Some of our processors are located outside Kenya or the EEA. Where transfers occur, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

7. Retention

We keep personal data only as long as necessary to provide the service, comply with legal obligations, resolve disputes and enforce agreements. When you close an account, we delete or anonymise your personal data within 90 days unless the law requires us to keep it longer (typically 7 years for financial records).

8. Security

We apply technical and organisational measures — encryption in transit, access controls, regular backups — to protect your data. No system is perfectly secure; you agree to use strong, unique passwords and to notify us of any suspected breach.

9. Children

Our services are intended for adults. We do not knowingly collect personal data from children under 16. Parents managing a child's diagnosis may enter the child's dietary information on the parent's own account, under their responsibility.

10. Cookies

See our Cookie Policy for details on the cookies we use and how to manage them.

11. Changes to this Policy

We may update this Policy. Material changes will be announced on the site or by email at least 30 days before they take effect.