Your GDPR / FADP rights

Last updated: 16 May 2026

You have specific rights over your personal data depending on the applicable legal framework:

EU residents (including Italy): General Data Protection Regulation (GDPR — EU Reg. 2016/679) + the Italian Privacy Code (Legislative Decree 196/2003 as updated);
Residents in Switzerland: Federal Act on Data Protection (FADP/nLPD, in force since 1 September 2023) + the Ordinance on Data Protection (DPO).

The two frameworks are broadly aligned. In Leileat you can exercise these rights at any time, free of charge.

Your rights

GDPR Art. 15 · FADP Art. 25 · Access

Know what data we hold about you

You can request a copy of the personal data we process, the purposes of the processing, and the recipients.

How: Open the app → Profile → Download my data.

GDPR Art. 16 · FADP Art. 32 · Rectification

Correct inaccurate data

You can independently modify your profile, weight, goals, allergies, and onboarding data directly in the app.

How: Open the app → Profile → Edit the individual fields.

GDPR Art. 17 · FADP Art. 32(2)(c) · Erasure

Delete your account and data

You can delete your account and all personal data at any time. Deletion is irreversible.

How: Go to the Delete account page.

GDPR Art. 18 · FADP Art. 32 · Restriction

Suspend the processing

You can request the temporary suspension of the processing (e.g. during an accuracy check).

How: Write to privacy@leileat.com.

GDPR Art. 20 · FADP Art. 28 · Portability

Export your data in a readable format

You can download your data in CSV/JSON format to take it to another app.

How: Open the app → Profile → Download my data.

GDPR Art. 21 · FADP Art. 30 · Objection

Object to marketing or profiling

You can deactivate at any time the consents for marketing, analytics, and AI personalisation.

How: Open the app → Profile → Privacy & Data → Manage consents.

GDPR Art. 7 · FADP Art. 6 · Withdrawal of consent

Withdraw previously given consents

Each consent (analytics, AI, marketing, health data) can be withdrawn at any time, without prejudice to the lawfulness of previous processing.

How: Open the app → Profile → Privacy & Data.

GDPR Art. 77 · FADP Art. 49 · Complaint to the Authority

File a complaint with the supervisory Authority

If you believe that the processing of your data infringes the GDPR or the FADP, you can file a complaint:

EU/IT residents: Italian Data Protection Authority — garanteprivacy.it;
CH residents: Federal Data Protection and Information Commissioner (FDPIC / EDÖB / PFPDT) — edoeb.admin.ch.

Response times

For requests sent by email, we undertake to respond within 30 days (GDPR Art. 12 / FADP Art. 25(7) deadline). In complex cases, an extension of a further 60 days may be necessary, of which we will inform you within the initial deadline.

Special category of data (Art. 9 GDPR / Art. 5(c) FADP)

Some of the data we process falls within the category of personal data requiring special protection (GDPR Art. 9 — FADP Art. 5 let. c):

Allergies and intolerances declared;
Weight, height, age (health data);
Vegan / vegetarian diet (potential philosophical belief);
Calories burned / steps read from Apple Health / Health Connect.

For this data, the legal basis is explicit consent (GDPR Art. 9(2)(a) / FADP Art. 6(7)) which we ask you for during onboarding and which you can withdraw at any time.

EU representative (GDPR Art. 27)

As a Controller established in Switzerland processing data of EU residents on a non-occasional basis, we have the obligation to appoint a representative within the EU under Art. 27 GDPR.

Update in progress: the designation of the EU representative is being formalised and the details will be published on this page within 30 days of operational launch on the Italian market. In the meantime, you can contact the Controller directly at the contact details below for any GDPR request.

Data Controller

Laurent Drenica ("Leileat")
Sagefeldweg 47E, 2504 Biel/Bienne, Switzerland
Email: privacy@leileat.com
Phone: +41 79 801 64 56

Data transfer EU → Switzerland: Switzerland is recognised as a third country with an adequate level of protection by the European Commission (Adequacy Decision 2000/518/EC, renewed 2024). The transfer is therefore lawful under Art. 45 GDPR.