privacy policy

Last updated: 2 July 2026

LUNCHBOX • KIDS respects your privacy and aims to handle your personal information clearly, responsibly and securely.

This Privacy Policy explains what information we collect when you visit lunchbox.kids, subscribe to our emails, download The Lunchbox Formula, join a waitlist, contact us or interact with us through Instagram.

1. Who is responsible for your information?

The data controller is:

David Gomes, operating as LUNCHBOX • KIDS
Jan Van Rijswijcklaan, 2018 Antwerp, Belgium
Email: hello@lunchbox.kids

The data controller determines why and how personal information is used.

2. Information we collect

Depending on how you use the website, we may collect:

Newsletter, downloads and waitlists

When you subscribe, download The Lunchbox Formula or join The Lunchbox Manual waitlist, we may collect:

• your email address;
• the form or campaign through which you subscribed;
• the date and time of subscription;
• your subscription and consent status;
• emails opened and links clicked;
• your email preferences and unsubscribe history.

When you sign up through Instagram, we may also receive information connected with that interaction, such as your Instagram username, messages or automation responses.

People downloading The Lunchbox Formula or joining certain waitlists may also be added to the LUNCHBOX • KIDS newsletter where this is clearly stated on the relevant form.

Contact and partnership forms

When you contact us, we may collect:

• your name;
• email address;
• message;
• brand or company name, where relevant.

Website and device information

Where you consent to analytics or advertising technologies, we may collect:

• IP address or approximate location;
• device, browser and operating-system information;
• pages viewed;
• referring website or campaign;
• interactions with pages, forms and links;
• cookie and advertising identifiers.

Basic technical data may also be processed where necessary to host, secure and operate the website.

3. How we use your information

We may use your information to:

• send requested downloads and resources;
• manage newsletter subscriptions and waitlists;
• send lunchbox content, product news, offers and launch information;
• respond to enquiries and partnership requests;
• measure and improve our emails and website;
• understand which content and campaigns are useful;
• measure advertising performance and show relevant advertising;
• protect the website and prevent misuse;
• comply with legal obligations and establish or defend legal claims.

4. Our legal bases

We rely on the following legal bases:

Consent

We rely on consent to:

• send marketing newsletters and product communications;
• place or access non-essential analytics and advertising cookies;
• use Google Analytics and the Meta Pixel;
• carry out related engagement tracking where consent is legally required.

You can withdraw your consent at any time. Withdrawing consent does not affect processing that occurred before the withdrawal.

Steps requested by you

We process information where necessary to:

• send a resource you requested;
• manage your place on a waitlist;
• respond to a partnership or business enquiry.

Legitimate interests

We may rely on our legitimate interests to:

• respond to ordinary enquiries;
• understand and improve our services and communications;
• maintain records of business correspondence;
• protect the website, systems and users;
• prevent fraud, misuse and security incidents.

We only rely on legitimate interests where those interests are not overridden by your rights.

Legal obligations

We may process information where required by law, regulation, a court order or another valid legal request.

5. Email communications

Our email communications are managed using MailerLite.

MailerLite may record information such as subscription status, delivery, email opens and link clicks. We use this information to understand engagement, improve our emails and avoid sending content that is consistently irrelevant.

You can unsubscribe at any time using the unsubscribe link included in every marketing email.

We may retain a limited suppression record after you unsubscribe so that we can respect your request and avoid adding you back to marketing communications accidentally.

6. Instagram and ManyChat

We use ManyChat to provide some Instagram automations and collect email addresses where users choose to submit them.

Information collected through these interactions may be transferred through Make and added to MailerLite.

Instagram and Meta also process information under their own privacy terms. Your use of Instagram is governed separately by Meta.

7. Contact and partnership forms

Website forms may use Make to transfer the information you submit to our email inbox or other relevant service.

We use this information only to review and respond to the enquiry, manage the potential business relationship and retain appropriate correspondence records.

Please do not submit sensitive information about yourself or a child through these forms.

8. Analytics and advertising

With your consent, we use:

• Google Analytics 4 to understand how visitors use the website;
• Google Tag Manager to manage approved website scripts;
• Meta Pixel to measure advertising activity, website conversions and campaign performance.

These services may receive information about your device, browsing activity, interactions and advertising identifiers.

Google Tag Manager does not itself function as an analytics service, but it can load other technologies. Any analytics or advertising tools managed through it must remain disabled until the relevant consent is provided.

You can reject these technologies or change your choice through the website's Cookie Settings.

9. Affiliate links

Some website or newsletter links may be affiliate links. This means LUNCHBOX • KIDS may receive a commission if you click a link and later make a purchase, without increasing your purchase price.

When you click an affiliate link, you leave our website. The merchant or affiliate provider may process information and place its own cookies under its privacy and cookie policies.

We do not receive your full payment details from affiliate merchants.

10. Who we share information with

We may share information with providers that help us run the website and communications, including:

• GitHub, for website hosting;
• MailerLite, for email marketing;
• ManyChat, for Instagram automation;
• Make, for data transfer and workflow automation;
• Google, for analytics and tag management;
• Meta, for advertising measurement;
• email, security and technical service providers;
• professional advisers or authorities where legally necessary.

These providers may process information only as needed to provide their services or under their own legal responsibilities.

We do not sell or rent personal information.

11. International transfers

Some service providers may process information outside Belgium or the European Economic Area.

Where personal information is transferred internationally, we rely on safeguards recognised under data-protection law, such as:

• an adequacy decision;
• the EU–US Data Privacy Framework, where applicable;
• Standard Contractual Clauses;
• other lawful transfer safeguards.

12. How long we keep information

We use the following general retention approach:

• Active newsletter subscribers: while you remain subscribed.
• Unsubscribed contacts: a limited suppression and consent record may be retained as necessary to honour the unsubscribe request and demonstrate compliance.
• Waitlist information: while the waitlist or related product launch remains active, followed by the applicable newsletter retention period where newsletter consent was provided.
• Contact enquiries: generally up to two years after the last meaningful contact.
• Partnership enquiries: generally up to two years after the last meaningful contact, or longer where needed for an active agreement or legal claim.
• Analytics and advertising information: according to the relevant cookie durations and provider settings.
• Security information: for as long as reasonably necessary to investigate or prevent security incidents.

Information may be kept for longer where legally required or necessary for legal claims.

13. Children's privacy

The website is intended for parents, caregivers and other adults.

We do not knowingly collect personal information directly from children through the current website, and our forms do not request children's names, photographs, health information or other identifying information.

Contact us if you believe a child has submitted personal information so that we can investigate and, where appropriate, delete it.

14. Your rights

Depending on the circumstances, you may have the right to:

• access your personal information;
• correct inaccurate information;
• request deletion;
• restrict processing;
• receive certain information in a portable format;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• withdraw consent at any time;
• lodge a complaint with a data-protection authority.

Requests can be sent to hello@lunchbox.kids.

We may need to verify your identity before completing a request. Data-protection requests are generally answered within one month, subject to legally permitted extensions. These rights and information requirements are set out principally in Articles 13–22 GDPR.

You may also lodge a complaint with the Belgian Data Protection Authority.

15. Security

We take reasonable technical and organisational steps to protect personal information against loss, misuse, unauthorised access, disclosure or alteration.

No online system is completely secure, so absolute security cannot be guaranteed.

16. Changes to this policy

We may update this policy when the website, service providers or legal requirements change.

The latest version will always be published on this page with an updated revision date.

17. Contact

Questions or privacy requests can be sent to:

hello@lunchbox.kids

---