Dear Customer,<p>
</p>
<p>We are pleased that you are interested in data protection.
We would like to<br>
give you an easily understandable overview of our data protection process.</p>
<p>Our goal is to provide you with an amazing customer experience that also<br>
means that you can always trust us, that we are always transparent and<br>
honest to you.
Your trust in our product is the reason why we can provide<br>
you with an amazing customer experience.
We would like to thank you for this<br>
cooperation.</p>
WHO WE ARE
<p>We are <b>Delivery Hero Bulgaria Ltd.</b>, but usually we just use the name foodpanda.
You can always contact us via the following methods:<br>
Sofia, 2 Srebarna<br>
Poste code 1407<br>
E-mail address: contact@foodpanda.bg</p>
<p>While visiting our website, using our app and platform, registering as a<br>
user or placing orders, you agree to this privacy policy.</p>
<p>As data controller, we determine how we process your personal data, for what<br>
purposes and by what means.
While we are required by law to provide you with<br>
all of the following information, we do so primarily out of the belief that<br>
a partnership should always be honest.</p>
<p>As data controller we are responsible that all our processing activities are<br>
in accordance with legal requirements but also you may reasonably expect<br>
these processing of your personal data (link to “legitimate<br>
interests”).</p>
<p>If you have any questions about data protection at foodpanda, you can also<br>
contact our data protection officer at any time by sending an email to contact@foodpanda.bg.</p>
<p>We have a global Corporate Privacy Officer as we are also a member of the<br>
large and fascinating family of the Delivery Hero Group.</p>
<p>As a family, we make certain decisions together.
Both our parent company,<br>
Delivery Hero SE, Oranienburger Straße 70, 10117 Berlin and we jointly<br>
decide which means we will use to process your personal data and which<br>
purposes we consider to be appropriate.</p>
<p>We will continue to be your point of contact if you have any questions about<br>
data protection.</p>
PRIVACY IS YOUR RIGHT AND YOU HAVE THE CHOICE
<p>As a customer you have the choice which information you would like to share<br>
with us.
Of course, we need some information for the fulfillment of our<br>
contract.
However, this does not always require all the data which you can<br>
make available to us.</p>
<p>You can take the following steps to disclose less information about<br>
yourself:</p>
<p>Cookies: You can install additional add-ons in your browser that block<br>
unnecessary cookies.
By doing so, you will not see any interest-based<br>
advertisements.</p>
<p>Advertising: If you do not want to receive newsletters from us, you can<br>
unsubscribe at any time.
In this case, we will not be able to send you any<br>
cool offers.</p>
<p>No data sharing: If you do not want to share any information with us at all,<br>
that’s a shame.
In this case we cannot convince you how great our<br>
products are.</p>
YOU CAN ALSO MAKE USE OF THE FOLLOWING RIGHTS AT ANY TIME:
Right to access
<p>You have the right to be informed which data we store about you and how we<br>
process this data.</p>
Right to rectification
<p>If you notice that stored data is incorrect, you can always ask us to<br>
correct it.</p>
Right to erasure
<p>You can ask us at any time to delete the data we have stored about you.</p>
Right to restriction of processing
<p>If you do not wish to delete your data, but do not want us to process it<br>
further, you can ask us to restrict the processing of your personal data.
In<br>
this case, we will archive your data and only reintegrate it into our<br>
operative systems if you so wish.
However, during this time you will not be<br>
able to use our services, otherwise we will process your data again.</p>
Right to data portability
<p>You can ask us to transmit the data stored about you in a machine-readable<br>
format to you or to another responsible person.
In this context, we will<br>
make the data available to you in JSON format.</p>
Right to object to the processing of your data
<p>You can revoke your consent at any time or object to the further processing<br>
of your data.
This also includes objecting to our processing, which we<br>
process without your consent but based on our legitimate interest.
This<br>
applies, for example, to direct marketing.
You can object to receiving<br>
further newsletters at any time.
If you do not agree with one of our<br>
processing purposes based on our legitimate interest or wish to object to<br>
it, you may object to the processing at any time on grounds relating to his<br>
or her particular situation.
Please write an email to contact@foodpanda.bg.
In<br>
this case we will review the processing activity again and either stop<br>
processing your data for this purpose or explain to you our reasons worth<br>
protecting and why we will continue with the processing.</p>
Automated decision making
<p>We also process your personal data in the context of algorithms in order to<br>
simplify our processes.
Of course, you have the right not to be subject to<br>
decisions based solely on automated processing.
If you believe that we have<br>
denied your access in an unjustified way, you can always contact us at<br>
contact@foodpanda.bg.
In this case, we will examine the case separately and<br>
decide on a case-by-case basis.</p>
Right of complaint
<p>If you believe that we have done something wrong with your personal data or your rights, you can complain to the appropriate supervisory authority at any time.</p>
<p>The supervisory authority responsible for us is:</p>
<p>Datainspektionen<br>
Phone: 08-657 61 00<br>
E-mail: datainspektionen@datainspektionen.se<br>
To exercise your rights, you can contact contact@foodpanda.bg at any time.</p>
WHAT DATA WE PROCESS
<p>In the following description of our processing activities, we refer in each<br>
case to categories of personal data.
A category includes several personal<br>
data, which are usually processed together for the purposes.</p>
<p>Personal data is information that can identify you or even make you<br>
identifiable.</p>
<p>We generally process the following categories of personal data for the<br>
following reasons:</p>
Contact Information:
<p>Name, address, telephone number, email address, your ID from any social<br>
media (if applicable).<br>
Reason:<br>
If you contact us, we collect this data because we need to know who we are<br>
talking to and what we have been talking about so that we can help you with<br>
your reason for contacting us.
This also applies if you leave comments on<br>
social media on our fan pages.
We do not combine this data with your profile<br>
data on our platform, but we can still identify you by your social media ID.</p>
Location data:
<p>Address, Postcode, City, Country, Longitude, Latitude<br>
Reason:<br>
We need these data to be able to deliver your orders.
We create the<br>
longitude and latitude automatically in order to be able to process your<br>
delivery address in our other linked systems, such as our Rider app, and to<br>
display your address to our riders or riders of restaurants or shops.</p>
Profile data (master data):
<p>Name, email address, password, telephone number, delivery addresses,<br>
interests, demographic data (age, delivery address)<br>
Reason:<br>
This data is your master data, which we absolutely need for our services.<br>
Without an email address / telephone number and a password, you cannot<br>
create a profile.
Together with your name, this is your master data.
We need<br>
your age to ensure that you are not a minor.</p>
Device information and access data:
<p>Device ID, device identification, operating system and corresponding<br>
version, time of access, configuration settings, information on Internet<br>
connection (IP address)<br>
Reason:<br>
With each access this information is stored by us for technical reasons.
We<br>
also use parts of this information to detect suspicious behavior at an early<br>
stage and to avert damage.</p>
Order information:
<p>Order history, selected restaurants or shops, invoices, order ID, comments<br>
on orders, information on payment method, delivery address, successful<br>
orders and cancelled orders<br>
Reason:<br>
Each time you place an order, this information will be added to your<br>
profile.
You can view all this information in your profile at any time.
The<br>
information should give you an overview of your own interests and previous<br>
orders.
We will also use the same information to improve our services.
In<br>
addition, we will anonymize this information when you request a deletion or<br>
when your profile becomes inactive in order to continue to use this<br>
information in an anonymized form to optimize our services.</p>
Communication data
<p>Name, email address, telephone number, device ID<br>
Reason:<br>
If you would like to receive a newsletter, an SMS or an in-app push<br>
notification from us, we need certain information to send you the messages.<br>
Instead of addressing you with “Hey You”, we find it more customer<br>
friendly to address you with your name.
This category of personal<br>
information is also used by us to contact you, for example, if a product<br>
cannot be delivered and we want to offer you an alternative instead.<br>
Similarly, to make the online ads you may see from us more relevant, we may<br>
use this data.</p>
Payment information:
<p>Payment method, pseudonymized credit card information<br>
Reason:<br>
We need this information to track your payments and assign them to the<br>
orders you have placed.</p>
Delivery information:
<p>Name, delivery address, phone number, order ID<br>
Reason:<br>
In accordance with the principle of data minimization, we only provide our<br>
riders and partners with the information that they need from you to prepare<br>
and deliver your order.</p>
FOR WHICH PURPOSES WE PROCESS DATA
<p>We process your personal data only in accordance with the strict legal<br>
requirements.
We pay particular attention to the fact that all principles<br>
for the processing of personal data are taken into account.
The Delivery<br>
Hero Group pays great attention to transparency.
Therefore, we only process<br>
your data if this is lawful and you can reasonably expect it to be<br>
processed.
If, in the course of our evaluation, we come to the conclusion<br>
that the processing cannot reasonably be expected, we will only carry out<br>
the processing with your express consent.</p>
Account creation, SSO registration, administration of your profile
<p>In order to be able to offer you our services, the processing of your<br>
personal data is essential.
Much of this data you transmit to us and other<br>
parts of the data we collect automatically when using our platforms.<br>
Nevertheless, we endeavor to keep the amount of data as small as possible.<br>
You can help us by only sharing necessary data with us that we need to<br>
fulfill our contractual obligations.</p>
Account creation
<p>When creating a customer account, you will be asked to enter your master<br>
data.
This is absolutely necessary, as we cannot create a customer profile<br>
without this data.
Your email address and telephone number are particularly<br>
important, as we can use this information to identify you in our system the<br>
next time you want to log in again.
Furthermore, we would like to ask you to<br>
choose your password carefully.
Do not use the same password on multiple<br>
websites.
Your password should also be at least 12 characters long, at least<br>
one lowercase letter, one uppercase letter, one special character<br>
(!?#,%&.
etc.) and one digit.
Please do not share neither your password<br>
nor your email address with anyone else.</p>
<p>Categories of personal data:</p>
<p>Profile data (master data)</p>
<p>Device information and access data</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (b) GDPR, performance of contract</p>
Login
<p>If you already have an existing customer account, you will need to enter<br>
your email address and password to log in.
If we detect irregularities<br>
during registration, such as entering the wrong password several times, we<br>
will take appropriate measures to prevent damage to you and us.</p>
<p>Categories of personal data:</p>
<p>Profile data (master data)</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (b) GDPR, fulfilment of contract for registration;</p>
<p>Art.
6 Para.
1 (f) GDPR, for the security measures</p>
Single-Sign-On
Facebook
<p>If you have a Facebook profile, you can register on our website to create a<br>
customer account or to register using the social plugin “Facebook<br>
Connect” of the social network Facebook, which is operated by Facebook<br>
Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (“Facebook”), within<br>
the framework of the so-called Single Sign On technology.
You can recognize<br>
the social plugins of “Facebook Connect” on our website by the<br>
blue button with the Facebook logo and the inscription “Log in with<br>
Facebook” or “Connect with Facebook” or “Log in with<br>
Facebook” or “Sign in with Facebook”.</p>
<p>If you call up a page of our website that contains such a plugin, your<br>
browser establishes a direct connection to the Facebook servers.
The content<br>
of the plugin is transmitted directly from Facebook to your browser and<br>
integrated into the page.
Through this integration, Facebook receives the<br>
information that your browser has called up the corresponding page of our<br>
website, even if you do not have a Facebook profile or are not logged on to<br>
Facebook.
This information (including your IP address) is transmitted<br>
directly from your browser to a Facebook server in the USA and stored there.<br>
These data processing operations are carried out in accordance with Art.
6<br>
Para.
1 (f) GDPR on the basis of Facebook’s legitimate interest in the<br>
display of personalised advertising on the basis of surfing behaviour.</p>
<p>By using this “Facebook Connect” button on our website, you can<br>
also log in or register on our website using your Facebook user data.
Only<br>
if you give your express consent in accordance with Art.
6 Para.
1 (a) GDPR<br>
prior to the registration process on the basis of a corresponding note on<br>
the exchange of data with Facebook, will we receive the general and publicly<br>
accessible information stored in your profile when using the Facebook<br>
“Facebook Connect” button on Facebook, depending on your personal<br>
data protection settings on Facebook.
This information includes user ID,<br>
name, profile picture, age and gender.</p>
<p>We would like to point out that after changes have been made to<br>
Facebook’s data protection conditions and terms of use, your profile<br>
pictures, the user IDs of your friends and the friends list may also be<br>
transferred if they have been marked as “public” in your Facebook<br>
privacy settings.
The data transmitted by Facebook is stored and processed<br>
by us for the creation of a user account with the necessary data, if this<br>
has been released by you on Facebook (title, first name, surname, address<br>
data, country, e-mail address, date of birth).
Conversely, we can transfer<br>
data (e.g.
information on your surfing behaviour) to your Facebook profile<br>
on the basis of your consent.
The consent given can be revoked at any time<br>
by sending a message to us.
Facebook Inc.
adheres to the Standard<br>
Contractual Clauses to ensure an adequate level of protection for personal<br>
data can always be ensured.</p>
Google
<p>If you have an account with Google, you can use this account to log in to<br>
our service.
Google accounts for European users are provided by Google<br>
Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (“Google<br>
Ireland”), a subsidiary of Google LLC, 1600 Amphitheatre Parkway,<br>
Mountain View, CA 94043 (“Google”).</p>
<p>By using the “Continue with Google” button on our website, you<br>
can log in or register on our website using your Google user data.
Only if<br>
you give your express consent in accordance with Art.
6 Para.
1 (a) GDPR<br>
prior to the registration process on the basis of a corresponding note on<br>
the exchange of data with Google, will we receive your Google user ID, user<br>
name and email address.
We will never receive your Google password and<br>
cannot log in to your Google account.
You can learn more about data sharing<br>
with Google when logging in to our service with Google by reviewing<br>
Google’s explanations here:<br>
https://support.google.com/accounts/answer/112802.</p>
<p>The data transmitted by Google is stored and processed by us solely for the<br>
creation of a user account with the necessary data.
Google adheres to the<br>
Standard Contractual Clauses to ensure an adequate level of protection for<br>
personal data can always be provided.</p>
<p>Categories of personal data:</p>
<p>Profile data (master data)</p>
<p>Contact Information</p>
<p>Facebook profile information</p>
<p>Google profile information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (a) GDPR, Consent</p>
Managing your profile
<p>You can log in to your profile at any time and change your personal data,<br>
such as name, email address or telephone number.
You can also view your<br>
previous orders.</p>
<p>Categories of personal data:</p>
<p>Profile data, location data</p>
<p>Order information</p>
<p>Device information and access data</p>
<p>Order information</p>
<p>Communication data</p>
<p>Payment information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (b) GDPR, performance of contract</p>
Order processing
Ordering from a restaurant
<p>Once you have successfully registered and decided to place your order, we<br>
will store this information in your profile and process it in further<br>
processes so that you can submit your order to us.
When you submit your<br>
order, your personal data is transferred to our backend where it is<br>
transferred to other systems for further processing.</p>
<p>Categories of personal data:</p>
<p>Contact Information</p>
<p>Location data</p>
<p>Device information and access data</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (b) GDPR, fulfilment of contract</p>
Buffering
<p>After you have logged in to your profile and made your selection, the<br>
products will be saved in your profile.
If you accidentally close your<br>
browser or app, you can continue to the last point of your order.
The last<br>
information is stored in a cookie.</p>
<p>Categories of personal data:</p>
<p>Profile data (master data)</p>
<p>Device information and access data</p>
<p>Order information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (f) GDPR, legitimate interest</p>
<p>The legitimate interest is to provide you with a better ordering experience<br>
where you can conveniently continue your order with browsers or apps that<br>
are accidentally closed.</p>
Delivery
<p>Once you have successfully placed your order, a number of processes are<br>
running in the background to ensure that your order is delivered quickly.<br>
The following processing activities describe how and why your data is<br>
processed for the respective purposes.</p>
Transfer to riders and partners
<p>We use different riders for delivery.
These can be permanent employees,<br>
freelancers or third parties who provide us with riders on the basis of a<br>
data processing agreement when we deliver our orders.
In all these cases we<br>
send your personal data to the riders so that they can deliver your order<br>
quickly.</p>
<p>Categories of personal data:</p>
<p>Delivery information to Market Place Partners (own delivery of partner)</p>
<p>Name, address, phone number to own riders</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (b) GDPR, performance of contract</p>
Calls from riders or partners
<p>If a product of your choice is not available for delivery or our riders<br>
cannot reach you at the delivery address you provided, they have received<br>
instructions from us to call you so that the problem can be solved easily.</p>
<p>Categories of personal data:</p>
<p>Delivery information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (b) GDPR, contract performance on call by the rider</p>
<p>Art.
6 Para.
1 (f) GDPR, legitimate interest when called by the partner.
The<br>
partner have no claim whatsoever to your personal data and under no<br>
circumstances may they use it for their own purposes.
If you should<br>
nevertheless be contacted by a partner without your prior consent, we ask<br>
you to report this to us by e-mail to contact@foodpanda.bg.</p>
Saved payment methods
<p>In order to make the ordering process even more convenient for you, we offer<br>
to save your preferred payment method.
This means that you don’t have to<br>
enter your payment details again the next time you place an order.
The<br>
storage of this data requires your prior consent.
You can save your payment<br>
data by clicking on the consent field.
You can revoke your consent for the<br>
future at any time by deactivating the consent field again or by informing<br>
us of this by e-mail to contact@foodpanda.bg.</p>
<p>Categories of personal data:</p>
<p>Payment data</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (a) GDPR, consent</p>
Advertising and marketing
DIRECT MARKETING
Newsletter
<p>If you have created an account on our platform and provided us with your<br>
email adress, we reserve the right to send you newsletters and offers from<br>
our platform.</p>
<p>If you have provided us with your email address when purchasing goods or<br>
services or we reserve the right to send you regular offers of similar goods<br>
or services to those already purchased from our range by email.</p>
<p>Not only do the contents of our newsletters vary, but so do the technologies<br>
and criteria we use to design our newsletters and segment customer groups.<br>
For example, a group of customers may receive a special newsletter promoting<br>
special deals from restaurants and shops where customers have ordered.
Other<br>
newsletters may refer to specific products or to orders that relate to a<br>
particular flavour, such as sushi, Indian delicacies or pizza.
We use<br>
different information from your order history and delivery addresses.
This<br>
is a profiling process in which we automatically process your data.
The<br>
specific customer segmentation can have a legal effect on you or can have a<br>
significant effect on you in other ways if you receive certain newsletters<br>
and are not included in other campaigns.</p>
<p>If automated decision making leads to a negative result for you and you do<br>
not agree with this, you can contact us at contact@foodpanda.bg.
In this case,<br>
we will individually assess the circumstances of your case.</p>
<p>Categories of personal data:</p>
<p>Contact Information</p>
<p>Location data</p>
<p>Order information</p>
<p>Legal basis:</p>
<p>Data processing in this respect takes place solely on the basis of our<br>
legitimate interest in personalised direct advertising pursuant to Art.
6<br>
Para.
1 lit.
f GDPR.
If you have initially objected to the use of your email<br>
address for this purpose, we will not send you an email for marketing<br>
purposes.
You are entitled to object to the use of your email address for<br>
the aforementioned advertising purposes at any time with effect for the<br>
future by notifying the person responsible named at the beginning.
Upon<br>
receipt of your objection, the use of your email address for advertising<br>
purposes will be discontinued immediately.</p>
NPS
<p>We are constantly striving to improve our services.
Your constructive<br>
feedback is very important to us.
Therefore we will occasionally send you<br>
customer surveys and ask you to give us your opinion.
If you do not wish to<br>
receive customer surveys, you can unsubscribe at any time.
For any customer<br>
survey request you can click “unsubscribe” below and we will not<br>
contact you again.</p>
<p>Categories of personal data:</p>
<p>Communication data</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (f) GDPR, legitimate interest.</p>
<p>Our legitimate interest is the purpose described above.</p>
App
<p>We have a strong interest in informing you about new partners or deals when<br>
using our app.
We are always working to give you an amazing customer<br>
experience.
To achieve this, we negotiate very good deals for you with our<br>
restaurant partners.
To inform you about these deals, we send you in our<br>
Apps in-app-notification or push-notification.
It is imperative that you<br>
have activated this in your end devices.</p>
<p>Categories of personal data:</p>
<p>Location data</p>
<p>Profile data (master data)</p>
<p>Order information</p>
<p>Legal basis:</p>
<p>If processing takes place with your consent, the legal basis is Art.
6 Para.<br>
1 (a) GDPR, namely your consent.
Otherwise, the processing is based on our<br>
legitimate interest pursuant to Art.
6 Para.
1 (f) GDPR.
Our legitimate<br>
interest lies in the aforementioned purpose.</p>
SMS
<p>Besides other means we continue to use SMS to inform you about new deals in<br>
your area.
You will only receive an SMS from us if you have given your<br>
consent.
You can revoke your consent at any time for the future.
Please send<br>
us an e-mail to contact@foodpanda.bg.
The registration as well as the<br>
cancellation is free of charge for you.</p>
<p>Categories of personal data:</p>
<p>Contact Information</p>
<p>Order information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (a) GDPR, consent</p>
Online marketing
<p>Our service is based to a large extent on convincing potential customers<br>
that we offer an amazing customer experience and that every visit to our<br>
platform is worthwhile.
In order to reach as many potential customers as<br>
possible, we are very active in the field of online marketing.
It is just as<br>
important to win the trust of potential customers and to strengthen the<br>
trust of our existing customers.
Therefore, we would like to present to you<br>
our processes as transparently as possible.</p>
Targeting
<p>In principle, targeting means the switching and fading in of advertising<br>
banners on websites that are tailored to specific target groups.
The aim is<br>
to display the most attractive banners as individually as possible for the<br>
user and potential customer.
Firstly, we define a target group and secondly,<br>
we commission our service providers to show our advertising to the defined<br>
target group.
We do not process any personal data, as these are initially<br>
made anonymous.
To better define the target group, we segment customer types<br>
and place different ads on different portals.</p>
Retargeting
<p>As soon as you have visited our website and, for example, have already<br>
placed an order in your shopping cart, we store this information in cookies.<br>
If you continue to surf other websites, our advertising partners will remind<br>
you on our behalf that you have not yet completed your order.
We don’t<br>
want you to miss out on our amazing customer experience.
You can disable<br>
retargeting by installing appropriate add-ons for your browser.
Furthermore,<br>
you can and should also regularly delete the cookies stored in the browser<br>
you are using.</p>
<p>Categories of personal data:</p>
<p>Contact Information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (f) GDPR, legitimate interest.</p>
<p>Our legitimate interest is the purpose described above.</p>
Cookies
<p>In order to make the visit of our website/app attractive and to enable the<br>
use of certain functions, we use so-called cookies on various pages.
These<br>
are small text files that are stored on your device.
Some of the cookies we<br>
use are deleted after the end of the browser session, i.e.
after closing<br>
your browser (so-called session cookies).
Other cookies remain on your<br>
device and allow us or our affiliate to recognize your browser on your next<br>
visit (persistent cookies).
You can set your browser so that you are<br>
informed about the setting of cookies and individually decide on their<br>
acceptance or exclude the acceptance of cookies for specific cases or in<br>
general.
Failure to accept cookies may limit the functionality of our<br>
website/app.</p>
<p>Legal basis:</p>
<p>If processing takes place with your consent, the legal basis is Art.
6 Para.<br>
1 (a) GDPR, namely your consent.
Otherwise, the processing is based on our<br>
legitimate interest pursuant to Art.
6 Para.
1 (f) GDPR.
Our legitimate<br>
interest lies in the aforementioned purpose.</p>
<p>You can find our cookie policy with all the cookies we use at the bottom of<br>
this Privacy Policy.</p>
Bonus programs
<p>We want to reward our customers’ loyalty with attractive deals and<br>
points.
For this reason, we offer our customers the opportunity to<br>
participate in such bonus programs.
Participation in a bonus program<br>
requires consent.
You can revoke your consent at any time for the future.<br>
Please send us an email to contact@foodpanda.bg for this purpose.</p>
<p>Categories of personal data:</p>
<p>Contact Information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (a) GDPR, Consent</p>
Sweepstakes
<p>The participation in the lottery requires your consent.
If you have already<br>
given your consent and would like to revoke it for the future, you can do so<br>
at any time by sending an email to contact@foodpanda.bg.
In this case, we<br>
will exclude you from participating in our sweepstakes and you will not<br>
receive any further invitations to sweepstakes.</p>
<p>Categories of personal data:</p>
<p>Contact Information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (a) GDPR, Consent</p>
User Experience Surveys:
<p>We always develop new products and try to adapt our services to the wishes<br>
of our customers.
In order to measure the effectiveness of these changes, we<br>
regularly offer interviews with our User Experience team.
In these<br>
interviews we record your usage behaviour and ask you for possible<br>
optimisation possibilities.
Participation in the interviews requires your<br>
consent.
If you have already given your consent and would like to revoke it<br>
for the future, you can do so at any time by sending an email to<br>
contact@foodpanda.bg.
In this case we will exclude you from participating in<br>
our interviews and you will not receive any further invitations for them.</p>
<p>Categories of personal data:</p>
<p>Contact Information</p>
<p>Order information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (a) GDPR, Consent</p>
CUSTOMER RELATIONSHIP MANAGEMENT
Your requests
<p>Your satisfaction is our biggest goal.
Therefore we are very keen to be<br>
available for all your questions and to answer them.
In order to be able to<br>
answer these questions and understand the overall problem, we store the<br>
conversation content in our Customer Relationship Management System when you<br>
contact us.
The content of the information we store depends on the<br>
information you provide to us as part of our communications.</p>
<p>Categories of personal data:</p>
<p>Contact information</p>
<p>Order information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (b) GDPR, performance of contract</p>
Call Center
<p>If you contact us by phone, we store the conversation with your consent for<br>
quality assurance purposes.
In individual cases, we also use the recordings<br>
for Quality improvement in customer service, i.e.
for training purposes<br>
(coaching) with our employees.
The content of the information we store<br>
depends on the information you provide to us as part of our communications.<br>
The stored telephone calls are deleted after 90 days at the latest or if the<br>
purpose of the storage, i.e.
the quality check, is fulfilled earlier.</p>
<p>Categories of personal data:</p>
<p>Contact information</p>
<p>Order information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (a) GDPR, Consent</p>
Fraud prevention and security of our platform
Fraud detection and prevention
<p>In order to protect our customers and our platform from possible attacks, we<br>
continuously monitor the activities on our website for all visitors.
To this<br>
end, we use various technical measures to ensure that suspicious behavior<br>
patterns are detected at an early stage and prevented in good time.
To<br>
achieve this goal, several monitoring mechanisms run in parallel and prevent<br>
potential attackers from accessing our website at all.</p>
<p>The decision-making process is automated and can have a legal effect on the<br>
person concerned or affect them in a similar way.
If automated decision<br>
making leads to a negative result for you and you do not agree with this,<br>
you can contact us at contact@foodpanda.bg.
In this case, we will<br>
individually assess the circumstances of your case.</p>
<p>Categories of personal data:</p>
<p>Device information and access data</p>
<p>Contact information</p>
<p>Payment information</p>
<p>Order information</p>
<p>Voucher information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (a) GDPR, Consent</p>
Mergers &.
acquisitions, change of ownership
<p>We would also like to inform you that in the event of a merger with or<br>
acquisition by another company, we will disclose information to that<br>
company.
Of course, we will require the company to comply with the legal<br>
data protection regulations.</p>
<p>Categories of personal data:</p>
<p>Contact Information</p>
<p>Delivery information</p>
<p>Location data</p>
<p>Profile data (master data)</p>
<p>Device information and access data</p>
<p>Order information</p>
<p>Communication data</p>
<p>Payment information</p>
<p>Voucher information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (f) GDPR, legitimate interest</p>
<p>Our legitimate interest is the purpose described above.</p>
Vouchers
<p>We often offer vouchers for our platforms.
The reasons can vary.
The purpose<br>
of these vouchers is to reward our loyal customers and to encourage them to<br>
continue to lead our loyal customers.
In order to be able to check the<br>
number, the value and the frequency of use of the vouchers, but also to<br>
avoid misuse of these vouchers, we collect various personal data.</p>
<p>Categories of personal data:</p>
<p>Profile data (master data)</p>
<p>Voucher information</p>
<p>Legal basis:</p>
<p>Art.
6 Para.
1 (f) GDPR, legitimate interest</p>
<p>Our legitimate interest is the purpose described above.</p>
WHO WE WORK WITH AND WHERE WE PROCESS YOUR DATA
<p>We never give your data to unauthorized third parties.
However, as part of<br>
our work we obtain the services of selected service providers and give them<br>
limited and strictly monitored access to some of our data.
However, before<br>
we forward personal data to these partner companies for processing on our<br>
behalf, each individual company undergoes an audit.
All data recipients must<br>
meet the legal data protection requirements and prove their data protection<br>
level with appropriate proofs.</p>
Delivery Hero Group
<p>Within a group it is sometimes necessary to use resources effectively.
In<br>
this context, we support each other within our Group in optimizing our<br>
processes.
In addition, we provide joint content and services.
This<br>
includes, for example, the technical support of systems.
This is a joint<br>
responsibility within the meaning of Art.
26 GDPR.
We are fully responsible<br>
for fulfilling the data protection requirements together with Delivery Hero<br>
SE, Oranienburger Straße 70, 10117 Berlin, contact@foodpanda.bg.<br>
Within the framework of joint controllership, both we and Delivery Hero SE<br>
have agreed that both will guarantee your rights equally.
For practical<br>
reasons we have decided that we are to you for all data protection-legal<br>
questions at the disposal and in particular your rights in accordance with<br>
Art.
15 to 22 GDPR will guarantee we will guarantee.</p>
<p>Please contact us for this under contact@foodpanda.bg</p>
Service providers
<p>We use different data processors in our daily processing.
These process your<br>
personal data in accordance with the requirements of Art.
28 GDPR only<br>
according to our instructions and have no claims whatsoever on these data.<br>
We also monitor our processors and include only those who meet our high<br>
standards.
Because we use different data processors and change them from<br>
time to time, it is not appropriate to identify specific recipients of<br>
personal information.
However, if you are interested, we will be happy to<br>
disclose the name of the processor(s) in use at that time upon request.</p>
Third parties
<p>In addition to data processors, we also work with third parties, to whom we<br>
also transmit your personal data, but who are not bound by our instructions.<br>
These are, for example, our consultants, lawyers or tax consultants who<br>
receive your data from us on the basis of a contract and process your<br>
personal data for legal reasons or to protect our own interests.
We do not<br>
sell or rent your personal data to third parties under any circumstances.<br>
This will never take place without your explicit consent.</p>
Prosecuting authorities and legal proceedings
<p>Unfortunately, it can happen that a few of our customers and service<br>
providers do not behave fairly and want to harm us.
In these cases, we are<br>
not only obliged to hand over personal data due to legal obligations, it is<br>
also in our interest to prevent damage and to enforce our claims and to<br>
reject unjustified claims.</p>
SOCIAL MEDIA PAGES
<p>We have profiles on various social media platforms on which we advertise our<br>
products and interact with customers.
Since we operate these profiles on<br>
third-party platforms, each time you visit these social media channels the<br>
operators collect different personal data from you.</p>
Responsibilities
<p>We and the respective operators of the social media platforms act as joint<br>
controllers.
Where two or more controllers jointly determine the purposes<br>
and means of processing, they shall be joint controllers.</p>
<p>The social media platforms Facebook and Instagram are operated by Facebook<br>
Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.</p>
<p>We are responsible for all interactions on our own platforms.
The operators<br>
of the social media platforms themselves are data controllers for general<br>
interactions and interactions outside our profiles.
An exception applies to<br>
the data processing described below for the usage analysis (page insights);<br>
we are jointly responsible with Facebook for this.</p>
<p>The following links will show you exactly which data is collected by the<br>
respective social media operators:</p>
<p>Privacy Policy Facebook</p>
<p>Privacy Policy Instagram</p>
Data processing
<p>For pages, Facebook provides page administrators with statistics and<br>
insights that help them understand the types of actions people take on their<br>
pages (“Page Insights”).</p>
<p>When you visit or interact with a Page or its content, information such as<br>
the following may be collected and used to create Page Insights:</p>
<ul>
<li>Viewing a Page, or a post or video from a Page</li>
<li>Following or unfollowing a Page</li>
<li>Liking or unliking a Page or post</li>
<li>Recommending a Page in a post or comment</li>
<li>Commenting on, sharing or reacting to a Page post (including the type of<br>
reaction)</li>
<li>Hiding a Page’s post or reporting it as spam</li>
<li>Clicking a link to a Page from another Page on Facebook or from a<br>
website off Facebook</li>
<li>Hovering over a Page’s name or profile picture to see a preview of<br>
the Page’s content Clicking on the website, phone number, Get<br>
Directions button or other button on a Page</li>
<li>Whether you’re on a computer or mobile device while visiting or<br>
interacting with a Page or its content</li>
</ul>
<p>We and Facebook are jointly responsible for the processing of your data for<br>
the provision of page insights.
For this purpose, we and Facebook have<br>
agreed in an agreement which and a division of our data protection<br>
obligations according to Art.
26 GDPR shall be agreed.</p>
Your data subject rights
<p>For all data processing on this website, we are solely responsible for<br>
processing your data in accordance with data protection regulations.
As part<br>
of our agreement with Facebook, we have determined that Facebook is<br>
primarily responsible for fulfilling its information obligations in<br>
connection with the Page Insight data and for ensuring that you exercise<br>
your rights under the GDPR.
For more information about your data subject<br>
rights on Facebook, please see<br>
Facebook’s Page-Insights Privacy Policy.</p>
DATA PROCESSING OUTSIDE THE EU
<p>We process your data mainly within the European Union (EU) and the European<br>
Economic Area (EEA).
However, some of our service providers mentioned above<br>
are based outside the EU and the EEA.
The GDPR has high requirements for the<br>
transfer of personal data to third countries.
All our data receivers have to<br>
measure up to these requirements.
Before we transfer your data to a service<br>
provider in third countries, every service provider is first assessed with<br>
regard to its data protection level.
Only if they can demonstrate an<br>
adequate level of data protection will they be shortlisted for service<br>
providers.</p>
<p>Regardless of whether our service providers are located within the EU/EEA or<br>
in third countries, each service provider must sign a data processing<br>
agreement with us.
Service providers outside the EU/EEA must meet additional<br>
requirements.
According to Art.
44 ff.
GDPR personal data may be transferred<br>
to service providers that meet at least one of the following requirements:</p>
<p>a.
Commission has decided that the third country ensures an adequate level<br>
of protection (e.g.
Israel and Canada).</p>
<p>b.
Standard data protection clauses have been accepted.Contractual clauses<br>
which cannot be modified by the contracting parties and in which they<br>
undertake to ensure an adequate level of data protection are recognized by<br>
the GDPR as a suitable transfer mechanism.</p>
<p>c.
Further appropriate safeguards pursuant to Art.
46 GDPR have been<br>
implemented.: The GDPR also permits data transfers in other situations, e.g.<br>
where a recipient has accepted the terms of binding corporate rules or<br>
approved certification mechanisms, or where a data subject has granted their<br>
consent.</p>
<p>We will only transfer your data to service providers who meet at least one<br>
of these requirements.
If we transfer data to third countries, these are<br>
mainly companies based in the USA or Israel.</p>
HOW LONG WE STORE YOUR DATA
<p>We generally delete your data after the purpose has been fulfilled.
The<br>
exact deletion rules are defined in our regional deletion concepts.<br>
Different deletion rules apply depending on the purpose of the processing.<br>
Within our deletion concepts we have defined various data classes and<br>
assigned rule deletion periods to them.
The data collected is marked with a<br>
deletion rule.
When the retention period is met, the stored data will be<br>
deleted accordingly.</p>
<p>We will delete your personal data either if you wish and let us know or if<br>
your account is inactive for three years, we will also delete your account.<br>
Before this happens, you will receive a separate notification from us to the<br>
email address registered in your user account.</p>
<p>In addition to the deletion rules defined by us, there are other legal<br>
retention periods which we must also observe.
For example, tax data must be<br>
kept for a period of between six and ten years or even longer in some cases.<br>
These special retention periods vary according to local legal requirements.</p>
<p>Therefore, despite your request for deletion of your data, we may still have<br>
to store some of the stored data due to legal regulations.
In this case,<br>
however, we will restrict data from further processing.</p>
<p>Furthermore, we will continue to store your data if we have a right to do so<br>
in accordance with Art.
17 Para.
3 GDPR.
This applies in particular if we<br>
need your personal data for the establishment, exercise or defence of legal<br>
claims.</p>
COOKIES AND WEB-TRACKING POLICY
<p>In order for your visit to or use of our service to be attractive and to<br>
allow some features to be used, we use so-called cookies on various pages.<br>
Cookies are small text files that are stored on your device.
Some of the<br>
cookies we use are deleted after the end of your browser session, i.e.
after<br>
you close the browser (session cookies).
Other cookies remain in your<br>
browser and allow us to recognize your browser on your next visit<br>
(persistent cookies).
You can configure your browser to know how to set<br>
cookies and decide individually whether or not to accept them for specific<br>
occasions or in general.
Not accepting cookies may limit the functionality<br>
of our site.</p>
<p>We classify the cookies we use into three categories:</p>
<p>● Required: They are required to navigate our service, and in order to use<br>
the features provided.
Without the use of such cookies, proper functioning<br>
of our site is not guaranteed.
You cannot opt out of these cookies.</p>
<p>● Functional: They store your information to fulfill important, if not<br>
strictly necessary functions.
For example they enable you to automatically<br>
log in next time you visit us, allow us to continuously improve the services<br>
we offer by collecting and analyzing data on website traffic, or help you<br>
find exactly what you are looking for.</p>
<p>● Personalization and advertising cookies: They are used to create<br>
personalized content, tailor-made for you, to give you the best possible<br>
online experience.
They are also used to deliver to you personalized online<br>
advertisements for our services, targeted to your specific interests.<br>
Effectively, they can be used to send ads and bids or to measure the<br>
effectiveness of our ad campaigns.
This category also includes cookies<br>
transmitting pseudonymous data to our ad partners.</p>
Similar technologies
<p>Cookies are not the only way to identify or track individuals online.
There<br>
are similar technologies, like web beacons (sometimes called “tracking<br>
pixels”, “pixel tags” or “clear gifs”).
These are<br>
tiny graphics files that contain a unique identifier that enable us to<br>
recognize when someone has visited our service.
This allows us, for example,<br>
to monitor the traffic patterns of users from one page within our service to<br>
another, to deliver or communicate with cookies, to understand whether you<br>
have come to our service from an online advertisement displayed on a<br>
third-party website, to improve performance.
In many instances, these<br>
technologies are reliant on cookies to function properly, and so declining<br>
cookies will impair their functioning.</p>
<p>For mobile applications, we also use software development kits (SDKs).
SDKs<br>
are part of the built-in code of our mobile applications and function in a<br>
way similar to cookies: They collect certain information about your device<br>
or the interaction with our service, e.g.
adding a certain meal to your<br>
order cart before submitting the order to the restaurant.</p>
Third parties
<p>Through cookies and other web-tracking technologies we also communicate<br>
limited device information such as your IP address, device ID, MAC address,<br>
Apple Advertiser ID (IDFA) or Android Ad ID (AAID) to our partners (Google<br>
Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland operates the<br>
Google Ads network, Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal<br>
Harbour, Dublin 2, Ireland delivers advertisements on Facebook and<br>
Instagram).
If you opt out of cookies and other web-tracking technologies,<br>
this will also stop any sharing of device information with any recipients.</p>
Opting out of cookies and web-tracking
<p>If you do not want us to collect and analyze information about your visit to<br>
or use of the service, you can opt out at any time.
You can do so by<br>
configuring your browser to delete all cookies and rejecting them in the<br>
future.
You can also use our cookie and web-tracking preference manager.<br>
There, you can select which category of cookies and web-tracking<br>
technologies you would rather like to have deactivated.
However, please note<br>
that you cannot opt out of required cookies and similar technologies.</p>
<p>To implement your opt-out, an exception cookie will be set in your browser<br>
(to remember your preference).
This cookie is solely intended to map your<br>
objection.
Please note that for technical reasons the opt-out cookie can<br>
only be used for the specific browser from which it is set.
If you delete<br>
cookies or use a different browser or device, you will need to repeat this<br>
process.</p>