Personal Data Protection Policy

GetFoodies respects the privacy of its customers, users and suppliers. This Privacy Policy describes who we are, the purposes for which we may use your data, how we process it, who we share it with, how long we keep it, and how to contact us and exercise your rights. The rules in this Data Protection Policy complement the provisions on the protection and processing of personal data set out in the contracts that Customers/Users enter into with GetFoodies, as well as the rules in the terms and conditions governing the various products and services, which are duly published on the respective websites. Your data is collected by Get Casa, Unipessoal Lda, with registered office at Edifício Uptown 13, Bloco A 4R, 9000-123 Funchal, Madeira, hereinafter referred to as GetFoodies. GetFoodies processes and stores personal data within the European Union (EU) and follows best practice in security and personal data protection, having taken the technical and organisational measures necessary to comply with the General Data Protection Regulation (Regulation (EU) 2016/679), a directly binding legislative act for natural and legal persons who, whether or not resident in the EU, process the data of citizens of the European Union, and to ensure that the processing of personal data is lawful, fair, transparent and limited to the authorised purposes. This privacy statement is the responsibility of GetFoodies, which is the data controller for the purposes of the GDPR and determines the purpose and means of processing the personal data presented and collected online. The Data Protection Officer (DPO) ensures compliance with the regulation and is involved in all matters relating to the protection of personal data. Their identification and contact details are given at the end of this document.

What is personal data?

Personal data is any information, of any nature and regardless of its medium, including sound and image, relating to an identified or identifiable natural person. A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to a name, an identification number, location data, online identifiers or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

What does processing personal data involve?

Processing of personal data is any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, comparison, combination, restriction, erasure or destruction. Our data protection policy ensures that data is:

• Processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);
• Collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
• Adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
• Accurate and, where necessary, kept up to date, with every reasonable step taken to ensure that data that is inaccurate, having regard to the purposes for which it is processed, is erased or rectified without delay;
• Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which it is processed;
• Processed in a manner that ensures its security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Purposes of processing personal data

Ensuring, whenever necessary, the prior consent of the data subject, we will collect, among others, the following information: first name and surname, civil identification number, tax identification number, date of birth, email and telephone number. In general, the personal data collected is used to manage the contractual relationship, provide the contracted services and adapt the services to the needs and interests of the Customer/User, in particular for access to specific features of the services, content suggestions, local information services, and information and marketing actions. In addition, personal data may be processed to comply with legal obligations and for the purposes of investigating, detecting and prosecuting serious crime.

Cookies

Our website uses cookies or similar technologies to ensure the best user experience and to analyse trends, track users’ movements within the website and gather demographic information about our user base as a whole. Our cookies record information such as Internet Protocol (IP) address, browser type, Internet Service Provider (ISP), referring/exit pages, files accessed on our site (for example HTML pages), operating systems, and date and time, in order to analyse trends on the site. For more details, see our Cookie Policy (Portuguese).

Retention period

The period for which personal data is stored and kept varies according to the purpose for which the information is processed. There are legal requirements that oblige us to keep data for a minimum period. Where there is no specific legal requirement, data will be stored and kept only for the minimum period necessary to pursue the purposes for which it was collected or subsequently processed, as defined by law.

Age of majority

By accepting this privacy policy you confirm that you are 18 years of age or older.

Use of personal data

GetFoodies will contact you to present the goods and/or services it sells. Processing of this data is based on the consent given by the data subject. Access to personal data is strictly limited to the personnel of the data controllers and processors. As regards sharing personal data, GetFoodies and its processors process data in the European Union. Where data has to be transferred outside the European Union or the European Economic Area, for example because restaurants and customers are in other countries or because of where a service provider is located, we do so only with the appropriate safeguards under the GDPR, such as adequacy decisions or standard contractual clauses. In certain situations, both GetFoodies and its processors may be required to disclose personal information in response to requests from supervisory authorities in order to meet GDPR requirements.

Restaurant and customer data

GetFoodies provides restaurants with a branded ordering website and app, a management dashboard, and loyalty and marketing tools. When a restaurant’s customers register, order or earn rewards, personal data about them is created through the platform, such as name, contact details, delivery address, order history, loyalty balance and communication preferences. We also hold the restaurant’s own business contact and billing details, and information about how the platform is used, in order to provide, bill and support the service.

Who uses the data. Each restaurant decides how it uses its customers’ data to serve them, run its loyalty programme and communicate with them. GetFoodies stores that data on the platform and operates it on the restaurant’s behalf. GetFoodies also retains it and uses it for its own lawful purposes: running, securing and supporting the service, preventing fraud, meeting legal and tax obligations, and improving the product, including through aggregated and anonymised statistics. In this way the data belongs to the restaurant and is also held and used by GetFoodies, each within its own purposes and in line with this policy and the GDPR.

Access and export. The restaurant has live access to its customers’ data in its dashboard and can download it at any time in a structured, commonly used and machine-readable format. Because access is locked when a restaurant’s subscription ends, restaurants should download their customers’ data before cancelling.

When a restaurant leaves. The restaurant’s access to the platform and to its data is locked. GetFoodies continues to retain the data for the purposes above and for as long as the law requires, for example for financial and tax records. Customers can ask for their data to be erased at any time, as described below.

Customers’ rights. Customers can exercise their rights, such as access, rectification and erasure, with the restaurant or directly with GetFoodies at software@getfoodies.com, and we will coordinate with the restaurant.

Service providers. We use service providers to run the platform, including for payment processing, hosting, email and SMS delivery, analytics and deliveries. They are bound by written agreements and process data only for these purposes.

Security of processing

GetFoodies is committed to protecting the security of the personal data made available to it and has approved and implemented strict rules in this area. Compliance with these rules is an obligation of everyone who legally has access to the data. Given the care and commitment GetFoodies shows in defending personal data, various technical and organisational security measures have been adopted to protect the personal data provided to it against dissemination, loss, misuse, alteration, unauthorised processing or access, and against any other form of unlawful processing. In addition, third parties that, in the course of providing services, process the personal data of the Customer/User on behalf of GetFoodies are bound in writing to implement appropriate technical and security measures that at all times meet the requirements of the legislation in force and safeguard the rights of the data subject (in particular, the protection of the privacy and personal data of Customers/Users).

Access, rectification or erasure of personal data

As a data subject, the Customer/User has the right to request access to data concerning them, and to ask for it to be rectified or erased. You may also restrict the processing of your data, object to it, and request data portability. You may do so directly or by written request addressed to the relevant data controller, using the contact details provided in this document. You may also ask the Data Protection Officer for clarification or lodge a complaint with the CNPD (the Portuguese data protection authority) whenever you believe your rights are being infringed.

Right of access

The data subject has the right to obtain from GetFoodies confirmation as to whether or not personal data concerning them is being processed and, where that is the case, access to their personal data and to the information provided for by law.

Right to rectification

The data subject has the right to obtain from GetFoodies, without undue delay, the rectification of inaccurate or incomplete personal data concerning them.

Right to erasure (“right to be forgotten”)

The data subject has the right to obtain from GetFoodies the erasure of their data without undue delay, and GetFoodies has the obligation to erase personal data without undue delay where, in particular, one of the following grounds applies:

• a) The personal data is no longer necessary for the purpose for which it was collected or processed;
• b) The data subject withdraws consent on which the processing is based and there is no other legal ground for the processing;
• c) The data subject objects to the processing and there are no overriding legitimate grounds for the processing.

Right to restriction of processing

The data subject has the right to obtain from GetFoodies restriction of processing where, in particular, one of the following applies:

• a) The accuracy of the personal data is contested, for a period enabling GetFoodies to verify its accuracy;
• b) The processing is lawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
• c) GetFoodies no longer needs the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise or defence of legal claims;
• d) The data subject has objected to processing, pending verification of whether the legitimate grounds of the controller override those of the data subject.

Right to data portability

Where processing is based on the data subject’s consent and that consent was given by automated means, the data subject has the right to receive the personal data concerning them, which they provided to GetFoodies, in a structured, commonly used and machine-readable format.

Right to object

Where data is processed 1) for the legitimate interests pursued by GetFoodies; or 2) for direct marketing purposes; or 3) for profiling, you may also object at any time to the processing of your personal data.

Marketing emails

Data controllers are permitted, after explicit consent, to send marketing emails to users of the site. At any time the user may withdraw consent through the link provided for that purpose in every email sent.

Changes to this policy

This policy may be updated from time to time, for example because of changes in relevant legislation. If any material changes are made, customers will be notified by email or by a notice on the website.

Contacts and Data Protection Officer (DPO)

To exercise your rights, submit requests for clarification or contact the Data Protection Officer (DPO), you can use the following contact details:

• Data controller: Get Casa, Unipessoal Lda, with registered office at Edifício Uptown 13, Bloco A 4R, 9000-123 Funchal, Madeira, Portugal.
• Email: software@getfoodies.com

If you believe your rights have not been respected, you also have the right to lodge a complaint with the Portuguese National Data Protection Commission (CNPD).