Flipdish Privacy Policy

Privacy Policy

This Privacy Policy covers the services provided by Flipdish Limited trading as Flipdish (“Flipdish”, “we”, “us” or “our”). Flipdish is incorporated in Ireland with company registration number 555703 and having its registered address at First Floor Heron House, Corrig Road, Sandyford Business Park, Dublin 18, D18 Y2X6, Ireland.

This Privacy Policy provides details of the way in which we process personal data in line with our obligations under the laws which apply to us in relation to the processing of personal data (collectively referred to as “Data Protection Laws”).

About Us

The Flipdish Platform is the technology solutions developed by Flipdish and made available to you, including our technology solution which enables you to order products from restaurants and food service providers. Flipdish and the Restaurants who operate on the Flipdish Platform (“Restaurant” or “Restaurants”) are joint controllers in respect of any personal data that is processed for placing and completing orders made with a Restaurant via the Flipdish Platform. If you are a customer of a Restaurant and have queries how your personal data is processed by the Restaurant or wish to address your rights, please contact the Restaurant.

The purpose of this Privacy Policy is to explain Flipdish’s data processing activities, including how and why we process personal data. Personal data generally means information that can be used to individually identify a person, and processing generally covers actions that can be performed in connection with data such as collection, use, storage and disclosure. Flipdish will be the controller of your personal data processed in connection with our services. We process your personal data across a range of systems and tools, including our end-user management system, our customer management system and communications platforms.

Personal Data We Collect

We collect personal data in relation to you when you provide it directly to us through the Flipdish Platform, when third parties such as Restaurants provide us with personal data about you or when personal data about you is automatically collected in connection with your use of the Flipdish website *.flipdish.com (the “Website”). If you are acting on behalf of a Restaurant or are a Flipdish corporate customer, we collect personal data through the Restaurant’s or corporate customer’s engagement with Flipdish including personal data that is collected from you and from the Restaurant or corporate customer or through an account created on the Flipdish Portal (the dedicated micro-site hosted and managed by Flipdish which enables the Restaurant or corporate customer to access their Flipdish account).

In providing our services, we may collect and process the following information:

Personal Data Collected Directly From You

We receive personal data directly from you including when you provide it to us through use of the Website, placing an order for food with a Restaurant through the Flipdish Platform or through creating an account on the Flipdish Portal, including, but not limited to:

• Biographical and contact information. Information such as name, email address, telephone number.

• Order information. Information such as delivery address, username, payment details and location data (when an order is placed through a Flipdish kiosk).

• Special category data order information. You may choose to include details in your food order that indicate health information or religious beliefs.

Personal Data Collected From Third Party Sources

Third Parties may provide us with personal data. For example, a Restaurant may provide us with personal data about you in order for us to fulfil food orders placed with the Restaurant through the Flipdish Platform. This includes biographical and contact information, order information and special category order information.

Personal Data We Automatically Collect

Some personal data is automatically collected when you use the Website, such as:

• IP address;

• device identifiers;

• browser information; and

• any personal data contained in cookie data (as explained in our Cookie Policy)

This information is collectively referred to as “automatically collected information”.

How We Process Your Personal Data

The below table sets out how and why we process your personal data, based on the categories of personal data described above.

Categories of personal data	Purposes for Processing
Biographical and contact information, order information, automatically collected data and in certain cases, special category data order information	Restaurant Operations Purposes Fulfilling your food order placed with a Restaurant through the Flipdish Platform; Communicating with you; Responding to inquiries; and Providing support and assistance through the Flipdish Platform
Biographical and contact information	Security and Verification Purposes for the security of administering our services to you, including, but not limited to, sending notifications, alerts, or messages necessary to safeguard your account. Specifically, we may utilize your contact information for the purpose of multi-factor authentication (MFA), which may involve sending verification codes via text message (SMS) or email. ensuring the protection of your personal information and to prevent unauthorized access to your account
Biographical and contact information, order information, automatically collected data and in certain cases, special category data order information	Personalization services, troubleshooting, data analysis and survey purposes
Biographical and contact information, order information, automatically collected data and in certain cases, special category data order information	Training, quality monitoring or evaluating the services we provide
User activity on the Flipdish Platform (e.g. duration on a particular page, most popular choices etc). This data is aggregated so that it is not referable to any individual user	Statistical information that is not related back to individuals to help us improve the services we offer
Biographical and contact information, including the name of the Restaurant or Flipdish corporate customer on whose behalf you act and the role you occupy in respect of such an entity	Corporate purposes, including engage and deal with Restaurants and Flipdish corporate customers;
Biographical and contact information, order information, automatically collected data and in certain cases, special category data order information	Legal and contractual matters Ensuring our services and Website are used in accordance with applicable terms and conditions and policies Complying with Flipdish’s legal obligations; Enforcing and defending our rights and resolving disputes; and Complying with our contractual obligations relating to service providers
Biographical and contact information, order information and automatically collected data	Corporate matters Administering and managing the Flipdish group’s financial and taxation affairs; and Facilitate internal and external audits and corporate transactions including fundraising and mergers and acquisitions transactions
Biographical information, contact information, reward information and employment information	Disclosure requests, including complying with Flipdish’s legal obligations

Individual Data Subject Rights

Data Protection Laws provide certain rights in favour of data subjects (the “Data Subject Rights”). Data Subject Rights include the right to:

• receive detailed information on the processing (as per transparency obligations on controllers) which we have provided through this Privacy Policy;

• access personal data;

• rectify or erase personal data (i.e. right to be forgotten);

• restrict processing;

• withdraw consent to processing based on consent. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal;

• data portability;

• object to processing of personal data based on legitimate interests and object to processing of personal data for direct marketing purposes;

• object to automated decision making (including profiling);

• appeal decision by us regarding your privacy request; and

• complain to any competent data protection supervisory authority or Flipdish’s lead supervisory authority, the Data Protection Commission.

Not all Data Protection Laws are the same and your rights may vary depending on the applicable jurisdiction in which you are located. These Data Subject Rights will be exercisable by you subject to limitations as provided for under Data Protection Laws.

You may contact us or make a request to exercise any Data Subject Right by contacting [email protected]. Your request will be dealt with in accordance with Data Protection Laws. If we decline to take action regarding your request, we will inform you of our decision and the reason for it. If an applicable data protection law allows you to appeal our decision, we will provide you with instructions on how you may appeal.

Disclosing Your Information

Your personal data may be shared with wholly-owned subsidiaries of Flipdish in respect of collaboration between entities in the Flipdish group. These entities are Flipdish UK Limited, Flipdish GmbH, Flipdish, Inc. and any other wholly-owned subsidiaries of Flipdish that may be incorporated.

Flipdish may engage other companies and individuals to perform services on our behalf, such as delivery services, hosting services, data analysis, billing, and customer support. These parties are strictly our processors and are engaged under conditions requiring confidentiality and used solely to support our provision of services. We do not share your mobile information with third parties or affiliates for marketing or promotional purposes.

These other companies and people include:

• delivery service providers. To be able to provide food delivery services, these providers receive your biographical and contact information and order information.

• hosting service providers. To be able to provide online hosting services, these providers receive your biographical and contact information, order information and special category data information.

• data analysis service providers. To be able to provide data analysis services, these providers receive order information.

• marketing assistance providers. To be able to provide marketing assistance, these providers receive your biographical and contact information and order information.

• payment service providers. To be able to provide payment services, these providers receive biographical and contact information and order information.

Flipdish may also disclose personal data to Restaurants. As part of the food ordering process, a Restaurant may obtain from Flipdish biographical and contact information, order related information and special category data order information.

Flipdish may disclose personal data in some scenarios e.g., when you violate our terms and conditions or other policies. Flipdish may disclose such personal data, at our sole discretion, if we believe it necessary or appropriate in connection with investigation of fraud, IP infringement, piracy, or other unlawful activity. This may require disclosure of biographical and contact information and automatically collected data, amongst other personal data.

As set out in the table above, we will disclose personal data where we receive a legally binding request to disclose personal data from law enforcement or other bodies or where we have a legitimate interest in assisting law enforcement or other agencies in respect of an investigation.

As set out in the table above, in some cases, Flipdish may buy or sell its assets which may involve the transfer of user information. Flipdish will transfer such information if we are acquired by or merged with another company.

Restaurants

As noted above, as part of the food ordering process, a Restaurant may obtain from Flipdish biographical and contact information, order information, special category data order information or other personal data.

Where you consent to direct marketing, your consent is provided directly to the Restaurant. Flipdish, acting as a processor, may assist Restaurants in managing its users’ consent preferences. You may unsubscribe from direct marketing through the opt-out link included in marketing communications. Flipdish also acts as processor when it assists Restaurants with managing their analytics. The Restaurant’s Privacy Policy and notices will govern in respect of marketing activities and analytics conducted by Flipdish acting as a processor.

If you require more information about how a Restaurant processes your personal data or you wish to exercise any of your data subject rights in respect of the processing of your personal data by a Restaurant you should contact the Restaurant directly.

Data Retention

We will keep personal data only for as long as the retention of such personal data is deemed necessary for the purposes for which that personal data are processed (as described in this Privacy Policy) unless we are required to retain your personal data for a longer period (e.g. in the event of legal proceedings or investigations).

International Data Transfers

If you provide personal information through the Services, you understand that we may process, store, and transfer your personal information in and to a foreign country. The laws that apply to the use and protection of personal information in other countries or jurisdictions in which we transfer or process personal information may be different from the laws and protections in your country. Whenever transfer personal data to a third country, we require that its privacy and security standards adhere to this policy and applicable Data Protection Law. If you require further information, please contact [email protected].

Necessity of Provision of Certain Personal Data

Certain information, such as biographical and contact details and order details have to be provided to enable us to provide our services to you. If you do not provide this information, it will mean that we are not able to provide our services to you.

Children’s’ Personal Data

Our Services are not intended for persons under 16 years of age. We do not knowingly collect or process the personal information of individuals under the age of 16. If we learn that we have collected personal information from a child under age 16, we will delete that information. If you believe that a child under 16 may have provided us their Personal Information, please contact us at [email protected].

Third Party Links

On occasion we include links to third parties on the Website. Where we provide a link it does not mean that we have any control over the linked website or its privacy policy or that we endorse, or approve that website’s policy towards visitor privacy. You should review the linked website’s privacy policy before sending them any personal data.

Service-related Announcements

Flipdish may send you Flipdish Platform service-related announcements. You may not opt-out of service-related communications.

Contacting Us

For further information about this Privacy Policy or the processing of your personal data by or on behalf of Flipdish, please contact us at [email protected].

Changes

The manner in which we process personal data will evolve and we will update this Privacy Policy from time to time to reflect changing practices. We will update the “Last Modified” date accordingly at the end of this Privacy Policy. We will notify you of material updates but please review this Privacy Policy from time to time.

Last Modified

This Privacy Policy was last updated in September 2024.

Privacy Notice for California Residents

Last Updated: 2 September 2024

This Privacy Policy for California Residents (“California Privacy Policy”) supplements the information contained in Flipdish’s Privacy Policy. Flipdish has adopted this California Privacy Policy in accordance with the notice requirements under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”), Any terms defined in the CCPA have the same meaning when used in this California Privacy Policy.

The Personal Information We Collect and Disclose

The chart below shows the categories of Personal Information we may collect; examples of the types of Personal Information in each category; all types of sources from which each category of Personal Information is collected; the Restaurant purpose(s) for which that category of Personal Information is collected; and all types of third parties with whom that category of Personal Information is shared. As this chart shows, we disclose certain Personal Information to Service Providers for Restaurant purposes. We have not sold or shared consumers’ personal information in the preceding 12 months.

This information covers the past 12 months.

We will not collect a category of Personal Information not listed above, or use any Personal Information collected in any of the above categories for a Restaurant purpose not listed above, without first providing you with notice.

Your Rights Under the California Privacy Rights Act

California Residents have certain rights under the CPRA, including the following:

• Access. You have the right to know what personal information the Restaurant has collected about you. While our California Privacy Policy details the personal information we collect about all California consumers, you have the right to make a request to know and get access to information that is specific to you, should we have any.

• Deletion. You have the right to request that we delete personal information we have collected from you, subject to certain exception. For example, we will not delete any personal information required to provide our services to you or that we must maintain to comply with our legal obligations. We will notify you following submission of your request if this is the case.

• Correction. You may request that we correct inaccurate information we maintain about you, subject to some exceptions and, if necessary, independent verification.

• Opt-Out of the Sale/Sharing of Your Personal Information. If we have sold or shared personal information about you, you have the right to opt out of the sale or sharing of that personal information.

• Limitation. In some instances, you have the right to limit our use or disclosure of Sensitive Personal Information.

• Non-Discrimination. You have the right not to be discriminated against if you exercise any of the rights conferred by the CPRA. Please note that a legitimate denial of a request for information, deletion, or to opt out is not discriminatory, nor is charging a fee for excessive or repetitive consumer requests as permitted by the CPRA.

Exercising Your CPRA Rights

Submitting Access, Deletion, and Correction Requests

You may contact us or make a request to exercise any CPRA right by contacting [email protected]. After we receive your request, to ensure the security of the information we store and consumers’ privacy, we will verify that you are appropriately affiliated with the subject of the request, either as the consumer or as an authorized agent or guardian of the consumer. We may ask you to provide a few pieces of information to confirm your identity in our records.

You may designate an authorized agent to exercise your rights under the CCPA on your behalf. You must provide the authorized agent written permission to exercise your rights under the CPRA on your behalf and we may deny a request from an agent on your behalf if we cannot verify that they have been authorized by you to act on your behalf. Even if you use an authorized agent to exercise your rights under the CCPA on your behalf, pursuant to the CCPA we may still require that you verify your own identity directly to us. This provision does not apply if you have provided a power of attorney under the California Probate Code.

Opting Out of the Sale/Share of Your Personal Information

As described in our privacy policy, we sell and share personal information with our marketing and advertising service provider to allow them and use to serve ads more relevant to you. You have the right to opt out of the sale or sharing of your personal information by us. The following are some methods you can use to submit your opt-out requests:

This website responds opt-out preference signals in a frictionless manner. That means upon receipt of the opt-out preference signal, we will not require you to provide additional information beyond what is necessary to process the signal. However, we may provide you the option to provide additional information to help facilitate your request. For example, we may ask you to provide an offline identifier, like a name or physical address, so that we can honor your opt-out request with respect to offline sales of your personal information. In such cases, we will not use the additional personal information you provide except to process your opt-out request.

• Online Requests. You may also submit a request to opt out of the sale or sharing of your personal information by emailing us at [email protected].

Limiting the Use of Your Sensitive Personal Information

California law permits consumers to limit the use of their sensitive personal information (described above) to only specific permissible purposes. We do not use your sensitive personal information for non-permissible purposes. Our purposes for processing sensitive information are to provide our Services and process payment. For example, we process credit and debit card numbers only to process payments. If you provide us with your health or diet restrictions (which may include or imply a religious affiliation), we only use that information to comply with your dietary requests. We do not use sensitive personal information to profile you.

Additional California Privacy Rights

California Civil Code Section § 1798.83 permits users of our web site that are California residents to request certain information regarding our disclosure of personal information to other parties for their direct marketing purposes. To make such a request, please send an email to [email protected] with the subject “Shine the Light Request.”

Changes to Our California Privacy Policy

Flipdish reserves the right to amend this California Privacy Policy at our discretion and at any time. When we make changes to this California Privacy Policy, we will post an updated notice on our website with the effective date.

Contact Us Regarding Your Privacy Rights

If you would like additional information regarding our California Privacy Policy or your privacy rights generally, please email us at [email protected]. Please submit your CPRA rights requests using the methods described above.