Privacy promise for end users

In this privacy promise, you can learn more about how OrderYOYO Limited (OrderYOYO) processes your personal data when you use our online order website and mobile application, depending on the platform you use (the Service).

We provide you with this information as we are required to do so under the UK General Data Protection Regulation (UK GDPR).

Controller

OrderYOYO is the controller in respect of the processing of your personal data when you create a user profile and/or when you complete an order on the Service.

OrderYOYO's contact details are stated at the bottom of this webpage.

Purposes of and legal basis for processing

When you use the Service, we process your personal data for several purposes. In the table below, you can learn more about the various purposes, which data we process and what the legal basis for our processing is.

Processing activities	Purpose(s) of the processing	Legal basis for the processing
Processing your orders and creating your user profile	We process your contact details (name, address, email address and telephone number) and particular order data (any comments on the order, purchase history, payment details, etc.) for the purpose of registering and completing payment of your order which we share with the relevant restaurant and for the purpose of relocating the details in connection with future orders. In addition, we process your contact details to be able to create your user profile, if relevant.	The legal basis for our processing is article 6(1)(f) of the UK General Data Protection Regulation (UK GDPR) as we are pursuing our legitimate interest in collecting payments for our and the restaurant's services, letting the restaurant know which order to prepare and deliver, and creating a profile for you.
Checking and correcting errors in the Service	We record log data in the Service, and such log data may include personal data (e.g. your IP address). The log data is recorded for the purpose of correcting technical errors in the Service and identifying and preventing potential fraud (e.g. in case of unusual orders etc.).	The legal basis for our processing is article 6(1)(f) of the UK General Data Protection Regulation (UK GDPR) as we are pursuing our legitimate interest in correcting errors and improving the Service, including making it more user-friendly.
Answering and processing enquiries about the Service	When you contact us (e.g. by email or directly on the Service), your enquiry will often contain personal data, including your contact details and other personal data which you may disclose to us. We process such data to be able to process and answer your enquiries and provide general customer service and technical support etc. relating to your use of the Service.	The legal basis for our processing is article 6(1)(f) of the UK General Data Protection Regulation (UK GDPR) as we are pursuing our legitimate interest in providing relevant customer service and/or technical support to you when you use the Service.

Recipients of your personal data

Disclosure to external third parties

We disclose your name, email address and order data to the restaurant preparing your order, in particular for the purpose of enabling the restaurant to send service notices about the delivery of your order. The restaurant also receives your name and your email address for the purpose of distributing marketing material (if you have consented to receive electronic marketing from the restaurant).

We may also disclose your personal data to our external business partners (e.g. carriers or couriers who may deliver the items you have ordered from the restaurant on the Service). We also disclose personal data included in our accounting records (e.g. your contact and/or payment details) to the relevant public authorities, including the tax and customs authorities, in connection with our statutory bookkeeping etc.

Disclosure within the OrderYOYO group

For the purpose of providing efficient and stable customer service irrespective of the country you are in, we share your personal data with the other OrderYOYO group companies. That also means that we may have received personal data about you from one of our group companies, e.g. for the purpose of processing your enquiries relating to particular orders or your use of the Service.

Use of processors

We make your personal data available to our processors who e.g. host, develop and support the OrderYOYO group's IT systems and/or send service notices for us.

Transfer of your personal data to third countries

When we make data available to our processors, we may transfer your personal data to the USA, Ukraine, and the Philippines. The basis for such transfer is the Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council as we have entered into such standard contractual clauses with the relevant recipients of the data.

Storage of your personal data

We are required to only store your personal data for the period necessary for us to fulfil the purposes for which they were collected. For that reason, we have established the time limits for erasure set out in the table below. As a general rule, we erase or anonymise your personal data according to the time limits stated below unless it is necessary that we continue to store them, e.g. for the purpose of particular cases or the like.

When it is stated below that your personal data will be erased, we may instead anonymise the data, and then the data can no longer be used to identify you. Anonymised data are not covered by the UK GDPR as they are no longer personal data.

Processing activities	Storage and time limits for erasure
Processing your orders and creating your user profile	As a general rule, data relating to particular orders or other agreements with you are stored for 5 years after the end of the financial year in which the order was completed or the agreement has ended. The personal data are stored e.g. for the purpose of complying with our obligation to present financial statements etc. As a general rule, data included in your user profile but not related to a particular order (e.g. your login information etc.) are stored for 12 months after the end of the financial year in which you were last logged in (unless you have deactivated your user profile before that).
Checking and correcting errors in the Service	As a general rule, the personal data included in the recorded log data are erased no later than 12 months after the particular actions on the Service are recorded.
Answering and processing enquiries about the Service	As a general rule, data relating to particular cases or agreements with you, or the business you represent, are stored for 5 years after the end of the financial year in which your last enquiry was closed or the agreement has ended. The personal data are stored e.g. for the purpose of complying with our obligation to present financial statements etc. As a general rule, we erase data not related to a particular case or agreement 12 months after the end of the financial year in which your last enquiry was closed.

Your rights etc.

You have special rights to help you control your personal data, and we wish to make it easy for you to exercise those rights:

Rights	Descriptions
Right of access	If you ask us, we will confirm whether we process your personal data and, if so, we will give you a copy of them.
Right to rectification	If your personal data are inaccurate or incomplete, you have a right to ask us to correct or complete them.
Right to erasure	You have the right to ask us to erase the data in specific circumstances, such as: - Where the personal data is no longer necessary for the purpose it was originally collected/processed. - If you have withdrawn your consent. - If you have objected to the processing, and there is no overriding legitimate interest for us to continue with the processing. - If you have objected to the processing of your data for direct marketing purposes. - If your personal data was unlawfully processed. - If we have a legal obligation to erase your data.
Right to restriction of processing	In certain circumstances, you have the right to ask us to restrict our use of the data we process about you.
Right to data portability	You have the right to receive the personal data that we process about you in a structured, commonly used and machine-readable format and to use it elsewhere.
Right to object and withdrawal of consent	In certain circumstances, you have the right to object to our otherwise lawful processing of your personal data, including processing for direct marketing purposes.
Right of complaint	If you wish to complain about our processing of your personal data, you may file a complaint with the Information Commissioner's Office (ICO) on https://ico.org.uk/

In order to exercise your rights described here, you can contact us directly using the contact details stated at the bottom of this webpage.

Right to withdraw consent (unsubscribing from marketing)

If you are no longer interested in receiving news or offers from OrderYOYO, you may withdraw your consent by unsubscribing from marketing in the individual emails you receive. You may also contact us directly using the contact details stated at the bottom of this webpage.

If you withdraw your consent, it will not affect the lawfulness of our processing before the withdrawal. As a result, your withdrawal will only be effective in respect of future processing.

Contact

If you have any questions about how we process personal data, please contact us using the following contact details:

• OrderYOYO Limited
• Company number 10103166
• 55 Princess Street, Manchester, M1 6HS
• United Kingdom
• Email: [email protected]

For the purpose of protecting your data, we may, in certain circumstances, ask you to confirm your identity before we are able to process your request. Therefore, it will be practical if you contact us by email and include a reference to an order number or the like in your enquiry.