Effective from 01.03.2023    This Privacy Notice describes the rules applied by Fudy to processing Customers’ personal data.     1. DEFINITIONS    1.1. Terms used in this Privacy Notice shall have the following meaning     Fudy: Fudy OÜ, registry code 16182871, address Harju County, Saku vald, Tänassilma, Põikmäe tn 2, 76406    An information society service provider that has developed and operates the Fudy dine-in application     Customer: a natural person who has placed an order via the Application, concluding a sales agreement with a Partner on the fulfilment of the order, and who has paid for the order via the Application     Partner: a restaurateur who has entered into an agreement with Fudy on the use of the Application and who offers Customers the opportunity to submit and pay for an order via the Application at their point of sale     Application: an application that opens upon scanning a QR code using a smart device, which displays the Partner's point of sale menu, and provides the Customer a possibility of placing an order and paying for the order via a smart device     Privacy Notice: this privacy notice     Agreement: The general terms and conditions for Customers that regulate the use of the Application by the Customer for placing orders     GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)     2. CONTROLLER     2.1. According to the GDPR, “controller” is a person who, alone or jointly with others, determines the purposes and means of the processing of personal data.     2.2. Through the Application Fudy offers Customers the possibility to independently review the menu of the Partner's point of sale, submit an order to the Partner and pay for the order without the assistance of the Partner's employee. Fudy processes personal data of Customers using the Application in the capacity of the controller.     2.3. In addition to Fudy, Partners also may act as controllers of Customers' personal data when they process Customers' personal data to fill Customers’ orders.     2.4. Fudy and Partner are separate controllers independent from each other. For the avoidance of doubt, under no circumstances can Fudy be held liable for violations of GDPR by the Partner.       3. PERSONAL DATA BEING PROCESSED    3.1. Fudy processes the following Personal Data of Customers who use the Application:     Order data: The Customer's given name and surname, phone number, e-mail address, order date, order number, order content, including the Customer's special requests and comments relating to the order, value of the order     Payment data: details of the bank card or other means of payment     Device data: Information regarding the device which the Customer uses to run the Application, including the model, name and any other identifier of the device, and the IP address of the network through which the Application is used     Application usage data: Time spent using the Application, time and date of visiting the Application, the Customer's activity in the Application     Fudy processes mainly such personal data of the Customer that it receives directly from the Customer. Fudy may collect certain personal data from the Customer automatically when the Customer visits the Application.     Disclosure of personal data to Fudy is voluntary. However, it may happen that Fudy cannot provide services to the Customer if the Customer refuses to provide personal data. For example, Fudy cannot forward the Customer's order to the Partner if the Customer refuses to add their personal data when making the payment.     4. PURPOSES OF PROCESSING     Order data:   -To make the Application available for use   -To make it possible to enter into and perform the Sales Agreement   -To make placing Orders possible   -To notify of the completion of an Order   -To analyse trends   LEGAL BASIS   For the performance of an agreement (GDPR, Art. 6(1)-b))   Fudy's legitimate interest (GDPR, Art. 6(1)-f)) to provide the consumer with exceptional services     Payment data   -To perform the obligation set forth in the Accounting Act or the Taxation Act   -To handle and settle legal claims and disputes   LEGAL BASIS   Statutory obligation (GDPR, Art. 6(1)-c))  For the performance of an agreement (GDPR, Art. 6(1)-b))     Device data  -To improve the application and the quality of services provided therein   -To detect any errors in the Application   LEGAL BASIS   Fudy's legitimate interest (GDPR, Art. 6(1)-f)) to provide the consumer with exceptional services     Application usage data   -To improve the application and the quality of services provided therein   -To analyse trends   -To detect any errors in the Application   LEGAL BASIS   Fudy's legitimate interest (GDPR, Art. 6(1)-f)) to provide the consumer with exceptional services    5. AUTOMATED DECISION-MAKING OR PROFILING     5.1. Automated decision-making means a decision that is taken based solely on automated processing of the Customer's personal data. This means processing personal data using, for example, a software code or an algorithm that does not require human intervention.     5.2. Fudy does not process Customers' personal data to take automated decisions based on profiling.     6. STORAGE OF PERSONAL DATA     6.1. Fudy does not store personal data longer than is necessary to attain the purpose for which personal data are processed, or is required under applicable law. When using the Application, the Customer undertakes to enter their personal data in the order form each time an Order is placed, unless the Customer has given Fudy consent to store the data contained in the order form for the purpose of automatically completing the order form.     6.2. In addition to the above, Fudy applies the following terms to storing of personal data:     6.2.1. Order Data and Payment Data or any other documents that prove payment of a fee are stored for 7 years from the payment of the fee;     6.2.2. Data related to disputes and investigations will be stored until a resolution is reached.     7. TRANSFER OF PERSONAL DATA    7.1. In order to enable the use of the Application, Fudy may share personal data of Customers with the following third parties:     7.1.1. The Partner, if the Customer has placed an order with the Partner via the Application. Fudy transfers to the Partner the Customer's given name, the first letter of the surname and the data provided by the Customer in the order;     7.1.2. Server hosts that host Fudy's servers;     7.1.3. Payment intermediation service provider;     7.1.4. Analytics service provider;     7.1.5. A person providing legal aid services or a debt collector.     7.2. The above-mentioned persons are mainly located in the European Economic Area. However, Fudy cannot rule out that some of the service providers it uses may also be located in countries whose level of data protection has not been assessed or rated as adequate by the European Commission. Due to inadequate level of data protection, such countries might not guarantee the same level of security of personal data, incl. protection of such data against abuse, unauthorised access, disclosure, modification or loss, that is ensured within the European Union. Should personal data of a Customer be transferred to countries outside of the European Union, Fudy will ensure that appropriate measures of protection are applied.       8. SECURITY OF PERSONAL DATA     8.1. Fudy has taken necessary organisational, physical, and IT-security measures to ensure that Customers’ personal data are protected against any misuse, unauthorised access, disclosure, modification or loss.     8.2. Only authorised persons have access to Customers’ personal data. Moreover, persons having access to personal data are bound by confidentiality obligations.       9. RIGHTS OF CUSTOMER    9.1. Upon processing of the Customer’s personal data, the Customer has all rights arising from law applicable to data subjects, including the following rights:     9.1.1. the right of access: The Customer has the right to ask at any time whether or not Fudy holds any of their personal data, and to receive information about what personal data Fudy processes about the Customer;     9.1.2. the right to rectify personal data: The Customer has the right to request Fudy to specify or rectify their personal data if they are insufficient, incomplete or incorrect;     9.1.3. the right to submit objections: The Customer has the right to submit objections to Fudy regarding the processing of their personal data, for example, when the use of personal data is based on Fudy's legitimate interest;     9.1.4. the right to demand erasure of personal data: The Customer has the right to request erasure of personal data, for example, if personal data are processed with the Customer's consent and if the Customer has withdrawn their consent;     9.1.5. the right to restrict processing: The Customer has the right to demand Fudy to restrict processing of their personal data based on applicable law, for example, where Fudy no longer needs the Customer's personal data for processing or if the Customer has objected to processing of personal data;     9.1.6. the right to withdraw the consent given to the processing of personal data: if processing of personal data is based on consent given by the Customer, the Customer has the right to withdraw the consent given to Fudy at any time;     9.1.7. the right to data portability: The Customer has the right to receive from Fudy personal data which the Customer has provided Fudy and which are processed on the basis of the Customer's consent or in order to perform a contract concluded with the Customer, in writing or in a commonly used electronic format, and, if it is technically possible, to demand that Fudy forward this data to a third-party service provider;     9.1.8. the right to file a complaint: to file a complaint with the Data Protection Inspectorate or the court in the event of a violation of their rights.     9.2. The Customer's rights listed in this section regarding the processing of personal data are not absolute rights. In certain cases, the rights of other data subjects or legal obligations of Fudy may limit the Customer's rights.     9.3. In order to exercise the rights associated with the processing of personal data or submit requests, the Customer must contact Fudy (the contact details can be found under “Contact details”).       10. AMENDMENT OF PRIVACY NOTICE    10.1. Fudy has the right to unilaterally supplement and/or amend this Privacy Notice from time to time. In the event of updating the Privacy Notice, the updated Privacy Notice is presented to Customers when they place their order via the Application.       11. CONTACT INFORMATION    11.1. In the case of any questions or requests regarding the processing of personal data, please contact us at the e-mail address estonia-support@fudy.eu.     11.2. Should you have any claims relating to the processing of personal data, you are kindly asked to first contact Fudy. However, Customers have the right to submit their complaints to the Data Protection Inspectorate or court.