1. Controller and contact
1.1.This privacy policy explains how SIA "DataTrends" (registration number 40203336128, legal address: Edvarta Virzas iela 27-35, Iecava, Bauskas nov., LV-3913; "we") as the controller processes personal data when you use the website food.iecava.net and its app (the "Platform"), place orders or contact us.
1.2.For questions about the processing of personal data and to exercise your rights, write to rsxdalv@gmail.com or by post to our legal address.
1.3.The Platform is an online marketplace: goods are sold by restaurants, cafés and shops (the "Partners"), and we act in their name as their commercial agent. The Partner you buy from receives the data needed to fulfil your order and processes it as an independent controller, to perform the purchase contract and meet its own legal obligations, such as accounting and food safety rules. You can ask the Partner or us about this.
1.4.We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (the "Regulation"), the Personal Data Processing Law of Latvia and other laws. The rules for orders are set out in the Terms of Use and Distance Contract.
2. What data we process
| Category | Data | Source |
|---|---|---|
| Account data | phone number, email address, password hash (if a password is set), when the account was created and last used | you |
| Sign-in data | one-time code sent by text message, session identifier | the Platform |
| Order data | items ordered and prices, delivery or pickup, delivery address, phone number, order status history and times, confirmation code, cancellation reason | you, Partners, couriers |
| Payment data | email address for the payment confirmation, amount, payment status and the Klix payment identifier | you, Klix |
| Correspondence | your messages, complaints and withdrawal statements and our replies | you |
| Reviews | the name you enter, your rating and comment | you |
| Technical data | IP address, browser type, time and address of the request in server logs | your device |
2.1.We do not receive payment card details: you enter them on the Klix payment page, and they are processed by the payment service provider.
2.2.We do not ask for special categories of personal data, such as health data. If you give them to us on your own initiative (for example, telling us about a food allergy), we use them only to deal with your request.
3. Why we process data and how long we keep it
| Purpose | Legal basis | Retention |
|---|---|---|
| Creating an account and signing in | performance of a contract (Article 6(1)(b) of the Regulation) | while the account is active; one-time code — until it expires; session — 7 days |
| Passing orders to Partners, sending confirmations and communicating about orders | performance of a contract (b) | 5 years after the order |
| Accepting payments and making refunds in Partners' name | performance of a contract (b) | 5 years after the order |
| Meeting accounting and tax requirements | legal obligation (c) — Accounting Law | source documents — at least 5 years, accounting registers — 10 years |
| Handling complaints, withdrawals and disputes | legal obligation (c) — Consumer Rights Protection Law; legitimate interests (f) — defending our rights | 3 years after the matter is resolved |
| Platform security and preventing abuse (for example, order limits) | legitimate interests (f) | server logs — 30 days |
| Publishing reviews | your consent (a) — you publish the review voluntarily | until you ask us to delete it |
| Remembering your name in the profile settings on your device | your consent (a) — in the cookie notice | 1 year or until you withdraw consent |
3.1.Where we process data to perform a contract, providing the data is necessary to accept and fulfil the order; without it, an order cannot be placed.
3.2.Where processing is based on legitimate interests, we have assessed that it is necessary for the security of the Platform and the defence of our rights and does not override your interests. You have the right to object to such processing (see section 6).
3.3.We do not send marketing messages. If we start doing so, we will send them only with your consent or where the Information Society Services Law allows it, and you will be able to opt out at any time.
3.4.After a request to delete an account, we delete the account data within one month. Order and payment data that must be kept for accounting or dispute purposes is kept until the relevant period ends and is then deleted or anonymised.
3.5.We do not make decisions based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you (Article 22 of the Regulation). Order limits, such as no more than two unfulfilled orders at a time, apply equally to all users.
4. Who receives the data
4.1.We share personal data only with those who need it to fulfil your order or our legal obligations:
- the Partner (restaurant or shop) you buy from — the order contents, phone number and delivery address. As the seller, the Partner processes this data as an independent controller (clause 1.3);
- couriers delivering the order on the Partner's behalf — the delivery address and directions;
- the payment service provider AS "Citadele banka" (Klix), which processes card payments as an independent controller under the Klix privacy protection rules;
- IT service providers that run the Platform on our behalf: servers and data storage — TODO: serveru nodrošinātājs / hosting provider; email — TODO: e-pasta pakalpojuma sniedzējs / email provider;
- the mobile network operator (TODO: mobilo sakaru operators / mobile network operator) through which we send text messages with sign-in codes;
- public authorities (for example, the State Revenue Service, the Consumer Rights Protection Centre, the police or courts) where the law requires it.
4.2.Our processors are required to process the data only on our instructions and to keep it secure.
4.3.We run the map, address search and routing services on our own servers, so the addresses you enter are not passed to third parties.
4.4.We do not sell personal data and do not use third-party advertising or analytics tools.
5. Transfers outside the EU and EEA
5.1.We process personal data in the European Union and the European Economic Area. If any of our service providers were to process data outside them, we would allow it only with the safeguards set out in Chapter V of the Regulation, for example where the European Commission has found the country's level of protection adequate or the European Commission's standard contractual clauses are in place.
6. Your rights
6.1.You have the right to:
- access your personal data and receive a copy (Article 15 of the Regulation);
- have inaccurate data corrected (Article 16);
- have your data erased (Article 17), for example on the account deletion page;
- have processing restricted (Article 18);
- receive the data you gave us in a structured, machine-readable format and pass it to another controller (Article 20);
- object to processing based on legitimate interests (Article 21);
- withdraw your consent at any time; this does not affect processing carried out before the withdrawal.
6.2.To exercise your rights, write to rsxdalv@gmail.com. We will reply without undue delay and within one month at the latest; for complex requests this may be extended by two further months, in which case we will tell you (Article 12(3) of the Regulation). To protect your data, we may ask you to confirm your identity, for example with a code sent to the phone or email in your account.
6.3.If you believe we process your data unlawfully, please contact us first. You also have the right to lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija): Elijas iela 17, Rīga, LV-1050, email pasts@dvi.gov.lv, phone +371 67223131, https://www.dvi.gov.lv.
8. Data of Partner representatives and couriers
8.1.For Partner representatives using the Partner portal and couriers using the courier app, we process account data (username, password hash and session data), the access rights granted, and actions on orders, such as accepting, handing over or delivering an order and when this happened.
8.2.We process this data to perform the contract with you or your employer (Article 6(1)(b) of the Regulation) and in our legitimate interests in keeping orders traceable and handling complaints (f). We keep it during the cooperation and for 5 years after it ends, unless the law requires a different period.
8.3.We do not currently process couriers' location. If we introduce it, we will inform couriers in advance.
8.4.Sections 4 to 6 of this policy also apply to this data.
9. Other provisions
9.1.The Platform is not intended for persons under 18, and we do not knowingly process children's personal data. If we learn that such data has been processed, we delete it.
9.2.We protect personal data with appropriate technical and organisational measures: data is transmitted over an encrypted connection (HTTPS), passwords are stored only as hashes, and only those who need the data for their work have access to it.
9.3.We may update this privacy policy. The current version and the date it took effect are always shown on this page; we will announce significant changes on the Platform.