Privacy Policy

1. Who We Are

Easy Fuud ("we", "our", "the Platform") is an online food ordering platform operated from Ireland. We act as a data controller in respect of personal data collected from platform users, and as a data processor in respect of personal data provided by restaurants about their customers.

This Privacy Policy applies to all users of the Easy Fuud platform (easyfuud.com) and is in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Data Protection Acts 1988–2018 (Ireland).

Our lead supervisory authority is the Data Protection Commission (DPC) of Ireland, reachable at dataprotection.ie.

2. What Information We Collect

Account information: When you register, we collect your name, email address, and phone number. Restaurant owners additionally provide business name, address, and billing details.

Order information: When you place an order, we collect your delivery address, order contents, and payment method preference. Full card details are processed exclusively by Stripe and are never transmitted to or stored by Easy Fuud.

Billing information: For restaurant subscriptions, we store your Stripe Customer ID and subscription status. Stripe holds and processes all payment card data under their own PCI-DSS compliant systems.

Usage data: We collect standard server logs including IP addresses, browser type, pages visited, and timestamps. This data is used solely to maintain platform security and improve performance.

Cookies: We use a single session cookie to keep you signed in (httpOnly, Secure). We do not use advertising, analytics, or third-party tracking cookies.

3. Legal Basis for Processing

We process your personal data under the following legal bases as defined in Article 6 GDPR:

• Contract performance — to process orders and manage your account.
• Legal obligation — to comply with Irish and EU tax, accounting, and consumer protection law, including retention of VAT records required by Revenue Commissioners Ireland.
• Legitimate interests — to maintain platform security, prevent fraud, and improve service quality.
• Consent — for any optional marketing communications (you may withdraw consent at any time).

4. How We Use Your Information

• To process and fulfil your food orders
• To send order confirmation and status updates
• To share necessary order details with the restaurant fulfilling your order
• To process and manage restaurant subscription billing
• To issue VAT-compliant invoices and receipts
• To maintain account security and prevent fraud
• To comply with our legal and regulatory obligations under Irish law
• To improve the platform experience

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Data Sharing

Your order details (name, phone number, delivery address, and items ordered) are shared with the restaurant fulfilling your order. This is strictly necessary to complete your purchase and is done on the basis of contract performance.

We use the following third-party processors, each bound by data processing agreements:

• Stripe Payments Europe, Ltd (Ireland) — payment processing and subscription billing. Privacy policy: stripe.com/ie/privacy.
• Railway (infrastructure) — cloud hosting and database services. Data is processed within the EU/EEA where possible.

We do not transfer personal data outside the European Economic Area (EEA) without appropriate safeguards in place.

6. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, subject to the following minimum retention periods required by Irish law:

• Order records and VAT invoices: 6 years, as required by the Taxes Consolidation Act 1997 and Value-Added Tax Consolidation Act 2010.
• Account data: Retained while your account is active. Deleted within 30 days of a verified account deletion request, subject to the above retention obligations.
• Server logs: 90 days.

7. Security

We implement industry-standard security measures to protect your personal data, including:

• HTTPS/TLS encryption for all data in transit
• Bcrypt-hashed passwords (never stored in plain text)
• Short-lived JWT access tokens (15 minutes) with rotating httpOnly refresh cookies
• Role-based access control limiting data access to authorised personnel
• Stripe PCI-DSS compliance for all payment card data

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours and affected individuals without undue delay, in accordance with Articles 33–34 GDPR.

8. Your Rights Under GDPR

Under the GDPR and Irish Data Protection Acts, you have the following rights in relation to your personal data:

• Right of access — to obtain a copy of the personal data we hold about you.
• Right of rectification — to have inaccurate data corrected.
• Right to erasure — to have your data deleted where there is no overriding legal basis for its retention.
• Right to restrict processing — to limit how we use your data in certain circumstances.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to processing based on legitimate interests, including direct marketing.
• Rights related to automated decision-making — we do not make solely automated decisions with legal or significant effects on individuals.

To exercise any of these rights, contact us at privacy@easyfuud.com. We will respond within one month of receiving a verified request, as required by Article 12 GDPR.

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission at dataprotection.ie or by calling +353 57 868 4800.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least 14 days before they take effect. The current version is always available at easyfuud.com/privacy.

10. Contact

For privacy-related enquiries or to exercise your data rights, contact our Data Protection contact at:

privacy@easyfuud.com

Easy Fuud, Ireland