Privacy policy for customers

This Privacy Policy ("Policy") explains how Innovation Group srl s.b. collects, uses, discloses and processes the personal data of its users, and applies to the processing of the personal data of customers who use the services via foodja (a platform owned by Innovation Group) physical or digital applications, to place orders with one of our business partners ("Partner" or "Event Organiser").

We may use your personal data to provide services and to collect and process orders placed via our physical or digital applications.

This Policy also applies to the processing of the personal data of all employees and users assigned by Partners who use one of our devices to handle orders (foodja App, foodja Totem, foodja POD or foodja POD Printer).

This policy must be compared with the General Terms and Conditions of Service available on the website https://foodja.it. 

Legal basis for processing

Processing of users' Personal Data is carried out on the following legal bases:

1. the consent given by the User for one or more specific purposes;
2. the processing is necessary to execute a contract with the User and/or to perform pre-contractual measures;
3. processing is necessary to comply with a legal obligation to which the Data Controller is subject;
4. processing is necessary to carry out a task in the public interest or to exercise the official authority held by the Data Controller;
5. processing is necessary for the pursuit of the legitimate interest of the Data Controller or of third parties;
6. processing is necessary for the pursuit of a vital interest of the Data Controller or a third party.

In any case, it is always possible to ask the Data Controller to clarify the legal basis of each processing operation at mailto:privacy@foodja.it?subject=Richiesta utente - informativa Privacy.

What personal data we process and for what purposes

“Personal Data”, also referred to in this Policy as “your Data”, means any information or set of information from which we are able, directly or indirectly, to identify you personally, in particular by reference to an identifier, e.g. your first and last name, e-mail address, telephone number, etc. This does not include data from which your identity has been removed (anonymous data).

Whenever you interact with Innovation Group through the foodja services, we collect and process your personal data. Innovation Group srl may process your personal data for the following purposes:

1. Ordering Process

We process the personal data you provide when you place your order. This personal data is necessary for the processing, confirmation and evaluation of your order, as well as for your payment and possible refund, both of which are handled by third parties in accordance with the following provisions. Your information (such as the items you add to your shopping cart) enables us to process your order and send you an accurate invoice. It also enables us and the Partner to contact you if necessary. Some of our Partners use third parties, especially at events, to handle order collection and delivery activities, who may use your information to provide updates on the status of your order. Depending on the circumstances, we may rely on your consent or on the fact that processing is necessary to fulfil a contract we have entered into with you or to comply with the law. We may process the following personal data in the order process: Name, Address, Contact data, Order and transaction data, Payment data.

As part of our Services, we may sell products that may reveal certain sensitive personal information about you, such as health information (allergies or dietary requirements), information about religion (again, with reference to certain foods prescribed or banned by certain religions), information about medical conditions (e.g. drugs, medicines, medical devices, medical creams, dietary supplements or herbal/homeopathic products) or sexual orientation. Also via our Partners, we will accept and process this data with your consent, provided when registering on our platforms or at the time of ordering.

We may sell restricted products or services (e.g. alcoholic beverages). To comply with our legal obligations, as may be required by applicable laws, we may implement verification procedures governing the sale and delivery of these products, including verification of your age and identity. For this purpose we may ask you to present a valid government-issued identification document and Innovation Group will not be obliged to perform and complete its Services if you do not cooperate in the required verification procedure.

2. Partner Reviews

After you have placed your order, you may be asked to review the Partner. Depending on the circumstances, we may rely on your consent or on the fact that processing is necessary to fulfil a contract we have entered into with you or to comply with the law.

Innovation Group processes the personal data you provide when submitting a review. You may revoke your consent by contacting us. We may process the following personal data when you publish a Partner review: Name, Contact details, Review.

When the review is published, it and your name may be accessible to Partners and/or the public.

3. Customer service and support

When you contact our customer service, we use the personal data you provide to answer your question or handle your complaint. We may collect personal data during call recordings to provide customer service, to resolve user concerns, and to monitor and update customer service procedures.

We may also collect your personal data when you report to us a potential suspicious element in our Services, which you may consider to be "illegal content" as defined in EU Regulation 2022/2065 of the European Parliament and of the Council ("Digital Services Act"), and also to grant you access to our internal complaint handling system and/or to take required suspension measures and protection against misuse of our Services as required by the Digital Services Act. 

Depending on the circumstances, we may rely on your consent or on the fact that processing is necessary to fulfil a contract we have entered into with you or to comply with the law. We may process the following personal data for customer service purposes: Name, Address, Contact data, Order and transaction data, Payment data, Comments, Content of correspondence between you and the customer service department, Any other content that may be required for compliance with the Digital Services Act.

4. Customer account

If you interact with our Services, you have the opportunity to create an account with us through our platforms or by using third party social access portals (e.g. Apple, Google, Facebook or other platforms); in the latter case, the privacy policy of the relevant third party will also apply in addition to this Policy. Depending on the circumstances, we may rely on your consent or on the fact that processing is necessary to fulfil a contract we have entered into with you or to comply with the law. You may revoke your consent and/or delete your account by contacting us. However, revocation of consent or deletion of the account may affect your user experience. We may process the following personal data for customer account purposes: Name, Address, Contact details, Credentials.

5. Customer research

In order to ensure that our Services are in line with your preferences and to improve the Services and our platforms, Innovation Group may contact you to conduct research, such as surveys and more. We will only send you these types of communications with your prior consent, unless this is necessary under applicable law. Participation in customer satisfaction surveys is entirely voluntary. If you do not wish to receive these surveys, you can unsubscribe within the messages themselves. We may process the following personal data for research purposes: Name, Contact data, Order and transaction data, Contributions made to research.

6. Marketing

We also process your personal data in order to send you (customised) marketing communications and notifications to manage, support, improve and develop our Services. Such messages may include the latest news and upcoming events, the latest discounts and updates on our Partners as well as other communications that may be subject to direct marketing. We rely on your consent, except where the same is not required under applicable law. Whenever you wish to change your preferences in relation to receiving such communications, you may unsubscribe by using the unsubscribe link included in the messages, in your account settings or by contacting us. We may process the following personal data for marketing purposes: Name, Address, Contact data, Order and transaction data, Review(s), Campaign data (optional), Device ID, Cookie and technology data.

In order to enable us to customise your user experience with the foodja platforms and optimise the Services we offer you we may use automated decision-making and profiling processes for marketing purposes. For more information, please refer to the section “Automated decision-making and profiling processes” below.

In some cases, Innovation Group may process your personal data to promote third party offers, products and services. The legal basis for this processing of personal data is your consent, except where the same is not required under applicable law. Whenever you wish to change your preferences in relation to receiving such communications, you may unsubscribe by using the unsubscribe link included in the relevant messages, or opt out of receiving SMS communications by replying with the word “STOP” in accordance with applicable law. You can also refuse to receive marketing messages sent via push notifications by revoking the authorisation referring to our app in the settings of your phone or tablet. This will also prevent you from receiving updates on your orders via push notifications.

8. Cookies

Innovation Group uses cookies or similar technologies for functional, analytical and marketing purposes. The data processed for cookies differs in purpose (functional, analytical or marketing) and depends on the preferences you set.

For more information on our use of cookies and/or similar technologies, please refer to our Cookie Policy, available at the following link https://foodja.it/cookie-policy. In any case, you may change your cookie settings via our preference centre and/or your settings in the device you use to browse. Please note that if you disable cookies you may not be able to use some of the Services and/or features on the website or your user experience may otherwise be affected.

9. Fraud prevention

We also process personal data to prevent fraud and other forms of misuse that may occur on and through our Services. Depending on the circumstances, we may rely on your consent or on the fact that processing is necessary to fulfil a contract we have entered into with you or to comply with the law. We may process the following personal data for fraud prevention purposes: Name, Order and transaction data, Payment data, Device information, IP address, Browser information.

10. Analysis

Innovation Group uses your personal data in order to improve its website, its App and its range of products and Services and to fulfil its reporting obligations to third parties. Depending on the circumstances, we may rely on your consent or on the fact that processing is necessary to fulfil a contract we have entered into with you or to comply with the law. We will ensure that the reports do not contain personal data so that the information cannot be traced back to you.

11. Campaigns

Innovation Group may launch specific campaigns or competitions in connection with its Services. Participation in campaigns or competitions is always on a voluntary basis. We may rely on your consent, except where the same is not required under applicable law. You may always revoke your consent via the contact data provided within the campaign or by contacting us.

We may process the following personal data to implement campaigns: Name, Contact data, Order and transaction data, Campaign data.

Additional Purposes

We will only use your personal data for the purposes described above. Should we wish to use the data for a different purpose, we will take appropriate measures to inform you, in line with the importance of the changes we make. Depending on the circumstances, we may rely on your consent or on the fact that processing is necessary to fulfil a contract we have entered into with you or to comply with the law. 

How we collect your personal data - types of data collected

We capture, process and store personal data on the devices you use to place orders via Innovation Group's foodja platforms (e.g. your computer, mobile phone or totems), as well as the data you provide by creating an account or contacting us.

We process the following personal data that you provide voluntarily, that we collect automatically and that we obtain from third-party sources for the purposes described in this Policy.

• Personal data you provide us with voluntarily: We may receive personal data that you provide when you place your order, create an account with us, set your marketing preferences or create customer reviews in connection with our Services.

• Personal data we collect automatically: With your prior consent or where permitted by applicable law, when you browse our platforms we may automatically collect technical data about your equipment, activities and browsing templates. This information is not collected in order to be associated with identified Users, but by its very nature could, through processing and association with Data held by third parties, allow Users to be identified. This category includes IP addresses, or the domain names used by Users connecting to the Application, the URIs (Uniform Resource Identifier) notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained, etc. We use this personal data with the help of cookies, server logs and other similar technologies. These self-learning algorithms generate content that is used to customise your user experience, specifically selecting items of interest to you, as well as to support the overall optimisation of our Services. For our cookie policy, read above (Cookies) for more information and see the following link https://foodja.it/cookie-policy.

• Personal data collected by social media: We may allow you to use social media websites to create your account or link it to the relevant social media website. These social media websites may provide us with automatic access to certain personal data they hold about you (e.g. content you have viewed, content you have liked, and information about advertisements you have viewed or may have clicked on). If we receive such information, we may use it to further customise your experience with us in line with your marketing preferences.
• Personal data we obtain from third-party sources: We may receive personal data from third party sources, including advertising networks and social media platforms such as Facebook or providers of technical payment and delivery services who may be based outside the EU, for purposes such as supporting the procurement of our Services, measuring the efficiency of marketing campaigns for our Services, and gaining a better understanding of your preferences so that we can tailor our marketing campaigns and Services accordingly. We may receive such personal data only after verifying that such third parties have your consent to process the information or other valid authorisation or obligation to share your personal data with us.

• Usage Data: Personal Data relating to the use of the Application by the User may also be collected, such as the pages visited, the actions performed, the features and services used.

Age

Our Services are not intended for use by those who are considered minors by applicable local laws, nor do we intend to collect personal data from users who have not reached the legal age, as defined by law. However, we are not able to verify the age of visitors. We therefore urge parents and/or legal guardians to monitor the online activities of minors in order to prevent their personal data from being acquired without their consent. If you believe that we have collected personal data from a child without your consent, you may contact us. At that point, we will proceed to delete this data.

Automated decision-making and profiling processes

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. In the performance of the contract with you and to the extent necessary to fulfil our obligations or where necessary to improve the platform or the Services for our legitimate interest, we use automated decision-making and profiling processes. For example, your address and/or location data can be used to select available partners in your area. We also use automated decision-making processes to comply with our legal obligations to prevent money laundering, terrorist financing and other crimes.

No decision that has a significant impact on you will be taken solely on the basis of an automated decision-making process, unless there is a legal basis authorising us to do so and you have received prior notification from us in this regard. If you wish to object to this type of processing, you can contact us. We will then re-evaluate the situation and/or provide you with more information on why this automated decision was taken and in what technical manner.

How long we retain your data

We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, as well as for the purpose of fulfilling any legal, tax, accounting or reporting requirements. In determining the appropriate retention period for personal data, we take into account the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of the personal data, the purposes for which it is processed, whether those purposes can be achieved by other means, and applicable legal requirements.

Under certain circumstances, we may anonymise your personal data so that it can no longer be associated with you, in which case we may use this information without further notice.

Sharing your personal data with Partners

If you order through our Services, Innovation Group may share your personal information (order, name, address or contact details) with the relevant Partner so that they can deliver your order and, where necessary, provide you with other services. Partners may process your personal data to contact you, if necessary to fulfil the contract concluded with you.

You are a direct customer of the Partner and, therefore, the Partner assumes its responsibility and obligations for the processing of your personal data. For questions on how the Partner handles your data, we suggest you contact the Partner directly.

Sharing your personal data with others

Innovation Group may cooperate with third parties in order to perform the processing described in this Policy and/or to fulfil legal obligations.

These third parties will process your personal data on our behalf as data controllers or autonomous data controllers (or another role defined or designated under applicable data protection law, including concepts equivalent to data controller or processor) and will have access to your personal data for the purposes described in this Policy. We require third parties to protect your personal data in accordance with the standards set out in this Policy and take appropriate measures, in accordance with applicable data protection laws, to ensure the same level of protection and confidentiality.

We may also share your data with other third parties where appropriate or required by applicable law or regulation (including court orders) or where we believe that disclosure is necessary to fulfil legal obligations, to exercise, establish or defend rights, or to protect an individual's vital interests. Such third-party data controllers could include law enforcement agencies.

Your personal data may be shared with the following parties:

• Companies affiliated or associated with Innovation Group srl;
• Software providers, hosting, application support, IT security, etc;
• Third parties who undertake various activities to promote, market or support our Services. These third parties include social media platforms such as Facebook, offshore customer service agents, marketing service providers, partners in charge of electronic customer relationship management who handle our marketing e-mails and push notifications, and partners who handle payment methods and money transfers related to your orders;
• Partners for implementing IT structures or developing devices for accessing our services;
• Merchants, providers of payment services and electronic payment processing and marketing service providers;
• Customer satisfaction survey and/or market research companies;
• Professional consultants;
• Law enforcement, judicial, governmental or regulatory authorities (including insurance companies, tax authorities and competent visa authorities);
• Potential buyers;
• Any other third party, provided you have given your consent to disclosure.

Third-party websites

Our website may include links to third-party websites. When accessing such third-party websites, please note that each of these websites has its own privacy policy. Although Innovation Group takes great care in selecting the websites to which you link, we cannot take responsibility for the way they handle your personal data.

Where your data is sent

Personal Data is processed at the premises of the Data Controller and at any other place where the parties involved in the processing are located. For further information, please contact the Data Controller at the following e-mail address privacy@foodja.it or at the following postal address Viale Enrico Forlanini 15 20134 Milan (Italy).

If you are located in the European Economic Area (EEA), Israel, Australia, New Zealand and Canada, please note that we may process and/or transfer your personal data outside the EEA, Israel, Australia, New Zealand and Canada. This may include transfer or access from other jurisdictions, including jurisdictions that may not provide a level of protection equivalent to your local and/or data protection laws ('Unsuitable Country'). Where we transfer personal data outside the EEA, Israel, Australia, New Zealand and Canada, we will consider any applicable legal obligations relating to transfers of personal data and, in an unsuitable country, we will rely on appropriate safeguards, including EC-approved standard contractual clauses or other binding transfer mechanism under applicable data protection law.

Personal data rights, questions or complaints

We inform you that, with respect to your personal data, you may exercise your rights under applicable data protection laws, which may include: the right to request access, verification, rectification or erasure of your personal data or restriction of processing; the right to object to processing or request its restriction; the right to data portability, to receive your data or to have your data transferred to another data controller; the right to withdraw your consent at any time (without prejudice to the lawfulness of the processing based on the consent provided prior to withdrawal) as well as to lodge a complaint directly with a supervisory authority and/or take legal action.

To exercise your rights, you can contact us at the addresses indicated in this policy. We will do our best to fulfil your request promptly and free of charge, except where it requires an excessive and disproportionate effort. In some cases, we may ask you to verify your identity before we can process your request.

Security - methods of processing

We take appropriate measures to protect your personal data from misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification.

The Personal Data is processed by means of computer and/or telematic tools, with organisational methods and logic strictly related to the purposes indicated. In some cases, subjects involved in the organisation of the Data Controller below (such as, for example, personnel management staff, sales staff, system administrators, etc.) or external subjects (such as IT companies, service providers, postal couriers, hosting providers, etc.) may also have access to Personal Data. These persons may be appointed as Data Processors by the Data Controller, and may have access to the Personal Data of the Users whenever necessary, and will be contractually obliged to keep the Personal Data confidential. The updated list of Data Processors can be requested by e-mail at privacy@foodja.it 

How to contact us

The Data Controller is INNOVATION GROUP ITALIA SRL, with a registered office in Viale Enrico Forlanini, 15 20134 MILAN (Italy), Tax Code/VAT No. IT13283490152, e-mail address info@foodja.it PEC (certified e-mail) address innovationgroup@pecimprese.it 

If you need to contact us to make an enquiry or if you have any questions or concerns about this Policy and/or our privacy practices and processing activities, please contact us at the addresses above.

Updates to this Privacy Policy

We may update this Policy from time to time in response to legal, technical or commercial changes. If we update our Privacy Policy, we will take appropriate steps to inform you, in line with the importance of the changes. Where required by applicable data protection law, we will obtain your consent to any material changes to this Policy.

By way of clarification, it should be noted that the use of the term "Partner" or any similar expression in this Policy does not imply or establish a partnership, an employer-employee relationship or an agency relationship of any kind between the mentioned party and Innovation Group.

We encourage you to periodically consult this Policy for the latest information regarding our privacy practices.

If local language versions are available, in the event of a conflict between the different language versions of this Policy, the Italian version shall prevail.

This Privacy Policy is subject to updating and was last updated on 15.05.2023.