Welcome to TASTEAT!

A. Subject matter and Purpose of this Policy

TASTEAT respects your privacy and protects your personal data. For any issue related to this policy, you can contact the data protection officer mentioned below. With this policy, we aim to inform you about the personal data we collect and process during our operation. Your personal data is collected and retained for the necessary time, for the specified, explicit and legitimate purposes described in detail below, and is lawfully and fairly processed in a transparent manner in accordance with the applicable legal framework and in a way that guarantees their integrity and confidentiality. Such data shall be adequate, relevant, appropriate and no more than necessary in view of the above purposes and shall be accurate and, where necessary, updated and reassessed.

Data Controller:

Name: TASTEAT PC

Address: 23 Alexandroupoleos Str., Athens, Greece

VAT no.: EL801889736, Athens B Tax Office

Contact Tel. No. 2162007280

B. Concepts and Definitions

"Personal data": any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"Processing of personal data": any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The "Controller" is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

The "Processor" is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

"Consent" of the data subject: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by means of a statement or a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

"Personal data breach": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

"Data concerning health": personal data relating to the physical or mental health of a natural person, including the provision of healthcare services, which reveal information about his or her state of health.

"Special categories of personal data/Sensitive personal data": personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of unequivocally identifying a person, data concerning health or data concerning the sexual life of a natural person or sexual orientation.

C. General Principles of Personal Data Processing

TASTEAT ensures that the personal data it processes are

• Processed in a lawful and fair manner in relation to the data subject
• Collected for specified, explicit and legitimate purposes
• Adequate, relevant and limited to what is necessary for the purposes for which they are processed.
• Accurate and up-to-date
• Processed in a manner that ensures the appropriate security of the personal data, including their protection against unauthorised or unlawful processing and against accidental loss, destruction or deterioration, using appropriate technical or organisational measures
• Kept only for the time necessary for the purposes of the processing of personal data. In some cases, they may be retained for a longer period of time, in particular if the processing of such data is deemed necessary:

• for the observance of a legal obligation imposed by a provision of another law
• for the performance of a task of TASTEAT carried out in the public interest
• for archiving, for purposes of public interest, scientific or historical research
• for purposes relating to the protection of public health
• for statistics
• for the establishment, defense, exercise or support of legal claims

D. Legal Framework for the Protection of Personal Data

In addition to the General Data Protection Regulation of the European Parliament (2016/679) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, every national law in force concerning the processing and protection of personal data applies, as well as the Directives issued by the Personal Data Protection Authority. Indicatively, the following laws are mentioned:

• Law 4624/2019 (Implementing Measures of the General Data Protection Regulation of the European Parliament [2016/679])
• Law 2472/1997 on the protection of individuals with regard to the processing of personal data
• Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
• Directive 2002/58/EC of the European Parliament and of the Council concerning the processing of personal data and the protection of privacy in the field of electronic communications
• Directive 1/2011 of the Personal Data Protection Authority on the use of video surveillance systems for the protection of persons and property.
• Directive 115/2001 of the Personal Data Protection Authority on the protection of personal data in the field of labor relations
• Law 3471/2006 on the protection of personal data and privacy in the field of electronic communications
• Regulatory Acts of the competent administrative bodies.
• Health Protocols, Legislative Acts, Joint Ministerial Decisions.

E. Processing Purposes

In accordance with the above legal framework, the personal data collected by TASTEAT are used for the following processing purposes:

• To manage the orders made through its website, www.tasteat.io, as well as any other service provided by it.
• To manage our relationship with you before, during and after the use of our services.
• For our compliance with Greek and European Law.
• For marketing purposes.
• For the establishment, recognition, exercise or defense of a right and legal claims.
• To support operational processes.
• To improve our services.
• For the security of our information systems.
• For the performance of a task carried out in the public interest and, in particular, in the field of public health.

F. Legal Basis for the Processing of Personal Data
TASTEAT processes your personal data in a transparent manner, according to the principles of legality, proportionality, confidentiality and integrity, purpose limitation and accuracy, specific data retention time and data minimization.

The legal basis for the processing of your personal data may be:

• your consent
• the necessity of processing your data in the context of our contractual obligation or at the pre-contractual stage
• the necessity of processing your data in compliance with our legal obligations
• the necessity of processing your data in the context of safeguarding our legitimate interests
• the necessity of processing the data to protect your vital interests
• the necessity for statistical data to be extracted
• the necessity of processing for the performance of a task in the public interest, in particular in the field of public health

G. Data Processed by TASTEAT

In accordance with the above purposes, TASTEAT collects and processes personal data, including but not limited to the following:

G.1 Employees/External partners: full name, father's name, mother's name, year of birth, place of birth, gender, nationality, address, email address (email), contact telephone numbers, Identity Card Number (ID), Tax Identification Number (TIN), Social Security Number (SSN), bank account number (IBAN), data concerning the family situation, education and training of the employee/partner, his/her previous employment, CV, salary, working hours, medical record/health certificate

Purposes/Legal Basis for Processing:

• The management of the employment relationship between TASTEAT and the employee/external partner. The processing of such data is deemed necessary for the performance of the employment contract.
• The fulfillment of TASTEAT's employer obligations. The processing of the data is necessary for TASTEAT to comply with its legal obligations.

G.2. Candidate Employees: name, surname, contact details, education, work experience, email, nationality, marital status.

TASTEAT collects and processes the personal data of candidates for job vacancies. Such data shall be collected by the candidate upon request. In case the candidate is not hired, his/her CV is kept for 2 years to cover any future job vacancies.

Purposes/Legal Basis for Processing

• Assessment of the candidate's suitability for a specific job vacancy. The legal basis for processing is the legitimate interest of TASTEAT and the consent of the prospective employee.

G.3. Users of the Website/Completion of Orders:

• name, email, address, telephone, billing details (card number), order content, store evaluations, invoicing details. TASTEAT may process data belonging to special categories of personal data ("sensitive data"), such as data concerning eating habits, allergies, religious preferences, diseases, etc.

Purposes/Legal Basis for Processing:

• Performance of a contract to which the subject is a party
• Consent of the subject
• Compliance with a legal obligation of TASTEAT
• Protection of the vital interests of the subject

G.4. Suppliers: full name, VAT, IBAN, contact phone number, address, email

Purposes/Legal Basis for Processing:

• Performance of a contract to which the subject is a party

G.5 Communication data

Persons who have declared their wish to receive news and updates from TASTEAT through their valid consent

Purposes/Legal Basis for Processing:

The consent of persons that wish to receive updates and offers from TASTEAT.

H. Data transmission

All of the workforce that is employed by TASTEAT and is processing your personal data is contractually bound by confidentiality and data privacy clauses.

 
At TASTEAT, part of our philosophy and one of our basic principles is that we will not share your information with third parties for their own independent business or marketing purposes without your consent.

In any case, TASTEAT will forward the necessary information regarding your order (name, address, food order) to the restaurant of your choice in order to complete the order. These partner restaurant companies act as independent data controllers regarding the processing of data for the purpose of completing the order.

In addition, we may share your information with the following entities:
• Affiliates. Your information may be shared with the affiliates of TASTEAT
• Business partners. We may also share your information with trusted business partners. These partners may use your information to provide you with the services you requested and to provide you with promotional, advertising and other material, provided that you have given your consent
• Service providers and/or any third party who may perform the processing on our behalf. We may also share your information with companies that provide services on our account or behalf, such as IT subcontractors, companies that send mass emails on our behalf, banks, credit card issuers, law firms, post office companies, print service companies, etc
• Credit approval: When you submit a credit request, your personal information is used and disclosed to appropriate third parties in accordance with the applicable legislation, in order to decide to grant and maintain a credit limit for you

• Other third parties with your consent or at your direction. In addition to the disclosures described in this Privacy Policy, we may share information that concerns you with third parties if you give your consent or if you request it

• Public bodies, when expressly provided for by the National Legislation

By way of exception, access to your personal data is permitted:

• to the judicial and prosecutorial authorities in the performance of their duties ex officio or at the request of a third party claiming a legitimate interest and in accordance with legal procedures
• to other bodies of the Greek State, which according to their statutory provisions have such right and competence.

I. Data Retention Period

We take reasonable steps to ensure that your personal data is retained only for as long as necessary and for the purpose for which it was collected or for as long as required by contract or by applicable law. In case you request it or in case your account remains inactive for 2 years, your personal data will be deleted.

Tax information shall be kept in accordance with tax legislation.

Therefore, despite your request to delete your data, we may need to store some of the data due to legal requirements. In this case, however, we will restrict your data from further processing.

J. Data Subject Rights
TASTEAT ensures that data subjects can exercise the rights granted to them by the legislation regarding the collection and processing of personal data at any time. These rights are as follows:

• The right of access to data.
• The right to correct data.
• The right to erase data ("right to be forgotten").
• The right to restrict the processing of data.
• The right to data portability.
• The right to object to the processing of data.

Any request of the person/subject shall be submitted to TASTEAT, at the following e-mail address: info@tasteat.io

TASTEAT will respond to your request free of charge, without delay and in any case within one month of receipt of the request, except in exceptional cases, in which case the above deadline may be extended by two more months, if required, taking into account the complexity of the request and/or the number of requests. TASTEAT will inform you of any extension within one month of receipt of the request, as well as of the reasons for the delay.

In case the completion of your request is impossible, TASTEAT will inform you within one month from the receipt of the request, for the relevant reasons and for the possibility to file a complaint to the Personal Data Protection Authority, as well as for your right to appeal before the competent judicial authorities.

If your request is deemed manifestly unfounded or excessive by TASTEAT, it may impose a reasonable and proportionate fee, taking into account the administrative costs for its completion or refuse to follow up on your request.

K. Right of complaint to the competent Authority.

In case you consider that the protection of personal data is affected in any way, you can appeal to the Data Protection Authority (www.dpa.gr, 1-3 Kifissias Avenue, 115 23, Athens, Greece +30 210 6475600, +30 210 6475628, contact@dpa.gr)

L. Changes to this Policy

TASTEAT may unilaterally review this Policy at any time to comply with regulatory changes or for operational purposes.

We encourage you to regularly review this Policy in order to be informed about how TASTEAT manages and processes your personal data.

This Policy was posted on  05 SEPTEMBER 22