FOXI ID Privacy Notice

1. Data Controller

Elite Digital Services, LLC
1111B S Governors Ave #21653
Dover, DE 19904, USA

Email: support@foxi.food

EU Representative (Article 27 GDPR)

Euro business company Kft.
Rómer Flóris utca 8/B. 3. em., Budapest 1024, Hungary
Tax number: HU28959364

2. What Data We Collect

When you create and use a FOXI ID account, we collect and process:

• Account credentials — email address and password (stored as a cryptographic hash — we cannot read your password);
• Contact information — name, phone number, and delivery address (provided by you to enable pre-filling across restaurants);
• Authentication data — session tokens, login timestamps, IP address at login (for security and fraud prevention);
• Account preferences — cross-restaurant pre-filling preference (on/off), language preference.

We do NOT collect or control:

• your order data (items ordered, order history, dietary preferences) — this is controlled by the restaurant;
• your payment information (card details are handled exclusively by the payment processor and the restaurant);
• any data from restaurants where you have not placed an order.

3. Legal Basis for Processing

We process your FOXI ID data based on the following legal grounds:

• Contract performance (Article 6(1)(b) GDPR) — maintaining your FOXI ID account, authenticating you at the restaurant where you are placing an order, and storing your contact details for your convenience;
• Legitimate interest (Article 6(1)(f) GDPR) — pre-filling your contact data at restaurants where you have not previously ordered, to provide a seamless ordering experience. You may opt out of this at any time (see Section 6). Our legitimate interest has been balanced against your rights: only basic contact data is shared, no order history is disclosed, and pre-filling serves your convenience;
• Legal obligation (Article 6(1)(c) GDPR) — where required to comply with applicable laws (e.g., fraud prevention, responding to lawful requests from authorities).

4. How Your Data is Shared

Your FOXI ID contact data (name, email, phone, delivery address) is shared with restaurants on the platform only when:

• you log in with your FOXI ID on the restaurant's ordering website; and
• you have not opted out of cross-restaurant pre-filling (or you have previously ordered at that restaurant).

Each restaurant receives your contact data solely for the purpose of fulfilling your order. Restaurants do NOT have access to:

• your order history at other restaurants;
• your preferences or dietary information at other restaurants;
• your FOXI ID password or authentication data;
• a list of other restaurants where you have an account.

We do not sell your data. We do not use your data for marketing, profiling, or cross-restaurant analytics.

5. Third-Party Processors

We use the following third-party services to operate the FOXI ID infrastructure:

• DigitalOcean, LLC — cloud hosting (EU and USA data centers, Standard Contractual Clauses in place);
• Brevo (Sendinblue) — transactional emails such as password reset and account notifications (France/EU).

All third-party processors are contractually bound to process data only according to our instructions.

6. Your Rights

בהתאם למקום מגוריך, ייתכן שיש לך חלק מהזכויות הבאות או את כולן מכוח חוקי הגנת המידע החלים עליך (כגון GDPR באזור הכלכלי האירופי/בריטניה, חוקי פרטיות ממלכתיים בארה״ב כגון CCPA/CPRA, חוק ה-LGPD הברזילאי, או חוקים מקומיים מקבילים) בנוגע לנתוני FOXI ID שלך:

• Access — request a copy of the personal data we hold about you;
• Rectification — update or correct your contact information at any time through your account settings, or by contacting us;
• Erasure — delete your FOXI ID account (see FOXI ID Terms of Use, Section 6). This removes your login credentials and shared contact data. Order history at individual restaurants must be requested from the restaurant directly;
• Data portability — receive your FOXI ID data in a structured, machine-readable format (JSON);
• Restriction — request that we restrict processing of your data in certain circumstances;
• Object — object to processing based on legitimate interest (cross-restaurant pre-filling). If you object, we will cease sharing your contact data with restaurants where you have not previously ordered;
• Opt out of cross-restaurant pre-filling — you may disable automatic sharing of your contact data with new restaurants at any time through your FOXI ID account settings. This does not affect your ability to log in.

To exercise any of these rights, contact us at: support@foxi.food. We will respond within 30 days.

You may also contact our EU representative: Euro business company Kft., Rómer Flóris utca 8/B. 3. em., Budapest 1024, Hungary.

You have the right to lodge a complaint with a supervisory authority in your country of residence. See the GDPR page on the FoxiFood website for a list of relevant authorities.

7. Cookies

FOXI ID uses the following cookies:

• Session cookie (.foxi.food) — maintains your authenticated session at the restaurant where you are placing an order. Strictly necessary — no consent required;
• Cross-restaurant authentication — keeps you logged in when you visit other restaurants on the platform. Functional cookie — presented through the restaurant's cookie consent mechanism. You may decline it; you will need to log in manually at each restaurant;
• SSO redirect (custom domains) — short-lived cookie for restaurants using their own domain. Strictly necessary for the login redirect — no consent required.

FOXI ID does not use any third-party cookies, advertising cookies, or cross-domain tracking.

8. Data Retention

• Active accounts: data is retained for as long as you maintain your FOXI ID account;
• Account deletion: data is deleted within 30 days of your deletion request;
• Inactive accounts: accounts with no login activity for 36 months are automatically scheduled for deletion, with 30 days' prior notice to your registered email address;
• Security logs (IP address, login timestamps): retained for 12 months for fraud prevention, then deleted.

9. International Data Transfers

Elite Digital Services, LLC ממוקמת בארצות הברית ומשרתת לקוחות ברחבי העולם. נתוני FOXI ID שלך עשויים להיות מועברים ומעובדים בארה״ב ובמדינות אחרות שבהן פועלים תת-המעבדים שלנו. במקרים שבהם הדין החל מחייב זאת, אנו מבטיחים אמצעי הגנה מתאימים להעברות כאמור — לגבי נתונים הכפופים ל-GDPR, בהתאם לפרק ה' ל-GDPR, לרבות סעיפים חוזיים סטנדרטיים (SCCs). תשתית האחסון שלנו (DigitalOcean) מפעילה מרכזי נתונים במספר אזורים, לרבות בתוך האיחוד האירופי עבור משתמשים אירופיים.

10. Data Security

We protect your FOXI ID data with:

• encryption of all data in transit (TLS/SSL);
• password hashing using industry-standard algorithms (we cannot read your password);
• access controls and monitoring;
• regular security updates and vulnerability assessments.

11. Age Requirement

FOXI ID accounts may only be created by individuals who are at least 16 years of age or have reached the age of digital consent in their jurisdiction. If we become aware that an account has been created by an individual below this age, we will delete the account and associated data promptly.

12. Where to Find This Notice

This Privacy Notice is always accessible:

• on each restaurant's ordering website — in the footer or during FOXI ID registration;
• on the FoxiFood website at the Legal section;
• within your FOXI ID account settings.

13. Changes to This Notice

We may update this Privacy Notice from time to time. Material changes will be notified via email to your registered FOXI ID address at least 30 days before they take effect.

14. Contact

For privacy-related questions about your FOXI ID account, contact us at: support@foxi.food

Elite Digital Services, LLC
1111B S Governors Ave #21653
Dover, DE 19904, USA