개인정보 처리방침

1. Data Controller

Elite Digital Services, LLC
1111B S Governors Ave #21653
Dover, DE 19904, USA

Email: support@foxi.food

For the purposes of the FoxiFood platform, Elite Digital Services, LLC acts in the following data protection roles:

• Data controller — for personal data of restaurant partners (Users), and for FOXI ID account data (login credentials and authentication data) of end customers who create a FOXI ID account;
• Data processor — for personal data of end customers processed on behalf of the restaurant partner in connection with orders placed through the restaurant's ordering website (see our Data Processing Agreement for details).

Elite Digital Services, LLC는 미국 회사로서 foxifood.com 및 foxi.food 도메인에서만 전 세계적으로 FoxiFood 플랫폼을 운영합니다. 동사는 특정 기술적 업무를 대행하도록 각 관할지역의 승인된 법인을 참여시킬 수 있습니다. 플랫폼의 다른 도메인 또는 현지/국가별 버전은 FOXIFOOD 상표 사용에 관한 별도의 라이선스 계약에 따라 별개의 법인이 운영할 수 있으며, 이러한 법인은 자신의 명의로 자신의 책임 하에 행동하고 자체적인 개인정보 관련 문서를 유지합니다.

Apart from operating the FOXI ID shared identity infrastructure (see Section 2.3), FoxiFood does not establish a direct commercial relationship with end customers. The platform provides the technical infrastructure required to operate restaurant ordering websites.

EU Representative (Article 27 GDPR)

In accordance with Article 27 of the GDPR, the following entity has been appointed as the EU representative of Elite Digital Services, LLC:

Euro business company Kft.
Rómer Flóris utca 8/B. 3. em., Budapest 1024, Hungary
Tax number: HU28959364

For full details on the EU representative and its role, see our GDPR page.

Privacy by Design and Records of Processing

We implement data protection by design and by default in accordance with Article 25 of GDPR. We maintain Records of Processing Activities as required by Article 30 of GDPR, documenting all categories of processing activities carried out on behalf of or as part of the FoxiFood platform. Where required by Article 35 of GDPR, we conduct Data Protection Impact Assessments before undertaking processing operations that are likely to result in a high risk to the rights and freedoms of natural persons.

2. What Data We Collect

2.1. Restaurant Partner (User) Data

When you register and use the FoxiFood platform, we collect:

• Business identification: business name, registration number, VAT ID, registered address;
• Contact information: name, email address, phone number;
• Account credentials: email and encrypted password;
• Billing information: payment method details, transaction history, invoices (card details are processed and stored exclusively by the payment processor);
• Service usage data: login history, feature usage, admin dashboard activity;
• Communication data: support requests, feedback, correspondence.

2.2. End Customer Data (Processed on Behalf of Restaurant Partners)

End customers interact directly with the restaurant partner's ordering website. FoxiFood provides only the technical infrastructure required to operate that website.

When end customers place orders through a restaurant's FoxiFood-powered website, we process the following data on behalf of the restaurant partner:

• Contact information: name, email address, phone number;
• Delivery address (when applicable);
• Order details: items ordered, order history, preferences;
• Payment transaction references (card details are handled exclusively by the payment processor).

2.3. FOXI ID (Shared Customer Identity Infrastructure)

The FoxiFood platform includes a shared customer identity system ('FOXI ID') that allows end customers to create a single account and use the same login credentials across all restaurant ordering websites on the platform. FOXI ID is a technical infrastructure component provided as part of the platform.

Elite Digital Services, LLC acts as the data controller for FOXI ID account data, which includes:

• Login credentials (email address and hashed password);
• Authentication session data;
• Contact information used for pre-filling order forms (name, phone number, delivery address).

Through FOXI ID, the end customer's contact data (name, email, phone number, delivery address) may be pre-filled when placing an order at any restaurant on the platform. Order data, order history, preferences, and payment information are NOT shared between restaurants. Each restaurant can only access data generated through its own ordering website.

The legal bases for processing FOXI ID data are:

• Contract performance (Article 6(1)(b) GDPR) — for maintaining the FOXI ID account and authenticating the end customer at the restaurant where they are placing an order;
• Legitimate interest (Article 6(1)(f) GDPR) — for pre-filling contact data across restaurants on the platform, where the legitimate interest is providing a seamless ordering experience and reducing friction for returning customers. This interest has been balanced against the end customer's rights — only basic contact data is shared, no order history or preferences are disclosed, and the end customer may request deletion of their FOXI ID account at any time.

The Provider does not use FOXI ID data for marketing, profiling, cross-restaurant analytics, or any purpose other than providing the platform infrastructure.

End customers may exercise their data subject rights regarding their FOXI ID account (access, rectification, erasure, portability, restriction, objection) by contacting: support@foxi.food. Deletion of a FOXI ID account removes the shared login across all restaurants on the platform. Order history at individual restaurants is retained or deleted in accordance with the respective restaurant partner's data retention policy.

2.4. Automatically Collected Data

We automatically collect certain technical data when you visit our websites:

• IP address and approximate geolocation;
• Browser type, version, and language settings;
• Device type and operating system;
• Pages visited, time spent, referring URLs;
• Cookie data (see our Cookie Policy for details).

3. Legal Basis for Processing

당사는 다음의 법적 근거(GDPR에서 정의되고 기타 적용 가능한 개인정보 보호법상 이에 상응하는 개념에 반영된 것)에 기초하여 개인정보를 처리합니다.

• Contract performance — processing necessary for the performance of the Agreement between us and the User (registration, account management, service provision, billing);
• Legitimate interest — processing necessary for our legitimate business interests (service improvement, security, fraud prevention, analytics), balanced against your rights;
• Legal obligation — processing required to comply with applicable laws (tax reporting, anti-money laundering, regulatory requirements);
• Consent — where required by law, we obtain your explicit consent (e.g., for analytics cookies, marketing communications). You may withdraw consent at any time.

4. How We Use Your Data

We use your personal data for the following purposes:

• Providing and operating the FoxiFood platform and all its features;
• Account creation, authentication, and management;
• Processing payments and issuing invoices through our payment partners;
• Providing technical support and responding to your inquiries;
• Sending service notifications (maintenance, security alerts, Terms updates);
• Improving the Service based on usage patterns and feedback;
• Ensuring security, preventing fraud, and detecting unauthorized access;
• Complying with legal and regulatory obligations;
• Generating anonymized and aggregated statistics.

5. Data Sharing and Third Parties

We do not sell your personal data. We share data only with the following categories of recipients, to the extent necessary:

• Payment processor (currently Stripe) — payment processing (PCI DSS Level 1 certified);
• DigitalOcean — cloud hosting and infrastructure;
• Brevo — transactional email delivery;
• Google Analytics — website analytics (with your consent, anonymized);
• Legal and regulatory authorities — when required by law, court order, or government request;
• Professional advisors — lawyers, auditors bound by professional secrecy.

All third-party processors are contractually bound to process data only according to our instructions and to maintain appropriate security measures.

6. International Data Transfers

Elite Digital Services, LLC는 미국에 소재하며 전 세계 고객에게 서비스를 제공합니다. 귀하의 데이터는 미국 및 당사의 하위처리자가 운영하는 기타 국가로 이전되어 처리될 수 있습니다. 적용되는 개인정보 보호법상 요구되는 경우, 당사는 이러한 이전에 대해 적절한 안전조치가 마련되어 있음을 보장합니다. GDPR의 적용을 받는 데이터의 경우, 2021년 6월 4일자 유럽위원회 이행결정(EU) 2021/914에 따라 채택된 표준계약조항(SCC)을 포함한 GDPR 제5장에 따라 이전이 이루어집니다. 하위처리자로의 이전의 경우, 해당되는 대로 모듈 2(관리자-처리자 간) 또는 모듈 3(처리자-처리자 간) SCC가 적용되며, 당사는 각 하위처리자에 대해 목적지 국가의 법적 체계를 평가하기 위한 이전영향평가(Transfer Impact Assessment)를 실시합니다. 서명된 SCC의 사본은 요청 시 제공됩니다. 기타 개인정보 보호 체계의 적용을 받는 데이터의 경우, 당사는 적용 법률상 인정되는 이전 메커니즘에 따릅니다. 당사의 호스팅 인프라(DigitalOcean)는 유럽 이용자를 위한 EU 내 데이터센터를 포함하여 여러 지역에서 데이터센터를 운영합니다.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Account data: for the duration of the Agreement plus 30 days for data export;
• Billing and transaction data: for the period required by applicable tax and accounting laws (typically 5-10 years);
• Communication records: for 3 years after the last communication;
• Analytics data: retained for statistical purposes in anonymized form; identifiable data deleted after 26 months;
• End customer order data: as determined by the restaurant partner (data controller). The restaurant partner may configure data retention settings within the platform. FoxiFood processes and deletes end customer data strictly according to the instructions of the restaurant partner. Upon termination of the restaurant partner's Agreement, data is deleted within 30 days;
• FOXI ID account data: for as long as the end customer maintains an active FOXI ID account. Upon account deletion request, FOXI ID data is deleted within 30 days. Inactive FOXI ID accounts (no login activity for 36 months) are automatically scheduled for deletion with 30 days' prior notice to the end customer's registered email address.

The restaurant partner, as the data controller for order data of its end customers, remains solely responsible for compliance with all applicable legal, tax, and accounting data retention obligations in its jurisdiction. FOXI ID account data retention is managed by the Provider as described in Section 2.3.

After the expiration of retention periods, data is irreversibly deleted or anonymized.

8. Data Security

In accordance with Article 32 of GDPR and the principle of data protection by design and by default (Article 25 GDPR), we implement appropriate technical and organizational measures to protect personal data, including:

• Encryption of all data in transit using TLS/SSL;
• Encrypted storage of sensitive data at rest;
• Password hashing using industry-standard algorithms;
• Access controls and role-based permissions;
• Regular security updates and vulnerability monitoring;
• Daily automated backups with 30-day retention;
• Payment card data handled exclusively by the PCI DSS Level 1 certified payment processor — we never store card numbers;
• Incident response procedures and breach notification protocols.

9. 귀하의 개인정보 권리

귀하의 거주지에 따라, GDPR(EEA/영국), 캘리포니아 소비자 개인정보 보호법(CCPA/CPRA)과 같은 미국 주(state) 개인정보 보호법, 브라질의 LGPD, 그리고 다른 국가의 이에 상응하는 법률을 포함하여 귀하에게 적용되는 개인정보 보호법에 따라 다음 권리의 일부 또는 전부를 보유할 수 있습니다.

• Right of access — request a copy of your personal data we hold;
• Right to rectification — request correction of inaccurate or incomplete data;
• Right to erasure — request deletion of your data ('right to be forgotten'), subject to legal retention obligations;
• Right to restriction — request restriction of processing in certain circumstances;
• Right to data portability — receive your data in a structured, machine-readable format;
• Right to object — object to processing based on legitimate interest;
• Right to withdraw consent — withdraw consent at any time where processing is based on consent;
• Right to lodge a complaint — 귀하의 거주국 개인정보 보호 감독기관에 불만을 제기하는 것. EU/EEA 국가의 경우, 감독기관의 연락처 정보는 당사 GDPR 페이지를 참조하십시오. 다른 국가의 경우, 관할 당국이 해당 국가별 특별약관에 기재되어 있을 수 있습니다.

To exercise any of these rights, contact us at: support@foxi.food. We will respond to your request within 30 days. You may also contact our EU representative (Euro business company Kft.) — see our GDPR page for details.

10. Cookies

We use essential cookies for site functionality and optional analytics cookies with your consent. For detailed information about the cookies we use and how to manage your preferences, see our separate Cookie Policy.

The FOXI ID shared customer identity infrastructure uses the following cookies:

• Session cookie on the .foxi.food domain — maintains the end customer's authenticated session at the restaurant where they are currently placing an order. Classified as strictly necessary for the ordering service to function (no consent required);
• Cross-restaurant authentication persistence — enables the end customer to remain logged in when visiting other restaurants on the platform. Classified as a functional cookie. On restaurant ordering websites, this cookie is presented through the cookie consent mechanism, and the end customer may decline it without affecting the ability to place orders (manual login will be required at each restaurant);
• SSO redirect for custom domains — for restaurants using their own custom domain, a short-lived redirect cookie facilitates authentication. Classified as strictly necessary for the login process on custom domains (no consent required).

FOXI ID does not use any third-party cookies, tracking cookies, or cross-domain tracking mechanisms. All FOXI ID cookies serve exclusively the technical purpose of authentication.

11. Children's Privacy

The FoxiFood Service is a B2B platform intended for businesses. We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have collected data from a child, we will delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes at least 30 days in advance via email or notification in the Service. The date of the last update is shown at the top of this document. Continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

13. Contact

For privacy-related inquiries, data subject requests, or complaints, contact us at: support@foxi.food

Elite Digital Services, LLC
1111B S Governors Ave #21653
Dover, DE 19904, USA