Politika tal-privatezza

1. Kontrollur tad-Data

Elite Digital Services, LLC
1111B S Governors Ave #21653
Dover, DE 19904, USA

Email: support@foxi.food

For the purposes of the FoxiFood platform, Elite Digital Services, LLC acts in the following data protection roles:

• Kontrollur tad-data — for personal data of restaurant partners (Users), and for FOXI ID account data (login credentials and authentication data) of end customers who create a FOXI ID account;
• Proċessur tad-data — for personal data of end customers processed on behalf of the restaurant partner in connection with orders placed through the restaurant's ordering website (see our Data Processing Agreement for details).

Elite Digital Services, LLC hija kumpanija tal-Istati Uniti u topera l-pjattaforma FoxiFood madwar id-dinja, esklussivament fuq id-dominji foxifood.com u foxi.food. Hija tista' tafda kompiti tekniċi speċifiċi lil entitajiet awtorizzati f'diversi ġurisdizzjonijiet. Dominji oħra jew verżjonijiet lokali jew nazzjonali tal-pjattaforma jistgħu jitħaddmu minn entitajiet ġuridiċi separati taħt ftehim ta' liċenzja separat għall-użu tat-trademark FOXIFOOD; dawn l-entitajiet jaġixxu f'isimhom stess u taħt ir-responsabbiltà tagħhom stess u jżommu d-dokumentazzjoni tal-privatezza tagħhom stess.

Apart from operating the FOXI ID shared identity infrastructure (see Section 2.3), FoxiFood does not establish a direct commercial relationship with end customers. The platform provides the technical infrastructure required to operate restaurant ordering websites.

Rappreżentant fl-UE (Artikolu 27 GDPR)

In accordance with Article 27 of the GDPR, the following entity has been appointed as the EU representative of Elite Digital Services, LLC:

Euro business company Kft.
Rómer Flóris utca 8/B. 3. em., Budapest 1024, Hungary
Numru tat-taxxa: HU28959364

For full details on the EU representative and its role, see our GDPR page.

Privatezza bid-Disinn u Rekords tal-Ipproċessar

We implement data protection by design and by default in accordance with Article 25 of GDPR. We maintain Records of Processing Activities as required by Article 30 of GDPR, documenting all categories of processing activities carried out on behalf of or as part of the FoxiFood platform. Where required by Article 35 of GDPR, we conduct Data Protection Impact Assessments before undertaking processing operations that are likely to result in a high risk to the rights and freedoms of natural persons.

2. Liema Data Niġbru

2.1. Data tal-Partner Ristoranti (Utent)

Meta tirreġistra u tuża l-pjattaforma FoxiFood, niġbru:

• Business identification: business name, registration number, VAT ID, registered address;
• Informazzjoni ta' kuntatt: isem, indirizz tal-email, numru tat-telefon;
• Kredenzjali tal-kont: email u password kriptata;
• Billing information: payment method details, transaction history, invoices (card details are processed and stored exclusively by the payment processor);
• Service usage data: login history, feature usage, admin dashboard activity;
• Data ta' komunikazzjoni: talbiet ta' appoġġ, feedback, korrispondenza.

2.2. Data tal-Klijenti Finali (Ipproċessata f'Isem il-Partners Ristoranti)

End customers interact directly with the restaurant partner's ordering website. FoxiFood provides only the technical infrastructure required to operate that website.

When end customers place orders through a restaurant's FoxiFood-powered website, we process the following data on behalf of the restaurant partner:

• Informazzjoni ta' kuntatt: isem, indirizz tal-email, numru tat-telefon;
• Indirizz tal-kunsinna (meta applikabbli);
• Dettalji tal-ordni: oġġetti ordnati, storja tal-ordnijiet, preferenzi;
• Payment transaction references (card details are handled exclusively by the payment processor).

2.3. FOXI ID (Infrastruttura Kondiviża tal-Identità tal-Klijenti)

The FoxiFood platform includes a shared customer identity system ('FOXI ID') that allows end customers to create a single account and use the same login credentials across all restaurant ordering websites on the platform. FOXI ID is a technical infrastructure component provided as part of the platform.

Elite Digital Services, LLC acts as the data controller for FOXI ID account data, which includes:

• Kredenzjali ta' login (indirizz tal-email u password encrypted);
• Data tas-sessjoni ta' awtentikazzjoni;
• Contact information used for pre-filling order forms (name, phone number, delivery address).

Through FOXI ID, the end customer's contact data (name, email, phone number, delivery address) may be pre-filled when placing an order at any restaurant on the platform. Order data, order history, preferences, and payment information are NOT shared between restaurants. Each restaurant can only access data generated through its own ordering website.

Il-bażijiet legali għall-ipproċessar tad-data FOXI ID huma:

• Twettiq ta' kuntratt (Artikolu 6(1)(b) GDPR) — for maintaining the FOXI ID account and authenticating the end customer at the restaurant where they are placing an order;
• Interess leġittimu (Artikolu 6(1)(f) GDPR) — for pre-filling contact data across restaurants on the platform, where the legitimate interest is providing a seamless ordering experience and reducing friction for returning customers. This interest has been balanced against the end customer's rights — only basic contact data is shared, no order history or preferences are disclosed, and the end customer may request deletion of their FOXI ID account at any time.

The Provider does not use FOXI ID data for marketing, profiling, cross-restaurant analytics, or any purpose other than providing the platform infrastructure.

End customers may exercise their data subject rights regarding their FOXI ID account (access, rectification, erasure, portability, restriction, objection) by contacting: support@foxi.food. Deletion of a FOXI ID account removes the shared login across all restaurants on the platform. Order history at individual restaurants is retained or deleted in accordance with the respective restaurant partner's data retention policy.

2.4. Data miġbura awtomatikament

We automatically collect certain technical data when you visit our websites:

• Indirizz IP u ġeolokazzjoni approssimattiva;
• Tip ta' browser, verżjoni u settings tal-lingwa;
• Tip ta' apparat u sistema operattiva;
• Paġni viżitati, ħin mgħoddi, URLs ta' referenza;
• Data tal-cookies (ara l-Politika tal-Cookies tagħna għad-dettalji).

3. Bażi Legali għall-Ipproċessar

Aħna nipproċessaw data personali abbażi tal-bażijiet legali li ġejjin (kif definiti fil-GDPR u riflessi f'kunċetti ekwivalenti taħt liġijiet applikabbli oħra tal-protezzjoni tad-data):

• Eżekuzzjoni tal-kuntratt — processing necessary for the performance of the Agreement between us and the User (registration, account management, service provision, billing);
• Interess leġittimu — processing necessary for our legitimate business interests (service improvement, security, fraud prevention, analytics), balanced against your rights;
• Obbligu legali — processing required to comply with applicable laws (tax reporting, anti-money laundering, regulatory requirements);
• Kunsens — where required by law, we obtain your explicit consent (e.g., for analytics cookies, marketing communications). You may withdraw consent at any time.

4. Kif Nużaw id-Data Tiegħek

Nużaw id-data personali tiegħek għall-finijiet li ġejjin:

• Provvediment u operazzjoni tal-pjattaforma FoxiFood u l-karatteristiċi kollha tagħha;
• Ħolqien tal-kont, awtentikazzjoni u ġestjoni;
• Ipproċessar tal-pagamenti u ħruġ ta' fatturi permezz tal-partners tal-pagament tagħna;
• Provvediment ta' appoġġ tekniku u risposta għall-mistoqsijiet tiegħek;
• Sending service notifications (maintenance, security alerts, Terms updates);
• Titjib tas-Servizz ibbażat fuq xejriet tal-użu u feedback;
• Żgurar is-sigurtà, prevenzjoni tal-frodi u skoperta ta' aċċess mhux awtorizzat;
• Konformità mal-obbligi legali u regolatorji;
• Ġenerazzjoni ta' statistika anonimizzata u aggregata.

5. Qsim tad-Data u Partijiet Terzi

We do not sell your personal data. We share data only with the following categories of recipients, to the extent necessary:

• Proċessur tal-pagamenti (bħalissa Stripe) — ipproċessar tal-pagamenti (PCI DSS Livell 1 iċċertifikat);
• DigitalOcean — hosting fil-cloud u infrastruttura;
• Brevo — kunsinna ta' emails transazzjonali;
• Google Analytics — analitika tal-websajt (bil-kunsens tiegħek, anonimizzata);
• Legal and regulatory authorities — when required by law, court order, or government request;
• Professional advisors — lawyers, auditors bound by professional secrecy.

All third-party processors are contractually bound to process data only according to our instructions and to maintain appropriate security measures.

6. Trasferimenti Internazzjonali tad-Data

Elite Digital Services, LLC hija bbażata fl-Istati Uniti u sservi klijenti madwar id-dinja; id-data tiegħek tista' tiġi ttrasferita lejn u pproċessata fl-Istati Uniti u f'pajjiżi oħra fejn joperaw is-subproċessuri tagħna. Fejn meħtieġ mil-liġi applikabbli tal-protezzjoni tad-data, niżguraw li jkunu fis-seħħ salvagwardji xierqa għal dawn it-trasferimenti. Għad-data soġġetta għall-GDPR, it-trasferimenti jsiru skont il-Kapitolu V tal-GDPR, inklużi l-Klawżoli Kuntrattwali Standard (SCC) adottati mill-Kummissjoni Ewropea permezz tad-Deċiżjoni ta' Implimentazzjoni (UE) 2021/914 tal-4 ta' Ġunju 2021 — għat-trasferimenti lejn subproċessuri japplikaw, skont il-każ, il-Modulu Tnejn (kontrollur–proċessur) jew il-Modulu Tlieta (proċessur–proċessur) tal-SCC, u nwettqu Valutazzjoni tal-Impatt tat-Trasferiment (Transfer Impact Assessment) għal kull subproċessur biex nevalwaw il-qafas legali tal-pajjiż tad-destinazzjoni; kopji tal-SCC iffirmati huma disponibbli fuq talba. Għad-data soġġetta għal reġimi oħra tal-protezzjoni tad-data, nistrieħu fuq il-mekkaniżmi ta' trasferiment rikonoxxuti mil-liġi applikabbli. L-infrastruttura tal-hosting tagħna (DigitalOcean) topera ċentri tad-data f'diversi reġjuni, inklużi ċentri tad-data fl-UE għall-utenti Ewropej.

7. Żamma tad-Data

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Account data: for the duration of the Agreement plus 30 days for data export;
• Billing and transaction data: for the period required by applicable tax and accounting laws (typically 5-10 years);
• Rekords ta' komunikazzjoni: għal 3 snin wara l-aħħar komunikazzjoni;
• Analytics data: retained for statistical purposes in anonymized form; identifiable data deleted after 26 months;
• End customer order data: as determined by the restaurant partner (data controller). The restaurant partner may configure data retention settings within the platform. FoxiFood processes and deletes end customer data strictly according to the instructions of the restaurant partner. Upon termination of the restaurant partner's Agreement, data is deleted within 30 days;
• FOXI ID account data: for as long as the end customer maintains an active FOXI ID account. Upon account deletion request, FOXI ID data is deleted within 30 days. Inactive FOXI ID accounts (no login activity for 36 months) are automatically scheduled for deletion with 30 days' prior notice to the end customer's registered email address.

The restaurant partner, as the data controller for order data of its end customers, remains solely responsible for compliance with all applicable legal, tax, and accounting data retention obligations in its jurisdiction. FOXI ID account data retention is managed by the Provider as described in Section 2.3.

After the expiration of retention periods, data is irreversibly deleted or anonymized.

8. Sigurtà tad-Data

In accordance with Article 32 of GDPR and the principle of data protection by design and by default (Article 25 GDPR), we implement appropriate technical and organizational measures to protect personal data, including:

• Kriptaġġ tad-data kollha waqt it-trażmissjoni bl-użu ta' TLS/SSL;
• Ħażna kriptata ta' data sensittiva meta tkun maħżuna;
• Hashing tal-passwords bl-użu ta' algoritmi standard tal-industrija;
• Kontrolli tal-aċċess u permessi bbażati fuq ir-rwol;
• Aġġornamenti regolari tas-sigurtà u monitoraġġ tal-vulnerabbiltajiet;
• Backups awtomatizzati ta' kuljum bi żamma ta' 30 jum;
• Payment card data handled exclusively by the PCI DSS Level 1 certified payment processor — we never store card numbers;
• Proċeduri ta' risposta għall-inċidenti u protokolli ta' notifika ta' ksur.

9. Id-Drittijiet tal-Privatezza Tiegħek

Skont fejn tgħix, għandek uħud mid-drittijiet li ġejjin jew kollha kemm huma skont il-liġijiet tal-protezzjoni tad-data applikabbli għalik — inklużi l-GDPR (ŻEE/Renju Unit), il-liġijiet statali tal-privatezza tal-Istati Uniti bħall-California Consumer Privacy Act (CCPA/CPRA), l-LGPD tal-Brażil u liġijiet ekwivalenti f'pajjiżi oħra:

• Dritt ta' aċċess — itlob kopja tad-data personali tiegħek li nżommu;
• Dritt ta' rettifika — itlob korrezzjoni ta' data mhux preċiża jew mhux kompluta;
• Dritt ta' tħassir — request deletion of your data ('right to be forgotten'), subject to legal retention obligations;
• Dritt ta' restrizzjoni — itlob restrizzjoni tal-ipproċessar f'ċerti ċirkostanzi;
• Dritt ta' portabbiltà tad-data — tirċievi d-data tiegħek f'format strutturrat li jinqara mill-magni;
• Dritt ta' oġġezzjoni — oġġezzjoni għall-ipproċessar ibbażat fuq interess leġittimu;
• Dritt li tirtira l-kunsens — irtira l-kunsens fi kwalunkwe ħin fejn l-ipproċessar huwa bbażat fuq il-kunsens;
• Dritt li tressaq ilment — tressaq ilment quddiem l-awtorità superviżorja tal-protezzjoni tad-data fil-pajjiż tar-residenza tiegħek. Għall-pajjiżi tal-UE/ŻEE, ara l-paġna GDPR tagħna għad-dettalji ta' kuntatt tal-awtoritajiet superviżorji; għal pajjiżi oħra, l-awtorità kompetenti tista' tkun elenkata fit-Termini Speċifiċi għall-Pajjiż applikabbli.

Biex teżerċita xi waħda minn dawn id-drittijiet, ikkuntattjana fuq: support@foxi.food. We will respond to your request within 30 days. You may also contact our EU representative (Euro business company Kft.) — see our GDPR page for details.

10. Cookies

We use essential cookies for site functionality and optional analytics cookies with your consent. For detailed information about the cookies we use and how to manage your preferences, see our separate Cookie Policy.

The FOXI ID shared customer identity infrastructure uses the following cookies:

• Cookie tas-sessjoni fuq id-dominju .foxi.food — maintains the end customer's authenticated session at the restaurant where they are currently placing an order. Classified as strictly necessary for the ordering service to function (no consent required);
• Persistenza tal-awtentikazzjoni bejn ir-ristoranti — enables the end customer to remain logged in when visiting other restaurants on the platform. Classified as a functional cookie. On restaurant ordering websites, this cookie is presented through the cookie consent mechanism, and the end customer may decline it without affecting the ability to place orders (manual login will be required at each restaurant);
• Redirect SSO għal domini personalizzati — for restaurants using their own custom domain, a short-lived redirect cookie facilitates authentication. Classified as strictly necessary for the login process on custom domains (no consent required).

FOXI ID does not use any third-party cookies, tracking cookies, or cross-domain tracking mechanisms. All FOXI ID cookies serve exclusively the technical purpose of authentication.

11. Il-Privatezza tat-Tfal

The FoxiFood Service is a B2B platform intended for businesses. We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have collected data from a child, we will delete it promptly.

12. Bidliet f'din il-Politika tal-Privatezza

We may update this Privacy Policy from time to time. We will notify you of material changes at least 30 days in advance via email or notification in the Service. The date of the last update is shown at the top of this document. Continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

13. Kuntatt

For privacy-related inquiries, data subject requests, or complaints, contact us at: support@foxi.food

Elite Digital Services, LLC
1111B S Governors Ave #21653
Dover, DE 19904, USA