PRIVACY POLICY

(for a restaurant ordering page powered by Mealo / Dully ApS)

1. Roles and responsibilities

When you place an order via this ordering page, your personal data is processed as part of your purchase from the restaurant you are ordering from.

• The restaurant is the data controller for the processing of your personal data in connection with your order.
• Mealo / Dully ApS provides the technical ordering solution and acts as:
• a commercial agent on behalf of the restaurant, and
• a data processor, processing personal data solely on the instructions of the restaurant.

Mealo / Dully ApS
Rådhusstræde 3, st.
1466 Copenhagen K
Denmark
CVR no.: 42324930
Email: support@dully.io

If you have questions regarding the processing of your personal data, you may contact the restaurant directly. You are also welcome to contact Mealo / Dully ApS, which will assist the restaurant in its role as data processor where relevant.

2. User profile

The ordering page may allow you to create a user profile in order to make future orders easier, for example by saving contact details and order history.

The user profile is used solely in connection with purchases from restaurants using the solution.
Mealo / Dully ApS processes the data in the user profile as a data processor on behalf of the restaurant.

The user profile does not constitute the creation of an independent platform account with Mealo / Dully ApS for Mealo / Dully’s own purposes.

3. Categories of personal data

In connection with the creation of a user profile and/or your order, the following personal data may be processed:

• Name
• Phone number
• Email address
• Delivery or pickup details
• Order details (e.g. ordered items and time)
• Payment information in the form of a payment reference (full card details are processed by the payment service provider)
• Any comments or notes you voluntarily provide in connection with your order
  
  

4. Purposes of processing

Your personal data is processed for the purpose of:

• completing and administering your order
• ensuring correct delivery or pickup
• sending order confirmations and relevant service messages
• handling payment, complaints, and customer service
• enabling a user profile and order history
• complying with applicable legislation, including bookkeeping requirements
  
  

5. Legal basis for processing

The processing of your personal data is based on the following legal grounds:

• GDPR Article 6(1)(b)
  Processing is necessary for the performance of the purchase agreement between you and the restaurant.
• GDPR Article 6(1)(c ) 
  Processing is necessary to comply with legal obligations, including bookkeeping legislation.

Mealo / Dully ApS processes personal data solely on behalf of and in accordance with instructions from the restaurant.

6. Marketing on behalf of the restaurant

If, in connection with your order or user profile, you have given consent to receive marketing communications from the restaurant, your personal data may be processed for this purpose.

Marketing is carried out on behalf of the restaurant, which acts as the data controller, and may include newsletters, offers, loyalty programs, and other relevant communications.

In this context, Mealo / Dully ApS may, as a data processor, process and transfer personal data on behalf of the restaurant to categories of data processors, including providers of:

• email and communication systems
• marketing and advertising platforms
• loyalty and CRM systems
• digital agencies and other technical service providers

Such processing is carried out solely on the basis of your consent, pursuant to GDPR Article 6(1)(a).
You may withdraw your consent at any time via the unsubscribe link in the marketing communication or by contacting the restaurant.

7. Disclosure and sub-processors

Personal data is not disclosed to third parties unless this is necessary to complete your order, fulfil your consent, or comply with applicable law.

Mealo / Dully ApS may engage sub-processors for purposes such as:

• IT hosting and operations
• payment infrastructure
• technical support and system maintenance

All sub-processors are subject to data processing agreements and may only process personal data in accordance with instructions.

8. Retention of personal data

Personal data is retained only for as long as necessary for the purposes of processing and in accordance with applicable legislation.

• Order and accounting data is retained in accordance with bookkeeping laws.
• Data related to user profiles and orders is deleted when it is no longer necessary for the relevant purpose.
  
  

9. Cookies on the ordering page

The ordering page uses necessary cookies to ensure functionality, including the correct completion of orders.

Any statistical or marketing cookies are used only if you have given consent via the cookie banner.
You may change or withdraw your consent at any time via the cookie settings.

10. Your rights

Under the General Data Protection Regulation, you have the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to object
• Right to data portability

As the restaurant is the data controller, requests to exercise these rights will generally be handled by the restaurant. Mealo / Dully ApS assists the restaurant in its role as data processor where applicable.

11. Complaints

If you are dissatisfied with the processing of your personal data, you may lodge a complaint with the relevant supervisory authority.

In Denmark, this is the Danish Data Protection Agency (Datatilsynet):
www.datatilsynet.dk