Privacy and Personal Data Processing Policy
Effective date: August 23, 2026
1. GENERAL PROVISIONS
1.1. This Privacy Policy (hereinafter – the “Policy”) establishes the rules for the processing and protection of personal data of individuals when using the foodhouse.md website (hereinafter – the “Website”) and Foodhouse services.
1.2. This Policy applies to all personal data processing activities carried out by “FOODHOUSE” SRL (hereinafter – the “Controller”) in connection with the use of the Website, registration of an account, placing and fulfilling orders, contacting the Foodhouse Contact Center, and any other interaction with Foodhouse.
1.3. This Policy has been prepared in accordance with Law No. 195/2024 of the Republic of Moldova on the Protection of Personal Data and other applicable legislation of the Republic of Moldova. Law No. 195/2024 incorporates into national legislation the principles of Regulation (EU) 2016/679 (GDPR).
1.4. This Policy constitutes a separate legal document and applies together with the Foodhouse Public Offer. The Public Offer governs the terms and conditions for providing Foodhouse services, while this Policy governs the processing and protection of personal data.
1.5. The purpose of this Policy is to ensure transparency regarding the processing of personal data and to inform individuals about the categories of personal data processed, the purposes and legal bases of processing, data recipients, retention periods, and their rights.
1.6. Where applicable law requires consent for a particular processing activity, such consent will be requested separately. Merely reading or acknowledging this Policy does not replace consent where consent is legally required.
1.7. If any provision of this Policy conflicts with mandatory provisions of applicable law, the applicable legal provisions shall prevail.
2. PERSONAL DATA CONTROLLER
2.1. The Controller of personal data is:
“FOODHOUSE” SRL
IDNO: 1017600001840
VAT No.: 0209577
Registered office: mun. Chișinău, str. Gheorghe Tudor 2b
Contact Center: +373 22 88 88 22
E-mail: [email protected]
2.2. The Controller determines the purposes and means of processing personal data within the limits established by applicable law.
3. TERMS AND DEFINITIONS
3.1. Personal Data – any information relating to an identified or identifiable natural person.
3.2. Processing of Personal Data – any operation or set of operations performed on personal data, including collection, recording, organization, storage, alteration, retrieval, use, disclosure, restriction, erasure, or destruction.
3.3. Data Subject – the natural person to whom the personal data relates.
3.4. User – any natural person who uses the Website or Foodhouse services.
3.5. Controller – “FOODHOUSE” SRL, which determines the purposes and means of processing personal data.
3.6. Recipient – any natural or legal person, public authority, or other entity to whom personal data is disclosed in accordance with applicable law.
3.7. Consent – a freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which the Data Subject agrees to the processing of their personal data where consent constitutes the legal basis for such processing.
4. PRINCIPLES OF PERSONAL DATA PROCESSING
4.1. The Controller processes personal data in accordance with the following principles:
a) lawfulness, fairness, and transparency;
b) purpose limitation;
c) data minimization;
d) accuracy and keeping data up to date;
e) storage limitation;
f) integrity and confidentiality;
g) accountability of the Controller.
4.2. The Controller processes only personal data that is adequate, relevant, and necessary for achieving the stated purposes.
4.3. Personal data shall not be used for purposes incompatible with those for which it was originally collected, except where expressly permitted by law.
5. CATEGORIES AND SOURCES OF PERSONAL DATA
5.1. Depending on the nature of the User’s interaction with Foodhouse, the Controller may process the following categories of personal data:
a) name;
b) telephone number;
c) e-mail address;
d) delivery address;
e) user account information;
f) information concerning orders and order history;
g) comments associated with orders;
h) information concerning the selected payment method;
i) information contained in User requests and complaints;
j) recordings of telephone conversations;
k) technical information concerning the use of the Website and the User’s device;
l) data obtained through authentication using third-party services, within the scope of permissions granted by the User.
5.2. The Controller does not store users’ complete bank card details. Card payments are processed exclusively by the authorized payment service provider.
5.3. The Controller does not intend to collect special categories of personal data through the standard functionality of the Website, except where required by law or where such processing is necessary due to the nature of a specific request.
5.4. Personal data may be collected directly from the User when the User:
a) creates an account;
b) places an order;
c) contacts the Contact Center;
d) uses the Website functionality;
e) submits a request, complaint, or inquiry;
f) authenticates through Google, Facebook, VK, or Mail.ru.
5.5. Certain technical data may be collected automatically through the use of Cookies and similar technologies, in accordance with Section 10 of this Policy.
5.6. When authentication through third-party services is used, certain data may be received from the respective provider within the scope of the permissions granted by the User.
6. PURPOSES OF PERSONAL DATA PROCESSING
6.1. The Controller processes personal data for the following purposes:
a) creating and administering User accounts;
b) identifying and authenticating Users;
c) receiving, confirming, modifying, and fulfilling orders;
d) organizing delivery;
e) communicating with Users regarding their orders;
f) processing and confirming payments;
g) providing customer support services;
h) handling requests and complaints;
i) maintaining order history;
j) ensuring the security of the Website and information systems;
k) preventing fraud and misuse of the services;
l) analyzing the use of the Website and improving its functionality;
m) evaluating the effectiveness of advertising campaigns where an appropriate legal basis exists;
n) complying with legal obligations;
o) establishing, exercising, or defending the legal rights and legitimate interests of the Controller.
6.2. Personal data is not sold to third parties.
7. PURPOSES AND LEGAL BASES FOR PROCESSING
7.1. The Controller determines the legal basis for each processing activity based on its specific purpose and nature.
7.2. For receiving, placing, and fulfilling orders, organizing delivery, and creating and administering a User account, processing is carried out to the extent necessary for entering into or performing a contract with the User or taking steps at the User’s request prior to entering into a contract.
7.3. For compliance with tax, accounting, financial, and other legal obligations under the legislation of the Republic of Moldova, processing is carried out on the basis of the Controller’s legal obligations.
7.4. For ensuring the security of the Website and information systems, preventing fraud, monitoring service quality, resolving disputes, and protecting legitimate interests, processing may be carried out on the basis of the Controller’s legitimate interests, provided that such interests do not override the rights and freedoms of the Data Subject.
7.5. For analytical, advertising, and other optional purposes for which applicable law requires the User’s consent, processing is carried out only on the basis of such consent.
7.6. Consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
7.7. Withdrawal of consent does not prevent processing where another legal basis provided by law applies.
7.8. Where the provision of certain personal data is necessary for entering into or performing a contract, such data may be mandatory. Failure to provide such data may make it impossible to process the order or provide the requested service.
7.9. Providing data that is not necessary for contract performance or compliance with a legal obligation is voluntary.
8. DISCLOSURE OF PERSONAL DATA AND CATEGORIES OF RECIPIENTS
8.1. The Controller discloses personal data only to the extent necessary to achieve the relevant processing purpose, perform the contract, or comply with legal obligations.
8.2. Depending on the circumstances, personal data may be accessible to or disclosed to:
a) authorized Foodhouse employees;
b) Foodhouse’s own courier service – to the extent necessary to deliver the order;
c) MAIB payment service provider – for processing and confirming payments;
d) IT and infrastructure service providers – where access is necessary for the operation of the Controller’s services;
e) analytics and advertising service providers – in accordance with Section 17 of this Policy and the User’s consent preferences;
f) public authorities and courts – where required by law.
8.3. Restaurants receive only the information necessary to prepare the order, including:
a) the contents of the order;
b) quantities of products;
c) selected options and additional ingredients;
d) comments relating to the dishes.
8.4. The User’s name, telephone number, e-mail address, delivery address, and payment details are not disclosed to restaurants, except where expressly required by law or necessary for the performance of a specific order.
8.5. If the User voluntarily enters personal data in comments relating to an order or dishes, such information may be disclosed to the restaurant as part of that comment.
8.6. Foodhouse recommends that Users do not include personal data in order comments unless such data is necessary for the preparation or fulfillment of the order.
8.7. Where the Controller engages data processors to process personal data, the Controller takes the measures required by applicable law to ensure an appropriate level of data protection and establishes their obligations through appropriate legal arrangements.
9. INTERNATIONAL TRANSFER OF PERSONAL DATA
9.1. The use of certain technological, analytical, advertising, payment, and authentication services may involve the processing or transfer of personal data outside the territory of the Republic of Moldova.
9.2. Such processing may occur, in particular, when using the services specified in Sections 16 and 17 of this Policy.
9.3. International transfers of personal data shall be carried out only where there is an appropriate legal basis under applicable law and the relevant conditions and safeguards for the protection of personal data are met.
9.4. Depending on the specific circumstances, such conditions and safeguards may include an adequacy decision, appropriate contractual or other safeguards provided by law, or another lawful basis for the transfer.
9.5. Where an international transfer is carried out on the basis of appropriate safeguards, the Data Subject has the right to obtain information about the safeguards applied, in accordance with applicable law, by contacting the Controller at [email protected].
9.6. The Controller does not carry out international transfers of personal data solely because a User uses a particular service. Each transfer is subject to the legal requirements applicable at the time of the transfer.
10. COOKIES AND SIMILAR TECHNOLOGIES
10.1. The Website uses Cookies and similar technologies to ensure its operation, retain necessary settings, perform analytics, and, where an appropriate legal basis exists, for marketing purposes.
10.2. Depending on their purpose, the Website may use:
a) strictly necessary Cookies;
b) functional Cookies;
c) analytical Cookies;
d) marketing and advertising Cookies.
10.3. Strictly necessary Cookies may be used without the User’s separate consent where permitted by applicable law, as they are necessary for the proper operation of certain Website functionalities.
10.4. Analytical, marketing, and other non-essential Cookies for which applicable law requires consent shall only be used after obtaining the User’s respective consent.
10.5. Users must have the ability to accept or reject non-essential Cookies and to change or withdraw previously given consent through the Cookie management mechanism available on the Website.
10.6. Refusing non-essential Cookies shall not prevent the User from using the basic functions of the Website, unless the relevant Cookies are necessary for providing a specific functionality.
10.7. Detailed information about the Cookies used, their purposes, providers, categories, retention periods, and management options is provided in the separate Cookie Policy published on the Website.
11. RETENTION PERIODS FOR PERSONAL DATA
11.1. Personal data shall be retained for no longer than necessary to achieve the purposes for which it is processed, unless a longer retention period is required or permitted by applicable law.
11.2. When determining the retention period, the Controller takes into account:
a) the purpose of processing;
b) the nature and volume of the personal data;
c) the duration of the relationship with the User;
d) legal obligations concerning the retention of certain documents and information;
e) applicable limitation periods for bringing and defending legal claims.
11.3. User account data and order history shall be retained for the duration of the use of the relevant account and/or for the period necessary to fulfill the purposes specified in this Policy and applicable law.
11.4. Data that must be retained under accounting, tax, or other applicable legislation shall be retained for the periods established by the relevant legislation.
11.5. Telephone conversation recordings shall be retained for the period specified in Section 15 of this Policy.
11.6. Upon expiry of the applicable retention period, personal data shall be deleted, destroyed, or anonymized, unless another lawful basis exists for its continued processing.
12. RIGHTS OF THE DATA SUBJECT
12.1. In the cases and within the limits provided by applicable law, the Data Subject has the right to:
a) obtain information about the processing of their personal data;
b) access their personal data;
c) request the correction of inaccurate data or completion of incomplete data;
d) request the deletion of their personal data;
e) request restriction of processing;
f) object to processing;
g) withdraw consent where processing is based on consent;
h) exercise the right to data portability where the relevant conditions are provided by law;
i) exercise rights concerning automated decision-making, including profiling;
j) lodge a complaint with the competent supervisory authority;
k) use judicial and other remedies provided by law.
12.2. Where personal data is processed for direct marketing purposes, the Data Subject has the right to object at any time to such processing, including profiling related to direct marketing.
12.3. Following receipt of an objection to the processing of personal data for direct marketing purposes, the Controller shall cease using the relevant personal data for such purposes, unless otherwise provided by law.
12.4. The above rights are not absolute and may be restricted in cases expressly provided by applicable law.
13. PROCEDURE FOR EXERCISING DATA SUBJECT RIGHTS
13.1. To exercise their rights, a Data Subject may submit a request to the Controller at [email protected] or to the Controller’s registered address.
13.2. The request must contain sufficient information to identify the subject matter of the request and the data to which it relates.
13.3. The Controller shall provide information on the measures taken in response to the Data Subject’s request without undue delay and, as a general rule, no later than one month from receipt of the request.
13.4. Where necessary, taking into account the complexity and number of requests, the period specified in Clause 13.3 may be extended within the limits permitted by applicable law.
13.5. Where the period is extended, the Controller shall inform the applicant of the extension and the reasons for it within the initial response period.
13.6. The provision of information and exercise of Data Subject rights shall be free of charge, unless otherwise provided by applicable law.
13.7. Where a request is manifestly unfounded or excessive, in particular because of its repetitive nature, the Controller may, where permitted by applicable law, charge a reasonable fee or refuse to act on the request.
13.8. Where the Controller has reasonable doubts concerning the identity of the applicant, it may request additional information necessary to confirm the applicant’s identity.
13.9. Any information requested for identity verification shall be proportionate to the purpose of the verification and shall not be used for other incompatible purposes.
13.10. In the cases and in accordance with the procedure provided by law, the Controller may refuse to comply with a request, in whole or in part, stating the applicable reasons.
14. TECHNICAL AND ORGANIZATIONAL MEASURES FOR THE PROTECTION OF PERSONAL DATA
14.1. The Controller implements appropriate technical and organizational measures to ensure a level of security for personal data that is proportionate to the risks involved.
14.2. Depending on the nature of the processing, such measures may include:
a) access rights management;
b) the use of authentication and authorization mechanisms;
c) restricting employees’ access to data to the scope required by their duties;
d) measures to protect information systems against unauthorized access;
e) monitoring and periodic review of access rights;
f) backups and other measures to ensure the availability and integrity of information, where applicable to the relevant systems;
g) organizational requirements concerning confidentiality;
h) training and informing authorized personnel regarding personal data protection requirements;
i) other measures appropriate to the nature, volume, and risks of the relevant processing.
14.3. Access to personal data shall be granted only to persons who require such access to perform their respective duties.
14.4. The Controller takes measures to ensure that engaged data processors process personal data only in accordance with the Controller’s documented instructions and applicable legal requirements.
15. RECORDING OF TELEPHONE CONVERSATIONS
15.1. Telephone conversations between Users and the Foodhouse Contact Center may be recorded for the following purposes:
a) monitoring and improving service quality;
b) confirming the content of requests and agreements;
c) handling requests and complaints;
d) resolving disputes;
e) establishing, exercising, and defending the Controller’s legal rights and legitimate interests.
15.2. In connection with a telephone call, the following information may be processed:
a) telephone number;
b) date, time, and duration of the call;
c) audio recording of the conversation;
d) information provided by the User during the conversation;
e) order-related information where such information is the subject of the call.
15.3. The processing of telephone conversation recordings shall be carried out on an appropriate legal basis, including, depending on the specific purpose, the Controller’s legitimate interest, provided that such interest does not override the rights and freedoms of the Data Subject.
15.4. Where legitimate interest is relied upon as the legal basis, the Controller takes into account the necessity and proportionality of the processing and balances the Controller’s legitimate interests against the rights and freedoms of the Data Subject.
15.5. Telephone conversation recordings shall be retained for 60 (sixty) business days.
15.6. Upon expiry of this period, the recording shall be deleted unless its further retention is necessary in connection with an unresolved complaint, dispute, legal claim, or legal obligation.
15.7. Where the circumstances specified in Clause 15.6 arise, the relevant recording may be retained until the legal grounds for its further retention cease to exist.
15.8. Access to recordings shall be granted only to authorized persons within the scope of their official duties.
15.9. Where a telephone conversation is recorded, the User shall be informed of the recording through an appropriate notification at the beginning of the call or by another method provided by applicable law.
16. AUTHENTICATION THROUGH THIRD-PARTY SERVICES
16.1. Foodhouse provides the option to register and/or authenticate using accounts from the following third-party services:
a) Google;
b) Facebook;
c) VK;
d) Mail.ru.
16.2. When using authentication through a third-party service, the relevant provider may transmit certain information relating to the User’s account to Foodhouse, within the scope of the permissions granted by the User.
16.3. The specific scope of the data transmitted depends on the relevant service, its settings, and the permissions selected by the User.
16.4. Data obtained through third-party authentication is used by Foodhouse to register, identify, and authenticate the User and to ensure the operation of the User’s account.
16.5. Foodhouse does not receive or store the User’s password for their Google, Facebook, VK, or Mail.ru account through the third-party authentication mechanism.
16.6. Processing carried out independently by the providers of the relevant third-party services is governed by their own terms of use and privacy policies.
16.7. The User may manage the permissions granted through the settings of the relevant third-party account.
17. ANALYTICS AND ADVERTISING SERVICES
17.1. The Website uses the following analytics, advertising, and technological tools:
a) Google Analytics 4;
b) Google Tag Manager;
c) Google Ads;
d) Meta Pixel;
e) Yandex.Metrica.
17.2. Google Tag Manager is used as a tag management tool and, in itself, does not constitute a separate analytics purpose. Through Google Tag Manager, other technological, analytics, or advertising tags may be loaded and managed in accordance with the Website settings and the consent management mechanism.
17.3. Depending on the specific service and applicable settings, the following information may be processed through Cookies and similar technologies:
a) IP address;
b) browser and device information;
c) operating system;
d) technical identifiers;
e) date and time of access to the Website;
f) source from which the User accessed the Website;
g) pages visited;
h) information about the User’s actions on the Website;
i) information about interactions with advertising materials;
j) other technical data necessary to provide the relevant analytics or advertising functionality.
17.4. Analytics services are used to analyze Website traffic, understand how Users interact with the Website, identify technical issues, and improve the operation of the Website.
17.5. Advertising technologies may be used to evaluate the effectiveness of advertising campaigns, measure and analyze advertising audiences, and for other marketing purposes where an appropriate legal basis exists.
17.6. Services and technologies for which applicable law requires the User’s prior consent shall be used only after such consent has been obtained through the Cookie management mechanism, unless otherwise expressly provided by applicable law.
17.7. Where the required consent has not been provided, the relevant optional analytics and advertising technologies shall not be activated through the consent management mechanism used on the Website.
17.8. Certain providers of the services listed above may independently process the data they receive in accordance with their own privacy policies, service terms, and applicable law.
17.9. Detailed information regarding the Cookies used, their purposes, providers, and retention periods is provided in the separate Cookie Policy.
18. AUTOMATED PROCESSING AND PROFILING
18.1. The technical, analytics, and advertising tools used on the Website may perform automated processing of information concerning the User’s interaction with the Website.
18.2. Such processing may be used for statistical analysis, traffic measurement, evaluation of advertising campaign effectiveness, and improvement of the User experience, within the scope of the relevant processing purposes.
18.3. Foodhouse does not make decisions based solely on automated processing of personal data that produce legal effects concerning the User or similarly significantly affect the User, unless otherwise expressly provided by applicable law.
18.4. If the nature of the processing changes in such a way that specific legal requirements concerning automated decision-making or profiling become applicable, the Controller shall provide Data Subjects with the information required by law and implement the necessary safeguards.
19. DELETION OF USER ACCOUNTS AND PERSONAL DATA
19.1. The User has the right to request the deletion of their account and the personal data associated with it, in the cases and within the limits provided by applicable law.
19.2. A request for deletion shall be submitted in accordance with the procedure set out in Section 13 of this Policy.
19.3. Deletion of a User account does not automatically result in the deletion of information that the Controller is required or entitled to retain on another lawful basis.
19.4. In particular, certain information may be retained where necessary:
a) to comply with a legal obligation;
b) to comply with accounting, tax, or other legal requirements;
c) to establish, exercise, or defend legal rights or claims;
d) to handle an unresolved complaint or dispute;
e) on another lawful basis provided by applicable law.
19.5. Personal data for which there are no longer any grounds for further processing shall be deleted, destroyed, or anonymized.
20. PERSONAL DATA SECURITY BREACHES
20.1. Where a personal data security breach is identified, the Controller shall take measures to assess its nature, scope, and potential consequences and to contain and remedy its effects.
20.2. The Controller shall document identified personal data security breaches and the measures taken in response, where and to the extent required by applicable law.
20.3. Where a personal data security breach presents a risk to the rights and freedoms of individuals and applicable law requires notification of the competent supervisory authority, the Controller shall submit such notification within the period prescribed by law.
20.4. Where a personal data security breach is likely to result in a high risk to the rights and freedoms of affected Data Subjects, the Controller shall inform the relevant Data Subjects without undue delay, where and to the extent required by applicable law.
20.5. Depending on the nature of the incident, the measures taken may include restricting access, disabling compromised credentials, remedying technical vulnerabilities, restoring systems, and taking other necessary actions.
20.6. Information concerning a specific incident shall not be disclosed publicly unless such disclosure is required by law or is necessary to protect the rights and legitimate interests of affected individuals.
21. CHANGES TO THIS POLICY
21.1. The Controller may revise this Policy in connection with changes to applicable law, the functionality of the Website, technologies used, or personal data processing activities.
21.2. The current version of the Policy shall be published on the Website with an indication of its effective date.
21.3. Where changes materially affect the nature of personal data processing or the rights of Data Subjects, the Controller shall take the measures required by applicable law to inform Users.
21.4. Changes to this Policy do not replace the requirement to obtain the User’s consent where applicable law requires consent for new or modified processing activities.
22. CONTACT DETAILS REGARDING PERSONAL DATA PROTECTION
22.1. For questions concerning the processing and protection of personal data, this Policy, or the exercise of their rights, Data Subjects may contact the Controller:
E-mail: [email protected]
Address: mun. Chișinău, str. Gheorghe Tudor 2b
Contact Center: +373 22 88 88 22
22.2. The procedure for submitting and handling Data Subject requests is set out in Section 13 of this Policy.
23. FINAL PROVISIONS
23.1. This Policy forms part of the Foodhouse documentation framework concerning the protection of personal data and applies together with the Public Offer and the separate Cookie Policy, within the scope of regulation of each respective document.
23.2. Nothing in this Policy shall be interpreted as restricting the rights of Data Subjects granted under applicable law.
23.3. The invalidity or unenforceability of any individual provision of this Policy shall not affect the validity or enforceability of its remaining provisions.
23.4. This Policy entered into force on August 23, 2026.
23.5. This Policy shall remain in force until a new version enters into force.