Privacy Policy

This Privacy Policy explains how dojofood, Inc. ("dojofood", "we") handles personal data when you use our platform or website. We aim to be plain about what we collect and why.

Two roles, and the difference matters

dojofood plays two different roles, and mixing them up would mislead you about who answers for what.

We are the controller of the personal data we decide the purposes for: the people who open and run an account with us, billing contacts, website visitors, and anyone who contacts us. This policy covers that data.

We are the processor of the personal data you put into the platform to run your restaurant: your diners, your account customers and your own staff. There you are the controller. You decide what is collected and why; we only act on your instructions. That data is governed by our Data Processing Agreement, which sets out our obligations under Article 28 GDPR. If you are a diner asking about an order you placed at a restaurant, the restaurant is the one who answers, and we will pass your request to it.

The controller for the first set is dojofood, Inc., 1111B South Governors Avenue, Suite 59952, Dover, DE 19904, United States. Email: [email protected].

What we collect

• Account and business data — the details you provide to set up and run your account (name, contact details, business and branch information).
• Operational data — catalog, orders, and reporting data generated as you use the Service. We hold this as your processor, under the Data Processing Agreement.
• Website data — basic analytics and, where you consent, cookies (see our Cookie Policy).
• Enquiry data — what you send us through our forms or the website chat, covered in detail in our Data Processing Notice.

Why we use it, and on what legal basis

Where we are the controller, we rely on these grounds under Article 6 GDPR:

• Performance of a contract — to give you the Service, support you, and manage your account.
• Legal obligation — to keep accounting records and meet tax and reporting duties.
• Legitimate interests — to keep the Service secure, prevent abuse, and improve the product, balanced against your rights. You can object at any time.
• Consent — for analytics cookies and for answering an enquiry you send us. You can withdraw consent at any time, which does not affect what we did before you withdrew it.

We do not sell personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects.

Sharing

We share data with service providers who help us run the Service (for example, hosting, payment and marketplace integrations), under appropriate safeguards, and where required by law. We do not share your personal data for others' independent marketing.

Where data is held, and international transfers

Today the platform's data is hosted in Germany. We may change the hosting region, including to the United States or Türkiye, and we will not do so without a valid transfer mechanism in place.

dojofood, Inc. is established in the United States and our team works from Türkiye, Europe and the United States. Under the GDPR, reaching the data from outside the EEA is itself a transfer, even when the data stays in Germany. We would rather say so than leave you to assume otherwise.

Where a transfer happens we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), with the UK Addendum where the UK GDPR applies, and we carry out a transfer impact assessment where one is required. Türkiye is a third country for this purpose, with no adequacy decision covering it, so access from Türkiye sits on the same footing as access from the United States. For transfers out of Türkiye we rely on the mechanisms available under Law No. 6698. Ask us and we will tell you which mechanism applies to a given provider.

Your rights

Under the EU and UK GDPR, and under comparable laws elsewhere, you have the right to:

• Access the personal data we hold about you, and get a copy
• Rectify data that is wrong or incomplete
• Erase your data, where the grounds in Article 17 apply
• Restrict processing while a dispute about it is resolved
• Portability — receive the data you gave us in a machine-readable form, and have it sent to another provider
• Object to processing based on our legitimate interests, and to direct marketing at any time
• Withdraw consent at any time, where consent is the basis

To exercise any of these, email [email protected] or use our contact page. We answer within one month, and we will tell you if we need longer because the request is complex. We do not charge for this.

You can also complain to a supervisory authority. In the EU that is the authority in the country where you live or work, or where the issue arose. In Malta it is the Office of the Information and Data Protection Commissioner. In the United Kingdom it is the Information Commissioner's Office. In Türkiye it is the Kişisel Verileri Koruma Kurumu. We would rather you came to us first, but that is your right and not conditional on doing so.

Retention

We keep account and billing data for as long as your account is open and then for the period our accounting and tax obligations require. Enquiry data is kept for as long as needed to resolve the enquiry and any follow-up. Website analytics is kept in aggregate form. Data we hold as your processor is deleted on the timetable in the Data Processing Agreement.

Contact

Questions about this policy or your data: reach us via our contact page or by post to dojofood, Inc., 1111B South Governors Avenue, Suite 59952, Dover, DE 19904, United States.