Privacy policy

01Data controller

Controller

OXIF GmbH, Lugeck 1-2/15, 1010 Vienna

Email

[email protected]

Supervisory authority

Austrian Data Protection Authority, Vienna

02What data we process

• Account data: name, email address, telephone number, password in hashed form.
• Order data: items, businesses, time, amount, receipts, tip.
• Address and location data: delivery address and, optionally, approximate location for nearby searches.
• Payment data: payment method and reference; full card details are held exclusively by the payment service provider.
• Usage data: device and browser information, IP address, interactions in the app.
• Communication data: messages to support, reviews, complaints.

03Purposes and legal bases

Performance of a contract

Orders, delivery, reservations — Art. 6(1)(b) GDPR

Payments and accounting

Billing, retention obligations — points (b) and (c)

Fraud prevention

legitimate interest — point (f)

Product improvement

pseudonymised analysis — point (f)

Marketing

Newsletters and recommendations — consent, point (a)

Support

Handling enquiries — points (b) and (f)

04Recipients of data

Data is shared only to the extent necessary to provide the service:

• The business receiving the order receives the name, order contents and, for delivery, the address.
• Couriers receive the address, first name and a masked telephone number.
• Payment service providers in the EU process the transaction.
• IT service providers acting as processors based in the European Union.
• Authorities, where a legal obligation exists.

No data is transferred to third countries. All systems are operated in data centres in Austria and the Netherlands.

05Retention period

Account

until deletion, followed by a 30-day recovery period

Receipts and invoices

7 years under § 132 BAO

Location data

96 hours after delivery

Support history

24 months

Reviews

until consent to publication is withdrawn

Cookie consent

12 months

06Cookies and consent

Necessary cookies maintain login, basket and security functions and do not require consent. We use all other categories only with your express consent.

07Your rights

• Access to the data processed about you.
• Rectification of inaccurate data and completion of incomplete data.
• Erasure, provided no statutory retention obligation prevents it.
• Restriction of processing and objection to processing based on legitimate interests.
• Data portability in a machine-readable format.
• Withdrawal of consent with effect for the future.
• Lodging a complaint with the Austrian Data Protection Authority.

We respond to requests within one month. You can obtain a copy of your data on request through our support team.

08Contact the data protection officer

OXIF GmbH, Lugeck 1-2/15, 1010 Vienna, [email protected].