Delli - Website Privacy and Cookie Policy.pdf

DELLI PRIVACY POLICY

This privacy policy was last modified on 22nd September 2022

1. OUR APPROACH TO PRIVACY
   • DELLI Limited ("DELLI", "we", "our" or "us") is committed to protecting and respecting your privacy. This Privacy Policy sets out how we collect, store, process, transfer, share and use data that identifies or is associated with you ("personal data") and information regarding our use of cookies and similar technologies.
   • We operate an online marketplace for ordering food and drink products which DELLI makes available as a service to sellers and buyers through our mobile application (the “DELLI App”) that is available to download on your device (the "DELLI Service").
   • This Privacy Policy applies to personal data that we collect as a controller through the DELLI Service and personal data that we collect as a controller through our website at https://www.delli.market/ (the "DELLI Website"). The DELLI Service and the DELLI Website are collectively referred to in this Privacy Policy as the "DELLI Platform".
   • Please ensure that you have read this Privacy Policy and understand how we collect, store, use and disclose your personal data before accessing or using the DELLI Service.
2. WHO IS RESPONSIBLE FOR THE USE OF YOUR PERSONAL DATA

DELLI is the controller of the personal data we hold about you in connection with your use of the DELLI Platform. This means that we determine and are responsible for how your personal data is used.

1. PERSONAL DATA we collect FROM you when you use the DELLI PLATFORM, and how we use it
   • We collect personal data that you voluntarily submit directly to us when you use the DELLI Platform. This can include information you provide to us when you set up an account on the DELLI Service, fill in a form on the DELLI Service or the DELLI Website, purchase any products through the DELLI Service, correspond with us by phone, e-mail or otherwise, subscribe to our mailing lists, newsletters or other forms of marketing communications, or use some other feature of the DELLI Platform.
   • This information may include, for example, your contact and payment details. If you choose not to provide such personal data, we may not be able to provide those parts of the DELLI Platform to you or respond to your other requests.
   • The table at Annex 1 sets out in detail the categories of personal data we collect about you and how we use that information when you use the DELLI Service or visit the DELLI Website, as well as the legal basis which we rely on to process the personal data and recipients of that personal data.
2. Information we collect about you automatically
   • We also automatically collect personal data indirectly about how you access and use the DELLI Platform, and information about the device you use to access the DELLI Platform when you visit the DELLI Platform, read our emails, or otherwise engage with us. We use this information to provide you the features and functionality of the DELLI Platform, to monitor and improve the DELLI Platform and to develop new products and services. We typically collect this information through a variety of tracking technologies, including cookies, web beacons, embedded scripts, location-identifying technologies, file information, and similar tracking technologies.
   • The table at Annex 2 sets out in detail the categories of personal data we collect about you automatically and how we use that information. The table also lists the legal basis which we rely on to process the personal data and recipients of that personal data. For more information on cookies and other tracking technologies we use, please see Section 10
   • We may link or combine the personal data we collect about you and the information we collect automatically. This allows us to provide you with a personalised experience regardless of how you interact with us.
   • We may anonymise and aggregate any of the personal data we collect (so that it does not directly identify you). We may use anonymised information for purposes that include testing our IT systems, research, data analysis, improving the DELLI Platform and developing new products and features. We may also share such anonymised and aggregated information with others.
3. How long will we store your personal DATA
   • The tables at Annex 1 and Annex 2 set out retention periods for different aspects of your personal data. Where the tables do not set out a retention period for an aspect of your personal data, we will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of our legitimate business interests and satisfying any legal or reporting requirements.
   • To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and the applicable legal requirements.
4. RECIPIENTS OF PERSONAL DATA

We may share your personal data with the following persons (as required in accordance with the purposes set out in Annexes 1 and 2):

• Food and drink sellers: we may share your personal data with sellers of food and drink products in order to facilitate the orders you place through the DELLI Service.
• Service providers and advisors: we may share your personal data with third party vendors and other service providers that perform services for us or on our behalf, which may include providing professional services, such as legal and accounting services, mailing, email or chat services, fraud prevention, web hosting, or providing analytic services.
• Purchasers and third parties in connection with a business transaction: your personal data may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganisation, financing, change of control or acquisition of all or a portion of our business.
• Law enforcement, regulators, and other parties for legal reasons: we may share your personal data with third parties as required by law or if we reasonably believe that such action is necessary to (i) comply with the law and the reasonable requests of law enforcement; (ii) detect and investigate illegal activities and breaches of agreements, including our Terms of Service; and/or (iii) exercise or protect the rights, property, or personal safety of DELLI, its users or others.

1. marketing and advertising
   • From time to time, we may contact you with information about our products and services, including sending you marketing messages and asking for your feedback.
   • We will only send you marketing messages if you have given us your consent to do so.
   • Most marketing messages we send will be via the DELLI Service in the form of push notifications. For some marketing messages, we may use personal data we collect about you to help us determine the most relevant marketing information to share with you.
   • You can unsubscribe from receiving promotional email communications or other marketing messages from us by updating your preferences via your account profile settings on the DELLI App or by unsubscribing to the Newsletter via the option on the mail. We make every effort to promptly process all unsubscribe requests.
   • You may not opt out of service-related communications (e.g., account verification, transactional communications, changes/updates to features of the DELLI Service, technical and security notices).
2. storing and transferring your personal DATA
   • Security. We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, change or damage. All personal data we collect will be stored by our cloud hosting provider on secure servers. We will never send you unsolicited emails or contact you by phone requesting your account ID, password, credit or debit card information or national identification numbers.
   • International Transfers of your Personal Data. The personal data we collect may be transferred to and stored in countries outside of the jurisdiction you are in where we and our third-party service providers have operations. If you are accessing our DELLI Service from the European Economic Area ("EEA"), your personal data will be processed outside of the EEA, in the UK.

In the event of such a transfer, we ensure that: (i) the personal data is transferred to countries recognised by the European Commission or the UK Secretary of State (as applicable) as offering an equivalent level of protection; or (ii) such transfer is to a third party that is a member of a compliance scheme recognised as offering adequate protection for the rights and freedoms of data subjects, as determined by the European Commission or the UK Secretary of State (as applicable). If you wish to enquire further about these safeguards used, please contact us using the details set out at the end of this Privacy Policy.

1. rights FOR UK AND EEA USERS
   • If you are accessing our DELLI Service from the United Kingdom or the EEA, in accordance with applicable privacy law, you have the following rights in respect of your personal data that we hold:
     • Right of access. The right to obtain access to your personal data along with certain related information.
     • Right of portability. The right, in certain circumstances, to receive a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another person.
     • Right to rectification. The right to obtain rectification of any inaccurate or incomplete personal data we hold about you without undue delay.
     • Right to erasure. The right, in some circumstances, to require us to erase your personal data without undue delay if the continued processing of that personal data is not justified.
     • Right to restriction. The right, in some circumstances, to require us to limit the purposes for which we process your personal data if the continued processing of the personal data in this way is not justified, such as where the accuracy of the personal data is contested by you.
     • Right to withdraw consent. If you have provided consent for the processing of your personal data, you have the right to withdraw your consent. If you withdraw your consent, this will not affect the lawfulness of our use of your personal data before your withdrawal.
   • You also have the right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal data, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.
   • If you wish to exercise one of these rights, please contact us using the contact details at the end of this Privacy Policy.
   • You also have the right to lodge a complaint to your local data protection authority. Information about how to contact the UK Information Commissioner's Office is available here. If you are based in the European Union, information about how to contact your local data protection authority is available here.