Last updated on: October 01, 2024

GRUBMATES, INC.

Privacy and Cookies Policy

When you use Grubmates, you trust us with your personal data. We’re committed to keeping that trust. That starts with helping you understand our privacy practices.

This notice describes the personal data (“data”) we collect, how it’s used and shared, and your choices regarding this data. We recommend that you read this along with our privacy overview, which highlights information about our privacy practices and provides summaries of the data we collect and how we use it.

1. Scope

Grubmates is committed to respecting Users’/ Couriers’/ Job Applicants’/ Partners’/ Investors’/ Prospects’/ Website Visitors’ (jointly named hereinafter as the “Data Subjects”) privacy and protecting their Personal data. In this sense, the aim of this Privacy Policy is to inform Data Subjects about Grubmates’ processing activities as per GDPR and the Local Regulation requirements

The purpose of the Privacy PolicyThis Privacy Policy provides information on the processing of personal data of Data Subjects who contact us via the contact form available on our website, in accordance with the General Data Protection Regulation ("GDPR").

This Privacy Policy notice describes: how Grubmates collects and processes the personal data, the different stakeholders involved in this processing as well as our Data Subjects rights with regard to their data. We recommend that both all stakeholders involved in the processing as well as Data Subjects read it carefully and on a frequent basis to fully understand this along with our privacy overview, which highlights key points about our current privacy practices.

Due to the constant evolution of Grubmates’ activities, this Privacy Policy may be subject to change or updates in the future.

Use of our Platform after this Privacy Policy has been updated shall be deemed to constitute consent by Data Subjects, whether located in the EU or outside the EU, to the updated or modified Privacy Policy to the extent permitted by local law.

Grubmates will notify the Data Subjects in advance in case of substantial changes and modifications to the Privacy Policy by email, in case of User request for that, through any other means that ensures its receipt. Grubmates will in no event modify its policies or practices to make them less effective in the protection of its Data Subjects personal data.

If our Data Subjects have any doubt concerning this Privacy Policy or want to obtain more information on it, they can contact our legal team at any time to this email address: legal@grubmates.io.

2. Summary of Information

Data Controller: Grubmates Ltd., Westwood Apt, Flic en Flac, Mauritius 90502.

Your rights: You can exercise your rights related to personal data at any time by sending us an email to: legal@grubmates.io.

Your rights related to personal data: right of access, right to rectification, right to erasure, right to object to processing, right to object to profiling, right to unsubscribe to any marketing communication.

Data Protection Officer: legal@grubmates.io.

When you are a User or Supplier/Courier we may use your data for:
- legal purposes (e.g. in case of frauds and crimes committed on our App; to comply with legal regulations; menage your requests, to fill and/or defend any claims and legal actions);
- contractual purposes (e.g. grant the possibility to create your own account, locate the nearest Partner and Supplier/Courier, perform payment processing, assist in decisions and use of the service, provide you with a customer service, studying the use of the platform performed by you, provide you with the equipment and material needed to provide the services);
- security purposes (e.g. use device, location, profile, usage, and other data to prevent and detect malicious or unsafe activities, monitor all actions that could cause fraud, when requested by any authority, administration or court, collaborate with Public Authorities);
- statistics and research purposes (e.g. analyze trends, purchase behavior and characteristics, understand how you use our Platform, send voluntary and anonymous questionnaires, and surveys, competitions and communications of your interest, carry out financial calculations);
- marketing and non marketing purposes (e.g. carry out marketing, communications, research and development activities, analyze how to improve our services, provide you with offers, promotions, discounts, suggestions, carry out promotional activities for the delivery of samples or free products, generate and provide you with receipts, inform you about any incident on the App).

When you are a Partner we may use your data for:
- grant you the possibility to create your own account and maintain the business relationship with Grubmates;
- provide you with customer service to answer your questions or consultations.

When you are an Investor we may use your data for:
- fulfill the compliance requirements;
- formalize the relationship with you as an Investor;
- notify you concerning the corporate matters and inform you about Grubmates’ results.

When you are a Job Applicant we may use your data for:
- consider your present or future suitability for any of the positions available at Grubmates, to conduct any interviews it may deem necessary for the position, test your knowledge, contact companies for which you have previously worked, check references, and assess your skills and abilities in general;
- provide you with information of your interest regarding our Job offers.

When you are a Prospect we may use your data for:
- process your requests to obtain the products and/or services offered by Grubmates and manage the prospective relationship;
- carry out marketing, communications, research activities regarding Grubmates’ products and/or services similar to those included in your request.

When you are a Web Visitors we may use your data for:
- follow up your comments left on Grubmates’ Website or our Blog;
- provide you with the answer regarding your request.

Lawfulness of processing:
- Compliance with the business/ labor relationship;
- Legitimate interest and User/ Courier / Supplier / Applicant/ Investor/ Website visitor consent.

If you are a User we may share your data with the following groups of recipients:
- the Courier/Supplier who carries out the task of collecting and delivering the product;
- the establishment or venue in charge of selling the product;
- the Customer Care Services available to you;
- the payment Platform and payment service providers;
- Telecommunications service providers;
- Providers rendering satisfaction survey services;
- service providers that send parcels, carry out orders and/or resolve incidents with delivery;
- pharmacists dispensing products;
- Payment Platforms contracted by Grubmates;
- Service providers for fraud control purposes and for for the anonymisation of some data;
- Telecommunications services;
- Punctually another entity or affiliate of the Grubmates;
- Social media;
- Third parties associated with Grubmates for the purposes of commercial communications;
- insurance companies.

If you are a Courier/Supplier we may share your data with different group of recipients:
- advisers and consultants for the pursuit of accounting, labor, tax, insurance, legal and technical activities,
- government bodies (tax authority, social security system, etc.);
- state security forces, courts, mediation and arbitration bodies, governments for regulatory matters;
- users who have placed an order which you have agreed to carry out;
- external service providers that provide commercial offers with benefits and/or discounts for you;
- to group companies or third parties in charge of the filing and management of computer data.

In case of every Data Subject (Users, Couriers, Job Applicants, Partners, Investors, Prospects, Website Visitors) we may share personal data with:
- another entity or affiliate of the Grubmates;
- any public authority that requests the sharing.

3. Your personal data rights:

You may exercise your rights free of charge at any time by emailing us at legal@grubmates.io.

You may exercise the following rights vis-a-vis Grubmates:
- The right of access to your personal data to know which data is being processed and the processing operations carried out thereon;
- The right to correct any inaccuracies in relation to your personal data;
- The right to the erasure of your personal data, where possible; by sending us a data erasure request.
- The right to request the restriction of processing of your personal data when the accuracy, legality or need for processing of the data is in question, in which case we may retain the data for the purpose of filing or defending claims.
- The right to request portability of your data to another service provider. We will give you a copy of your data so that you can provide it to another service provider. If you request us to do so and it is technically possible, we will transfer the data directly to that other service provider on your behalf.
- The right to object to the processing of your data in order to resolve any query you may have raised with us through the email legal@grubmates.io and the right to object to the processing of your data on social media and/or for the purpose of processing your CV.
- If you are the User, and you don’t want to receive any marketing communications, you have the right to unsubscribe to any marketing communication, by sending an e-mail or by using the link provided for this purpose in every commercial communication. Please note that disabling Push notifications will also prevent you from receiving notifications about the status of any order.

You can anytime object to profiling by sending an email to: legal@grubmates.io.

4. Data Controller of Your Personal Data

The Data Controller of your Personal Data in relation with the use of the Grubmates and of the other Forms is Grubmates Ltd., Westwood Apt, Flic en Flac, Mauritius 90502

Furthermore Grubmates may share the data of those users ("users") or Couriers / Suppliers ("Couriers") who register on the website or the APP (the "Platform") and those persons who contact Grubmates using the forms available on its platform with each of the subsidiaries and companies of the Grubmates for the purpose of offering the services requested by Users through the Platform.

5. Useful Information for Users:
5.1. Grubmates will process your the personal data for the following purposes:

- For legal purposes;
- For contractual purposes;
- For security purposes;
- For statistics and research purposes;
- For marketing and commercial purposes;
- For non-marketing purposes.

Grubmates processes your personal data for the following Legal purposes:
i) detect and investigate fraud and possible crimes committed against our Platform and all the users;
ii) comply with the legislation in case any legal regulations oblige us to keep your data for a defined period of time;
iii) manage and execute your request(s) to exercise the rights established in the GDPR and local regulations;
iv) file, submit and defend legal actions against any entity of Grubmates;
v) in any of the cases above-mentioned, Grubmates shall be entitled to use any data obtained from you or arisen from your activity through our Platform (e.g. conversations between you and the Partner, you and the Courier, you and our Platform using the chat system) for the purpose of filing and/or defending any claims and/or legal actions that may be necessary, and to manage any incidents arising in connection with User’s orders.

Grumates processes your personal data for the following Contractual purposes:
i) grant you the possibility to create your own account;
ii) provide you with the services you have requested and any additional features on the Platform;
iii) locate the nearest Partners and Courier to the delivery point informed by you (which may involve using geolocation services, if you agreed to them when asked to by the Platform, as described above);
iv) perform payment processing and collection on behalf of you,v) communicate your Order to the Partner selected by you and update you on the status of your Order;
vii) assist you in your decisions and use of the service, including the possibility to quickly reorder from the stores, where you have ordered in the past or suggest you stores based on your past orders or “popularity” among new users. Additionally, we could assist you in your decisions through automatically determined filters by the historical order you have placed in the past, providing in each case specific contents in the Platform tailored for you;
viii) send you the receipt corresponding to your Orders;
ix) provide you with a customer service to manage any incident related to your Orders and being able to answer your questions or consultations;
x) allow your direct contact with the Courier in charge of your Order;
xi) be contacted by our Partners in case of any incident with your Orders
xii) process reimbursements and refunds both via promo-codes or bank refunds;
xiii) notify you concerning changes or updates to our services, terms and conditions, privacy policy, cookies policy and any other corporate document that may affect you in a substantial way.

Grubmates processes your personal data for the following Security purposes:
i) use device, location (including geolocation data, if you agreed to), profile, usage, and other data to prevent and detect malicious or unsafe activities (e.g. payment fraud, identity fraud, account hacking, phishing, incentive abuses). In particular, Grubmates uses your device's IP address to detect fraudulent activity on your device and to keep the platform away from attackers who may try to access your account by impersonating you;
ii) ii) monitor all actions that could cause fraud or in the commission of a criminal offense related to the payment method employed by you; if any irregularities are detected, Grubmates reserves the right to retain the data provided and share it with the competent Authorities in order to carry out the relevant investigation,
iii) make sure that you follow the legal requirements related to specific products you may order through the Platform (e.g. legal age for alcoholic beverages).

Grumates processes your personal data for the following Statistics and research purposes:
i) analyze trends, purchase behavior and characteristics;
ii) understand how you use our Platform;
iii) manage and improve the services offered, including the possibility of adding new or different features and services to improve the quality of the services.

Grumates processes your personal data for the following Marketing and commercial purposes:
i) carry out marketing, communications, research and development activities;
ii) analyze and research how to improve our services both offline and on the Platform, by using the data provided by you (such as in focus groups, reviews, valuations of the services, satisfaction survey, feedback or any kind, etc.);
iii) provide you with personalized offers, promotions, discounts, suggestions, views and options in App, by email or by any other communication means, including the use of cookies or other technologies for advertising in third party websites or apps, according to our Cookie Policy and only if you have agreed to;
iv) carry out promotional activities for the delivery of samples or free products inside the order placed by you, which may be of your interest to promote Grubmates’ and our Partner’s products or services;
v) carry out promotional activities such as contests, raffles, tenders, quizzes, competitions between users when they have subscribed and/or sent their data for such campaigns;
vi) create custom audiences with Facebook or other providers to reach out to you or other people with similar characteristics, who might be interested in using Grubmates services; you can manage your privacy in your Facebook or other third party platform settings;
vii) use as commercial or marketing material published by you on your social networks profiles when Grubmates has been expressly mentioned by you (i.e. via hashtag or @). We may personalize the marketing communications by using the User activity in our App (including your past orders) and the interaction with the App, online advertising, previous emails, promotions, etc. However, this personalisation is not made only by automated means, nor have any legal effect or affect the User similarly. Grubmates may use Push services on the User’s mobile device to provide marketing communications. If the User does not want to receive these marketing communications, he / she shall unsubscribe Please note that disabling Push notifications will also prevent the User from receiving notifications about the status of any order.

Grumates processes your personal data for the following Non-marketing purposes:
i) generate and provide you with receipts from each of your Orders placed through Grubmates;
ii) inform you about any incident on the Platform or the operation of the services, including incidents related to your orders. This information can be sent by e-mail or SMS messages, and any other messaging application, that may be used by you and Grubmates at any moment;
iii) inform you about any changes to our Terms and Conditions, privacy policy, cookies policy, services, and more generally to inform you about any relevant non-marketing communications;
iv) process incidents and claims with insurance companies in the event you report the occurrence of any damages or unforeseen events that may be covered by Grubmates insurance policy.

5.2 What kind of data do we hold about you and how is your personal data collected?

Grubmates holds the following data about you:

1. Information supplied directly by you:

1.1. Registration Data: the information provided by you when you create an account with Grubmates: username and e-mail.

1.2. User Profile Information: the information added by you on the Platform in order to be able to use Grumates’ service, e.g., your mobile phone number and delivery address. You can view and edit the personal data on your profile whenever you wish.

1.3. Payment information: payment information when processing your orders; card data will be processed by our electronic payment service providers, who will receive the data directly from you. Grubmates will have access to this information only for complying with the request of any competent authority. Grumates might offer its users to store the payment information or card details. In this case, the card details are tokenized (converted in a unique code). This token is usable in the Grubmates platform, allowing Grubmates to facilitate the use of the platform by preventing the introduction of the card details each time you want to perform a payment and provide additional security, as the details of the card are never stored in our systems. You can erase this token at any moment in your profile area.

1.4. Additional information: any information that you could supply to Grubmates for other purposes, e.g. your photograph or the billing address in the case if you have asked to receive invoices from Grubmates.

1.5. Information about previous communications with Grubmates: information supplied by you for the resolution of any queries or complaints about the use of the platform, whether through the contact forms), by e-mail or by phone through the customer service.

1.6. Information regarding any accidents: information of any of the parties involved in the provision of services through the Platform for the purpose of making insurance claims or carrying out any other actions with the insurance companies contracted by Grubmates.

1.7. Information of conversations held with Grubmates: Transcription and recording of conversations for the processing of incidents, queries or other consultations that may be made to guarantee and improve the quality of our services and for security reasons.

1.8. Information on Communications: communications exchanged between you and the Couriers/Suppliers on the chat system provided on the Platform whenever it is necessary to address any incident or discussion between Users and Couriers, or to comply with any request made by authorities. Grubmates will never access the communications if it is not strictly necessary and will always ensure the privacy of its users and the confidentiality of all information exchanged on its platform.

1.9. Any additional information that you provide in your requests, comments or questions.

2. Information indirectly supplied by Users:

2.1. Data arising from the Use of the Platform: Grubmates collects the data arising from your Use of the Platform every time you interact with Grubmates.

2.2. Data on the application and the device: Grubmates stores data on the device and the Application used by you to access the services:
i) the IP address used by you to connect to the Internet using your computer or mobile phone, and to prevent fraudulent misappropriation or unauthorized access to your account by third parties;
ii) information about your computer or mobile phone, such as your Internet connection, browser type, version and operating system, and type of device;
iii) the full uniform resource locator (URL) Clickstream (the information related with your navigation through our website or the App, links followed, etc.), including date and time;
iv) data from your account: information on the orders made by you, as well as feedback and/or comments made by you;
v) your browsing history and preferences.

2.3. Data arising from the User’s origin: if you arrive at the Grumates through an external source (such as a link from another website or a social network, as long as you have authorized it on those websites), Grubmates collects data on the source from which you arrived.

2.4. Data resulting from the management of incidents: if you contact the Grubmates through the contact forms, Grubmates Chat or on Grubmates phone number or Whatsapp, Grubmates will collect the messages received in the format used by you and may use and store them to manage current or future incidents.

2.5. Data arising from “cookies”: Grubmates uses its own and third-party cookies to facilitate browsing by its users and for statistical purposes, among others (please refer to the Cookie Policy for more details).

2.6. Geolocation Data: provided that you have authorized this, Grubmates will collect data relating to your location, including the real-time geographic location of your computer or mobile device.

2.7. Data resulting from external third parties:
i) Grubmates collects personal data or information from external third parties only if you authorize such third parties to share that information with Grubmates. For example, if you create an account through your Facebook or Google account, these platforms could disclose to us your personal data that can be found on your Facebook/Google profile (such as name, gender or age);
ii) If you choose to send messages to us from social media networks (including Twitter, Facebook and Whatsapp), we will collect that information you provide to us for the purposes set out in this privacy policy, including responding to your inquiry, providing you with customer support and resolving issues.

5.3. What are the recipients of your data and why are we communicating it?

Grubmates warrants that all commercial partners, technicians, suppliers or independent third parties are bound by contractually binding promises to process the information shared with them in accordance with Grubmates’ indications, this Privacy Policy and the applicable data protection legislation.

We will not disclose your personal data to any third party who does not act under our instructions and no communication will involve selling, renting, sharing or in any other way revealing customers’ personal information for commercial purposes in breach of the commitments made in this Privacy Policy.

When carrying out an order, data may be shared with:
- The Courier/Supplier who carries out the task of collecting and delivering the product;
- The establishment or venue in charge of selling the product, if you have requested the purchase of a product. If you contact the above-mentioned providers directly and give them your data directly, Grubmates will not be responsible for the providers’ use of such data;
- The Customer Care Services contracted by Grubmates for the purpose of warning you of any possible incidents or asking why negative feedback has been given; data will be used to manage any incidents that may occur during the provision of the services;
- The payment Platform and payment service providers so that the amount can be charged to your account;
- Telecommunications service providers, when they are used to send communications regarding orders or incidents relating to orders;
- Providers rendering satisfaction survey services on Grubmates’s behalf.

To continue providing the services offered by Grubmates, the company may share your certain personal data with the third parties:
- Service providers: service providers that send parcels, carry out orders and/or resolve incidents with deliveries have access to your personal information as may be necessary only to carry out their functions. They must process the said personal information as provided in this Privacy Policy and in the applicable data protection legislation;
- Pharmacies: Grubmates may provide your name and phone number to pharmacists dispensing products to those Users, to ensure the provision of pharmaceutical advice according to the current applicable legislation.
- Payment Service Providers: When you enter your card number on the App, this is stored directly by the Payment Platforms contracted by Grubmates, which allows payment to be charged to your account. Payment service providers have been chosen based on their security measures and in any event complying with the security measures stipulated in the payment service legislation, and they are PCI Compliant under the Payment Card Industry Data Security Standard or PCI DSS. Grubmatesdoes not store such data in any event;
- Service providers for fraud control purposes: Grubmates will share your data with fraud control service providers to assess the risk of the transactions carried out;
- Service providers for the anonymisation of some data: In order to prevent the misuse of your data by third-party service providers, your data may be being anonymised so that it can be used solely for the provision of the service. For example, Glrubmates may assign your telephone numbers to third parties in order to anonymise them and provide them in this format to the providers used to carry out the services contracted by you;
- Security companies and Law Enforcement Forces and Agencies: Grubmates may disclose personal data on its customers’ accounts if such disclosure is necessary to comply with the law, to enforce or apply the “Terms of Use'' or to protect Grubmates’, its users’ or third parties’ rights, property or safety. It includes the exchange of information with other companies (for example, Grubmates uses Google's reCAPTCHA Enterprise service to protect users from cyber attacks or threats to their accounts) and organizations and with Law Enforcement Forces and Agencies to protect against fraud and reduce credit risk.
- Call center and incident management services: In order to provide a Customer Service and call centers, actions to measure your degree of satisfaction and the provision of administrative support services, your data may be disclosed to companies located outside the Republic of Mauritius.
- Telecommunications services: In order to be able to provide you with telephone contact services, Grubmates may contact telecommunications companies that provide secure lines and systems for the purpose of contacting you.
- Companies in the Grubmates group: To be able to provide its services, Grubmates may transfer your certain personal data to subsidiaries, based on the geographical area from which users request our services and to other Grubmates’ associated companies.
- Social media connected by Users: If you connect your Grubmates account to other social media or to a third-party platform, Grubmates may use the information provided to such social media or third party in compliance with the privacy policy of the social media or third-party platform in question;
- Third parties associated with Grubmates for the purposes of commercial communications: Grubmates may transfer your personal data to third parties associated with Grubmates, provided that you have given your express informed and unequivocal consent to such transfer of data and that you are aware of the purpose and recipient of such transfer.
- Changes of ownership: If Grubmates ownership changes or the majority of its assets are acquired by a third party, you are informed that Grubmates will transfer your data to the acquiring organizations to continue to provide the services subject to the processing of data. As Grubmates keeps growing continuously, we may buy or sell business units, assets, shares or legal entities, so data subjects’ information may also be transferred. That information, when acquired by Grubmates, shall be processed as any other information as described in our privacy policy. You acknowledge that such transfer may occur and that we will be allowed to use your personal information for any of the purposes described in this Privacy Policy. The new file controller will inform Users of its identification data. Grubmates states that it will comply with its duty of information and it shall inform Users of the change of file controller if and when this happens. This processing shall be carried out under the contract entered into with Grubmates.
- Insurance companies: Grubmates may provide your data to those insurers and insurance brokers it collaborates with, for the management and processing of claims and losses arising from the activity carried out by Grubmates and the parties that collaborate with it.

Your data will not be disclosed to any third parties unless:
i) this is necessary to provide the services requested if Grubmates is collaborating with third parties;
ii) if Grubmates has your express and unambiguous authorisation;
iii) where this has been requested by a competent authority pursuant to its functions (in order to investigate, prevent or take action in relation to illegal actions);
iv) finally, where required by law.

Grubmates may share your data also with some of Grubmates’ top Partners and only under some certain conditions: i) having obtained your expressed consent via consent checkbox which may appear (a) at the first order made by you or (b) in each order made by you previously to proceed with the check-out when placing an order through the Partner store;
ii) having signed a Data Sharing Agreement with the Partner and ensuring that all legal, safety and technical measures are met.

5.4 How long will we keep your data?

Grubmates shall retain your data for the duration of the contractual relationship and, after this has come to an end, for the period established by law for filing or defending the appropriate legal actions. This is established at a maximum of fifteen (15) years in order to comply with Grubmates’ legal obligations – which include the duty to assist the security forces as necessary in the investigation and prosecution of crimes pursuant to the higher interest of public safety – and defend itself or take any action in relation to criminal, tax and social security matters.

The said period may be shorter depending on the legal provision applicable to each purpose of data processing, as established in the table of retention periods set forth in Annex I.

ANNEX I – GENERAL RETENTION PERIODS

GENERAL:
- DATA PROTECTION: 6 years. The limitation period for any form of infringement is 6 years;
- PERSONAL CIVIL ACTIONS: 6 years. Personal actions of any kind without a specific limitation period established from the moment when the obligation becomes enforceable, taking into account that, in the case of ongoing positive or negative obligations, the period will start running again every time they are infringed.
- ACCOUNTING AND TAX DOCUMENTATION: 7 years. For commercial purposes: books, correspondence, documentation and supporting documents relating to their business, duly ordered, from the last entry in the books, save as may be established by general or special provisions. This commercial obligation applies to both compulsory books (income, expenses, investment goods and provisions), and the documentation and documentary evidence of the entries contained in the books (invoices issued and received, vouchers, amendment invoices, bank documents, etc.) For tax purposes: accounting books and other compulsory record books pursuant to the applicable tax legislation (personal income tax, VAT, corporation tax, etc.), as well as documentary evidence justifying the entries in the books (including software and computer files and any other documentary evidence that is relevant for tax purposes) must be retained at least for the period during which the tax authorities are entitled to verify and investigate and, therefore, assess and inform of, the tax owed.
- INFORMATION RELEVANT FOR CRIMINAL ACTIONS: 10 to 15 years. Any information and documentation that may be relevant for the prosecution or defense of criminal proceedings relating to the criminal liability of legal persons. This may include invoices, payment receipts, claims or complaints, delivery routes with geolocation, tax documentation and, in general, any other information from any data subject that may be useful to defend Grubmates’ legal interests.

USERS:
- USERS AND CONSUMERS: 6 years. Claims to enforce performance of the service as a result of non-conformity with the contract are subject to a limitation period of three years after the delivery of the product.
- E-COMMERCE AND INFORMATION SOCIETY SERVICES: 6 years. The limitation period for any form of infringement is 6 years.
- MONEY LAUNDERING: 10 years. Documents formalizing compliance with the obligations provided by law. The filing systems of regulated parties must ensure the proper management and availability of documentation both for internal control purposes and for the purpose of responding to requests from the authorities in a proper and timely manner.

6. Useful Information for Couriers/Suppliers

Grumates will process the personal data of Couriers/Suppliers for the following purposes:
- For legal purposes;
- For contractual purposes;
- For security purposes;
- For statistics and research purposes.

Grubmates processes your personal data for the following Legal purposes:
i) detect and investigate fraud and possible crimes committed against our Platform and all the users;
ii) comply with the legislation in case any legal regulations oblige us to keep your data for a defined period of time (please check Annex I on data retention);
iii) manage and execute your request(s) to exercise the rights established in the GDPR and local regulations;
iv) file, submit and defend legal actions against any entity of Grubmates associated companies;
v) manage and execute your claims related to an Order, problems with the delivery and different sorts of general incidents generated by the use of the Platform.

Grubmates processes your personal data for the following Contractual purposes:
i) manage Grubmates’ activity, enabling you to access and communicate with the Grubmates company so as to provide their services through it;
ii) provide informative sessions to you before the starting of services (focus groups) and to comply with the services offered by the providers through the technological platform, and with obligations arising from the contractual relationship;
iii) studying the use of the platform performed by you and performance of focus groups with you to understand their opinion and feedback about the services provided;
iv) provide you with the equipment and material needed to provide the services, if requested;
v) activate the insurance in case of an incident of you during the delivery of an Order;
vi) assign Orders to you and show to the Customers your position while delivering their Orders;
vii) assist you during the performance of services by contacting customer centers;
viii) notify you concerning changes or updates to our services, terms and conditions, privacy policy, cookies policy and any other corporate document that may affect them in a substantial way.

Grubmates processes your personal data for the following Security purposes:
i) control visitors’ access to Courier center’s facilities and ensure your goods’ and facilities’ safety;
ii) use device, location, profile, usage, and other data to prevent and detect improper payments, money laundering, especially when you pay by cash;
iii) when requested by any authority, administration or court, collaborate with Public Authorities whenever they request Grubmates information useful to the aim of their investigation (e.g. anti-drug projects, anti-fraud projects, anti-terrorism projects);
iv) defend Grubmates interests in case of a conflict between the parties related to the interpretation or execution of the contract;
v) comply with the compensation, accounting, tax and economic obligations.

Grubmates processes your personal data for the following Statistics and Research purposes:
i) carry out statistical and financial calculations based on aggregate and non-identifiable data,
ii) send voluntary and anonymous questionnaires, as well as surveys, competitions and communications of your interest, for the purpose of assessing the quality of the relationship and any opinions that you may have.

6.2 What kind of data do we hold about you and how is your personal data collected?

Grubmates might hold the following data about you:
- Name and surnames: pursuit of the contractual relationship;
- Identity Card (DNI) / Passport No.Foreign resident’s card: pursuit of the contractual relationship - billing and legal compliance;
- Social Security number: payment management and legal compliance;
- Bank and billing information: information for billing purposes, current account or credit card numbers, if necessary to fulfill contractual obligations or manage purchases, or services;
- Photo: road safety, account fraud prevention and public safety;
- Image: video surveillance and access control when entering one of the company’s sites;
- Voice (without biometrics) from Customer service calls: pursuit of the contractual relationship and legal compliance.
- Signature: pursuit of the contractual relationship;
- Date of birth: legal compliance;
- Residence details (resident/non-resident): legal compliance;
- Accident insurance processing details: accident insurance management;
- Driving license: road safety;
- Own vehicle: pursuit of the contractual relationship;
- Vehicle insurance: pursuit of the contractual relationship;
- Geolocation: management of the service provider’s location during the provision of services for road safety reasons and in order to comply with tax and accounting obligations;
- Phone number and Email (Contact data): Pursuit of the contractual relationship and be able to communicate with the Courier/Supplier by sending some communications through different channels such as: SMS, email, Whatsapp messages, etc;
- Internet connection: pursuit of the contractual relationship;
- Conversation information: Transcription and recording of conversations held between Couriers/Suppliers and Grubmates to guarantee and improve the quality of our services, processing of incidents and for security reasons.

6.3 What are the recipients of your data and why are we communicating it?

Your data may be disclosed to third parties only where necessary for the establishment, performance and termination of the contractual relationship with Grubmates. The third-party recipients of the Data, designated as Data Processors, include: i) advisers and consultants for the pursuit of accounting, labor, tax, insurance, legal and technical activities, ii) government bodies (tax authority, social security system, etc.), iii) state security forces, courts, mediation and arbitration bodies,iv) governments for regulatory matters.

During the performance of the relationship and to ensure that you can carry out your activity, the Data will be disclosed: i) to those establishments with which Grubmates has a commercial relationships, ii) those users who have placed an order which you have agreed to carry out, iii) external service providers that provide commercial offers with benefits and/or discounts for you.

Grubmates hereby informs you that the Data may be disclosed to companies associated with Grubmates in connection with the purposes described previously.

The Data may also be transferred inside and outside the Mauritius or European Union to group companies or third parties in charge of the filing and management of computer data solely for purposes related to the management of the contractual relationship between the Parties and fully in accordance with the applicable data protection legislation. Grubmates hereby reports that it has taken the necessary measures to ensure that the disclosure of your data is carried out in accordance with the above-mentioned legislation.

6.4 How long will we keep your data?

Grubmates shall retain your data for the duration of the contractual relationship and, after this has come to an end, for the period established by law for filing or defending the appropriate legal actions. This is established at a maximum of fifteen (15) years in order to comply with Grubmates’s legal obligations – which include the duty to assist the security forces as necessary in the investigation and prosecution of crimes pursuant to the higher interest of public safety – and defend itself or take any action in relation to criminal, tax and social security matters.

The said period may be shorter depending on the legal provision applicable to each purpose of data processing, as established in the table of retention periods set forth in Annex I.

ANNEX I – GENERAL RETENTION PERIODS

GENERAL:
- DATA PROTECTION: 6 years. The limitation period for any form of infringement is 6 years.
- PERSONAL CIVIL ACTIONS: 6 years. Personal actions of any kind without a specific limitation period established from the moment when the obligation becomes enforceable, taking into account that, in the case of ongoing positive or negative obligations, the period will start running again every time they are infringed.
- ACCOUNTING AND TAX DOCUMENTATION: 7 years. For commercial purposes: books, correspondence, documentation and supporting documents relating to their business, duly ordered, from the last entry in the books, save as may be established by general or special provisions. This commercial obligation applies to both compulsory books (income, expenses, investment goods and provisions), and the documentation and documentary evidence of the entries contained in the books (invoices issued and received, vouchers, amendment invoices, bank documents, etc.). For tax purposes: accounting books and other compulsory record books pursuant to the applicable tax legislation (personal income tax, VAT, corporation tax, etc.), as well as documentary evidence justifying the entries in the books (including software and computer files and any other documentary evidence that is relevant for tax purposes) must be retained at least for the period during which the tax authorities are entitled to verify and investigate and, therefore, assess and inform of, the tax owed.
- INFORMATION RELEVANT FOR CRIMINAL ACTIONS: 10 to 15 years. Any information and documentation that may be relevant for the prosecution or defense of criminal proceedings relating to the criminal liability of legal persons. This may include invoices, payment receipts, claims or complaints, delivery routes with geolocation, tax documentation and, in general, any other information from any data subject that may be useful to defend Grubmates’ legal interests.

COURIERS/SUPPLIERS:
- COMMERCIAL AGREEMENTS OR. CONTRACTS: 6 years. The agreements signed between the Courier/Supplier and Grubmates in case of commercial relationships.
- USERS AND CONSUMERS: 6 years. Claims to enforce performance of the service as a result of non-conformity with the contract are subject to a limitation period of three years after the delivery of the product.
- E-COMMERCE AND INFORMATION SOCIETY SERVICES: 6 years. The limitation period for any form of infringement is 6 years.

7. Useful Information for Partners:
7.1 What are the data processing purposes and the legitimate basis of the processing?

Grubmates will process your personal data in order to:
i) grant you the possibility to create your own account and maintain the business relationship with Grubmates in order to provide technology intermediation in the generation of leads and processing of payments and other services relating to in-store sales and the delivery of products, also to handle incidents arising in relation to orders;
ii) provide you with customer service to answer your questions or consultations.

7.2 What kind of data do we hold about you and how is your personal data collected?

Grubmates might hold the following data about you:
- Registration Data: the information provided by you when you create an account with Grubmates: username and e-mail.
- User Profile Information phone number and email; phone number and email; pursuit of the business relationship and be able to communicate with the Partner or the Investor by sending some communications through different channels such as: SMS, email.
- Information of conversations held with Grubmates and recording of conversations for the processing of incidents, queries or other consultations that may be made to guarantee and improve the quality of our services and for security reasons.
- Any additional information that you provide in your requests, comments or questions.

7.3 How long will we keep your data?

Grubmates shall retain your data for the duration of the contractual relationship and, after this has come to an end, for the period established by law for filing or defending the appropriate legal actions. This is established at a maximum of fifteen (15) years in order to comply with Grubmates’ legal obligations – which include the duty to assist the security forces as necessary in the investigation and prosecution of crimes pursuant to the higher interest of public safety – and defend itself or take any action in relation to criminal, tax and social security matters.

The said period may be shorter depending on the legal provision applicable to each purpose of data processing, as established in the table of retention periods set forth in Annex I.

ANNEX I – GENERAL RETENTION PERIODS

GENERAL:
- DATA PROTECTION: 6 years. The limitation period for any form of infringement is 6 years.
- PERSONAL CIVIL ACTIONS: 6 years. Personal actions of any kind without a specific limitation period established from the moment when the obligation becomes enforceable, taking into account that, in the case of ongoing positive or negative obligations, the period will start running again every time they are infringed.
- ACCOUNTING AND TAX DOCUMENTATION: 7 years. For commercial purposes: books, correspondence, documentation and supporting documents relating to their business, duly ordered, from the last entry in the books, save as may be established by general or special provisions. This commercial obligation applies to both compulsory books (income, expenses, investment goods and provisions), and the documentation and documentary evidence of the entries contained in the books (invoices issued and received, vouchers, amendment invoices, bank documents, etc.). For tax purposes: accounting books and other compulsory record books pursuant to the applicable tax legislation (personal income tax, VAT, corporation tax, etc.), as well as documentary evidence justifying the entries in the books (including software and computer files and any other documentary evidence that is relevant for tax purposes) must be retained at least for the period during which the tax authorities are entitled to verify and investigate and, therefore, assess and inform of, the tax owed.
- INFORMATION RELEVANT FOR CRIMINAL ACTIONS: 10 to 15 years. Any information and documentation that may be relevant for the prosecution or defense of criminal proceedings relating to the criminal liability of legal persons. This may include invoices, payment receipts, claims or complaints, delivery routes with geolocation, tax documentation and, in general, any other information from any data subject that may be useful to defend Grubmate’ legal interests.

PARTNERS:
- COMMERCIAL AGREEMENTS OR. CONTRACTS: 6 years. The agreements signed with Grubmates in case of commercial relationships.
- USERS AND CONSUMERS: 6 years. Claims to enforce performance of the service as a result of non-conformity with the contract are subject to a limitation period of three years after the delivery of the product.
- E-COMMERCE AND INFORMATION SOCIETY SERVICES: 6 years. The limitation period for any form of infringement is 6 years.
- MONEY LAUNDERING: 10 years. Documents formalizing compliance with the obligations provided by law. The filing systems of regulated parties must ensure the proper management and availability of documentation both for internal control purposes and for the purpose of responding to requests from the authorities in a proper and timely manner.

8. Useful Information for Investors:
8.1 What are the data processing purposes and the legitimate basis of the processing?

Grubmates will process your personal data for the following purposes:
i) fulfill the requirements of Grubmates’ Compliance Model of carrying out an Investors Due Diligence procedure;
ii) formalize the relationship with you as an Investor;
iii) notify you concerning the corporate matters and inform you about Grubmates’ results.

8.2 What kind of data do we hold about you and how is your personal data collected?

Information supplied directly by you:
- Registration Data: the information provided by you when you create an account with Grubmates: username and e-mail;
- User Profile Information: phone number and email; pursuit of the business relationship and be able to communicate with the Partner or the Investor by sending some communications through different channels such as: SMS, email;
- Information of conversations held with Grubmates: transcription and recording of conversations for the processing of incidents, queries or other consultations that may be made to guarantee and improve the quality of our services and for security reasons;

8.3 How long will we keep your data?

Grubmates shall retain your data for the duration of the contractual or investment relationship and, after this has come to an end, for the period established by law for filing or defending the appropriate legal actions. This is established at a maximum of fifteen (15) years in order to comply with Grubmates’ legal obligations – which include the duty to assist the security forces as necessary in the investigation and prosecution of crimes pursuant to the higher interest of public safety – and defend itself or take any action in relation to criminal, tax and social security matters.

The said period may be shorter depending on the legal provision applicable to each purpose of data processing, as established in the table of retention periods set forth in Annex I.

ANNEX I – GENERAL RETENTION PERIODS

GENERAL:
- DATA PROTECTION: 6 years. The limitation period for any form of infringement is 6 years.
- PERSONAL CIVIL ACTIONS: 6 years. Personal actions of any kind without a specific limitation period established from the moment when the obligation becomes enforceable, taking into account that, in the case of ongoing positive or negative obligations, the period will start running again every time they are infringed.
- ACCOUNTING AND TAX DOCUMENTATION: 7 years. For commercial purposes: books, correspondence, documentation and supporting documents relating to their business, duly ordered, from the last entry in the books, save as may be established by general or special provisions. This commercial obligation applies to both compulsory books (income, expenses, investment goods and provisions), and the documentation and documentary evidence of the entries contained in the books (invoices issued and received, vouchers, amendment invoices, bank documents, etc.). For tax purposes: accounting books and other compulsory record books pursuant to the applicable tax legislation (personal income tax, VAT, corporation tax, etc.), as well as documentary evidence justifying the entries in the books (including software and computer files and any other documentary evidence that is relevant for tax purposes) must be retained at least for the period during which the tax authorities are entitled to verify and investigate and, therefore, assess and inform of, the tax owed.
- INFORMATION RELEVANT FOR CRIMINAL ACTIONS: 10 to 15 years. Any information and documentation that may be relevant for the prosecution or defense of criminal proceedings relating to the criminal liability of legal persons. This may include invoices, payment receipts, claims or complaints, delivery routes with geolocation, tax documentation and, in general, any other information from any data subject that may be useful to defend Grubmates legal interests.

9. Useful Information for Job Applicants:
9.1 What are the data processing purposes and the legitimate basis of the processing?

Grubmates will process your personal data for the following purposes:
i) consider your present or future suitability for any of the positions available at Grubmates. In addition, Grubmates shall process your data for the purpose of conducting any interviews it may deem necessary for the position, test your knowledge, contact companies for which you have previously worked, check references, and assess your skills and abilities in general.
ii) provide you with information of your interest regarding our Job offers.

9.2 What kind of data do we hold about you and how is your personal data collected?

Grubmates holds the following data about you:
- Registration Data: the information provided by you when you apply for the position available at Grubmates or when you request information of your interest regarding our job offers, including the information of your CV and any additional information provided by you during interviews, results of any test or assessment on skills, abilities carried out, information on previous companies and references;
- Academic and Professional Data: student history, professional experience, membership in professional associations, trainings, qualifications;
- Any additional information that you provide in your requests, comments or questions.

9.3 How long will we keep your data?

Your data will be retained for the duration of the selection process and, if you are not selected, for two (2) years following the end of such process, for the purpose of being able to offer the candidate any other vacancy that may be similar and/or compatible to those for which he/she has applied.

If you register with Grubmates, your personal data may be retained until you delete your user or any information that you may have included in your applicant profile.

In some cases, we may have to retain some information to comply with any legal provision applicable, such as in case of fraud on your application, according to the table of general retention periods set forth in Annex I.

ANNEX I – GENERAL RETENTION PERIODS

GENERAL:
- DATA PROTECTION: 6 years. The limitation period for any form of infringement is 6 years.
- PERSONAL CIVIL ACTIONS: 6 years. Personal actions of any kind without a specific limitation period established from the moment when the obligation becomes enforceable, taking into account that, in the case of ongoing positive or negative obligations, the period will start running again every time they are infringed.
- ACCOUNTING AND TAX DOCUMENTATION: 7 years. For commercial purposes: books, correspondence, documentation and supporting documents relating to their business, duly ordered, from the last entry in the books, save as may be established by general or special provisions. This commercial obligation applies to both compulsory books (income, expenses, investment goods and provisions), and the documentation and documentary evidence of the entries contained in the books (invoices issued and received, vouchers, amendment invoices, bank documents, etc.). For tax purposes: accounting books and other compulsory record books pursuant to the applicable tax legislation (personal income tax, VAT, corporation tax, etc.), as well as documentary evidence justifying the entries in the books (including software and computer files and any other documentary evidence that is relevant for tax purposes) must be retained at least for the period during which the tax authorities are entitled to verify and investigate and, therefore, assess and inform of, the tax owed.
- INFORMATION RELEVANT FOR CRIMINAL ACTIONS: 10 to 15 years. Any information and documentation that may be relevant for the prosecution or defense of criminal proceedings relating to the criminal liability of legal persons. This may include invoices, payment receipts, claims or complaints, delivery routes with geolocation, tax documentation and, in general, any other information from any data subject that may be useful to defend Grubmates’ legal interests.

10. Useful Information for Prospects:
10.1 What are the data processing purposes and the legitimate basis of the processing?

Grubmates will process your personal data for the following purposes:
i) process your requests to obtain the products and/or services offered by Grubmates and manage the prospective relationship between both parties;
ii) carry out marketing, communications, research activities regarding Grubmates products and/or services that are similar to those included in your request.

10.2 What kind of data do we hold about you and how is your personal data collected?

Grubmates holds the following data about you:
- Registration Data: the information provided by you when you request for information relating to our products and/or services;
- Any additional information that you provide in your requests, comments or questions;

10.3 How long will we keep your data?

Grubmates shall retain your data while it is necessary to provide you with the relevant answer to any question you may ask and, after this has come to an end, for the period established by law for filing or defending the appropriate legal actions. The said period may vary depending on the legal provision applicable to each purpose of data processing, as established in the table of retention periods set forth in Annex I.

ANNEX I – GENERAL RETENTION PERIODS

GENERAL:
- DATA PROTECTION: 6 years. The limitation period for any form of infringement is 6 years.
- PERSONAL CIVIL ACTIONS: 6 years. Personal actions of any kind without a specific limitation period established from the moment when the obligation becomes enforceable, taking into account that, in the case of ongoing positive or negative obligations, the period will start running again every time they are infringed.
- ACCOUNTING AND TAX DOCUMENTATION: 7 years. For commercial purposes: books, correspondence, documentation and supporting documents relating to their business, duly ordered, from the last entry in the books, save as may be established by general or special provisions. This commercial obligation applies to both compulsory books (income, expenses, investment goods and provisions), and the documentation and documentary evidence of the entries contained in the books (invoices issued and received, vouchers, amendment invoices, bank documents, etc.). For tax purposes: accounting books and other compulsory record books pursuant to the applicable tax legislation (personal income tax, VAT, corporation tax, etc.), as well as documentary evidence justifying the entries in the books (including software and computer files and any other documentary evidence that is relevant for tax purposes) must be retained at least for the period during which the tax authorities are entitled to verify and investigate and, therefore, assess and inform of, the tax owed.
- INFORMATION RELEVANT FOR CRIMINAL ACTIONS: 10 to 15 years. Any information and documentation that may be relevant for the prosecution or defense of criminal proceedings relating to the criminal liability of legal persons. This may include invoices, payment receipts, claims or complaints, delivery routes with geolocation, tax documentation and, in general, any other information from any data subject that may be useful to defend Grubmates’ legal interests.

11. Useful Information for Web Visitors:
11.1 What are the data processing purposes and the legitimate basis of the processing?

Grubmates will process your personal data for the following purposes:
i) follow up your comments left on Grubmates Website or our other Internet websites. This may include, depending on your consent, the notification of new comments on the article commented by you, and the information on new entries on the blog or our website.
ii) provide you with the answer regarding your request.

11.2 What kind of data do we hold about you and how is your personal data collected?

Grubmates holds the following data about you:
- Registration Data: the information provided by you when you request for information relating to our products and/or services.
- Any additional information that you provide in your requests, comments or questions.
- Data derived from cookies: Grubmates uses its own and third party cookies to facilitate navigation for its users and for statistical purposes (see Cookies Policy).

11.3 How long will we keep your data?

Grubmates shall retain your data while it is necessary to provide you with the relevant answer to any question you may ask and, after this has come to an end, for the period established by law for filing or defending the appropriate legal actions.

The said period may vary depending on the legal provision applicable to each purpose of data processing, as established in the table of retention periods set forth in Annex I.

Any comment you may post on our articles published on rubmates Website or our other Internet websites may be kept indefinitely while the post is still published.

ANNEX I – GENERAL RETENTION PERIODS

GENERAL:
- DATA PROTECTION: 6 years. The limitation periods for any form of infringement is 6 years.
- PERSONAL CIVIL ACTIONS: 6 years. Personal actions of any kind without a specific limitation period established from the moment when the obligation becomes enforceable, taking into account that, in the case of ongoing positive or negative obligations, the period will start running again every time they are infringed.
- ACCOUNTING AND TAX DOCUMENTATION: 7 years. For commercial purposes: books, correspondence, documentation and supporting documents relating to their business, duly ordered, from the last entry in the books, save as may be established by general or special provisions. This commercial obligation applies to both compulsory books (income, expenses, investment goods and provisions), and the documentation and documentary evidence of the entries contained in the books (invoices issued and received, vouchers, amendment invoices, bank documents, etc.). For tax purposes: accounting books and other compulsory record books pursuant to the applicable tax legislation (personal income tax, VAT, corporation tax, etc.), as well as documentary evidence justifying the entries in the books (including software and computer files and any other documentary evidence that is relevant for tax purposes) must be retained at least for the period during which the tax authorities are entitled to verify and investigate and, therefore, assess and inform of, the tax owed.
- INFORMATION RELEVANT FOR CRIMINAL ACTIONS: 10 to 15 years. Any information and documentation that may be relevant for the prosecution or defense of criminal proceedings relating to the criminal liability of legal persons. This may include invoices, payment receipts, claims or complaints, delivery routes with geolocation, tax documentation and, in general, any other information from any data subject that may be useful to defend Grubmates’ legal interests.

12. Do We Proceed to International Transfer of Data?

When choosing service providers, Grubmates may transfer your data outside the borders of Mauritius, for example to the United States or for non-EU countries, outside your country. In such cases, Grubmates will ensure before sending the data, that such service providers are in compliance with the standard clauses and minimum security standards established by the European Commission (or your country’s data protection regulator) and that they always process the data in accordance with Grubmates’ instructions.

12.1. Basis and instructions regarding the international transfer

Grubmates shall have a contractual relationship with service providers under which they agree to comply with Grubmates’s instructions and put in place the necessary security measures to protect your data.

Where Grubmates is compelled to carry out further processing by EU law or the law of the EU Member States to which it is subject, it shall inform the service provider of such legal requirements prior to the processing.

Grubmates may subsequently change, supplement or replace the instructions initially given to the service provider by means of individual instructions and are entitled to issue appropriate instructions at any time. This includes, among other things, instructions regarding the correction, deletion and prohibition of data. All instructions issued shall be documented by both Grubmates and the service provider.

12.2. Requirements directed to service providers

Service providers may only collect, process or use data pursuant to a master contract and in accordance with Grubmates’ instructions. This applies in particular to the transfer of personal data to a third country or an international organization.

External service providers are required to inform Grubmates if they consider that an instruction issued by Grubmates, is in contravention of the data protection legislation. Furthermore, service providers are entitled to suspend the execution of the instruction concerned until its confirmation or modification by Grubmates, and they have a duty to refuse to carry out any instructions that are clearly illegal.

13. Do We Proceed to Automated Decision Making?

Grubmates does not adopt any decision that could affect our User/ Courier / Supplier / Job Applicant / etc. significantly based solely on automated processing of their data (e.g. reordering from the stores where our Users have ordered in the past). The only decision-making processes of Grubmates are conducted by applying human intervention (e.g. defining the conditions that the User shall meet to be considered for an offer, such as location).

Regarding the existence of automated decisions with legal effects for the Courier/Supplier, it should be noted that:
- Decisions are not made solely on the basis of the automated processing of the personal data of Couriers/Suppliers, but, where appropriate, on the basis of an assessment of the performance of the service.
- Consumers or Stores have generated all parameters to be taken into account manually.
- All parameters and metrics used to make such decisions always and exclusively refer to the service and the execution of the Terms and Conditions, regardless of the Courier/Supplier executing it.
- Profiles based on the personal data or personal characteristics of the Couriers/Suppliers are not created, as described below.
- In no case the attributes of the personality or of the non-professional sphere of the Couriers/Suppliers are taken into account.
- The results depend on previous and voluntary actions of the Couriers/Suppliers.
- The results may be corrected if there has been an error and/or discrepancy between the Couriers/Suppliers and Grubmates.
- The Couriers/Suppliers are not prevented from exercising any right.
- The Couriers/Suppliers are not prevented from accessing a good or service.
- The Couriers/Suppliers are not prevented from entering into a contract.

14. Do We Proceed to Profile Creations?

When using the application, Grubmates classifies Users based on the information provided by them about their usage of the application to adapt it to their needs and to improve it.

The classification is conducted by solely using first party data. We use information that our Users provide us, such as their historical orders and popularity among new users to suggest similar stores that could be of their interest. This classification is only intended to ensure that our Users find relevant contents, Partners or offers, among others, that may be suitable according to their preferences, and will never have any legal effect on them or the provision of the services by Grubmates, the Partners or the Couriers/Suppliers.

15. What Security Measures Have Been Adopted?

Grubmates has taken the necessary steps recommended by the European Commission and the competent authority to maintain the required security level, according to the nature of the personal data processed and the circumstances of the processing, in order to avoid, to the extent possible and always in accordance with the state of the art, its alteration, loss or unauthorized access or processing. As mentioned above, the personal data supplied will not be disclosed to third parties without the data subject’s prior authorisation.

16. Definitions

For the purpose of this document:
a) “Data Controller” shall mean: the entity in charge of determining the purposes and means of the processing of personal data;
b) “Data Processor” shall mean: the entity in charge of processing personal data on behalf of the controller;
c) “DPPA” shall mean: Data Protection and Privacy Act, 2019 and Regulations;
d) “Supplier(s)” also referred to as “Courier(s)” shall mean: the independent professionals in charge of providing the user with delivery services and who may access User’s personal data in order to perform such services;
e) “Grubmates” also referred to as “Us” / “we / our / ours” shall mean: the company of the Grubmates associated companies corresponding to the country where User(s) or Courier(s)/Supplier(s) have registered for the first time in the website or App. The legal details of such a company are included hereafter in the section “Who is the data controller of your data?”;
f) “Investor(s)” shall mean: anyone who shows interest in committing capital with the expectation of receiving financial returns;
g) “Job Applicant” shall mean: anyone who applies for a Job at Grubmates;
h) “Local regulation” shall mean: the data protection regulation applicable to your country;
i) “Order(s)” shall mean: both food and non-food product/ service requested by the User through the Grubmates;
j) “Partner(s)” shall mean: local stores, physical “retailer”, “supplier”, or “seller” that offer to Users include their products and/or services via Grubmates;
k) “Personal data” shall mean: any information which directly relates to User(s), Courier(s), Partner(s), Job Applicant(s), Partner(s), Investor(s), Prospect(s), Website Visitor(s) or that may allow their identification;
l) “Platform” shall mean: both and indifferently the Grubmates website, Whatsapp communications, and Application;
m) “App” shall mean: the word “App” is used interchangeably with the word “Platform” , both words means the same: both and indifferently the Grubmates website, Whatsapp communications, and Application;
n) “Processing of personal data” also referred to as “Data activity(ies)” shall mean: any activity performed on or with your Personal data, such as collecting, organizing, accessing, holding, storing, disclosing, adapting, destroying, erasing or using the Data in any way;
o) “Profiling” is the process of construction and application of user profiles generated by computerized data analysis also understandable as the use of algorithms or other mathematical techniques that allow the discovery of patterns or correlations in large quantities of data, aggregated in databases;
p) “Prospects” shall mean: anyone who leaves their data on Grubmates’ forms to receive information about Grubmates’s services;
q) “User(s)” shall mean: anyone who registers with Grubmates;
r) “Website Visitor(s)” shall mean: anyone who browses Grubmates website, leaves comments in relation to Grubmates’s publications or asks any questions through the website;
s) “Data Subject”: any natural person from whom data is collected or processed by Grubmates; in essence, the User(s), the Supplier(s), the Agent(s), the Job Applicant(s), the Partner(s), the Investor(s), the Potential Client(s), the Website Visitor(s).

17. Ethics Channel

Grubmates Ethics Channel (accessible here) is an information system aimed at both employees and third parties, from which they can request information about the company's Compliance model and/or the internal regulations that develop it and/or report conduct or acts that may constitute a violation of the regulations to which Grubmates subject, the Code of Ethics or any other internal regulations.

1. Grubmates informs its employees and third parties that it will process the personal data provided in this context for different purposes:
i) To process requests/complaints received through the complaints channel.
ii) To investigate the facts communicated/complained through this mechanism.
iii) Propose resolutions on communications and complaints related to possible criminal acts or breaches of regulations and ethics.
iv) Notify the competent authority of facts constituting criminal or administrative offenses and/or, where appropriate, take disciplinary action against an employee, as well as legal and/or contractual actions against partners, distributors, suppliers or other third parties with which it maintains relations.

2. Grubmates declares that it has all the measures required by current regulations to ensure:
i) The confidentiality of the identity of both the complainant and the reported, as well as any third party involved in the process.
ii) The confidentiality of the communication and documents that the complainant may have provided, as well as the unauthorized access to them.

If our Data Subjects have any questions or would like to obtain more information, they can contact the department in charge through the following e-mail address: legal@grubmates.io.

For any exercise of data protection rights, please contact us at legal@grubmates.io.

18. Cookies Policy: General Information

What are they? Cookies are small files that websites send to the browser which are stored on the User's terminal, which might be a personal computer, a mobile phone, a tablet, or any other device.

What is their function? They play an essential part in providing numerous IT services. Among other functions, they allow a website to store and recover information regarding a User's browsing habits or their equipment and, depending on the information obtained, can be used to recognise the User and improve the service offered through a website and/or app.

What type of cookies do exist? Cookies can be used jointly or separately and can be classified according to different criteria, such as:
- The purpose (technical cookies, analysis, customisation cookies, as defined in sections below in this Policy);
- The management entity (own cookies established by the domain of the website visited by the User or third-party cookies are those established and managed by different domains to the website visited with the aim of being able to send Users personalized advertising);
- The time of activity or retention and storage (session cookies or persistent cookies), etc.

19. Cookies Policy: Regulation

In accordance with the requirements of GDPR, the different local regulations that may be applicable depending on the territory, and the requirements of the European Court of Justice Resolution(s) together with the different local data protection authorities’ resolutions:
- The User must have access to clear and detailed information regarding the data processing activities performed by using cookies.
- The User must have the possibility to i) reject all cookies, ii) enable all of them, iii) enable them or reject them case by case by an express action.

Therefore, Grubmates provides you, as a User of our website and/ or app, with the following information:

20. Cookies Policy: Our Cookies Activities
20. 1. Identity of our Data and Cookies Controller, as well as DPO:

- GRUBMATES, LTD. on its own behalf (hereinafter “Grubmates”).
- The aforementioned entity is committed to protecting your personal information when you use our website and apps and offer the following information regarding the use of Cookies on its online platform.
- DPO contact: legal@grubmates.io.

20. 2. Cookies we use and purposes

Grubmates can use different types of cookies, which may be freely checked and managed by the user when accessing the Web. Cookies are described hereinafter:
- Own cookies are those sent to the Users terminal from a computer or domain managed by Grubmates and from which the service requested by the User is provided.
- Third party cookies are those sent to the User’s terminal from a computer or domain that is not managed by Grubmates and from which the service requested by the User is provided but for another entity that processes the data gathered by the cookie.
- Session cookies. These are a type of cookie designed to collect and store information while the User is accessing a website. These cookies are not stored on the User’s computer when the session expires or the browser is closed.
- Functional cookies. These are a type of cookie in which the data continues to be stored on the User's terminal and can be accessed and processed during a period defined by the controller of the cookie, which can range from a few minutes to several years. Functional cookies enable the website to function properly and are therefore necessary and not optional. However, the User can delete them at any time. Also, limiting their functions will depend on the browser used by the User.
- Technical cookies are those that enable the User to browse the Web page, platform or application and use the different options or service on it, e.g. to control traffic and data communication, to identify the session, to access restricted web site areas, to record elements that make up an order, to make a subscription or an application to participate in an event, to use security elements during browsing, to store content to broadcast videos or sound or to share content over the social networks.
- Personalisation cookies are those that enable the User to access the service pursuant to certain general, pre-defined characteristics according to a range of criteria on the User's terminal, such as e.g. language, browser type used to access the service, regional configuration from where the service is accessed, etc.
- Analysis cookies are those that enable its owner, by monitoring and analyzing the behavior of Users of the website to which they are linked. The information gathered through such cookies is used for measuring the activity of the website, platforms or application and for profiling navigation of Users of the website, platform or application, in order to improve the website based on those analyses.

21. Cookies Policy: Manage Your Cookies

When browsing this website for the first time, a cookies banner might be displayed, which will allow the User to choose which cookies are saved to their browser, giving the option:
- To accept all of them and keep browsing: the cookies banner will not be displayed again, and it will be assumed that the User accepts the present Cookies Policy.
- To disable selected categories of cookies (except for those that are essential for the website to function).
- To disable all cookies (except for those that are essential for the website to function). In this case, the website will only store the cookies which are required for the User to use the website.
- To modify the configuration by following the instructions hereinafter and accepting or disabling some of the cookies or just acquiring more information about cookies and check our Cookies Policy.
- At any time, you will be able to access and manage the actual cookies consent and to check the actual cookies used by Grubmates. The information will be accessible in Privacy of Cookies.
- In case of the banner missing, please consider all types of cookies are on, and either refrain from using our services and visiting our websites and contact your DPO, or, please, feel free to use and visit them with all cookies accepted by default.

Likewise, the reproduction of content that may redirect the User through the links inserted in a different format on the website, or media owned by Grubmates that may contain cookies from the owners of said redirected content. In this case, Grubmates shall not be held liable for either the information,the policies provided to the User or for the cookies used that are made by third-parties.

In the case that the User does not consent to the processing of such information, they can modify the configuration of their browser, by following the information and advice included in the links hereinafter, regarding cookie settings:

For websites, follow the links:
- Chrome: https://support.google.com/chrome/answer/95647?hl=es
- Safari: https://support.apple.com/kb/ph21411?locale=es_ES
- Opera: http://help.opera.com/Windows/12.10/es-ES/cookies.html

For mobile phones, follow the links:
- For Android: Menu > More > Settings > Privacy Settings
- For Safari (IOS): https://support.apple.com/es-es/HT201265

If the User is using another browser, they can obtain more information on how to configure the installation of Cookies through the help or assistance section of that browser.

22. Cookies Policy: Other Relevant Information

Grubmates shall not be held liable for the use of cookies that third parties carry out outside the services offered by the channels and media owned by Grubmates.

23. Cookies Policy: Obtain More Information

Users can contact Grubmates through the following email address: legal@grubmates.io to get more information concerning cookies.