Privacy Policy

3buddy is a restaurant technology and ordering platform operated by Rexett AB, a company registered in Sweden.

This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you use 3buddy websites, applications, ordering services, booking services, payment services and related features.

We take privacy and data protection seriously and process personal data in accordance with applicable data protection legislation, including the EU General Data Protection Regulation (GDPR) and applicable Swedish legislation.

This Privacy Policy applies to customers, visitors, users of the 3buddy website and mobile application, and other individuals whose personal data is processed through 3buddy.

Restaurants using 3buddy may have their own privacy responsibilities. More information about this distinction is provided below.

1 Who is responsible for your personal data?

For personal data that 3buddy processes for its own purposes, the data controller is:

Rexett AB
Pumpgatan 1
417 55 Göteborg
Sweden

Organisation number: 559453-1856
Email: privacy@3buddy.io
Website: https://3buddy.io

For privacy-related questions or requests, contact:

Email: privacy@3buddy.io

Where a restaurant determines the purposes for which customer data is processed and 3buddy processes that data only on the restaurant’s instructions, the restaurant may be the data controller and 3buddy may act as its data processor.

The applicable relationship depends on the specific service and processing activity.

2 What is personal data?

Personal data is information that directly or indirectly identifies, or can identify, a living individual.

Examples include:

• Name
• Email address
• Telephone number
• Delivery address
• Billing information
• Booking information
• Order information
• IP address
• Device information
• Account information
• Location information
• Customer preferences
• Communication history
• Payment-related information
• Identifiers associated with your device
• Information contained in customer support communications

Information may also constitute personal data when it is combined with other information that makes an individual identifiable.

3 What personal data do we collect?

The information we collect depends on how you use 3buddy.

3.1 Information you provide directly

When you create an account, place an order, make a booking or contact us, we may collect:

• First and last name
• Email address
• Telephone number
• Password or authentication information
• Delivery address
• Billing information
• Restaurant preferences
• Booking details
• Order details
• Customer support messages
• Information you voluntarily provide

We only request information that is reasonably necessary for the relevant service.

4 Online orders

When you place an order through 3buddy, we may process information such as:

• Customer name
• Telephone number
• Email address
• Delivery address, where applicable
• Restaurant selected
• Ordered products
• Quantity and price
• Order notes
• Allergens or dietary information voluntarily entered by you
• Pickup or delivery information
• Order status
• Payment status
• Order date and time
• Order identification number

This information is used to:

• Process and fulfil your order
• Send the order to the selected restaurant
• Communicate with you regarding your order
• Arrange pickup or delivery
• Provide order confirmations
• Provide customer support
• Process refunds where applicable
• Prevent fraud and misuse
• Maintain records required by law

The restaurant receiving your order may independently process the information necessary to prepare and fulfil your order.

5 Restaurant bookings

If you use 3buddy to make a restaurant reservation, we may process:

• Name
• Telephone number
• Email address
• Number of guests
• Reservation date and time
• Restaurant selected
• Special requests
• Booking status
• Information relating to the booking

The restaurant may receive this information because it is necessary to manage your reservation.

6 Payments

Payments may be processed through third-party payment providers such as Stripe or other payment providers made available through 3buddy.

3buddy may receive information necessary to identify and reconcile a payment, such as:

• Payment status
• Transaction ID
• Amount
• Currency
• Payment date
• Refund status
• Payment method type
• Limited payment-related information

We generally do not store complete card numbers, CVV/security codes or other sensitive card authentication information on our own systems when payment is handled by a specialised payment provider.

Payment providers process payment information according to their own terms and privacy policies.

For payment processing, the relevant payment provider may act as an independent controller or processor depending on the service and transaction structure.

7 Restaurant marketplace and ordering

If 3buddy operates a marketplace where customers can discover restaurants based on location or other criteria, we may process information necessary to:

• Identify restaurants near you
• Display relevant restaurants
• Calculate approximate distance
• Show available pickup or delivery options
• Determine whether a restaurant delivers to an address
• Present restaurant menus and availability
• Process marketplace orders

Where location functionality is enabled, we will only process location information for the purposes explained at the time of collection and in accordance with the applicable legal basis.

8 Location information

Some 3buddy features may use location information.

For example, location may be used to:

• Find restaurants near you
• Display nearby restaurants
• Determine restaurant distance
• Determine whether delivery is available
• Improve location-based services

Depending on the feature, location may be obtained from:

• Your device
• Your browser
• An address you enter
• Information provided by you

Where precise device location is not necessary, we aim to use less precise location information where appropriate.

You can normally control location permissions through your browser or mobile device settings.

If location processing relies on consent, you may withdraw that consent through the relevant settings.

9 Email communications

We may use your email address for:

• Account-related communications
• Order confirmations
• Booking confirmations
• Receipts
• Payment-related communications
• Security notifications
• Customer service
• Important changes to our services

Marketing emails will only be sent where permitted under applicable law.

You can unsubscribe from marketing communications at any time.

10 Customer accounts

If you create a 3buddy account, we may process:

• Name
• Email address
• Telephone number
• Authentication information
• Account creation date
• Login information
• Account preferences
• Order history
• Booking history
• Saved addresses, if you choose to save them
• Other information associated with your account

This information allows us to operate your account and provide our services.

11 Restaurant customer data

Restaurants using 3buddy may use the platform to manage customer relationships.

A restaurant may therefore process information about its customers including:

• Name
• Telephone number
• Email
• Orders
• Bookings
• Customer notes
• Loyalty or lunch-card information
• Gift-card information
• Communication history
• Other information provided to the restaurant

Where a restaurant determines the purposes of this processing, the restaurant may be the data controller.

In such cases, the restaurant is responsible for determining why the data is processed and for ensuring that its processing complies with applicable data protection law.

3buddy may process this information on the restaurant’s behalf as a data processor.

12 Restaurant staff and business users

If you use 3buddy as an employee, owner, administrator or authorised representative of a restaurant, we may process:

• Name
• Work email
• Telephone number
• Login credentials
• Role and permissions
• Restaurant affiliation
• Device information
• Login history
• Security logs
• Actions performed within the platform

This information is used to:

• Authenticate users
• Manage permissions
• Protect restaurant accounts
• Maintain security
• Audit important actions
• Provide the service
• Prevent unauthorised access

13 Mobile application

If you use the 3buddy mobile application, we may process:

• Device information
• Operating system
• Application version
• Device identifier
• Push notification token
• Login/session information
• Network information
• App activity required for the service
• Printer/device configuration where applicable

The application may request permissions for features such as:

• Notifications
• Camera
• Bluetooth
• NFC
• Local network access
• Location

Permissions are only used for features that require them.

For example, camera access may be required for scanning QR codes or barcodes, while NFC access may be required for supported lunch-card functionality.

You can manage permissions through your device settings.

14 Restaurant printers and local devices

3buddy may communicate with restaurant equipment such as:

• Receipt printers
• Kitchen printers
• Barcode scanners
• NFC readers
• Restaurant tablets
• Other authorised restaurant devices

Technical information relating to these devices may be processed for configuration, troubleshooting, security and service operation.

3buddy does not use restaurant devices to collect personal information beyond what is necessary for the configured service.

15 Lunch cards and gift cards

If a restaurant uses 3buddy lunch-card or gift-card functionality, we may process information such as:

• Customer identifier
• Card identifier
• QR/barcode identifier
• NFC identifier where applicable
• Remaining balance or meals
• Redemption history
• Redemption date and time
• Restaurant identifier
• Transaction identifier

The purpose is to:

• Validate cards
• Prevent duplicate redemption
• Record transactions
• Display remaining balances
• Provide restaurant reporting
• Prevent fraud and misuse

16 Customer support

When you contact us, we may process:

• Name
• Email
• Telephone number
• Account information
• Order information
• Booking information
• Your message
• Attachments you provide
• Technical information necessary to investigate the issue

We use this information to respond to your request and provide support.

17 Technical and security information

When you use our services, our systems may automatically record technical information such as:

• IP address
• Browser type
• Operating system
• Device type
• Application version
• Date and time
• Login events
• Authentication events
• Error information
• Security events
• API requests
• Session information

We use this information to:

• Keep the service secure
• Detect attacks
• Prevent fraud
• Troubleshoot technical problems
• Maintain service availability
• Monitor system performance
• Investigate security incidents

18 Cookies and similar technologies

3buddy may use cookies and similar technologies.

These can include:

Necessary cookies

These may be required for:

• Authentication
• Security
• Session management
• Shopping/order functionality
• Language preferences
• Other essential platform functions

Analytics cookies

Where used, analytics technologies may help us understand:

• How users interact with the service
• Which pages are used
• Technical performance
• General usage patterns

Marketing cookies

Where used, marketing technologies may be used for advertising or marketing purposes.

Non-essential cookies and similar technologies will be used only where the applicable legal requirements for consent or another lawful basis are satisfied.

You can manage cookie preferences through our cookie settings where available and through your browser settings.

Cookies and similar identifiers can constitute personal data when they can be linked to an identifiable individual.

19 Legal bases for processing

Under GDPR, personal data must be processed on a valid legal basis.

Depending on the processing activity, we may rely on:

Performance of a contract

For example:

• Creating and managing an account
• Processing an order
• Processing a booking
• Providing requested services
• Sending essential order communications

Legal obligation

For example:

• Accounting
• Tax requirements
• Fraud prevention where required by law
• Responding to lawful requests from authorities

Legitimate interests

For example:

• Platform security
• Fraud prevention
• Service improvement
• Technical monitoring
• Protecting our systems and users
• Certain business administration activities

When relying on legitimate interests, we consider whether our interests are overridden by your rights and freedoms.

Consent

We may rely on consent where required or appropriate, including certain optional marketing, cookies, location or similar activities.

You may withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

20 How we use personal data

We may use personal data to:

1. Create and manage accounts.
2. Process orders.
3. Process restaurant bookings.
4. Facilitate payments.
5. Process refunds.
6. Communicate order and booking updates.
7. Provide customer support.
8. Operate restaurant services.
9. Operate the 3buddy mobile application.
10. Provide restaurant marketplace functionality.
11. Provide pickup and delivery functionality.
12. Prevent fraud.
13. Protect accounts and systems.
14. Detect security incidents.
15. Improve reliability and performance.
16. Maintain technical logs.
17. Meet legal and accounting obligations.
18. Resolve disputes.
19. Enforce agreements.
20. Send permitted marketing communications.
21. Develop and improve our services.

We will not use personal data for purposes incompatible with the purposes for which it was collected without a valid legal basis and, where required, appropriate additional information or consent.

21 Data minimisation

We aim to collect and process only personal data that is reasonably necessary for the relevant purpose.

We do not intend to collect sensitive personal data unless there is a specific and lawful reason to do so.

Customers should not enter unnecessary sensitive information into free-text order notes, booking notes or other fields.

22 Special categories of personal data

GDPR provides enhanced protection for certain categories of personal data, including information concerning health, religion, political opinions, biometric data and other protected categories.

3buddy does not generally require customers to provide such information.

If you voluntarily enter information of this nature into an order note, booking request, customer message or other field, it may be processed as part of providing the requested service.

We encourage users not to provide sensitive personal information unless it is necessary.

Where special-category personal data is processed, we will ensure that the processing has an applicable legal basis and special condition under GDPR.

23 Who may receive personal data?

Depending on the service, personal data may be shared with:

• The restaurant you order from
• The restaurant you book with
• Payment service providers
• Email providers
• Cloud hosting providers
• Database and infrastructure providers
• Authentication providers
• Analytics providers, where enabled
• Customer-support providers
• Security providers
• Professional advisers
• Authorities where legally required
• Other service providers acting on our documented instructions

We do not sell customer personal data to third parties.

Where a service provider processes personal data on our behalf, we seek to ensure appropriate contractual and security protections are in place.

24 Restaurants as recipients of customer information

When you place an order or booking with a restaurant, the restaurant needs certain information to fulfil the service.

For example, a restaurant may receive:

• Your name
• Telephone number
• Email address
• Delivery address, where applicable
• Order information
• Booking information
• Special requests

The restaurant may use this information for purposes connected with fulfilling your order or booking and for other purposes for which the restaurant has its own lawful basis.

Restaurants may have their own privacy notices.

Where the restaurant is the controller, requests concerning processing carried out independently by that restaurant may need to be directed to the restaurant.

25 Service providers and processors

We use carefully selected technology providers to operate 3buddy.

Examples may include providers for:

• Cloud infrastructure
• Hosting
• Database services
• Payment processing
• Email
• Authentication
• Monitoring
• Security
• Analytics
• Customer support

Where a provider acts as our data processor, we require appropriate contractual protections and processing instructions.

Under GDPR, processors must provide sufficient guarantees regarding appropriate technical and organisational measures, and processing must be governed by an appropriate data processing agreement.

26 International data transfers

Some service providers may process personal data outside Sweden or outside the EU/EEA.

Where personal data is transferred to a country outside the EU/EEA, we will only do so where permitted by applicable data protection law.

Depending on the circumstances, this may involve:

• An adequacy decision
• Standard Contractual Clauses
• Additional safeguards
• Other lawful transfer mechanisms recognised by GDPR

We will provide information about relevant third-country transfers where required by GDPR.

27 Data security

We use appropriate technical and organisational measures designed to protect personal data against:

• Unauthorised access
• Unauthorised disclosure
• Loss
• Destruction
• Alteration
• Misuse
• Accidental disclosure

Security measures may include:

• Encryption in transit
• Access controls
• Authentication
• Role-based permissions
• Tenant isolation
• Logging
• Monitoring
• Backup procedures
• Security updates
• Infrastructure protection
• Restricted administrative access
• Incident response procedures

No internet-based service can guarantee absolute security.

You are also responsible for maintaining the confidentiality of your account credentials.

28 Restaurant tenant isolation

3buddy is designed as a multi-tenant platform.

Restaurant accounts are logically separated so that authorised users of one restaurant should not have access to another restaurant’s customer data, orders, bookings or operational information.

Access is controlled through account, restaurant and role permissions.

We continuously work to maintain appropriate tenant isolation and access controls.

29 Data breaches and security incidents

If we become aware of a personal data breach, we will assess the incident and take appropriate measures in accordance with GDPR.

Where legally required, we will notify the Swedish Authority for Privacy Protection (IMY) and/or affected individuals.

We may also take measures such as:

• Restricting access
• Resetting credentials
• Blocking compromised accounts
• Investigating affected systems
• Preserving relevant logs
• Notifying affected parties where required

30 Automated decision-making and profiling

We may use automated processing for purposes such as:

• Fraud detection
• Security monitoring
• Service personalisation
• Restaurant recommendations
• Technical optimisation

We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals unless permitted under GDPR and appropriate safeguards are provided.

Where GDPR requires information or safeguards concerning automated decision-making or profiling, we will provide them.

31 AI and machine learning

3buddy may introduce AI-supported functionality in the future.

Where AI features process personal data, we will assess the processing separately and ensure that an appropriate legal basis, transparency, security and data-minimisation measures are in place.

Personal data will not be provided to an external AI provider for unrelated purposes merely because the data is available in the 3buddy platform.

Where an AI service provider processes personal data on our behalf, appropriate contractual and security safeguards will be required.

If a specific AI feature involves materially different processing, we may provide additional privacy information before or when the feature is used.

32 How long do we keep personal data?

We do not keep personal data indefinitely.

Retention periods depend on:

• The purpose for which the information was collected
• Whether you maintain an account
• Whether there is an ongoing contractual relationship
• Legal obligations
• Accounting requirements
• Fraud prevention
• Dispute resolution
• Security requirements
• Legitimate business needs

Examples:

Account information

Normally retained while your account remains active and for a reasonable period after closure where necessary for legal, security or dispute purposes.

Order and booking information

May be retained for operational, customer-service, legal, accounting and dispute purposes.

Payment and accounting information

Certain information may have to be retained because of Swedish accounting and tax requirements.

Security logs

May be retained for a limited period appropriate to security, troubleshooting and incident investigation.

Marketing preferences

We may retain a limited record of your marketing opt-out so that we can respect your preference.

Deleted accounts

Deletion does not necessarily mean that every record can immediately be erased.

Certain information may have to remain available where we have a legal obligation to retain it or where it is necessary to establish, exercise or defend legal claims.

33 Swedish accounting retention requirements

Certain transaction and accounting information may constitute accounting records.

Under Swedish accounting rules, accounting information generally must be retained until the end of the seventh year following the end of the calendar year in which the financial year ended.

Accordingly, an erasure request may not always result in immediate deletion of accounting records where retention is legally required.

Such information will not be used for unrelated purposes merely because it must be retained.

Swedish accounting rules require qualifying accounting information to be retained for the applicable statutory retention period. Current Skatteverket guidance states that accounting information must generally be retained until and including the seventh year after the end of the calendar year in which the financial year ended.

34 Your rights under GDPR

Depending on the circumstances, you have the following rights.

Right to information

You have the right to receive clear information about how your personal data is processed.

Right of access

You may request confirmation of whether we process your personal data and, where applicable, request a copy of the information.

Right to rectification

You may request correction of inaccurate or incomplete personal data.

Right to erasure

You may request deletion of personal data in certain circumstances.

This right is not absolute. We may need to retain information where required by law or necessary for legal claims or other recognised exceptions.

Right to restriction

You may request restriction of processing in certain circumstances.

Right to object

You may object to certain processing based on legitimate interests.

You always have the right to object to processing of personal data for direct marketing.

Right to data portability

Where applicable, you may request personal data provided by you in a structured, commonly used and machine-readable format, and request transmission to another controller where GDPR requirements are met.

Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect processing carried out before withdrawal.

Rights concerning automated decision-making

Where applicable, you may have rights concerning decisions based solely on automated processing.

The exact scope of these rights depends on the circumstances and applicable GDPR exceptions.

35 How to exercise your rights

To exercise your rights, contact:

Email: privacy@3buddy.io

Please provide enough information for us to understand and process your request.

We may need to verify your identity before providing personal data or making changes to an account.

We normally handle GDPR requests without charge.

Where permitted by GDPR, we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.

We aim to respond without undue delay and generally within the time period required by GDPR.

36 Complaints

If you believe that we process your personal data unlawfully, we encourage you to contact us first so that we can investigate your concern.

You also have the right to lodge a complaint with the Swedish supervisory authority:

Integritetsskyddsmyndigheten (IMY)
Swedish Authority for Privacy Protection

Website: https://www.imy.se/

37 Direct marketing

Where permitted by law, we may use personal data for direct marketing.

You may object to direct marketing at any time.

If you unsubscribe from marketing, we will stop using your personal data for that marketing purpose, subject to limited retention of information necessary to ensure that your opt-out is respected.

38 Children’s privacy

3buddy is primarily intended for adults and users who are legally able to use the relevant services.

We do not knowingly collect personal data from children for purposes that are not permitted by applicable law.

If you believe that a child has provided personal data to us in circumstances where this should not have occurred, please contact us.

39 Third-party websites and services

3buddy may contain links to websites, applications or services operated by third parties.

We are not responsible for the privacy practices of third-party services.

You should review the privacy notice of the relevant third party before providing personal data.

40 Restaurant responsibility

Restaurants using 3buddy remain responsible for processing for which they determine the purpose and means.

For example, a restaurant may independently determine:

• Which customer information it collects
• How it uses customer information
• How long it keeps customer information
• Whether it sends marketing communications
• How it manages customer relationships

Where applicable, restaurants must provide their own privacy information and comply with GDPR and other applicable legislation.

3buddy may provide tools and infrastructure to help restaurants fulfil their obligations, but providing the software does not automatically make 3buddy responsible for every processing decision made by a restaurant.

41 Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Examples of reasons for changes include:

• Changes to our services
• New functionality
• Changes in technology
• Changes in legal requirements
• Changes in how we process personal data
• Introduction of new third-party services

The latest version will be published on our website.

Where a change materially affects your rights or the way we process your personal data, we will provide additional information where required.

42 Contact information

For privacy questions, GDPR requests or concerns:

Rexett AB / 3buddy
Pumpgatan 1
417 55 Göteborg
Sweden

Organisation number: 559453-1856
Email: privacy@3buddy.io
Website: https://3buddy.io

43 Summary of our privacy principles

Our approach is based on the following principles:

• We collect personal data for defined purposes.
• We aim to collect only what is necessary.
• We explain how personal data is used.
• We protect personal data using appropriate security measures.
• We do not sell customer personal data.
• We do not keep personal data indefinitely.
• We respect GDPR rights.
• We use appropriate safeguards when using service providers.
• We respect legally required retention periods.
• We distinguish between data processing carried out by 3buddy and processing controlled independently by restaurants.
• We aim to be transparent about how personal data is used.

This Privacy Policy should be read together with our Terms and Conditions, Cookie Policy and, where applicable, restaurant-specific privacy information.