INTRODUCTION
In order to face the digitalisation of the market, it is necessary to pay attention to the privacy protection. Drop Management S.à r.l.-S (hereinafter “DropLux”) undertakes to comply with the new general European personal data protection regulation (GDPR) that is in force since May 25th, 2018. The personal data collected by DropLux are fully subject to this new regulation. This matter is part of our essentials, and it is a vital subject that we sincerely pay attention.
The applications will be submitted under the name DropLux, Droplux Driver and Droplux Shop (hereinafter “Applications”). Those names may be amended in the future as Drop, Drop Driver and Drop Shop.
INDEX
1. PERSONAL INFORMATION COLLECTION
2. DATA PROCESSING PURPOSE
- INFORMATION THAT YOU PROVIDE VOLUNTARILY
. Registration information
. Transaction information
. Feedback and reviews
- INFORMATION THAT WE COLLECT AUTOMATICALLY
. Activity Information
. Cookies and similar technologies
- INFORMATION THAT WE OBTAIN FROM THIRD PARTY SOURCES
. Analytics reports and market research surveys
3. LEGAL BASIS
4. FORMS AND INTERACTION
- LINKS TO THIRD-PARTY SITES
5. LOG FILES AND COOKIES
6. THIRD PARTIES
7. STORAGE DURATION
8. RIGHT OF OBJECTION, WITHDRAWAL AND TRANSFER
9. RIGHT OF ACCESS AND RECTIFICATION
10. WHAT DATA DOES DropLux COLLECT
11. RIGHT TO LIMIT THE PROCESSING
12. RIGHTS REQUEST EXECUTION
13. SECURITY
1. PERSONAL INFORMATION COLLECTION
In general, your personal data are not automatically saved when you browse the website droplux.lu. Nevertheless, during your visit, a banner appears at the bottom of the screen informing you of the use of cookies when browsing the site. These cookies do not collect any personal data, it simply allows a better browsing experience.
In some cases, especially when you want to leave a message on the website, you will be asked to provide your name(s), first name(s) and e-mail address (hereinafter your 'Personal Data'). By providing this information, you expressly agree that your data will be processed by DropLux for the purposes indicated in the section 2 below. If there are other purposes than those indicated in point 2, they will be communicated at the end of each form.
2. DATA PROCESSING PURPOSE
DropLux may process your Personal Data for the following purposes:
(a) providing you with the information or services you have requested (including a commercial offer or a response to a contact request);
(b) sending the Newsletter;
(c) collecting the information enabling us to improve our site, our products and services (in particular by means of cookies);
(d) contacting you about various DropLux events, including product updates and customer support.
(e) Registration information: When you create a DropLux account, sign-up or fill in forms on the Services, we collect information about you including your name, address, telephone number, email address and the password you create which are encrypted.
(f) Transaction information: Payment operations are outsourced to our payment processors and we do not store your credit card information in our systems.
(g) We also collect delivery details (e.g. your physical address, name and phone number) to fullfil your order. The background location is used to manage the delivery fleet and also ensure the fulfillment of the order in a more efficient way.
(h) Information regarding your marketing preferences: We collect information about your preferences to receive marketing information any time you subscribe or unsubscribe.
(k) Feedback: When you post messages and reviews of the Services or you contact us, for example with a question, problem or comment, we collect information about you including your name and the content of your query. If you contact our customer support we will record and keep a record of your conversation for quality and training purposes and to aid in the resolution of your queries.
INFORMATION THAT YOU PROVIDE VOLUNTARILY
Registration information
The registration information you provide when you create a DropLux account allows us to give you access to the Services and to supply them to you under our Terms. We also use this information to authenticate your access to the Services, to contact you for your views and to notify you of important changes or updates to our Services.
Transaction information
Your transaction information (such as the grocery items you add to your basket) allows us to process your order and send you an accurate bill. DropLux or its external delivery partners may contact you by email, phone or SMS to give you status updates or other information or to resolve problems with your account or order. A shop may contact you by phone or SMS to provide you with status updates or other information regarding your order. Where you pay for your order with a mobile payment or digital wallet service provider we will send you transaction information via confirmation emails or SMS to the email address or phone number registered with that service provider (since this is required by those providers).
Some shops on our platform use our third party delivery companies; these companies may use your information to provide you with status updates on the delivery of your Order. We will also analyse information on completed transactions and successfully delivered orders on the basis of data matching or statistical analysis so that we can administer, support, improve and develop our business and services. Our analyses also help us detect and prevent fraud or other illegal activities or acts prohibited by our Terms or any policies applicable to our services.
Feedback and reviews
If you give us feedback we will use it to reply to your questions or queries, to provide customer support and resolve any problems with your Orders or with the Services. We will publish reviews that you send to us about the shops on our platform and our services in general and we also analyse your feedback to improve and develop our services and in order to enhance your experience.
INFORMATION THAT WE COLLECT AUTOMATICALLY
When you access our Services, we may collect certain information automatically from your device such as your IP address, MAC address or device ID. In some countries, including in Europe, this information may be considered personal information under applicable data protection laws.
Activity Information
We analyse your buying habits and how you interact with our services so that we can suggest shops or grocery product options from new shop we think you would like to try. We enable you to access your order history so that you can easily reorder with your favourite shop. We may also collect information about your interaction with our emails and other forms of communication.
Cookies and similar technologies
As usually done by many websites and online services we use cookies and other technologies to maintain a record of your interaction with our services. Cookies also help us to manage a range of features and content as well as to store searches and re-present your information at the point of order. For further information about the types of cookies and similar technologies we use, why, and how you can control such technologies.
INFORMATION THAT WE OBTAIN FROM THIRD PARTY SOURCES
Analytics reports and market research surveys
We analyse information we collect from our third-party service providers (such as Google, Facebook and other affiliates) to understand how you engage with our services and advertisements (e.g. whether you have clicked on one of our advertisements). This helps us to understand your preferences and recommend you our services which are tailored to your interests.
3. LEGAL BASIS
For the purposes explained on the section 2 :
(a) Pre-contractual relationship or legitimate interest
(b) Consent
(c) Legitimate interest
(d) Consent
(e) Contractual obligation
(f) Contractual obligation
(g) Consent
(h) Legitimate interest
4. FORMS AND INTERACTION
Your personal information is collected through our contact form or newsletter application form.
We use the collected information for the following purposes:
When you access our Services, we may collect certain information automatically from your device. In some countries, including countries in Europe, this information may be considered personal information under applicable data protection laws. For instance:
LINKS TO THIRD-PARTY WEBSITES
Our website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates or to any number of websites that may offer useful information to our visitors. We provide these links to you only as a convenience and the inclusion of any link does not imply endorsement of the relevant website by DropLux. If you follow a link to any of these websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for these policies or those linked websites. Please check these policies before you submit any personal information to such websites.
5. LOG FILES AND COOKIES
We collect certain information through log files and cookies. This is mainly the following information:
The use of such files allows us to:
6. THIRD PARTIES
Your personal data will be sent to some third parties, the shops where you buy the grocery will see only details of order and number of order. The restaurant will not receive your name or your address.
The driver will have access to your name, address, and details of your order.
Your data can be stored, but encrypted, on our cloud servers.
Some data like your IP address may be collected for statistics and commercial (advertising) purposes by our partners such as Google or Meta (Facebook) who are both located outside the EU/EEA. When your Personal Data is transferred (including in the case of remote access) to a country outside the EU/EEA that is not subject to an adequacy decision, appropriate safeguards in accordance with Chapter V of the GDPR are put in place, such as standard contractual clauses adopted and approved by the European Commission.
7. STORAGE DURATION
Your Personal Data is stored by DropLux only for the time in relation to the purpose of our communication exchanges (when you contact us via our contact form) or your order or until you unsubscribe from our newsletter if registered to it (an unsubscription link is available in every newsletter we send).
8. RIGHT OF OBJECTION, WITHDRAWAL AND TRANSFER
You have a right of objection, deletion of your Personal Data and withdrawal of your consent. You can also request a transfer of your Personal Data.
The right of objection is the possibility offered to the Internet users to refuse that their personal information is used for certain purposes mentioned during the collection. You can express the objection to the processing of your personal information if we have a legitimate interest (or the interest of a third party) in doing so and there is a valid reason to object the data processing. You also have the right to object if we process your personal information for direct marketing purposes.
The right of withdrawal is the possibility offered to users to request the deletion of their personal information. You also can request to delete or remove your personal information when you have expressed your right to object the processing of your data (see above).
When you provide your explicit consent to authorize the collection, processing and transfer of your personal information for a particular purpose, you have the right to withdraw your consent for this data processing at any time. Once we receive the notice of withdrawal of your consent, we will no longer process your information for the purpose (s) for which you gave your consent, unless we have a legitimate reason to do so.
You can request the transfer of your personal information on your behalf or on behalf of another controller in an electronic and structured format (right to data portability). This allows you to retrieve and transfer your data in an electronically usable format.
9. RIGHT OF ACCESS AND RECTIFICATION
You may request access to your personal information (commonly called 'request for access to his personal data'). This request allows you to receive a copy of your personal information and to verify that we are legally processing this data.
You can also request information about whether we have personal information about you and, if so, what information is available and why we keep it / use it.
Additionally, you can request the correction of the personal information we have about you. This allows you to rectify any incomplete or inaccurate information we have about you.
10. WHAT DATA DOES DropLux COLLECT?
The data that we collect about you through the Website and/or the Applications falls into the following categories:
a) Data that you provide voluntarily
Certain parts of the Website or Applications may ask or allow you to provide data voluntarily: for example, we may ask you to provide your contact details such as your name, email address and phone number, as well as details of your communication subject and request information when you contact us via the Website “Contact Us” form.
As described in this Privacy Policy, we may process this data for various purposes, such as to communicate with you, deal with your request, including sending communications directly with you, following up on any issues raised, and providing you with the appropriate details.
b) Data that we collect automatically
When you visit the Website or Aplications, we may collect certain data automatically related to your interactions with us and the Website and/or Applications. For instance, we may collect your IP address and data about how your device has interacted with the Website or Applications, including the pages accessed, date and time of visit, and links clicked. We may also collect your device type, unique device identification numbers, browser type, broad geographic location (e.g., country or city-level location) and other technical information. We collect this data through the use of cookies and similar technologies.
Collecting this data enables us to better understand the visitors who come to the Website or Applications, where they come from, and what content on the Website is of interest to them. As described below, we may use this data for various purposes, including our internal analytics purposes and to improve the quality and relevance of the Website to our visitors.
How does DropLux use the data?
DropLux collects and processes the data described above for any lawful purpose, including the following:
With whom does DropLux share the data?
We may disclose the data we collect to other parties, including the following categories of recipients:
We may share data that is de-identified or aggregated without limitation.
11. RIGHT TO LIMIT THE PROCESSING
You may request the limitation of the processing of your personal information. This allows you to suspend the processing of your personal information, for example if you want to establish the accuracy or the reason of the data processing.
12. RIGHTS REQUEST EXECUTION
To request your rights execution, you can contact us via the following email address droplux@droplux.lu. Your request will be processed within one month starting from the moment of your identity confirmation. You will not have to pay any fees to access your personal information (or execute any other of your rights). However, we may charge you a reasonable fee if your access request is manifestly unfounded or improper. We may also refuse to process your request for the same reason.
We may request you the information to help us confirm your identity and to ensure that you respect your right to access this information (or for the execution of any other of your rights). This is a security measure to ensure the non-disclosure of your personal information to an unauthorized person. You are allowed to file a complaint with the National Commission for Data Protection ('CNPD') if you feel that your rights are not respected.
13. SECURITY
The personal information we collect is kept in a secure environment. Our employees are required to respect the confidentiality of your information. To ensure the security of your personal information, we use the following measures:
We are committed to maintaining a high degree of privacy by incorporating the latest technological innovations to ensure the confidentiality of your data. However, since no mechanism offers maximum security, there is always a risk involved when using the Internet to transfer the personal information.
14. UPDATES TO OUR PRIVACY POLICY
We keep this Policy under regular review and we may change, modify, add, or remove portions from this Privacy Policy at any time. We will post any modifications or changes to the Policy on our website prior to such changes taking effect.