Privacy Policy

Because we understand the importance of your data privacy and, naturally, your concern about how the information you provide to us is used and processed,

Because we aim to build a mutual trust relationship with those we serve in the community,

Because we are committed to protecting your personal data and using it strictly for the purposes you have entrusted to us,

In the following policy, you will find all the necessary information regarding the use and processing of your personal data that we collect through our mobile application.

We encourage you to read this policy carefully and ensure that you understand it. If you have any clarifications or concerns, please contact us at: [email protected].

Accessing and using our website can only be done under the terms and conditions set out in this privacy policy. If you do not agree with the terms stated in this policy, please stop browsing our website immediately.

In this context, the following terms are defined as follows:

GDPR – The General Data Protection Regulation no. 679/2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, together with subsequent amendments and completions.

Supervisory Authority – The National Supervisory Authority for Personal Data Processing (ANSPDCP).

Consent – Any freely given, specific, informed, and unambiguous indication of the individual's wishes by which they agree to the processing of their personal data in accordance with this policy.

Cookie – An 'internet cookie' (also known as a 'browser cookie', 'HTTP cookie' or simply 'cookie') is a small file, made up of letters and numbers, stored on the user's computer, mobile device or other equipment used to access the internet.

The cookie is installed at the request of a web server to a browser (e.g., Internet Explorer, Chrome) and is entirely "passive" (it does not contain software programs, viruses, or spyware and cannot access information on the user's hard drive).

A cookie consists of a name and its content or value. Additionally, the lifespan of a cookie is defined; technically, only the web server that sent the cookie can access it again when a user returns to the associated website.

Personal Data – Any information relating to an identified or identifiable person, referred to as the "data subject". An identifiable person is one who can be identified, directly or indirectly, by an identifier (such as a name, identification number, location data, online identifiers, or specific factors of physical, physiological, genetic, mental, economic, cultural, social identity).

Operator – CIBO SRL, a limited liability company, headquartered in Galați, str. Portului nr. 7, jud. Galați, registered at the Trade Register under no. J17/1851/2023, having CUI 49210650, hereinafter referred to as "CIBO".

Processing – Any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

User – A natural person, Romanian or foreign citizen, who consents to accessing https://cibo.ro, in accordance with the Operator's policies.

Vendor – Any hospitality unit offering products or services within the CIBO platform. This may include restaurants, terraces, fast-foods, cafes, hotels, and other types of locations in the hospitality industry, interacting with end consumers or B2B partners through the application.

Purpose of this Policy

This policy applies only to your use of our website. It does not refer to any website linked to our site (whether we provide those links or they are shared by other users). We have no control over how your data is collected, stored, or used by other websites or mobile applications and we advise you to check the privacy policies of those sites before providing them with data.

Data We Collect

Among the data we collect are those related to:

• name and surname, email, phone;
• data obtained as a result of reservations made on the CIBO site, namely the venue where you made the reservation, the date, time, day of the reservation; the number of people for whom you made the reservation; other reservation details;
• culinary preferences, allergies;
• data regarding orders placed by you on the site: such as order history, fulfilled and canceled orders, payment methods, geolocation data.

Based on your consent regarding the processing of personal data related to geolocation, we inform you that CIBO may collect, use, and share data regarding the exact location, including the real-time geographic location of your mobile device or computer from which you placed an order.

You have the option to disable geolocation at any time, but this deactivation may lead to limited functionality of the CIBO site.

Also, when you access the CIBO site, our servers automatically create records of your visit. These records usually include the IP address, number of accesses, type of browser you are accessing from. For more details, please refer to the cookie usage section.

Legal Basis for Processing

The processing of your data by the Operator is in most cases necessary for the conclusion and execution of a contract between CIBO and you, as the data subject.

Also, certain processing subsumed to this purpose is imposed by applicable legislation, including tax and accounting legislation.

We process personal data under the provisions of art. 6 para. 1 letter b of the GDPR, respectively under the execution of a contract (namely to be able to provide you with the services offered by the CIBO site according to the General Terms and Conditions of the site, which you have accessed). The lack of agreement for the provision of personal data leads to the impossibility of providing services by the Operator, respectively the impossibility of using the CIBO site.

At the same time, we process your personal data based on legitimate interest, respectively under the provisions of art. 6 letter f of the GDPR, for situations where you do not have a user account on the CIBO site.

Last but not least, we process personal data under the provisions of art. 6 para. 1 letter c of the GDPR, under a legal obligation, when it is necessary to keep a record of reservations and/or orders made using the CIBO site, to justify the services provided and invoiced to our partners.

How We Use Collected Data

We process your personal data for the purpose of providing the services of the CIBO site, namely:

• Making reservations at listed Vendor locations;
• Placing orders, preparing and delivering them;
• Suggestions and recommendations regarding CIBO partner locations and the products they offer;
• Any other functionalities of the CIBO site.

Additionally, we may use personal data consisting of name, surname, email, phone for marketing purposes, or for sending commercial communications about CIBO products and services, or those of our Vendors.

How and Where We Store Your Data

The processing and storage of your personal data will only be carried out for the time necessary to achieve the processing purposes outlined above.

As a general rule, your personal data will be stored only as long as you have an account on the CIBO site. You can request the deletion of certain information or the closure of the account at any time, and we will comply with these requests, subject to retaining certain information even after the account is closed, in situations where applicable legislation (for example, for tax and accounting purposes) or our legitimate interests require it.

Data security is of great importance to us. To protect your data, we have implemented appropriate physical, electronic, and managerial procedures to protect and secure the data collected through our site and application.

The steps we take to ensure and protect your data include:

• encrypting access to our website through an SSL certificate,
• encrypted storage of data on our partner servers (for example, aws.amazon.com, which provides our web hosting service).

Although the security measures we implement are of a high standard, we recommend that you take appropriate precautions when transmitting personal data over the internet. We ensure that we only request the personal data necessary to provide you with access to information.

Additionally, we specify that we process your personal data in accordance with our internal data protection policy. In this regard, we guarantee that we have adopted all necessary security measures, in accordance with applicable legislation, to ensure the integrity and confidentiality of your data.

In the event that the security of personal data is compromised in a way that could create a major risk to your rights and freedoms, we will notify you immediately and implement all necessary measures to correct the situation and/or reduce any negative impact.

Retention Period

If you have a user account on the CIBO platforms, we will retain your personal data until the user account is deleted (at your initiative or at the initiative of CIBO, as the case may be). Regarding the data related to reservations made by you through CIBO, they can be deleted after they are fulfilled. Additionally, as a user, you have the option to delete order data after their completion.

If you do not have a user account on the CIBO platforms, we inform you that your personal data will be retained until the reservation is fulfilled and for a period of 1 year thereafter, considering the possibility that, during this period, you may want to make other reservations through the CIBO platforms. Retaining your personal data helps us provide you with an improved service. However, you have the right to request the deletion of your reservation data.

If you decide to delete or request the deletion of reservation or order data, we may be required to continue processing this data to fulfill certain legal or contractual obligations. In situations where you have not fulfilled or have canceled a reservation or order, it will be necessary to retain this information in accordance with the terms and conditions of the CIBO platform. In these cases, the data will be processed strictly for the mentioned purposes and for the duration imposed by law or contract.

Regarding the processing of data for marketing purposes (name, surname, email, phone), these will be stored until consent is withdrawn, but no longer than 5 years.

At the end of the retention period, the data will be permanently deleted or anonymized.

Depending on the circumstances, some of your personal data will be retained for as long as we have a legal obligation to do so.

Data Recipients

Your personal data is processed by the Operator and will not be disclosed to third parties, with the following exceptions:

• To the Vendors where you made reservations and/or orders;
• Cases where we are requested or where we are obliged to provide your data to the competent authorities under a legal provision
• To conventional representatives or courts for situations where you violate the obligations assumed towards CIBO according to the terms and conditions of the site and we understand to exercise our legal rights to recover the damage caused, other situations provided by law.

For situations where it is necessary to transmit your data to third parties, we will take all necessary steps to ensure that we only transfer the data necessary to fulfill the purpose for which your data is transmitted.

Your Control Over Your Personal Data

We take your rights regarding the processing of your data very seriously. We will continue to take all reasonable measures to ensure that they are respected.

Your Rights

In short, your rights are as follows:

• Right of access. You have the right to access your data that we process or control, or copies thereof; You also have the right to obtain information from us regarding the nature, processing, and disclosure of this data.
• Right to rectification. You have the right to correct inaccuracies in your data that we process or control.
• Right to erasure ('right to be forgotten'). You have the right to obtain from us the deletion of your data that we process or control, where the deletion of this data is possible under the law.
• Right to restrict processing. You have the right to restrict the processing of your data that we process or control, in cases established by law.
• Right to object. You have the right to object to the processing of your data by us or on our behalf, in cases provided by law.
• Right to data portability. You have the right to obtain the transfer to another operator of your data that we process or control.
• Right to withdraw consent. In situations where we process your data based on your consent, you have the right to withdraw your consent; you can do this at any time, at least as easily as you initially gave your consent; the withdrawal of consent will not affect the legality of the data processing we performed before the withdrawal.
• Right to lodge a complaint with the supervisory authority. You have the right to lodge a complaint with the data protection supervisory authority regarding the processing of your data by us or on our behalf, to the extent that you consider that the processing is not in accordance with legal provisions. The contact details of the authority can be found on the website and app, www.dataprotection.ro

How to Exercise Your Rights

To exercise one or more of these rights (including the right to withdraw your consent when we process your data based on it) or to address any questions about any of these rights or any provision of this notice or any other aspects of our data processing, please always use the contact details in the CONTACT US section or the email address [email protected]. We will try to respond as quickly and fully as possible to all your questions and concerns and facilitate the exercise of your rights.

If you are dissatisfied with our response and believe that your rights are being violated, you can file a complaint with the competent Supervisory Authority, namely the National Supervisory Authority for Personal Data Processing, located at B-dul G-ral. Gheorghe Magheru 28-30 Sector 1, postal code 010336 Bucharest, Romania. Additional contact details of the authority can be found on the website www.dataprotection.ro.

Cookies

As stated at the beginning of this document, a 'Cookie' is a small file, consisting of letters and numbers, stored on the user's computer, mobile device, or other equipment used to access the Internet. The cookie is installed at the request of a web server to a browser (e.g., Internet Explorer, Chrome) and is entirely 'passive' (it does not contain software programs, viruses, or spyware and cannot access information on the user's hard drive).

A cookie consists of a name and its content or value. In addition, the lifespan of a cookie is defined; technically, only the web server that sent the cookie can access it again when a user returns to the associated website.

Types of cookies used by the CIBO site:

connect.sid

This cookie is used to keep users sessions active in the application, so they are not accidentally logged out during use.

locale

The cookie stores users language preferences to display the application's content in the chosen language.

streamChatJWT

This cookie is used to authenticate users in the application's chat system, ensuring the correct functionality of the chat service.

GRECAPTCHA

It is used to protect the application from automated access (e.g., bots), ensuring that access is made by real users.

How can I avoid cookies?

Users can configure their browser to reject cookie files. Disabling and refusing to receive these files may make certain sections/pages impractical or difficult to visit and use.

More information about cookies can be found on the website www.allaboutcookies.org or http://www.youronlinechoices.com/ro.

Privacy Policy Update

The Operator periodically updates the content of this privacy policy, which is why we invite you to constantly check our website. In the event of substantial changes, we will appropriately notify you of these changes, either via email.