FoodIN2 Privacy Policy

1. Introduction

Welcome to FoodIN2.

FoodIN2 ("FoodIN2", "we", "our" or "us") is a food, groceries, pastries and market-errand delivery service that enables customers to send food packages and other thoughtful gifts to family members, friends, colleagues and other recipients in Nigeria.

This Privacy Policy applies to our website, foodin2.com, and the services we provide through it.

We process personal information in accordance with applicable data protection laws, including the Nigeria Data Protection Act 2023 (NDPA), where applicable.

By using our website or services, you acknowledge that you have read this Privacy Policy. Where applicable law requires your consent for a particular processing activity, we will obtain that consent before proceeding.

2. Information We Collect

We collect information that is necessary to operate our website, process orders, arrange deliveries, communicate with customers and improve our services. The information collected depends on how you interact with FoodIN2.

2.1 Personal and Account Information

When you register, submit an order or contact us, we may collect:

• Full name.
• Email address.
• Telephone number.
• Account login information.
• Information necessary to manage your account.
• Communications and enquiries submitted through our website or other communication channels.

We use this information to identify customers, manage accounts, communicate about orders and provide customer support.

2.2 Order and Transaction Information

When you place an order, we may collect:

• Selected food, groceries, pastries and other products.
• Product quantities and customisation preferences.
• Grocery lists and budget preferences.
• Order value, service charges and delivery fees.
• Order history and status.
• Payment status and transaction references.
• Receipts and payment confirmations.
• Special instructions relating to an order.

This information enables us to prepare quotations, source products, fulfil orders, arrange deliveries and maintain accurate transaction records.

2.3 Recipient and Delivery Information

FoodIN2 allows customers to send food and grocery packages to other people. To complete these orders, we may collect information relating to the intended recipient, including:

• Recipient's name.
• Delivery address and location.
• Telephone number, where required.
• Preferred delivery date and time.
• Delivery instructions.
• Personalised messages, including KindNotes.
• Other information reasonably necessary to complete the delivery.

Customers who submit another person's information are responsible for ensuring that they have an appropriate lawful basis to provide that information to us for the intended delivery.

We use recipient information primarily to fulfil orders and coordinate delivery. We do not use it for unrelated purposes without an appropriate lawful basis.

2.4 Payment Information

FoodIN2 accepts payments through the payment methods made available on the website, which may include bank transfers and third-party payment processing services.

Depending on the payment method, we may collect or receive:

• Payment confirmation.
• Transaction reference numbers.
• Amount paid.
• Payment date.
• Payment status.
• Bank transfer receipts or other payment evidence submitted by customers.

Where a third-party payment gateway processes your payment, that provider may collect and process payment information under its own privacy policy and applicable terms.

We do not intend to collect or store complete payment card details on our own systems where these are handled directly by a third-party payment processor.

Security reminder: Do not submit passwords, PINs, one-time passwords (OTPs) or other confidential banking credentials through our website or customer support channels.

2.5 Communications and Customer Support

When you contact us by email, telephone, WhatsApp or another available communication channel, we may retain the information you provide, including:

• Your contact details.
• Your enquiry or complaint.
• Relevant order information.
• Messages exchanged with our customer support team.
• Information required to investigate and resolve your request.

We use this information to respond to enquiries, resolve disputes and improve customer service.

2.6 Technical Information and Website Usage

Depending on our website configuration and the services we use, certain technical information may be collected automatically. This may include:

• Internet Protocol (IP) address.
• Browser type and version.
• Device type and operating system.
• Pages visited.
• Date and time of access.
• Referring website.
• Website performance and diagnostic information.
• Security-related logs.

Where collected, this information helps us maintain website functionality, diagnose technical problems, prevent unauthorised access and protect our systems.

2.7 Cookies and Similar Technologies

Our website may use cookies and similar technologies to support essential website functions, maintain sessions, remember preferences and improve performance.

Depending on the technologies enabled on our website, cookies may also be used for analytics or other purposes.

You can manage cookies through your browser settings. Where applicable law requires consent for non-essential cookies, we will seek that consent before using them. Disabling certain cookies may affect website functionality.

3. How We Use Your Information

FoodIN2 uses personal information for the following purposes:

• Account management: To create, maintain and administer customer accounts.
• Order processing: To receive orders, prepare quotations, confirm selections and coordinate the sourcing of food, groceries and other products.
• Payment administration: To verify payments, reconcile transactions, issue receipts and maintain financial records.
• Delivery coordination: To arrange deliveries, communicate with recipients where necessary and ensure that orders reach the correct destination.
• Customer communication: To provide order confirmations, delivery updates, service notifications and responses to enquiries.
• Personalisation: To include customer-provided KindNotes, preferences and special instructions with relevant orders.
• Customer support: To investigate complaints, resolve disputes and respond to requests relating to our services.
• Website operations: To maintain, troubleshoot and improve the performance, usability and security of our website.
• Fraud prevention and security: To identify suspicious transactions, prevent abuse and protect customers, our business and our systems.
• Legal and regulatory compliance: To meet applicable legal, tax, accounting and regulatory obligations.
• Business administration: To maintain appropriate operational records, analyse service performance and improve our order fulfilment processes.

We will not use personal information for purposes incompatible with the original purpose of collection unless permitted by applicable law or supported by another appropriate lawful basis.

4. Lawful Basis for Processing

We process personal information only where an appropriate lawful basis exists under applicable data protection law.

4.1 Contractual Necessity

We process information when necessary to provide services you have requested, including managing your account, preparing quotations, processing orders and arranging deliveries.

4.2 Legal Obligations

We may process and retain information when necessary to comply with applicable laws, regulations, court orders or legitimate regulatory requirements.

4.3 Legitimate Interests

We may process certain information where necessary for legitimate business interests, provided those interests do not override your fundamental rights and freedoms.

Examples may include website security, fraud prevention, service improvement and the management of customer complaints.

4.4 Consent

Where consent is the appropriate lawful basis, we will seek your consent before processing the relevant information.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal, and it does not affect processing supported by another valid lawful basis.

5. How We Share Your Information

FoodIN2 does not sell your personal information to third parties. However, we may share relevant information with the following categories of recipients where necessary and lawful.

5.1 Delivery Personnel and Logistics Providers

We may share the recipient's name, contact details, delivery address and relevant instructions with delivery personnel or logistics providers to complete an order. Only information reasonably necessary for the delivery should be shared.

5.2 Food Vendors and Product Suppliers

Where necessary to fulfil an order, we may share relevant order details with food vendors, grocery suppliers, market vendors, bakeries or other suppliers involved in preparing or sourcing the requested products.

We aim to limit the information disclosed to what is reasonably necessary to fulfil the order.

5.3 Payment Service Providers

We may share transaction information with banks and payment processing providers to verify payments, process transactions, reconcile accounts and investigate payment disputes.

These providers may process information under their own contractual obligations and privacy policies.

5.4 Website Hosting and Technology Providers

We may use third-party providers for website hosting, database management, email delivery, security, technical support and other operational services. Such providers may process personal information on our behalf where necessary to perform their services.

5.5 Professional Advisers and Authorities

We may disclose information to legal advisers, auditors, regulators, law enforcement agencies or other relevant authorities where disclosure is required by law or reasonably necessary to establish, exercise or defend legal claims.

5.6 Business Transfers

If FoodIN2 undergoes a merger, restructuring, acquisition or transfer of business assets, personal information may be transferred as part of that transaction, subject to applicable data protection requirements.

We do not authorise third parties receiving personal information from us to use it for unrelated purposes merely because they have received it.

6. Information About Other People

Because FoodIN2 facilitates deliveries to recipients selected by customers, an order may contain personal information belonging to someone other than the person placing the order.

If you provide another person's information, you should ensure that you are entitled to provide it for the purpose of arranging the requested service.

We will use recipient information for appropriate purposes, such as sourcing products, coordinating delivery, confirming delivery details and resolving order-related issues.

Where required by applicable law, we will take reasonable steps to ensure that affected individuals receive appropriate information about the processing of their personal data.

We will not use recipient contact details for unrelated marketing merely because a customer supplied those details when placing an order.

7. International Data Transfers

FoodIN2 accepts orders from customers who may be located outside Nigeria, while deliveries are made within our supported Nigerian locations.

The location of the customer does not, by itself, determine where personal information is stored or processed.

Depending on our hosting arrangements and the third-party services we use, personal information may be processed or stored outside Nigeria.

Where personal information is transferred internationally, we will take the measures required by applicable data protection law, including any necessary safeguards for the transfer and protection of the information.

Customers should consult the privacy policies of relevant third-party service providers where those providers process their information independently.

8. Data Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, subject to applicable legal and regulatory requirements.

Retention periods may depend on the type of information and the reason for processing.

• Account information: Retained while an account remains active and for an appropriate period afterward where necessary.
• Order records: Retained for order management, customer support, dispute resolution and legitimate business recordkeeping.
• Payment records: Retained for financial reconciliation, accounting, tax compliance and the resolution of payment disputes.
• Customer communications: Retained for as long as necessary to address enquiries, complaints or related matters.
• Technical and security logs: Retained for a period appropriate to the security, diagnostic or operational purpose for which they were collected.

When information is no longer required, we will take reasonable steps to delete it, anonymise it or otherwise dispose of it securely, unless continued retention is required or permitted by law.

Requests for deletion may be subject to legal, accounting or other legitimate retention requirements.

9. How We Protect Your Information

FoodIN2 takes reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, loss, destruction and misuse.

Depending on the systems in use, these measures may include:

• Access restrictions and appropriate account permissions.
• Password protection and secure authentication practices.
• Secure website connections.
• Database and server security measures.
• Restrictions on access to customer and order records.
• Appropriate handling of payment information.
• Security monitoring and incident response procedures.

Access to personal information should be limited to personnel and service providers who require it for legitimate operational purposes.

However, no website, electronic transmission or storage system can be guaranteed to be completely secure. We therefore cannot guarantee absolute security, although we will take reasonable steps to protect the information entrusted to us.

If a personal data breach occurs, we will take appropriate steps to investigate, contain and address the incident and make any notifications required by applicable law.

10. Your Data Protection Rights

Subject to applicable law and any relevant limitations, you may have the right to:

• Be informed: Receive information about how your personal data is collected and used.
• Access your information: Request confirmation of whether we process your personal data and obtain access to relevant information.
• Correct inaccurate information: Request correction or completion of personal data that is inaccurate or incomplete.
• Request deletion: Request the deletion of personal data where the applicable legal conditions are satisfied.
• Restrict processing: Request that we limit certain processing activities where the law permits.
• Object to processing: Object to particular processing activities where applicable law provides this right.
• Data portability: Request a copy of eligible personal data in a suitable format where the right applies.
• Withdraw consent: Withdraw consent for processing activities that rely on consent.
• Challenge certain automated decisions: Exercise applicable rights concerning decisions based solely on automated processing where those decisions produce legal or similarly significant effects.
• Lodge a complaint: Complain to the Nigeria Data Protection Commission or another competent supervisory authority, as applicable.

These rights are not absolute in every circumstance. We may need to verify your identity before acting on a request, and applicable legal exceptions may affect whether a request can be fulfilled.

How to Exercise Your Rights

To submit a privacy request, contact us using the details in Section 15 of this policy. Please describe your request clearly and provide sufficient information to help us identify the relevant records.

We will handle your request in accordance with applicable law. Where necessary, we may request additional information to verify your identity or clarify the scope of your request.

We will not charge a fee for ordinary requests unless a fee is permitted by applicable law.

11. Marketing Communications

FoodIN2 may occasionally communicate information about our services, offers or promotions where permitted by law.

Where marketing communications require consent, we will obtain the appropriate consent before sending them.

You may opt out of marketing communications at any time by following the unsubscribe instructions in the message, where available, or contacting us directly.

Opting out of marketing will not prevent us from sending essential service communications, such as order confirmations, payment notifications, delivery updates or responses to customer support enquiries.

We will not treat a customer's decision to receive or decline marketing communications as a requirement for completing an otherwise eligible order.

12. Children's Privacy

FoodIN2's website and ordering services are primarily intended for individuals who can lawfully enter into transactions and provide personal information for those transactions.

We do not knowingly collect children's personal information beyond what is lawfully necessary for a legitimate purpose, such as completing a delivery arranged by an authorised adult.

Where information relating to a child is provided in connection with a delivery, we will handle it appropriately and only for the relevant purpose.

If you believe that a child has provided personal information to us inappropriately, please contact us so that we can assess the circumstances and take appropriate action.

13. Third-Party Websites and Services

Our website may contain links to third-party websites or services, including payment providers and other external platforms.

These third parties may operate under their own privacy policies, terms and data handling practices.

FoodIN2 does not control the privacy practices of independent third parties. We encourage you to review their privacy policies before providing personal information directly to them.

The presence of a third-party link on our website does not necessarily mean that FoodIN2 endorses all of that third party's services or privacy practices.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, website functionality, data processing practices or applicable legal requirements.

When we make changes, we will update the "Last Updated" date at the beginning of this policy.

Where required by applicable law, we will provide additional notice or obtain consent before implementing material changes that require it.

We encourage you to review this page periodically to remain informed about how we handle personal information.

15. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights or have a complaint about how your personal information is handled, please contact FoodIN2.

Please include "Privacy Request" or "Data Protection Enquiry" in the subject line of your email to help us direct your request appropriately.

We will review privacy-related enquiries and respond in accordance with applicable data protection requirements.