Privacy Policy

1. Who is responsible

The controller for your data is Gastroexpress GmbH, Rosenheimer Str. 30-32, 81669 München, Germany — operator of cofood.ing and cofooding.de. Contact: hello@cofood.ing. Full company details are in the Impressum.

2. What we collect

• Your account — the e-mail address you sign in with, and the name you choose to show to the other people in a spot.
• The spots you join and your role in them, so the group can see who is in and the ambassador can run the rounds.
• What you order — the dishes you pick, quantities, and the “for whom” note if you order for someone else. For a round, the delivery address belongs to the spot. For a catering order and for a spot at home it is the address you enter yourself, together with the delivery day, the time and — if you give it — the number of people.
• Address entries — the addresses you type into an address field, even if you do not go on to order. They show us where deliveries are wanted and where we are missing restaurants. They are not used for advertising and are deleted after twelve months.
• Billing data, when your company pays by invoice — the company name, the billing address and the accounts e-mail address.
• FoodSpot requests — when you tell us on a demo page that you want a FoodSpot: the contact person's name, a business e-mail address and, if you give it, a phone number. We use them only to contact you about it.
• WhatsApp messages, when you write to us or order there — your phone number, the content of your messages, and voice messages, which we turn into text in order to answer them.
• Payment data, when you pay on the platform — the amount, the currency, the status of the payment and the last four digits of the card, kept so we can show you the order and handle a refund. The card number and its security code are entered on Stripe’s own form and are never stored by us.
• Technical data — a hashed IP address and basic device/browser information, to prevent abuse.

3. Signing in with Google or Microsoft

If you choose “Continue with Google” or “Continue with Microsoft”, that provider shares with us your email address, your name, and a unique account identifier so we can create your account. We never receive your password, and we request only basic profile and email scopes — no access to your mailbox, files, contacts or calendar.

We use this data solely to authenticate you and run your orders in your spots; we do not use Google or Microsoft account data for advertising. Their handling of your data is governed by their own privacy notices. Any e-mail address works — spots exist at workplaces and at home alike.

4. Why we use it (legal basis)

To run your membership in a spot, the rounds you take part in and your orders, including orders placed over WhatsApp — performance of a contract (Art. 6(1)(b) GDPR). To process payments and invoices — performance of a contract as well, and for keeping accounting records a legal obligation (Art. 6(1)(c) GDPR). To keep the service secure, prevent abuse, and look at address entries to see where we should deliver — our legitimate interests (Art. 6(1)(f) GDPR).

5. Who we share it with

• The restaurant fulfilling your round — the round’s order and the spot’s delivery address, so it can prepare and deliver the food.
• The people in your spot see the display name you chose and that you are part of the round — that is the point of ordering together.
• Stripe, our payment provider, when you pay on the platform. You enter your card on Stripe’s own form: the number never reaches our servers, and what we keep is the amount, the status and the last four digits, so we can show you the order and handle a refund.
• Service providers acting on our instructions, under data-processing agreements: Hetzner Online GmbH (servers in Germany), Supabase (database and sign-in), Resend (transactional e-mail), Google (address suggestions and map position — what you type into an address field goes to the Google Maps Platform for this), Cloudflare (embedded explainer videos), Telegram (passing your order to the restaurant’s kitchen), Slack (internal notifications to our team, for example about new orders and address entries) and sevDesk (invoices for business customers).
• When you write to us on WhatsApp: Meta (WhatsApp itself) and 1msg (our connection to WhatsApp), Anthropic (AI that understands your message and drafts a reply) and OpenAI (turning voice messages into text).
• We do not sell your data and do not pass it on for advertising.

6. Transfers outside the EU

Some of the providers named above are based in the US or process data there — in particular Stripe, Google, Microsoft, Resend, Cloudflare, Slack, Meta, Anthropic and OpenAI. Such a transfer takes place only on the basis of an adequacy decision of the European Commission (EU-US Data Privacy Framework, Art. 45 GDPR) where the provider is certified under it, and otherwise on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

7. Cookies on your device

We set only strictly necessary cookies: for your sign-in, your chosen language, the delivery address and delivery time you gave for a catering order, a dish you put in the basket before signing in, and the page you return to after signing in. The service does not work without them, and no consent is required for them (§ 25(2) no. 2 TDDDG). We set no analytics or advertising cookies.

8. Retention

We keep account data for as long as your account exists. Order, payment and invoice data are kept for as long as the law requires: ten years for accounting records and invoices (§ 147 AO, § 257 HGB), six years for business correspondence. Address entries without an order are deleted after twelve months. Abuse-prevention logs are kept only briefly.

9. Your rights

You may request access, rectification, erasure, restriction or portability of your data, and object to processing based on legitimate interests. Any consent you have given can be withdrawn at any time with effect for the future. E-mail hello@cofood.ing.

You also have the right to lodge a complaint with a data-protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority), Promenade 18, 91522 Ansbach, Germany.

10. Whether you must provide data, and automated decisions

Without an e-mail address you cannot create an account, and without a delivery address and delivery time we cannot carry out an order; anything else is voluntary. We make no automated decision that has legal effect on you or similarly significantly affects you (Art. 22 GDPR). Suggestions of dishes that might suit you are suggestions — you decide.

For users in Kazakhstan

Who is responsible. The controller of your personal data is Gastroexpress GmbH, Rosenheimer Str. 30-32, 81669 München, Germany. Contact: hello@cofood.ing. [Once the Kazakh ТОО is registered it will become the controller for customers in Kazakhstan — we will update this section then.]

What data. If you send a request to connect an office: the contact person's name, work e-mail, phone (if given), company name, city and the answers to the optional questions (how many people in the office, who pays for lunch, your role). We also keep which ad or page you came from (UTM parameters), without linking it to your devices.

Why. Only to answer your request, discuss the set-up and connect your office. We do not pass this data on for advertising and do not sell it.

Legal basis. Your consent, given by ticking the box in the form (art. 8 of the Law of the Republic of Kazakhstan «On personal data and its protection» No. 94-V).

Where the data is kept, and cross-border transfer. The data is kept in our CRM in the Hetzner data centre in Nuremberg (Germany). The AI service OpenAI (USA) drafts the first reply from the text of the request. Our team learns of a new request in Telegram and Slack (USA): normally they receive only the company name and a link to the request in the CRM; if the CRM is temporarily unavailable, the full text, so the request is not lost. This is a cross-border transfer (art. 16 of Law No. 94-V) made on the basis of your consent. In Germany and the EU the data is protected by the GDPR; the transfer to the USA takes place under the terms described in section 6 above.

How long. 24 months from the last contact with you. If you become a customer — for the term of the contract, and afterwards for as long as the law requires. After that the data is deleted.

Your rights. You can find out what data we hold about you, have it corrected, demand its erasure and withdraw your consent — by e-mail to hello@cofood.ing. We act on a withdrawal within 15 working days (art. 8 of Law No. 94-V). You can also contact the authority for personal data protection — the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan.

The website cofooding.kz. The website cofooding.kz runs on a server in Kazakhstan, collects no personal data, contains no forms and sets no cookies. All requests are taken on cofood.ing.