Foody riders Academy - Privacy policy
Version 1.0 | July 2023

With this policy we would like to offer you a clear overview of the data processing activities that take place on the website "www.ridersacademy.foody.com.cy" (hereinafter the "Website" or "riders Academy") and the corresponding application for mobile phones (hereinafter the "Application" or "riders Academy").
The company with the name "Delivery Hero (Cyprus) Ltd” with headquarters in Esperidon 5, Strovolos, 2001, Nicosia Cyprus, HE369772, hereinafter the "Company", or "We" or "Foody", created and operates the website "www.ridersacademy.foody.com.cy" (hereinafter the "Website") and the corresponding mobile application phones (hereinafter the "Application"), as well as any information or elements (e.g. documents, files, images, texts, graphs, videos, etc.) contained therein (hereinafter the "Content") for the purpose of providing online courses to the Foody riders community.
This Privacy Policy applies to the collection and processing of personal data collected by the Company in connection with your use of riders Academy and any other services or systems incorporated therein.

Who is the data controller regarding the data collected in the context of browsing and using riders Academy

The company with the distinctive title Delivery Hero (Cyprus) Ltd, with headquarters in Esperidon 5, Strovolos, 2001, Nicosia with the information detailed above, determines the manner, purposes and means by which your data are collected and processed (hereinafter referred to as "Foody", "Company" "we", "our", "controller" ). The Company is responsible for ensuring that all processing activities comply with legal requirements, as well as with your reasonable expectation of secure processing of your personal data. If you have any question regarding the protection of your personal data, you can contact the data protection officer at any time at gdpr@foody.com.cy.

Which of your data do we collect and process when navigating and using riders Academy

In the following description of processing activities, we refer to each category of personal data. One category includes reference to personal data, which we process in the context of a specific purpose. Personal data is any information that relates to an identified or identifiable natural person.
In particular, we process the following categories of personal data for the following reasons:

Account data (basic data)
Name, email, password, phone number.
Reason:
This data is your basic data, which we absolutely need in order to use Riders Academy. Without an email address and password to be created by you and to which we do not have access, your account on the educational platform cannot be created. Along with your name, this is your basic data.

Device information and access data:
IP address, web browser type and version, device type, operating system, location data, unique device number.
Reason:
Each time you access Riders Academy this information is stored for technical reasons. Some of this information may be used for the early detection of suspicious behavior on the website and the prevention of damages.

Information about your activity at riders Academy:
Day & time of access to Riders Academy, visits to sub-areas and courses of the Application, history of courses you attended, data recording of your responses or recording of video conferences for trainings you participated in (generally information about how you use Riders Academy and its services/content ).
Specifically, per course we can see the number of people enrolled in it, their progress in it as it is divided into modules and whether they completed it, the average time they spent on the course, best and worst performances, scores, pass/fail attempts and submitted responses, but also corresponding statistics for the lessons a rider has attended.
Reason:
This information is collected so that we can provide you with the services of the educational platform in the context of always fulfilling your contractual obligations, but also to improve Riders Academy and your experience during your training. This information will be anonymized when you request the deletion of your account or when your profile becomes inactive so that we can continue to use it solely for statistical purposes in anonymous form and to improve the content of the Website & App.
Please do not post or communicate to us in the context of using the Website and Application specific categories of personal data such as (eg racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership). We do not need this data for the operation and use of riders Academy. If, however, you provide us with this type of information then you give us your express consent to process and store this data.

How we process your data, on what legal basis and for how long we keep it:

We process your personal data strictly and only in accordance with the relevant legislative provisions. We pay particular attention and always take into account the observance of the principles of the General Data Protection Regulation for the processing of your personal data. The Company and the Delivery Hero Group, to which we belong, desire maximum transparency. Therefore, we only process your data if this is lawful and if you reasonably expect your personal data to be processed. If, upon assessment, we conclude that the processing is not reasonably expected, we will only carry out the processing with your express consent.

1) Create an account (registration) and manage your profile
In order to be able to use and experience the riders Academy, the processing of your personal data is necessary. The majority of the data used for your registration in the Application is collected in the context and for the purposes of the employment/independent services contract you have with the Company. Nevertheless, we try to keep the amount of data as minimum as possible. You can help us by sending us only the necessary data that we need for the purpose of using and operating the educational platform. When creating a user account we use your basic data. This is absolutely necessary, as we cannot create a user profile without this data (name, email address and phone). Your email address and telephone number are particularly important data, as we can use them for your authentication, but also for the relevant updates you will receive in the context of the courses you attend to perform your duties as a member of Foody riders community. In addition, we would like to ask you to choose your password carefully. Do not use the same password on multiple sites and ensure that you use a complex password consisting of at least 10 characters with alphanumeric elements, uppercase and lowercase letters, and symbols. Finally, it is clarified that in case you wish to post a profile photo on riders Academy, by posting it you give your consent to its processing as personal data.

Categories of personal data:
Account data (basic data): Name, email address, telephone
Photo

Legal basis:
Article 6 paragraph 1 b) of the General Data Protection Regulation, execution of the employment contract/contract for the provision of independent services

Article 6 paragraph 1 a) of the General Data Protection Regulation, consent in case the data subject uploads a photo to his account.

Retention Period:
Until the termination of the partnership or employment contract or the deletion of the rider's account by Riders Academy due to a violation of the terms of use.
2) Login to your account
Once your account is created, you will need to enter your email address and password to log in.

Categories of personal data:
Profile data (basic data): Email address, password.

Legal basis:
Article 6 paragraph 1 b) of the General Data Protection Regulation, execution of the employment contract/contract for the provision of independent services,
Article 6 paragraph 1 f) of the General Data Protection Regulation, legitimate interest for security measures regarding the use of the platform and access to company information only by authorized persons.

Retention Period:
Until the termination of the partnership/employment contract or the deletion of the rider's account by Riders Academy due to violation of the terms of use.
3) Managing your profile
You can log in to your profile at any time and change the personal data registered in your account, such as your name, email address and photo. To change your phone number you can contact ridersacademy@foody.com.cy. You can also see your activity within the Riders Academy (which classes you have taken, if there are new notifications/updates, etc.).

Categories of personal data:
Account data (basic data)
Device information and access data
Information about the activity on the Website/Application
Photo (if uploaded by the data subject)

Legal basis:
Article 6 paragraph 1 b) of the General Data Protection Regulation, execution of the employment contract/service provision
Article 6 paragraph 1 f) of the General Data Protection Regulation, the controller's legitimate interest in improving the provision of services and the continuous training of the Company's employees/partners.
Article 6 paragraph 1 a) of the General Data Protection Regulation, consent in case the data subject uploads a photo to his account.

Retention Period:
Until the termination of the partnership/employment contract or the deletion of the rider's account by Riders Academy due to a violation of the terms of use, with the exception of activity information, which is anonymized.
4) Your activity at riders Academy
In order to improve the services provided by the Company to users and partners and based on its legitimate interest regarding the necessary and continuous training of our employees/partners, as defined and as a relevant obligation of them in their employment contracts and provision of independent services, we record the courses attended by you, while we keep a record of all the activity related to attending the courses provided to you (grade, answers given, date and time of attending each course). Our purpose is to continuously optimize the services provided to you by the Website/Application, by extracting statistical data on the behavior of trained users while browsing them. It may happen that we use said information for security reasons in order to check any suspicious activity on the platform as well as in order to inform the competent colleagues so that you can provide your work after attending a training.

Categories of personal data:
Account data (basic data)
Information about the activity and use of the riders Academy

Legal basis:
Article 6 paragraph 1 f) of the General Data Protection Regulation, the controller's legitimate interest in improving the provision of services and the continuous training of the Company's employees/partners.

Retention Period:
Until the termination of the partnership/employment contract or the deletion of the rider's account by Riders Academy due to violation of the terms of use. The information is then anonymized and kept exclusively for statistical purposes.
5) Information communication:
We use your email address and mobile phone to send you regular updates regarding the running of training courses, but also regarding new content that has been posted on riders Academy and we recommend you watch. To send the relevant communication we use information derived from the history of your activity on the Website/Application.

Categories of personal data:
Profile data (basic data)
Contact data
Information about the activity and use of the riders Academy

Legal basis:
Article 6 paragraph 1 f) of the General Data Protection Regulation, the controller's legitimate interest in improving the provision of services and the continuous training of the Company's employees/partners.
The informational messages sent for the implementation of the courses have as a legal basis for processing:
Article 6 paragraph 1 b) of the General Data Protection Regulation, execution of the work contract/service provision as they are done for the purpose of fulfilling your contractual obligations and to improve the execution of your work.

Retention Period:
Until the termination of the partnership/employment contract or the deletion of the rider's account by riders Academy due to violation of the terms of use.
6) Cookies
In order to make your visit to Riders Academy attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored in your browser. Some of the cookies we use are deleted at the end of the browser session, i.e. after closing the browser (so-called session cookies). Other cookies remain on your device and allow us to recognize your browser on your next visit (persistent cookies). You can set your browser so that you are informed about the cookie settings, or through the information box (cookies banner) or finally from the cookies policy on our website and decide individually on their acceptance or rejection for specific cases or generally. Not accepting cookies may limit the functionality of our website.

Legal basis:
The legal basis is Article 6 paragraph 1 (a) of the General Data Protection Regulation, i.e. your consent based on the acceptance or rejection and the options selected in the cookie banner during your first visit to riders Academy here.

Who we share your data with

We never provide your data to unauthorized third parties. However, as part of our operations, we obtain services from service providers by giving them limited and strictly controlled access to some of your data, always to the extent necessary to perform their jobs. However, before we pass on personal data to these processing companies on our behalf, each individual company is evaluated. All data recipients must meet the legal requirements regarding data protection and demonstrate the level of data protection with appropriate technical and organizational means. They process your personal data in accordance with the requirements of Article 28 of the General Data Protection Regulation, only in accordance with our instructions and have no claim regarding them. We monitor processors and only work with those who meet our high data protection requirements.

We process your data within the European Union (EU) and the European Economic Area (EEA). In the event that a service provider, processor or third party is located outside the EU and EEA, they must meet the additional requirements set by the General Data Protection Regulation.

Third parties
In addition to data processors, we also work with third parties, to whom we transfer your personal data, but they are not bound by our instructions. These are, for example, our consultants, lawyers or tax experts who receive your data from us under contract and process this data for legal reasons or to protect our interests.
Under no circumstances do we sell or rent your personal data to third parties. This will never take place without your express consent.
Prosecutorial authorities and legal proceedings
It may be in response to legal proceedings, court requests or requests from other competent authorities that it is necessary for us to establish or exercise our legal right to share your personal data strictly necessary in order to investigate or prevent by the competent authorities illegal actions or to take action against illegal or suspicious activities directed against the Company.

Mergers & acquisitions, change of ownership
We would like to inform you that in the event of a merger or acquisition by another company, we will share information with that company. Of course, we will require the company to comply with data protection regulations and we will contact you in advance to inform you of the changes and give you the right to have your data deleted and not shared with the new owner.

Security | Technical & Organizational measures to protect your data

We make every effort to protect your data from malicious actions, taking all necessary measures to protect its confidentiality and integrity. We use various technical means to ensure that suspicious behavior is detected and addressed in a timely manner. To achieve this goal, several monitoring mechanisms are used in parallel to prevent potential attackers from a possible access to our Website and Application. We ask, however, to ensure the proper functioning of the Website and the Application that you also take the necessary measures in order to avoid any possibility of third parties accessing them. For example, we mention the non-permanent storage of your passwords on devices, the locking of all your devices in order to prevent access to Riders Academy by third parties in the event of theft or loss of your device, as well as the use of a password that is not identical to passwords that you use in other accounts.

Please contact us as soon as possible at ridersacademy@foody.com.cy for any issue regarding suspicious activity on the Website or the Application or if you think it creates a security problem.

You can also exercise your following rights at any time:

Right to access your data:
You have the right to be informed about the data we store about you and how it is processed. You can submit a relevant request for access to your data by sending an e-mail to gdpr@foody.com.cy.
Right of rectification
If you notice that your stored data is incorrect, you can always ask us to correct it. Some of your information can be corrected directly by you by logging into your account, and for those that are not changed, please contact ridersacademy@foody.com.cy

Right to erasure
You can ask us at any time to delete the data we have stored about you. Regardless of your request to delete your data, we may need to store some of the data due to legal requirements that override your right. In this case, however, we will restrict your data from further processing. As long as your work/service relationship with the Company lasts, the right of deletion is not granted as the online courses provided and the processing of your data in this context are done on the legal basis of the execution of your employment contracts or the provision of independent services and in the context of the correct handling your professional obligations. Of course, after the termination of the employment contract or provision of independent services to the Company, we will immediately proceed to delete your account.

Right to restriction of processing
If you do not want to delete your data, but at the same time you do not want us to process it further, you can ask us to limit the processing of your personal data. In this case, we will archive your data and reintegrate it into our operating systems only if you so wish. However, during this period you will not be able to use the riders Academy. In possible use of the educational platform we will process your data again.

Right to data portability
You can ask us to send you or another controller the stored personal data in a machine-readable format.

Right to object to the processing of your data
You can withdraw your consent at any time or object to the further processing of your data. This also includes objecting to processing that we carry out without your consent, but based on our legitimate interest.

If you do not agree with or wish to object to one of our processing purposes based on our legitimate interest, you can object to the processing at any time. Send an email to gdpr@foody.com.cy. In this case we will review the processing and either stop processing your data for this purpose or explain to you the reasons why we will continue processing.
To exercise your rights, you can contact the data controller via the e-mail address gdpr@foody.com.cy at any time.

Requests to exercise your above rights are processed within 30 days and are provided free of charge. When requests are made by electronic means, we provide the information in a commonly used electronic format, unless requested in a different format. Although we provide the requested information free of charge, any additional copies and/or repetition of the same request by the subject may incur a reasonable administrative cost. The Company, as the controller, always aims to provide the requested information as soon as possible, but no later than within 30 days from the date of receipt of the request. However, when the retrieval or provision of the information is particularly complicated or subject to valid delay, the deadline may be extended by an additional month. In this case, we will notify you by letter within 30 days and keep you informed of the reasons for this delay.

Automated decision making
We also process your personal data in the context of algorithms in order to simplify our processes. Of course, you have the right not to be subject to decisions based solely on automated processing. If you believe that we have denied your access in an unjustified way, you can always contact us at gdpr@foody.com.cy. In this case, we will consider your request and make a decision on a case-by-case basis.

Right of termination
If you believe that we have made a mistake with your personal data or your rights, you can file a complaint with the relevant supervisory authority at any time.

The supervisory authority responsible for data protection matters is:

Office of the Commissioner for Personal Data Protection
Address: Iasonos 1, Nicosia, Cyprus Postcode City: 1082
Email Address: commissioner@dataprotection.gov.cy