Privacy Policy
Version 2.0 — Effective 15 July 2026
1. Data Controller
Grablyy is the data controller responsible for your personal data collected through the Platform. For data protection matters, contact us at: dpo@grablyy.com
2. Personal Data We Collect
We collect the following categories of personal data:
- Account data: first name, last name, email address, phone number, city, profile image, language preference.
- Authentication data: email and password (managed by our authentication provider), login timestamps, IP addresses, and user agent strings.
- Order data: order history, items ordered, total amounts, order status, pickup instructions.
- Loyalty data: points, stamps, cashback balances, rewards, spin wheel tickets, daily streaks, and transaction history.
- Location data: approximate location (when you grant permission) to show nearby cafes.
- Device and usage data: IP address, browser user agent, device type, interaction patterns.
- Consent records: timestamps, IP addresses, and user agents for each consent action (Terms, Privacy, Cookies).
- Communication data: retention offers, reminders, and marketing messages sent to you by cafes.
- Support data: support tickets and messages between users and cafe owners or admins.
- Review data: ratings and comments you submit for cafes.
- Social data: friend connections, friend invites, and reward gifts between users.
3. Legal Basis for Processing
We process your personal data under the following legal bases:
- Contractual necessity (Art. 6(1)(b) GDPR): to create and manage your account, process orders, and operate loyalty programs.
- Consent (Art. 6(1)(a) GDPR): for marketing communications, retention offers, analytics cookies, and optional features like location.
- Legitimate interests (Art. 6(1)(f) GDPR): for platform security, fraud prevention, no-show tracking, audit logging, and service improvement.
- Legal obligation (Art. 6(1)(c) GDPR): for retaining records required by law (e.g., financial records, audit logs).
4. How We Use Your Data
- Creating and managing user accounts and profiles.
- Facilitating orders between Customers and Cafes.
- Operating loyalty programs (points, stamps, cashback, spin wheel, daily streaks, signup rewards, friend gifts).
- Displaying nearby cafes and personalized content.
- Sending retention offers, reminders, and marketing communications from Cafes.
- Moderating reviews and managing no-show reports.
- Managing friend connections and reward sharing.
- Platform security, fraud detection, and audit logging.
- Analytics and platform improvement.
- Complying with legal obligations.
5. Data Sharing
We share personal data with the following recipients:
- Cafes: when you interact with a Cafe (place an order, earn loyalty, write a review), your relevant data is shared with that Cafe.
- Payment providers: for processing payments (payment card data is handled directly by the provider; Grablyy does not store card details).
- Email service providers: for sending transactional and marketing emails.
- Analytics providers: when analytics cookies are accepted.
- Friend connections: when you accept a friend invite or send a reward gift, limited profile data is shared with your friend.
- Legal authorities: when required by law or to protect our rights.
6. Loyalty Program Data Processing
Loyalty data (points, stamps, cashback, rewards) is processed to operate the loyalty programs offered by each Cafe. Each Cafe Owner is a separate data controller for the loyalty data specific to their Cafe. Grablyy processes this data as a processor on behalf of the Cafe.
Loyalty units have no cash value. Their accumulation, redemption, and expiration are governed by each Cafe's rules. Grablyy does not guarantee the availability or value of loyalty units.
7. Data Retention
We retain your personal data for a period of 24 months from your last activity on the Platform. After this period, your data will be deleted or anonymized, unless:
- A longer retention period is required by law;
- The data is needed for the establishment, exercise, or defense of legal claims;
- You have an active account with recent activity.
Consent records (Terms, Privacy, Cookie acceptance) are retained for the lifetime of the account and for up to 3 years after account deletion for audit and compliance purposes.
Audit logs are retained for 24 months. Deleted user accounts are soft-deleted and their personal data is retained only for legal compliance purposes.
8. Your Rights Under GDPR
As a data subject under the GDPR, you have the following rights:
- Right of access (Art. 15): request a copy of your personal data.
- Right to rectification (Art. 16): correct inaccurate or incomplete data.
- Right to erasure (Art. 17): request deletion of your personal data ("right to be forgotten").
- Right to restriction (Art. 18): request restriction of processing.
- Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
- Right to object (Art. 21): object to processing based on legitimate interests or for marketing.
- Right to withdraw consent (Art. 7(3)): withdraw consent at any time without affecting the lawfulness of prior processing.
- Right to lodge a complaint (Art. 77): with the Greek Data Protection Authority (DPA) — www.dpa.gr.
To exercise your rights, contact us at dpo@grablyy.com. We will respond within one month.
9. Cookies
We use cookies and similar technologies. For details, see our Cookie Policy.
10. International Data Transfers
Your data may be processed by our service providers outside the EU/EEA. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.
11. Children's Data
The Platform is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided data, contact us and we will delete it immediately.
Users aged 13-15 must have parental or guardian consent. We do not perform targeted marketing to minors.
12. Security Measures
We implement appropriate technical and organizational measures to protect your data, including encryption, access controls, audit logging, and regular security reviews. However, no method of transmission or storage is 100% secure.
13. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or similarly significant effects. The AI Copilot feature provides insights to Admins but does not make automated decisions about users.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform. Continued use after changes take effect constitutes acceptance.
15. Contact
For privacy questions or to exercise your rights: dpo@grablyy.com