Privacy Policy

This Privacy Policy explains how Svaggy collects, uses, and protects your personal data when you use our food and grocery delivery service. We are committed to processing your data lawfully and transparently in accordance with the EU General Data Protection Regulation (GDPR) and applicable national data protection law.

1. Who is the data controller?

The data controller is the Svaggy entity operating in your country (details at svaggy.fi/legal). For Finland: Svaggy Finland Oy. You can contact our Data Protection Officer (DPO) at privacy@svaggy.fi.

2. What data we collect

When you use Svaggy, we collect:

• Account data: name, email address, phone number, preferred language.
• Order data: items ordered, Merchant details, delivery address, timestamps, order value.
• Payment data: last four digits of your card and payment method type (full card numbers are held only by Stripe).
• Location data: delivery address you enter; precise GPS location only when you grant permission in-app.
• Device and usage data: device type, OS version, IP address, in-app events and session data (via PostHog, EU-hosted).
• Communications: messages exchanged with support or couriers.

3. Why we process your data (legal basis)

| Purpose | Legal basis | |---|---| | Fulfilling your orders | Contract performance (Art. 6(1)(b) GDPR) | | Payment processing | Contract performance | | Sending order updates | Contract performance | | Fraud prevention and safety | Legitimate interests (Art. 6(1)(f)) | | Marketing emails (opt-in) | Consent (Art. 6(1)(a)) | | Legal compliance (tax, accounting) | Legal obligation (Art. 6(1)(c)) | | Analytics to improve the service | Legitimate interests |

4. Who we share your data with

We share your data only as necessary:

• Merchants: name, delivery address and order details to prepare and hand over your order.
• Couriers: name, delivery address, and contact number so they can deliver your order.
• Stripe: payment data for processing.
• : device token for push notifications.