Privacy Policy

1. Data controller

The data controller is TocTocFood (toctocfood.com), based in Italy. This notice applies to all partner restaurants on the platform. Contact: privacy@toctocfood.com.

2. Two categories of processing

We clearly distinguish two areas:

• Service data: collected only as needed to use TocTocFood (order, book, pay, receive confirmations).
• Marketing data / uses: processed only with your explicit consent (newsletter, offers, Mystery Pizza, promotions).

3. Service data (necessary)

To provide the service we only collect what is strictly necessary, for example:

• Name, phone, email and delivery address (for delivery)
• Order or reservation details, time slot, operational notes
• Any payment-related data needed solely to complete the requested order transaction
• Minimal technical data for security and operation (session, technical cookies — see Cookie Policy)

4. Service purposes

Service data is used exclusively to:

• Handle takeaway/delivery orders and table reservations with partner restaurants
• Send operational messages (confirmations, status updates, order support)
• Prevent abuse/fraud and keep the platform secure
• Meet legal obligations (e.g. tax and accounting) linked to the service

5. Marketing data and purposes (consent only)

Only if you give a separate, withdrawable consent may we use your data (typically email and, if provided, preferences/city) to:

• Send TocTocFood or partner restaurant newsletters, discounts and promotions
• Run services such as Mystery Pizza and loyalty campaigns
• Send commercial messages tailored to the preferences you indicated

6. Legal bases

In particular:

• Service data: performance of a contract / pre-contractual steps (using the platform) and, where applicable, legal obligations
• Marketing: explicit consent (withdrawable at any time, without affecting the service)
• Security and essential technical improvement: legitimate interest, respecting your rights

7. Retention

Service data: as long as needed to fulfil the order/reservation and legal duties. Marketing data: until you withdraw consent or unsubscribe. Cookies and technical data: as set out in the Cookie Policy.

8. Sharing

We do not sell your data. We may share it only when necessary with:

• The partner restaurant involved in your order or reservation (to fulfil it)
• Technical providers (hosting, database, email — e.g. Firebase, Vercel, Mailchimp)
• Providers involved in fulfilling the order, only when necessary
• Competent authorities, where required by law

9. Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent (for marketing). Contact privacy@toctocfood.com. You may also lodge a complaint with your supervisory authority.

10. Security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or misuse.

11. Cookies

We use cookies and similar technologies. Details, categories and how to manage preferences are in the Cookie Policy.

12. Changes

We may update this policy. Material changes will be posted on the site or, where appropriate, emailed to you.

13. Contact

Email: privacy@toctocfood.com — Website: https://www.toctocfood.com