Ponesi Privacy Policy

The controller of personal data processed through the Ponesi platform is: Sahara Group DOO Masarikov Trg 18 16000 Leskovac Republic of Serbia Tax ID (PIB): 115572837 Company Registration Number: 22177460 Privacy contact: privacy@ponesi.rs

This Privacy Policy explains what personal data Ponesi may process, for what purposes, on what legal basis and what rights users have. Ponesi seeks to process personal data lawfully, fairly, transparently and only to the extent necessary for a specified purpose.

Depending on how the Platform is used, we may process: Account information: - first and last name; - email address; - user identifier; - information required for authentication; - profile photo where available through the selected login provider. Contact information: - phone number where required for order fulfillment or communication. Order information: - selected restaurant; - products; - options; - quantities; - price; - creation time; - pickup time; - order status; - history of relevant order changes; - public order number. Verification information: - email address; - whether the email has been verified; - time of successful verification. Ponesi does not need to store the actual one-time OTP code where verification is performed by an external service provider. Location information: If the user grants permission, Ponesi may use their current location to show nearby restaurants. Ponesi does not use this feature for continuous location tracking. Technical information: We may process certain technical information generated while using the Platform, such as IP address, device and browser information, technical logs, security events and error information where necessary for security, diagnostics and operation of the system. Communication information: Information the user provides when contacting support or Sahara Group DOO.

We may process personal data for: - creating and managing user accounts; - authenticating users; - verifying email addresses; - creating and processing orders; - transmitting orders to selected restaurants; - displaying order status; - enabling order pickup; - providing customer support; - resolving complaints; - maintaining system security; - preventing abuse and fraud; - complying with legal obligations; - improving the stability and functionality of the Platform.

The applicable legal basis depends on the specific processing purpose. Processing may be based on: - performance of a contract or taking steps at the user's request; - compliance with a legal obligation; - the legitimate interests of Sahara Group DOO, where such interests are not overridden by the user's rights; - the user's consent where consent is the appropriate legal basis. Acknowledging this Privacy Policy does not constitute blanket consent to all processing of personal data.

If the user signs in through Google, Ponesi may receive certain information from Google, including: - email address; - name; - user identifier; - profile photo where available. The exact scope of data depends on the login configuration and permissions.

Ponesi may use an external service provider to send and verify email verification codes. This may currently include Twilio Verify and SendGrid. After successful verification, Ponesi may store: - confirmation that the email address is verified; - the time of verification.

When a customer creates an order, information necessary to fulfill that order is provided to the selected restaurant. This may include: - public order number; - ordered products and options; - quantities; - pickup time; - customer notes; - contact information where necessary for fulfillment. Restaurants should not receive information that is not required to fulfill the order.

Ponesi may use third-party service providers to operate the Platform. Depending on the current technical architecture, these may include: - Supabase; - Google; - Twilio; - SendGrid; - hosting and infrastructure providers; - monitoring and security services.

Some service providers may process personal data outside the Republic of Serbia. Where this constitutes an international transfer of personal data, Sahara Group DOO takes appropriate measures to ensure the transfer is lawful.

Personal data is retained for as long as necessary for the purpose for which it was collected or as required for legal obligations, dispute resolution or protection of legal interests. User account information may be retained while the user account remains active. Order information may be retained after fulfillment for order history, complaints, accounting or other legal requirements and for the establishment, exercise or defense of legal claims. Technical and security logs are retained only for a period reasonably necessary for security and diagnostics unless there is a justified reason to retain them longer.

Ponesi may request access to the user's current location in order to display nearby restaurants. Users may refuse location permission. Refusing location access does not prevent basic use of the Platform. Ponesi does not use location access for continuous tracking of the user's movements.

Ponesi may use necessary cookies, localStorage or similar technologies for: - login; - security; - preserving the cart; - language preference; - user settings; - technical operation of the Platform. If Ponesi introduces analytics, marketing or other non-essential technologies requiring consent, users should be given an appropriate choice before those technologies are activated.

Marketing consent is not required to use Ponesi. If users are offered the opportunity to receive marketing communications, consent must be: - separate; - optional; - clearly worded; - not pre-selected. Users may withdraw marketing consent without losing access to Ponesi.

Ponesi applies reasonable technical and organizational measures to protect personal data from: - unauthorized access; - unauthorized alteration; - loss; - misuse; - unlawful disclosure. No information system can guarantee absolute security.

Subject to applicable law and where the relevant conditions are met, users may have rights including: - access to their personal data; - correction of inaccurate data; - deletion; - restriction of processing; - data portability; - objection to processing; - withdrawal of consent where processing is based on consent. Requests may be sent to: privacy@ponesi.rs Users also have the right to contact the Commissioner for Information of Public Importance and Personal Data Protection in the Republic of Serbia.

Users may request deletion of their user account. Deleting an account does not necessarily mean every item of personal data will be deleted immediately where there is a legal obligation or another lawful basis requiring certain information to be retained. Data for which there is no longer a purpose or legal basis should be deleted or anonymized.

Ponesi is not intended to allow persons who lack the necessary legal capacity to independently enter into transactions that require the consent of a parent or legal representative. Minors should use the Platform under appropriate supervision of a parent or legal representative.

Ponesi may amend this Privacy Policy. The current version and the date of the latest update will be made available on the Platform. Where a change materially affects the processing of personal data, users will be provided with appropriate information.

For all privacy-related questions: Sahara Group DOO Masarikov Trg 18 16000 Leskovac Republic of Serbia Tax ID (PIB): 115572837 Company Registration Number: 22177460 Email: privacy@ponesi.rs