1 Introduction

Karma is a sales platform through which you can purchase take away food items from restaurants, cafés and bakeries (to name a few) and order food at restaurants (each food supplier is hereinafter called a “Merchant”). Basically, the Merchant provides the food and we provide a platform where you can purchase the food. You can both save surplus food at a discounted price and purchase regular food items through Karma. As a Merchant you can also offer food for sale through the Karma for Business application. The services are hereinafter referred to as the “Services”. 

‍

In this privacy policy (“Privacy Policy”) we describe the personal data we collect, how and why we use it, and what choices and rights you have regarding your personal data. This Privacy Policy applies when you use the mobile application Karma or Karma for Business (together, the “Apps”), visit our website www.karma.life (the “Website”), use our Services, subscribe to our newsletter or otherwise interact with us. When referring to “we” or “us”, we mean Karmalicious AB, which is responsible for the use of personal data described herein, unless otherwise stated herein.

‍

Please take a moment to familiarize yourself with our privacy practices, accessible via the headings below, and contact us if you have any questions.

‍

2 What personal data do we collect?

What data we collect about you depends on what services you use and what data you choose to share with us. For the purposes described in the following section, we may collect and use the following types of data about you:

‍

Data that you provide to us

• Contact information – including your full name, phone number and email address
• Information from contact forms or surveys – including contact information and other information you choose to share with us
• Food preferences – You can choose to filter food offerings by food preferences such as if a meal is vegetarian or gluten free, at what point we will process your food preference information. Also, when you order food, you might choose to include order requests in your order information. Order requests may contain information that can be attributed to a person’s health or religion and that is considered as sensitive information. To protect your privacy, we request that you only share the information necessary to prepare the food and do not include any sensitive information in your order information. If you choose to share sensitive information with us (and thereby with the Merchant), this information will only be used to prepare and deliver the ordered food to you. Sharing sensitive information is voluntary and based on your consent. 

‍

Data collected otherwise

• Contact information – If you choose to log in to the Services using credentials from a third party application (e.g. Google or Facebook), we will receive your contact information from the third-party service. If you are a Merchant or a representative of a Merchant, we may collect your professional contact information such as name, job title/role, company, and professional e-mail address from publicly available sources. 
• Redacted payment data – To provide secure payments, we use the well-renowned third-party payment service providers Stripe and Adyen in our check-out. As independent service providers, Stripe’s and Adyen’s Privacy Policies (respectively) apply to the payment. We do not process your credit card information, however we receive from the relevant payment service provider redacted payment information including card type, time stamps and information that the purchase is completed.
• Data that identifies you – Automatically collected information through logs and cookies including IP-address, login information, time stamps, and location data  based on your IP-address or your GPS on your mobile device. 
• Information on how you use our Services – Automatically collected information on how often you use our Services and which restaurants you order from. 
• Information from other sites (with your consent) – Automatically collected browser data about what other sites and apps you visit. This data is only stored pseudonymized in aggregate form.
• Technical information about your device – Automatically collected technical information, including device-specific information, such as your hardware model, operating system version, unique device identifiers, language settings and mobile network information about your device. 

‍

3 How and why do we use your personal data?

We may only use your data for informed reasons and where we have a legal basis to do so. The reasons for which we process your data are the following:

‍

Providing the Services – To use the Services, you need to create a user account. We collect your contact information to create and verify your user account and for us to collect payment.
This processing is necessary for your use of the Services and for us to fulfill our contractual obligations in the Terms of Service for Users or Terms of Service for Merchants, as applicable. 

‍

Providing customer service – We use contact information and information from contact forms to respond to customer enquiries, diagnose problems in the App or in the Services and provide other customer care and support services.

‍
This processing is necessary to fulfill our contractual obligations in the Terms of Service for Users or Terms of Service for Merchants, as applicable, or if you are not a user of the Services, to serve our legitimate interest to respond to customer queries.

‍

Providing an enhanced user experience  – When ordering food, you may choose to filter food offerings based on your food preferences and dietary needs and can opt in to view food offerings near your location. For these purposes we process your food preferences and location data, respectively. You can also choose to activate push notices to receive offerings relevant to you. 

‍
We process your personal data for these purposes only if you consent to it. You may at any time recall your consent for sharing food preferences by changing your filter options in the App or on the Website. You may change your data sharing and push notices through the settings on your mobile device.  

‍

Sending newsletters – If you are a customer of ours, we use your contact information and information on how you use our Services to send you updates over email about news we think might interest you, such as promotions or information about new service offerings. You may at any time choose to unsubscribe by using the “unsubscribe” instructions provided in each newsletter.

‍
This processing is based on our legitimate interest to update our customers of new features and promote our services.‍

‍

Improving our Services – We use data that you provide in surveys, data that identifies you and other aggregated data on how you use our Services to retain statistics in order for us to develop and improve our Services.

‍
We process aggregated data (that does not identify you) for these purposes based on our legitimate interest to improve our Website and Apps. Data that identifies you will only be processed for these purposes if you consent to it. 

Promoting our Services – If you consent to marketing cookies and similar technologies on our Website or in our Apps, we may collect information from other sites to create user audiences for marketing purposes, to display targeted advertisements and to measure how users interact with our advertisement. This may include profiling and the use of machine learning and other techniques over your data and in some cases using third parties to do this.

‍
We process your personal data for these purposes only if you consent to it. You may at any time recall your consent or change your preferences through the “Cookie settings” link in the footer of the Website or through the settings on your mobile device. 

Business operations – We use personal data to develop aggregated analysis and business intelligence that enable us to operate, protect, make informed decisions, and report on the performance of our business. This processing is necessary to serve our legitimate interest to monitor our business operations.

Invoicing – If you are a Merchant or a representative of a Merchant that has entered into an agreement with us regarding our provision of the Services, we need to process your contact information for invoicing and accounting purposes. This processing is necessary for the performance of contract between us and the legal entity that you represent.

Contacting potential customers – If you are a Merchant or a representative of a Merchant we may advertise our Services and reach out to prospective customers to offer demos, quotes and more information on the Services. This processing is based on our legitimate interest to market and grow our business. You may opt out of such communications by us at any time by unsubscribing from communications.

Security, safety and dispute handling – We use personal data to protect the security and safety of our Services, users, customers, the Apps and Website, to detect and prevent fraud, to resolve disputes and enforce our agreements. This processing is necessary to serve our legitimate interest to protect our business. 

4 How do we use cookies?

Some of the personal data collected about you is obtained automatically from your device through the use of “cookies” or similar tracking technologies (hereinafter “cookies”) when you visit our Website. Cookies are small text files that are stored on your device and collect aggregate information on you device and how our Service, Apps and Website are being used. This includes data that identifies you, information on how you use our Services, information from other sites (with your consent), and technical information about your device, as described above.

We use cookies to: 

• Ensure the basic functionality of the Website
• Maintain the security of the Website
• Analyze the use of our Website and help us make it better 
• Promote and market our Services

Some cookies are necessary for the Website to function as intended, and these will be installed automatically on your device based on our legitimate interest to provide you with a functioning and secure Website. Other cookies, such as those used for marketing and analytical purposes, will only be installed if you allow us to use such cookies when visiting our website (as part of selecting your cookies preferences). 

When you visit our Website, you will be requested to set your cookie preferences. You can choose to allow all cookies, including marketing and analytics cookies, or to only enable certain types of cookies. You may at any time withdraw your consent or change your preferences by clicking “cookie settings” in the footer. 

5 What about childrens’ personal data?

Children under the age of thirteen are not eligible to use our Services and we ask that such individuals do not submit any personal information to us or use the Services. Although visitors of all ages may navigate through the Websites or use our Apps, we do not knowingly collect or request personal information from those under the age of thirteen without parental consent. If, following a notification from a parent, guardian or discovery by other means, a child under thirteen has been improperly registered on our site by using false information, we will cancel the child’s account and delete the child’s personal information from our records. Other age restrictions may be set forth in the Terms for Service for Users from time to time.

6 Who can access your personal data?

Within our company, your personal data can only be accessed by those of our employees and consultants who need the data to perform their work. We also share your name, information on how you use our Services, and food preferences (if you have included such in your order) with the Merchant you order food from so that they can provide the food to you. If you opt in for receiving newsletters and updates from the Merchant, we will share your email address with the Merchant.

Besides our employees, consultants and partner restaurants, we use certain partners to help us provide, improve, promote, and protect our Services. For example, we use suppliers to manage marketing, analytics, data storage, and web hosting on our behalf. For our partners to perform their services, it is sometimes necessary for us to share your data with them. These suppliers may only use your personal data in accordance with our instructions under contracts and we only share such data that is required to perform the service in question. We do not sell any personal data to partners or any other third parties. 

‍

In order to offer you Klarna’s payment methods, we might in the checkout pass your personal data in the form of contact and order details to Klarna, in order for Klarna to assess whether you qualify for their payment methods and to tailor those payment methods for you. Your personal data transferred is processed in line with Klarna’s own privacy notice.

We may disclose personal data to public authorities or other third parties when we have reason to believe that disclosing this information is necessary to identify, contact or bring legal action against someone who may be causing injury to or interference with our rights or property, the users of the  Website or Apps, or anyone else that could be harmed by such activities. 

We may, in the future, sell or otherwise transfer some or all of our assets or equity to a third party. Your personally identifiable information and other information we obtain from you may be disclosed to any potential or actual third party purchasers of such assets or equity and may be among the assets transferred.  

7 Third party links 

The Website and/or Apps may contain links to other websites or applications that are owned and operated by third parties that are not affiliated with us. When you use those links, you leave the Website or Apps (as applicable) and we are unable to control how the owners of the websites or applications you link to handle any information they gather about you, including their privacy practices and use of cookies.

This Privacy Policy applies only to the Website and Apps and does not govern activities on linked websites or applications. We encourage you to review the privacy policy of any other website or application you visit, download or access to understand its owner’s practices on how it collects, uses and discloses your information.

8 Is your data processed outside of the EU?

Your personal data can be transferred to and processed by third parties located in a country outside of the EU/EEA. We take great care in protecting your personal information and have put in place adequate mechanisms to protect it when it is transferred outside of the EU/EEA. For instance, by using the Standard Contractual Clauses as approved by the European Commission together with additional organizational and technical security measures, such as pseudonymization and encryption procedures. 

9 For how long do we store your data?

We will retain your personal information for as long as we deem it necessary for the purposes described in this Privacy Policy. 

For purposes of clarity, you are entitled to terminate your user account at any time, at what point all information connected to your account will either be deleted or anonymized. However, binding legal requirements or other legitimate reasons may require that we store certain information for various periods of time, and as such we may be unable to delete all information from our databases.  

You can always alter the information you have submitted when creating your user account through the settings of your user account in the App or on the Website. We may alter, modify or delete any information you submit to the Website or through the App if we believe, in our sole discretion, it is in violation of our Terms of Service for Users or Terms of Service for Merchants, as applicable, otherwise against good taste.

10 How do we keep your data secured? 

While no system is completely secure, we take several precautionary measures to help prevent personal information about you from loss, theft, misuse and unauthorized access. Such measures include access control to physical locations and events logging in IT-systems, access restrictions to personal data, pseudonymization and encryption procedures and confidentiality routines. 

11 What are your rights?

You always have the following rights in relation to your personal data:

• The right to access your data. You always have the right to understand what personal information we collect and share. You have the right to ask us for supplementary information on why we process your data, what data we process, how long we store your data (or what criteria we use for determining the storage period), who we share your data with, and whether your data is transferred to countries outside of the European Economic Area.
• The right to correct inaccurate information. You always have the right to correct or ask us to correct any inaccurate data about you.
• The right to request erasure or restriction of your data. You have the right to have us erase or restrict the use of your data that is no longer needed for the purposes for which we collected the data. You also have a right to object to any processing you find unlawful or unnecessary for the informed purposes.
• The right to information on the source of data we collect. You have a right to get information on the source of information that is not provided by you and about automated decision-making, such as profiling.
• The right to data portability. When technically possible, you have the right to get your data transferred to another service.
• Right to non-discrimination. You have the right not to receive discriminatory treatment for the exercise of your privacy rights.

You may request the disclosures described above by sending a request to privacy@karma.life. We will make the disclosure within 30 days of receiving your request, unless we request an extension, in which case we will notify you of the extension within the given time period.

Please note that there may be restrictions for us to erase certain personal data, such as personal data we are required to store by law or regulations.

If you have questions or complaints regarding our processing of your personal data, we kindly ask you to contact us over email at privacy@karma.life. You also have the right, at any time, to file a complaint to the Swedish Authority for Privacy Protection (https://www.imy.se), which is the supervisory authority for data protection matters in Sweden.

12 Changes or updates to the Privacy Policy

Occasionally we may, in our discretion, make changes to our Privacy Policy, for example to reflect changes in the Services or regulatory requirements. When we update this Privacy Policy, we will revise the last update date.

If there are major changes to the Privacy Policy or in how we use your personal data, we will inform you either by posting a notice of such changes on our Website and in our Apps, prior to them taking place, or by directly sending you an email. 

13 How to contact us

If you have any questions about the use of your personal information, please send us an email to privacy@karma.life‍

‍

Unless otherwise stated, Karmalicious AB is the data controller for personal data we collect through the Services subject to this Privacy Policy. Our address is Karmalicious AB, Mailbox 163, 111 73, Stockholm, Sweden.