COUBONGA PRIVACY POLICY
At Coubonga, we take data protection seriously. Privacy and data security are at the heart of Coubonga. This Privacy Policy outlines the key principles and practices we follow to ensure that your privacy is respected when you use our services.
Coubonga Oy, along with the local, country-specific Coubonga companies belonging to the same group (“Coubonga,” “we”) process the personal data of Coubonga users who make purchases and submit offers through the Coubonga app (“Coubonga App”), as well as users of other Coubonga products and services and visitors to the Coubonga.com (“Website”).
In this Privacy Policy, the term “Coubonga Services” refers collectively to the Website, the Coubonga app, and other services provided by Coubonga to its users. In this Privacy Policy, the terms “User” or “you” collectively refer to our customers and those of our group companies, Coubonga users, representatives, and other authorized users of our client organizations, as well as potential customers and users of Coubonga Services. Our Privacy Policy explains, for example, what types of personal data we process, how we process personal data, and how you can exercise your rights as a data subject (such as the right to object and the right of access).
Some of our services may also be subject to a separate privacy policy. If a specific service is subject to a separate privacy policy, we will publish it in connection with that service.
This Privacy Policy may be updated from time to time to reflect changes in our data processing practices or other changes. You can find the current version on our website. We will not make any significant changes to this Privacy Policy or reduce users’ rights under this Privacy Policy without notifying you.
1. DATA CONTROLLER(S)
This Privacy Policy applies to the processing of personal data by Coubonga. This Privacy Policy applies only to the processing of personal data in which Coubonga acts as the data controller.
Coubonga Oy has been designated to respond, on behalf of the local joint data controllers, to all requests and inquiries from data subjects regarding the processing of personal data by the Coubonga Group.
2. COUBONGA CONTACT INFORMATION
Coubonga, Inc.
Business ID: 3341721-6
Email address: info@coubonga.com
Data Protection Officer: Coubonga has appointed a Data Protection Officer, whom you can contact using the contact information above or by sending an email to info@coubonga.com.
3. PERSONAL DATA PROCESSED AND THEIR SOURCES
We process personal data only to the extent that it is necessary and appropriate for a specific processing purpose. The personal data we collect and process can be divided into two general categories: user data and usage data.
User Information
User data consists of personal information that is collected on a case-by-case basis either directly from you or from our client organization on whose behalf you use Coubonga’s services (“Client Organization”). We may collect user data from our Users and Client Organizations in a variety of ways, including after entering into a service agreement with a Client Organization or when Users register for the Coubonga service, subscribe to a newsletter, or fill out a form. Please also note that we collect information about the transactions and payments you make through the Coubonga services.
User information required to use Coubonga's services
The following personal data that we collect and process is necessary for the proper performance of the agreement between you and us, as well as for our legitimate interests, while fulfilling our contractual obligations to our client organizations and complying with our legal obligations.
When you sign up for the Coubonga service and create a user account, you must provide us with the following information:
full name
phone number
Email address
Location Information
Date of Birth
User information that you voluntarily provide to us when using Coubonga services
Gender
You can enhance your user or customer experience by providing us with the following information:
Additional account information:
photo, location,
when ordering age-restricted items: age, and other information you provide either when creating your user account or later when editing your account profile.
Other information. We may also process other information you voluntarily provide, such as:
Information related to orders you place on Coubonga or through Coubonga services (such as products purchased, special instructions, order date and time, total order amount, and other order history), information you provide when submitting reviews, comments, or responding to surveys, favorite merchants and other preferences, marketing consents and opt-outs, and information you provide over the phone, via email, or through chat correspondence with us, including call recordings of your conversations with our customer service team.
In addition to the user data collected from you and your Customer Organization, we process certain personal data provided about you by third-party service providers. For example, in the case of corporate customers, we may process the contact information of the company’s designated contact person to facilitate communication and marketing with the company, as well as to manage the customer relationship. Such information is primarily obtained from public sources, such as local business registries, companies that provide such information services, or directly from the companies themselves.
If your order includes products or services that may relate to health status or other sensitive personal data (belonging to special categories of personal data), Coubonga must process this information in order to provide you with Coubonga services. Coubonga follows specific safeguards applicable to the processing of such personal data in accordance with applicable laws and regulations. Where required by applicable laws, Coubonga will request separate consent for the processing of such personal data, and you may withdraw your consent at any time by contacting Coubonga Support at info@coubonga.com.
If you connect or log in to your account via Facebook, Facebook will share your personal information with us, such as your profile picture, a sample of your Facebook friends, and your Facebook ID. When Coubonga maintains its page on Facebook, both Coubonga and Facebook are joint controllers of your personal data in this regard. For more information about the processing of personal data on Facebook, please see Meta’s Privacy Policy.
Usage Data and Analytics
Usage data is generated through your interaction with Coubonga’s services. Although we generally do not use usage data to identify you as an individual, under certain circumstances you may be identified from it, either on its own or when combined with or linked to user data. In such situations, usage data may also be considered personal information under applicable laws, and we will treat such data as personal information.
We may automatically collect the following usage data when you visit or interact with Coubonga's services:
We use the Firebase Analytics service to collect and analyze analytics data. Firebase Analytics helps us understand how users interact with the Coubonga app and how we can improve the service. Firebase Analytics collects data such as app usage events, device information, app version, and estimated location data. This processing is based on our legitimate interest in developing and improving the service. We may also use other similar analytics tools.
Cookies and Other Technologies
We use various technologies, including cookies, website data storage, and web and app telemetry, to collect and store usage data and other information when Users visit Coubonga services.
Cookies and other website data stored on your device allow us to identify visitors to Coubonga’s services, make it easier to use Coubonga’s services, and compile aggregate data about our visitors. This helps us improve the Coubonga services and better serve our Users. Cookies and other website data do not harm your device or your files. We use cookies and other website data to customize the Coubonga services and the information we provide to match our Users’ individual interests. Please note that the retention period for different cookies is limited and varies from less than a minute to permanent, or until the individual cookie is deleted.
Users can choose to set their web browser to block cookies.
Please note that some features of the Coubonga service may not work properly if cookies are disabled.
Coubonga Services uses pseudonymized identifiers to track and predict the use and settings of your apps and services. Coubonga also uses session-based third-party tracking technologies to validate and report on events triggered by its advertising partners.
You can manage your cookie settings through the cookie banner on our websites.
Coubonga uses various third-party analytics and telemetry providers, marketing and business partners, and other services integrated into our customer software.
4. PURPOSES AND BASIS OF THE PROCESSING
We process personal data only to the extent that it is necessary and appropriate for specific processing purposes. Please note that one or more of the following processing purposes and legal bases may apply to the processing.
First, Coubonga processes your personal data to fulfill its contractual obligations to you or your client organization, for example, to the extent necessary:
Second, we may process your personal data if there is a legitimate and justified interest (i.e., a legitimate interest) in conducting, maintaining, and developing our business or in establishing and maintaining customer relationships. When we decide to process your data based on our legitimate interests, we balance our interests against your privacy and, for example, provide you with an easy way to opt out of our marketing communications and use pseudonymized or non-personally identifiable data whenever possible. You have the right to object to the processing of your personal data based on legitimate interests. However, Coubonga may override such an objection in accordance with applicable law, for example, if the processing is necessary for the establishment, exercise, or defense of legal claims.
We process your personal data to the extent necessary and based on a legitimate interest, for example:
When we process your personal data to provide you with the Coubonga service and for the other purposes mentioned above, we may use automated means of processing, which may also include automated decision-making.
In addition, we may process your personal data to manage and fulfill our legal obligations. This includes data processed to comply with our accounting obligations and to provide information to relevant authorities, such as tax authorities or law enforcement agencies, in accordance with mandatory legal obligations.
In some parts of the Coubonga services, you may be asked to provide your consent to the processing of your personal data. If the processing of your personal data is based on your consent, you may withdraw it at any time by contacting us or by changing the relevant consent setting, for example, in the Coubonga app.
Please note that certain technical analytics data may always be active, and the processing of such data is based on a legitimate interest in improving the service. You can manage your consent for marketing-related push notifications from the Coubonga app in the app’s settings.
5. TRANSFER TO COUNTRIES OUTSIDE EUROPE
Coubonga primarily stores your personal data within the European Economic Area. However, we may have service providers, operations, and group companies in various geographic regions. Consequently, we and our service providers may transfer your personal data to or process it in countries outside the European Economic Area or the User’s country of residence.
One of the services we use is Firebase Analytics, provided by Google LLC in the United States. This may mean that certain usage data, such as event identifiers related to app usage, may be transferred to countries outside Europe—such as the United States—to Google’s infrastructure. However, this data is not linked to any personally identifiable information, nor is it used for individual user profiling or third-party advertising. Google LLC is certified under the EU–U.S. Data Privacy Framework (DPF), which enables data transfers in compliance with the GDPR.
We take appropriate measures to ensure that Users’ personal data is adequately protected. We ensure appropriate and adequate protection for transfers of personal data to countries outside the European Economic Area through agreements with our service providers based on standard contractual clauses or other appropriate safeguards.
For more information about the transfer of personal data, please contact us at any of the addresses listed above.
6. RECIPIENTS OF THE DATA
We will share your personal data within the Coubonga organization only if and to the extent that it is reasonably necessary for the purposes of this Privacy Policy.
We do not share your personal information with third parties outside the Coubonga organization unless one of the following conditions is met:
For the purposes set forth in this Privacy Policy and to authorized service providers
To the extent that third parties (such as restaurants, merchants, or retailers that prepare your orders, our courier partners who deliver your order, and any customer organization that may pay for your order) need access to personal data so that we can provide Coubonga services or for other legitimate reasons, we will disclose your data to such third parties. For example, we may share your phone number with a Partner preparing your order if it is necessary, for instance, to ask you whether you accept a substitute product in your order, to notify you that an item is missing from your order, or to obtain specific clarifications in other circumstances.
In addition, we may share your personal information with our group companies or authorized service providers that perform services for us (including data storage, accounting, analytics, sales and marketing, and payment fraud prevention) so that they can process it on our behalf, and to payment service providers so that they can process payments you make to us.
When third parties process data on behalf of Coubonga, Coubonga has taken appropriate contractual and administrative measures to ensure that your data is processed solely for the purposes specified in this Privacy Policy and in accordance with all applicable laws and regulations, as well as in accordance with our guidelines and relevant confidentialityand security obligations.
Please keep in mind that if you provide personal data directly to a third party—for example, through a link on the Coubonga services—the processing of that data is typically governed by that third party’s policies and terms.
With partners to implement Coubonga services
To the extent that third parties need access to personal data in order for us to provide the Coubonga services, we will provide your data to such third parties.
Legal Matters and Legal Proceedings
We may share your personal information with third parties outside of Coubonga if we determine that access to and use of such personal information is reasonably necessary: (i) to comply with any applicable law, regulation, and/or court order; (ii) to detect, prevent, or otherwise address fraud, criminal activity, security issues, or technical problems; and/or (iii) to protect the interests, property, or safety of Coubonga, Users, or others, to the extent permitted by law. Where possible, we will notify you of such processing.
For other valid reasons
If Coubonga is involved in a merger, acquisition, or sale of assets, we may transfer your personal information to a third party. However, we will continue to ensure the confidentiality of all personal information. We will notify all affected users when personal information is transferred to another company in this manner or when a different privacy policy applies to it.
With your express consent
We may share your personal information with third parties outside of Coubonga with your consent. You have the right to withdraw this consent at any time, free of charge, by contacting us, for example.
7. SHELF LIFE
Coubonga does not retain your personal data for longer than is permitted by law and necessary to provide the Coubonga service or its essential components. The retention period depends on the nature of the data and the purposes of processing. The maximum retention period may therefore vary depending on the purpose of use.
Once a User has deleted their user account, personal data may be retained only for as long as required by law or as reasonably necessary to fulfill our legal obligations or legitimate interests, such as processing claims, accounting, internal reporting, and reconciliation. We regularly review our personal data retention periods to ensure that data is retained only for as long as necessary.
8. YOUR RIGHTS
Right of Access to Information
You have the right to access and obtain information about the personal data we process about you. You can view certain information directly through your Coubonga user account or request a copy of your personal data by contacting us.
The Right to Withdraw Consent
If the processing is based on the User’s consent, the User may withdraw their consent at any time free of charge. Withdrawing consent may result in a reduction in the availability of Coubonga services. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.
Right to Rectification
You have the right to have any inaccurate or incomplete personal data we have stored about you corrected or supplemented by contacting us. You can correct or update some of your personal data directly through your user account on the Coubonga services.
Right to Data Erasure
You may also ask us to delete your personal information from our systems. We will comply with such a request unless we have a legitimate reason not to delete the information.
The Right to Object to Data Processing
You may have the right to object to certain uses of your personal data if such data is processed for purposes other than providing the Coubonga service or complying with a legal obligation. If you object to the continued processing of your personal data, this may result in a reduction in the functionality of the Coubonga services.
The Right to Limit Proceedings
You may ask us to restrict the processing of your personal data, for example, when requests to delete, correct, or object to the processing of your data are pending and/or when we have no legal basis for processing your data. However, this may result in a reduction in your ability to use Coubonga’s services.
The right to transfer data from one system to another
You have the right to receive the personal data you have provided to us in a structured, commonly used format and to transfer that data independently to a third party.
How to Exercise Your Rights
You can exercise the rights mentioned above by contacting Coubonga Support or by sending us a letter or email to the addresses listed above, including the following information: full name, address, email address, and phone number. If you have a Coubonga account, we recommend that you contact us through Coubonga Support, as this will make it easier for us to identify you. We may ask you to provide additional information necessary to verify your identity. We may reject or charge a fee for requests that are unreasonably repetitive, excessive, or manifestly unfounded.
9. DIRECT MARKETING
You have the right to opt out of our use of your personal information for direct marketing purposes, market research, and profiling for direct marketing purposes by contacting us at the addresses listed above, using the features of the Coubonga service, or by using the opt-out option provided in direct marketing messages.
10. FILING AN APPEAL
If the User believes that our processing of personal data is in violation of applicable data protection laws, the User may file a complaint with the local data protection authority in Finland, the Data Protection Ombudsman (tietosuoja.fi). Alternatively, the User may file a complaint with another local and competent data protection supervisory authority.
11. INFORMATION SECURITY
We use administrative, organizational, technical, and physical security measures to protect the personal data we collect and process. These measures include, where necessary, encryption, pseudonymization, firewalls, secure facilities, and access control systems. Our security controls are designed to maintain the appropriate confidentiality, integrity, availability, resilience, and recoverability of data. We regularly test Coubonga’s services, systems, and other assets for security vulnerabilities. In addition, Coubonga employees’ access to personal data is restricted, and access to and processing of data is limited to what is necessary for the employee to perform their job duties.
