Privacy Policy

Kuppio Order — Last updated: February 5, 2026

1. Data Controller

The data controller responsible for your personal data is:

IT-MT Development Solutions DOO Pančevo
Moše Pijade 50, 26000 Pančevo, Serbia
Email: legal@kuppio.com

This Privacy Policy explains how we collect, use, and protect your personal data when you use the Kuppio Order application ("App"). We process personal data in compliance with the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti — "ZZPLP"), which is modeled on the EU General Data Protection Regulation (GDPR).

2. Data We Collect

We collect the following categories of personal data:

Category	Data Collected	Purpose
Identity Data	Full name, email address, phone number, country	Account creation, authentication, communication
Device Data	Device model, operating system, app version, push notification tokens	App functionality, push notifications, troubleshooting
Location Data	Saved delivery addresses, GPS location (when permitted)	Delivery services, nearby restaurant discovery
Transaction Data	Order history, payment method type, transaction amounts	Order processing, payment handling, support
Behavioral Data	Ratings, reviews, feedback	Service quality improvement, restaurant feedback
Rewards Data	Loyalty points balance, reward tier level, redemption history	Loyalty program operation
Preference Data	Notification preferences, language preference	Personalized experience, communication preferences

We do not store full payment card numbers, CVVs, or banking credentials. All payment processing is handled securely by our third-party payment processors (see Section 5).

3. Legal Basis for Processing

We process your personal data on the following legal grounds under the ZZPLP:

Contract Performance (Article 12(1)(2)): Processing necessary to fulfill your orders and provide our services.
Consent (Article 12(1)(1)): For location services, push notifications, and marketing communications. You may withdraw consent at any time.
Legitimate Interest (Article 12(1)(6)): For fraud prevention, service improvement, and analytics.
Legal Obligation (Article 12(1)(3)): Where required by Serbian tax, consumer protection, or other applicable law.

4. How We Use Your Data

To create and manage your account
To process and deliver your orders
To handle payments securely through our payment processors
To operate our rewards and loyalty program
To send order status notifications (confirmation, preparation, delivery)
To provide real-time order tracking
To facilitate table sessions for dine-in orders
To enable you to rate and review orders and restaurants
To respond to your inquiries and provide customer support
To improve our App and services
To prevent fraud and ensure security
To comply with legal obligations

5. Third-Party Service Providers

We share personal data with the following third-party service providers, solely for the purposes described:

Provider	Purpose	Data Shared
Google Firebase / FCM	Push notifications (Android)	Device tokens, notification content
Apple Push Notification Service (APNs)	Push notifications (iOS)	Device tokens, notification content
Stripe	Online payment processing	Payment details, transaction amounts
Local Serbian payment processors	Local payment methods	Payment details, transaction amounts
Amazon Web Services (AWS SES)	Transactional email delivery	Email address, email content

All third-party providers are contractually bound to process data only as instructed and to maintain appropriate security measures.

6. Data Retention

We retain your personal data for as long as your account is active and as needed to provide our services. Specific retention periods:

Account data: Until account deletion, plus up to 30 days for backup removal.
Transaction data: Up to 5 years after the transaction, as required by Serbian tax and commercial law.
Rewards data: Until account deletion or program termination.
Device tokens: Until the token is invalidated or the account is deleted.
Behavioral data (ratings/reviews): Retained as long as the content remains published; anonymized upon account deletion.

After the retention period, data is securely deleted or anonymized.

7. Data Security

We implement appropriate technical and organizational security measures, including:

Encryption of data in transit (TLS/SSL) and at rest
Secure authentication mechanisms
Role-based access controls for internal systems
Regular security assessments
Database backups with restricted access

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We encourage you to use a strong password and keep your account credentials confidential.

8. International Data Transfers

Some of our third-party service providers (e.g., Firebase, AWS, Stripe) may process data outside of Serbia, including in the United States and the European Union. Where such transfers occur, we ensure appropriate safeguards are in place, such as:

Standard contractual clauses approved by the relevant authorities
Adequacy decisions recognized under Serbian law
Provider certifications and compliance frameworks

9. Your Rights Under ZZPLP

Under the Serbian Law on Personal Data Protection, you have the following rights:

Right of Access: Request confirmation of whether we process your data and obtain a copy.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your personal data (subject to legal retention requirements).
Right to Restriction: Request restriction of processing in certain circumstances.
Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format.
Right to Object: Object to processing based on legitimate interest, including profiling.
Right to Withdraw Consent: Withdraw consent at any time, without affecting the lawfulness of prior processing.

10. How to Exercise Your Rights

To exercise any of your rights, please contact us at legal@kuppio.com. We will respond to your request within 30 days.

If you believe that we have not adequately addressed your request, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti):

Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia
Website: www.poverenik.rs

11. Children's Privacy

Kuppio Order is not intended for use by individuals under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete such data promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at legal@kuppio.com.

12. Cookies & Tracking Technologies

The Kuppio Order mobile application does not use browser cookies. However, we may use the following technologies:

Local storage: To store your preferences, session data, and cart contents on your device.
Push notification tokens: To deliver push notifications to your device.
Analytics identifiers: To understand app usage patterns and improve our services.

When using our web-based services, standard cookies may be used for session management and functionality.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the App or by email. The "Last updated" date at the top of this policy indicates when it was last revised. Continued use of the App after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

IT-MT Development Solutions DOO Pančevo
Moše Pijade 50, 26000 Pančevo, Serbia
Email: legal@kuppio.com