OlaClick

Privacy Policy

Version 8.0.0 — Last update: May 2026

Introduction

This Privacy Policy is published at: https://olaclick.com/en/privacy-policy/

We present this Privacy Policy ("Privacy Policy") to inform Users about how their Personal Data are processed by OLACLICK when using the OLACLICK Platform, a technological tool accessible through the website "https://www.OlaClick.com" ("OLACLICK Platform" or "Platform") that facilitates the connection between commercial establishments that offer and sell their products and services ("Partner Establishments") and the users that wish to request and acquire such products or services from the Partner Establishment through the use of the OLACLICK Platform ("Clients").

"OLACLICK", "OC" or "We" refers to OLACLICK TECHNOLOGIES CO., a company headquartered in the city of Delaware, United States, which provides its service to Partner Establishments and is in charge of the processing of personal data, by itself or through its Affiliates. In this sense, the processing of personal data for users in Brazil is executed by OLACLICK BRASIL TECNOLOGIAS LTDA, while the processing of personal data of the OlaClick mobile applications is carried out by OLA TECHNOLOGIES COMPANY S.A.C.

The Platform allows Partner Establishments to create and make available Digital Menus, in which they list the products and services offered and provide information on the description and price of each item. Through the Platform, the Customer may access the Digital Menu of a particular Partner Establishment and select all the items they wish to purchase. When finalising the order, the Platform will open a conversation window on the "WhatsApp" application directed to the contact number provided by the Partner Establishment as a pre-structured message suggestion containing the items selected by the Customer, the amount of each item, the total amount and the Customer's contact and delivery details (as specified in this Privacy Policy). If agreed, the Customer shall send the message to the Partner Establishment and finalise his order directly with the Partner Establishment.

As the User contacts us, registers, accesses, or uses the Platform or places orders, personal information about the User may be requested or collected. This Privacy Policy describes what types of personal data we may receive about you, directly or through your interaction with us, how we may use it, with whom we may share it, how we protect and keep it secure and what your rights are with respect to your Personal Data.

OLACLICK respects and cares for the privacy of Personal Data Holders, seeking to be transparent and provide clear information about its Personal Data Processing practices. We are committed to ensuring the confidentiality of your information. The processing of your personal information aims, above all, to provide a better and more personalized service, taking into account the specific conditions of each User. The more you interact with us, the more you inform us and the more we are able to offer you personalized services.

2. Definitions

Capitalised terms used in these Terms of Use shall have the meanings set out below:

  1. a) "Partner Establishment". A natural or legal person who registers on the OlaClick Platform in order to display, advertise, offer and market their products and/or services to Clients.
  2. b) "Digital Menu". Digital menu/card generated and made available by the Partner Establishment through the OlaClick Platform listing all products and services offered by the Partner Establishment, including information such as the description and price of each product/service.
  3. c) "Customer or Client". Any person, natural or legal, who, as a final recipient, accesses the Digital Menu generated and made available by the Partner Establishment through the OlaClick Platform, to request and purchase the products and/or services offered by the Partner Establishment.
  4. d) "Personal Data". Any information relating to an identified or identifiable natural person.
  5. e) "Genetic data". Personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question.
  6. f) "Biometric data". Personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.
  7. g) "Data concerning health". Personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.
  8. h) "Pseudonymisation". Processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
  9. i) "Data Protection Legislation". Any laws and regulations in relation to the processing, protection and privacy of Personal Data that are applicable and, if applicable, all guidelines, standards, rules, ordinances, regulations and codes of practice and conduct issued by the authorities of the state of Delaware. The Partner Establishment declares to know and comply with the Data Protection Legislation.
  10. j) "User". A capable natural person over the minimum legal capacity age who may or may not be accessing the Platform on behalf of a legal entity and who registers on the Platform to enjoy the functionalities offered therein by adhering to these Terms of Use and the Privacy Policy. Users may be Partner Establishments or Clients.
  11. k) "OlaClick Platform". A virtual platform accessible via the web (available at "https://www.OlaClick.com") by means of which the Partner Establishments can create Digital Menus in order to display, advertise, offer and market their products and services and Customers can request and purchase said products and services from the Partner Establishments.
  12. l) "Terms of Use". These are the General Terms and Conditions of Use of the OlaClick Platform that regulate the access and use of the OLACLICK Platform by the Partner Establishments (https://olaclick.com/en/general-terms-and-conditions-partner/) and by the Clients (https://olaclick.com/en/terms-and-conditions-of-use-platform/).
  13. m) "Holder". The natural person to whom the Personal Data subject to Processing refers.
  14. n) "Processing". Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  15. o) "Personal Data Breach". A breach of information security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed by OLACLICK or an authorized sub-contractor.
  16. p) "Consent". Freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
  17. q) "Affiliates". Any person, organization or company controlling, controlled by or under common control with one of the Parties.
  18. r) "Controller". The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by State law, the controller or the specific criteria for its nomination may be provided for by State law.
  19. s) "Independent Controllers". Two or more natural or legal persons with power of decision over the Processing of Personal Data, each Controller defining separately and independently the purposes and the mode of Processing, each being responsible for the Processing carried out within its sphere of action.
  20. t) "Operator". A natural or legal person who carries out the Processing of Personal Data on behalf of the Controller.
  21. u) "Cookies". Navigation files that temporarily store what the User is visiting in a certain website or application.

3. What Data Is Processed?

When using the Platform, Users must provide certain information in order to register, use the Platform and place orders. OLACLICK collects information provided to Us directly by the User and other information that is provided indirectly through the use of the OLACLICK Platform.

3.1. Information Users provide directly to us

3.1.1. Identification, registration and record data: this is the information that the User provides us when registering or placing an order through the OLACLICK Platform, including:

  1. 3.1.1.1. In the case of Partner Establishments: company name, trade name, telephone number, e-mail, address, opening hours, Digital Menu (including name, description, image and price of the items offered), link to social networks, logo, username and password, data of the partner establishment contact person (e.g. name, e-mail, telephone).
  2. 3.1.1.2. In the case of the Clients: full name, user name, password, e-mail, telephone number, address, ID and/or information of their orders, among others necessary for the execution and delivery of your order. OlaClick will not collect directly or by its own means payment information from customers.

If the User signs up or registers through integration with their Google or Facebook account, we will collect information such as your email address and username registered on your Google or Facebook account, as applicable.

Identification, Registration and Record Data are required to access the Platform and use our services and will be requested from the User. Without providing this information, it shall not be possible to place orders through the Platform.

3.2. User Generated Content

We also process User information when the User publishes content on the Platform (including the Digital Menu), interacts with other Users, communicates with us through the User service channels, or by means of comments, criticisms, compliments, user's text messages including the sender, recipients, and the content of the message, messages in general, information about what a user has searched for in the app, suggestions, feedback or testimonials sent by the User about the Platform or the products and services acquired from Partner Establishments, or when the User shares with us other information about him or herself or his or her experience on the Platform.

3.3. Information Users provide to us indirectly

  1. 3.3.1. Platform Usage Data: OLACLICK collects data derived from the User's use of the Platform each time they interact with the Platform. The Platform Usage Data is data of a technical or statistical nature related to the use of the Platform. The Platform Usage Data includes, but is not limited to, the type of products and services purchased or offered, Digital Menus viewed, Partner Establishments searched, Platform features used or pages visited, the manner in which the User interacts with the Platform, the features the User uses most, the content the User publishes, shares or interacts with, User preferences in general, and third-party sites or services the User has used prior to using the Platform.
  2. 3.3.2. Technical Data: OLACLICK stores the data of the device and systems that the User uses to access the Platform. These are: IP address that the User uses to connect to the Internet with their computer or mobile phone; information from your computer or mobile phone, such as your internet connection, network data, your browser type, version and operating system, Platform version, settings activated for your account, hardware models, identifier, type and other technical data of your device; and app info and performance — crash log data from the app, diagnostics, and information about the performance of the app.
  3. 3.3.3. User Source Derived Data: if the User arrives at the OLACLICK Platform through an external source (such as a link from another webpage or a social network), OLACLICK collects the data from the source from which the OLACLICK User became aware of and accessed the Platform.
  4. 3.3.4. Data Derived from Incident Management: if the User addresses the OLACLICK Platform through the OLACLICK contact form or telephone number, OLACLICK will collect the messages received in the format used by the User and may use and store them to manage present or future incidents.
  5. 3.3.5. Data Collected by means of "Cookies": OLACLICK uses Cookies and electronic device identifiers (such as SDKs, web beacons, among others) when the User uses the Platform. These technologies facilitate the User navigation and allow the statistical analysis of the Platform use and the offer or development of functionalities by OLACLICK, but may also allow the identification of devices, browsers and User profiles. OLACLICK may set or use third-party or proprietary Cookies and similar technologies to fulfil the purposes described in this Privacy Policy. Third-party Cookies and similar technologies are subject to their privacy policies, not OLACLICK's Privacy Policy.
  6. 3.3.6. Information Provided by Third Parties: If the User accesses the OLACLICK Platform through products and services offered by third parties or links conveyed in the pages of third parties, such as Google, these may send the navigation data of the User to OLACLICK. Such information may be associated with other information collected by OLACLICK or provided by the Users and used in the situations and for the purposes described in this Privacy Policy. In that event, only the information collected directly by OLACLICK about the User and the result of such combination is covered by and subject to this Privacy Policy. Information provided by external third parties may be controlled by the User in accordance with the external third party's privacy policy.
  7. 3.3.7. Geolocation Data: Depending on your app settings or device permissions, OLACLICK may collect information about your precise or approximate location based on GPS, IP address and Wi-Fi data. OLACLICK collects this information about your location when the Platform is running on your device in the foreground (app open and displayed on screen) or background (app open but not displayed on screen). The geolocation data is important for us to monitor the quality of the services and protect the User against frauds and security incidents as well as for purposes of legitimate interest of OLACLICK. The User may disable this function directly on his device if he does not agree with this Treatment of Personal Data.

3.4. Additional Provisions

  1. 3.4.1. Periodically, OLACLICK may request the updating of the Identification, Registration and Record Data.
  2. 3.4.2. The User is solely responsible for ensuring the accuracy, clarity, relevance and timely update of the information provided, according to the need. The User acknowledges and agrees that inaccuracy, imprecision or outdated information may impair or prevent the execution of orders through the Platform.
  3. 3.4.3. The User agrees to enter real and true data. Likewise, he/she shall be the sole responsible for damages that OLACLICK, any of its Affiliates, other Users or third parties may suffer as a result of inaccuracy, invalidity or inauthenticity of the data provided.
  4. 3.4.4. The User is jointly responsible for the confidentiality of his/her Personal Data. The sharing of access logins and passwords, and other Personal Data that enables access to their account on the Platform violates this Privacy Policy and our Terms of Use.
  5. 3.4.5. OLACLICK, in the provision of the Platform and other services and ancillary products, shall act as Controller of the Treatment of Personal Data. In relation to the Client Personal Data processed by the Partner Establishments or the Partner Establishments Personal Data processed by Clients for the offer, negotiation, request, hiring, acquisition and/or supply of products and services by the Partner Establishments to Clients, OLACLICK, the Partner Establishment and the Client shall be considered Independent Controllers of such Personal Data, assuming responsibility for the processing carried out by them using or outside the Platform.
  6. 3.4.6. While using the Platform, the User may use other services, channels, products and platforms provided, maintained and/or operated by third parties, used as channels or means to support the services provided by OLACLICK, but without any relationship with OLACLICK ("Third Party Services"). These Third Party Services may include, for example, payment platforms, communication and instant messaging applications, including but not limited to the "WhatsApp" platform, the downloading and registration of which is essential to the full use of the OLACLICK Platform features as specified in the Terms of Use, as well as third-party food delivery platforms (covered in detail in Annex 1 of this Privacy Policy). When OLACLICK services use such Third Party Services, the processing of Personal Data is also subject, in addition to this Privacy Policy, to the privacy policies and terms of use of such Third Party Services, over which OLACLICK has no control or interference.
  7. 3.4.7. OLACLICK will use a runtime permissions request whenever available, prior to accessing data gated by Android permissions.
  8. 3.4.8. OLACLICK limits the access, collection, use and sharing of personal and sensitive user data acquired through the app to app and service functionality and policy-conforming purposes set forth in this Privacy Policy.
  9. 3.4.9. OLACLICK does not extend usage of personal and sensitive user data for serving advertising purposes, other than those set forth in this Privacy Policy.

4. For What Purpose Is The Data Collected?

4.1. OLACLICK uses Users' Personal Data to provide the services requested by Users through the OLACLICK Platform and to enable Users to communicate with OLACLICK.

During the execution of an order placed by the User, his Personal Data may be used:

  1. By the Partner Establishment from which the Client has requested the purchase of products or services. In this case, OLACLICK and the Partner Establishment shall be considered Independent Controllers of such Personal Data, assuming responsibility for the Treatment performed by them.
  2. By the Client who has requested the purchase of products or services of the Business Establishment. In this case, OLACLICK and the Client shall be considered Independent Controllers of such Personal Data, assuming responsibility for the Treatment performed by them.
  3. By means of the OLACLICK Customer Service (direct or through third parties) in order to alert the User about possible incidents or other issues related to the Platform or the request made. Whenever demanded by the User or when it becomes aware of any technical problem on the Platform, OLACLICK may use the User data to identify, treat and correct the problem or to comply with other requests made by the User in relation to the Platform or services provided by OLACLICK.

OLACLICK may also use the Personal Data provided by the User, as well as share it with other Users in the event of contracting products and services through the Platform, to communicate with the User or allow Clients and Partner Establishments to communicate with each other via telephone, email, SMS, WhatsApp, Messenger, Instagram or any other messaging or social network platform about the operation of the Platform or an order placed. OLACLICK and the Partner Establishment may send messages to the User with information about the status of the requested order, summary of the order and its price, as well as offers, promotions, discount coupons or other communications for promotional or commercial purposes. For these purposes such third parties shall have an adequate standard of personal data protection.

OLACLICK also uses the information to generate aggregate and anonymous statistical analyses and reports on the functioning and operation of the Platform and the services provided through the Platform for OLACLICK's benefit, to conduct satisfaction surveys on the Platform and the services provided through the Platform, to investigate and analyse how to improve the services it offers to Users, as well as to develop and improve the features of the Platform and the services it offers to Users, to generate new products, business or market intelligence for OLACLICK. Internally, OLACLICK uses the information in an anonymized form for statistical purposes. This information may be shared with Affiliates, provided it is pseudonymized.

The above processing is necessary for the performance of the services that the User uses through the OLACLICK Platform. The execution of the contract concluded between OLACLICK and the User, as regulated by this Privacy Policy and the Terms of Use, is the basis that legitimizes OLACLICK to treat the Personal Data, by itself or by third parties.

4.2. OLACLICK uses the Users' Personal Data to ensure security and a suitable environment for the use of the Platform and safe provision of services. OLACLICK may also use your information in order to detect and investigate fraud, as well as other illegal activities and possible violations of this Privacy Policy, our Terms of Use and applicable laws.

The above-mentioned treatments are necessary to ensure the prevention of fraud and the security of the Holder and to meet the legitimate interest of OLACLICK. Additionally, Android has an ID to support essential use cases such as analytics and fraud prevention; therefore your data will be collected, used and transferred if necessary for this purpose, for which you grant your express consent by accepting this privacy policy.

4.3. OLACLICK uses third party technology integrated into its Platform to collect your Personal Data and preferences and use them with CRM (Client Relationship Management) systems and advanced technology for the benefit of OLACLICK, its Affiliates or other third parties. Similarly, OLACLICK and Partner Establishments may access and use Users' Personal Data for the following purposes:

  1. 4.3.1. Sending the Users emails and promotional messages and/or offers related to the service offered by OLACLICK or by the Partner Establishments and that may be of the User's interest. In case the OLACLICK User does not wish to receive the aforementioned information and/or commercial communications, he/she may, at any time, choose the option "Unsubscribe" in the email itself and, consequently, the sending of said information shall cease immediately.
  2. 4.3.2. Send messages and/or offers related with the services of OLACLICK or the Partner Sites to the User through push notifications which consist of sending such promotional messages and/or offers through messaging and instant communication applications (including, but not limited to WhatsApp) to his/her device.
  3. 4.3.3. Customize OLACLICK's app to show recommendations, new content or suggestions.

OLACLICK and/or the Partner Establishments may use the order delivery address entered by the User to perform promotional activities. The above treatments will be carried out on the basis of the express and specific consent provided by the User.

4.4. Additionally, OLACLICK may use the Personal Data of Users for the following purposes:

  1. 4.4.1. Creation of an access account on the Platform and User Identification to place orders.
  2. 4.4.2. Profile analysis and customization: OLACLICK may use the User Personal Data to analyse the User use of the Platform and his/her profile as a user, seeking to identify personal preferences, interests, reliability, behaviour, location, among others.
  3. 4.4.3. Charges and payments: Third parties may use the User data to process payments and perform charges related to the use of the Platform.
  4. 4.4.4. Compliance with legal or regulatory obligations: OLACLICK will process certain User Personal Data to comply with its legal and/or regulatory obligations.
  5. 4.4.5. Administrative, judicial, extrajudicial or arbitration defence of interests and rights of OLACLICK.
  6. 4.4.6. Genetic data, biometric data and data concerning health shall be processed based on the User's consent.
  7. 4.4.7. Other Processing. In relation to the other Data Processing performed by OLACLICK, these shall be based, as applicable in each case, on the following legal assumptions: for the execution of a contract or preliminary arrangements; for the fulfilment of legal or regulatory obligations; for the exercise and defence of rights and interests of OLACLICK; or based on a legitimate interest of OLACLICK; or yet, based on the Consent, when expressly requested by the Platform.

5. Does OLACLICK Share The Information It Collects?

5.1. For the proper development of the contractual relationship and excellence in providing the service, as well as for its legitimate interest, OLACLICK may share (using modern cryptography) certain Personal Data of the Users with:

  1. Other Users: the OLACLICK Platform facilitates the connection between Partner Establishments and Clients. In case a Client requests the acquisition of products or services of a certain Partner Establishment through the Platform, the Client's data shall be shared with said Partner Establishment for the sole purpose of making the transaction possible. Similarly, Personal Information of the Partner Establishment may be shared with the Client as may be necessary to facilitate the transaction.
  2. Service providers: any OLACLICK outsourced service providers shall have access to the Users' Personal Data necessary to perform their functions but may not use it for other purposes.
  3. The User may also receive emails from OLACLICK and/or the Partner Establishment to confirm the order, arrange a return, request the User's assessment of the order or receive an order summary.
  4. Private Security Companies and Public Authorities and Agencies: OLACLICK may disclose Personal Data of Users when it believes that such disclosure is necessary to comply with the law, to enforce or apply the Terms and Conditions or this Privacy Policy, or to protect the rights, property or safety of OLACLICK, its Users or third parties.
  5. If required by law, OLACLICK may share information with public agencies and authorities and/or third parties in connection with requests for information in connection with criminal investigations and alleged illegal activities.
  6. In order to provide services, certain Users' Personal Data may be transferred to OLACLICK Affiliates for contract performance purposes.
  7. Service providers for the pseudonymisation of some data.
  8. The Personal Data of Users are stored on Amazon Web Services, Inc.'s servers located in the United States of America.
  9. The Users' Personal Data will not be transmitted to third parties, except that (a) are necessary for the requested services, (b) when the User expressly requests or consents to the sharing, (c) when requested by a competent authority in the exercise of its functions or (d) if required by law.
  10. Equally, to third party commercial and non-commercial partners for use for (a) statistical purposes, provided that the data is pseudonymized and (b) to carry out commercial communications to Users.
  11. Integrated third-party food delivery platforms (Uber Eats, Rappi, iFood, DiDi Food, 99 Food, Glovo, PedidosYa, and other equivalent platforms) when the Partner Establishment activates the corresponding integration. Such sharing is governed by Annex 1 of this Privacy Policy.

5.2. Sharing with Treatment Operators. OLACLICK may contract with third parties to assist in the provision of its services, such as cloud storage servers and payment processing platforms. OLACLICK, as Controller of the Personal Data, shall require from such Operating partners adequate levels of security and confidentiality.

5.3. Sharing with Independent Controllers. In relation to the Personal Data of Clients that is Processed by the Partner Establishments or the Personal Data of the Partner Establishments that is Processed by Clients, OLACLICK, the Partner Establishment and the Client shall be considered Independent Controllers of such Personal Data.

5.4. Other Third Parties. In addition to the cases already mentioned, Personal Data may also be transferred to third parties in the following cases:

  1. New Business. There may be the transfer of Personal Data in the context of an acquisition, sale, merger, corporate reorganization or any other change of control of OLACLICK.
  2. Regular exercise of rights by administrative or judicial or extrajudicial means: law firms, consultants, collection companies, accounting firms.
  3. Judicial or Administrative Requests.
  4. Compliance with legal or regulatory obligations.
  5. With the User authorization.

5.5. OLACLICK shares User information as described to comply with a legal or regulatory obligation, to exercise OLACLICK's rights, to enforce a contract with the User and for OLACLICK's legitimate interest. Furthermore, OLACLICK will not publicly disclose any personal and sensitive user data related to financial or payment activities or any government identification numbers. OLACLICK does not sell personal and or sensitive user data under any circumstances.

5.6. OLACLICK may transfer to third parties for commercial purposes, information about the activity of the Platform, such as: (i) products searched, (ii) commercial name and product identifier viewed by the Customer, (iii) number of units added to the cart by the Customer, as well as the commercial name and product identifier, (iv) number of units, commercial name and identifier of products purchased by the Customer, and the monetary value of each product purchased, (v) Customer's email, for which a hash will be used. In the event that any personal data of the Customer is commercialized, the personal data will have been previously anonymized.

6. What Are The Users' Rights?

6.1. OLACLICK provides tools for Users to exercise their legal rights over the Personal Data they are Holders of:

  1. Confirmation of the existence of processing.
  2. Access to Personal Data.
  3. Correction of incomplete, inaccurate or outdated Data.
  4. Pseudonymisation, blocking or deletion of data that is unnecessary, excessive or processed in breach.
  5. Portability of Data to another service provider.
  6. Deletion of Personal Data processed based on consent.
  7. Sharing Information: Users may request information on which public and private entities OLACLICK has shared their Personal Data with.
  8. Information on the possibility of not consenting and its potential consequences.
  9. Revocation of consent previously provided.
  10. Right to object on grounds relating to his or her particular situation.

6.2. Exercise of Rights. The aforementioned rights may be exercised by the Data Subject directly through the Platform or by means of a request addressed to the email address [info@olaclick.com]. The requests shall contain, at least, the name of the Data Holder, the right to be exercised, details and specifications on the request, ID and the User's email address.

6.3. Consequences of deletion of data. The request for deletion of Personal Data shall imply the immediate deactivation of the User account on the Platform. After the exclusion, OLACLICK may continue to use them in a non-individualized and pseudonymized way.

6.4. Data Retention. OLACLICK may retain the Personal Data of certain Users for a period longer than the legal retention period in compliance with any orders from public authorities, to defend itself in judicial and/or administrative proceedings.

IN COMPLIANCE WITH APPLICABLE LAW OR COURT ORDER WHEN APPROPRIATE, OLACLICK MAY KEEP CERTAIN PERSONAL DATA ABOUT YOU STORED FOR A PERIOD OF NO LESS THAN SIX (6) MONTHS FOLLOWING YOUR REQUEST FOR DELETION. SUCH DATA WILL NOT BE PSEUDONYMIZED OR DESTROYED BY OLACLICK BEFORE THE EXPIRY OF THIS PERIOD. IN CASE THE USER REQUESTS THE DELETION OF HIS/HER INFORMATION BUT STILL HAS SOME PENDING OBLIGATION TO OLACLICK, THE INFORMATION WILL NOT BE DELETED AND WILL REMAIN STORED.

The failure to provide consent in the events set forth in this Privacy Policy may prevent OLACLICK from providing its services or that certain features of the Platform be used by the User.

7. How We Store Personal Data

7.1. Security. OLACLICK will do its best to keep the Personal Data secure at all times and will even take technical and administrative security and protection measures commensurate with the nature of the Personal Data collected, used, stored or otherwise Handled by OLACLICK in accordance with appropriate industry practice.

7.1.1. Exceptions. However, no method of transmitting or retaining electronic data is fully secure. BY CONSENTING TO THIS PRIVACY POLICY AND/OR BY USING THE PLATFORM, THE USER UNDERSTANDS AND EXPRESSLY ASSUMES THIS RISK AND AGREES THAT OLACLICK SHALL NOT BE LIABLE FOR SUCH LEAKAGE OR UNAUTHORIZED ACCESS TO PERSONAL DATA.

7.1.2. If a Security Breach occurs on the Platform, the Holder and the competent authority shall be notified, and OLACLICK will inform: (a) the nature of the personal data breach; (b) the name and contact details of the data protection officer; (c) the likely consequences of the personal data breach; (d) the measures taken or proposed; (e) information on the Holders concerned; and (f) the risks related to the incident.

The security measures described above apply to the User's Personal Data only from the moment OLACLICK receives them. The operation and security of the device the User uses to access the Platform, as well as third party networks are not the responsibility of OLACLICK.

7.2. International transfers. All information collected shall be stored with high security standards in servers owned by OLACLICK or third parties, including servers abroad.

CONSENT TO INTERNATIONAL TRANSFER OF PERSONAL DATA. OLACLICK MAY PROCESS YOUR PERSONAL DATA, INCLUDING STORAGE, ABROAD AND/OR SHARE IT WITH OLACLICK AFFILIATES PURSUANT TO THIS PRIVACY POLICY OR THIRD PARTIES. YOU AUTHORIZE OLACLICK, IN ACCORDANCE WITH THIS PRIVACY POLICY, TO TRANSFER, PROCESS, STORE AND USE YOUR PERSONAL DATA IN OTHER COUNTRIES.

7.3. Storage period. Personal Data shall be retained as long as necessary for the purposes listed in this Privacy Policy. Access Logs shall be stored for at least six (6) months, as required by law, or longer, if so requested by the Data Subject or determined by court order.

7.4. Deletion of Data. When we no longer need to use Personal Data, it will be removed from our systems and records or anonymized so that you can no longer be identified from that data.

LIMITATION OF LIABILITY. NOTHING CONTAINED IN THE PRIVACY POLICY IS INTENDED TO EXCLUDE OR LIMIT ANY CONDITION, WARRANTY, RIGHT OR LIABILITY THAT MAY NOT BE LAWFULLY EXCLUDED OR LIMITED. IN CASES WHERE EXCLUSION OF LIABILITY IS NOT POSSIBLE, BUT LIMITATION OF LIABILITY IS LEGALLY APPLICABLE, OLACLICK'S TOTAL LIABILITY SHALL BE LIMITED TO UP TO ONE THOUSAND DOLLARS.

8. The User's Responsibility To Protect Their Data

  1. 8.1. Although we keep the Personal Data confidential in accordance with the terms of this Privacy Policy, it will be the responsibility of each User to keep the login and password of access to your account secure and should not provide them to anyone.
  2. 8.2. In case the User believes that his/her login and password to access his/her account on the Platform have been unduly accessed by third parties, the User shall immediately communicate OLACLICK through the e-mail [info@olaclick.com], without prejudice to the immediate password change through the Platform by the User.

9. Cookies

9.1. OLACLICK uses Cookies and similar technologies, such as pixels and tags, to make sure that the services provided meet our quality standards. Cookies only collect statistics and will not be used for purposes other than those expressly provided for in this Privacy Policy.

9.2. What are Cookies and what are they used for? OLACLICK may use Cookies:

  1. Required: Cookies that make the use of the Platform possible and without which the Platform may not function properly. As such Cookies are necessary, they are used based on the execution of the contract between OLACLICK and the User.
  2. Functional: Cookies that activate additional functions or serve to enable access to certain specific sections of the Platform. The use of such Cookies is based on your consent.
  3. Performance: Cookies used to measure and improve the performance of a given webpage and specific content contained on the page.
  4. Social networks: The Platform uses social network plugins, which enable them to be accessed from the Platform. Each social network has its own privacy and Personal Data protection policy.

OLACLICK HAS NO CONTROL OR INTERFERENCE OVER THESE THIRD PARTY WEBSITES AND SHALL NOT BE RESPONSIBLE FOR THE CONTENT, PRACTICES AND SERVICES OFFERED BY ANY THIRD PARTY, NOR FOR THE TREATMENT GIVEN TO YOUR PERSONAL DATA BY THESE WEBSITES AND SOCIAL NETWORKS, EVEN WHEN LINKS ARE PRESENT ON THE OLACLICK PLATFORM.

9.3. Is it possible to limit the use of Cookies? Browsers generally allow the collection of Cookies to be disabled. The User may oppose such treatment by adjusting the settings of his browser to reject such Cookies.

10. OLACLICK Contact

In case of doubt, suggestion, complaint or clarification about this Privacy Policy or the Treatment of Personal Data by OLACLICK, or to request the exercise of any of the rights described in this Privacy Policy or the Data Protection Legislation, the User may contact OLACLICK by e-mail: [info@olaclick.com]. OLACLICK will be pleased to clarify any questions and/or meet your request.

11. Updates To The Privacy Policy

  1. 11.1. Due to the continuous evolution of OLACLICK's activities, this Privacy Policy and Terms of Use may be modified. OLACLICK will send the User notices about the changes and substantial modifications by e-mail, or any other means that ensures its receipt. The User should check this page and review this Privacy Policy periodically to ensure that you agree with the modifications.
  2. 11.2. Except when the express consent is mandatory, if the User continues using the Platform and/or does not object to the changes after the disclosure of the new version of the Privacy Policy, it shall be understood that the User is fully aware and agrees with the new terms. If the User does not agree with the changes, he/she shall refrain from using the Platform.

12. Acceptance Of The Privacy Policy

BY ACCEPTING THIS PRIVACY POLICY YOU DECLARE TO HAVE THE LEGAL CAPACITY, GIVING YOUR EXPRESS CONSENT TO THE TERMS CONTAINED THEREIN.

13. International Transfer Of Personal Data

In order to optimize the efficiency, performance and security of the Platform, OLACLICK uses a technical infrastructure on a global scale and has service providers abroad.

Certain Users' Personal Data may be transferred to OLACLICK Affiliates for contract performance purposes or third parties. Users are informed that by accessing, using or registering on the Platform from any country in which OLACLICK operates, their Personal Data will be stored in OLACLICK's database or of third parties, abroad.

Therefore, your Personal Data, including Genetic Data, Biometric Data and Data concerning health, may be transferred to other countries for data processing and storage in accordance with the terms and purposes set out in our Privacy Policy and for the provision of the services requested by the User.

OLACLICK may transfer your Personal Data to service providers, who will perform the Processing of Personal Data on OLACLICK's behalf and in accordance with our instructions.

Laws on privacy and protection of Personal Data vary from country to country. OLACLICK will make every effort to try to ensure the level of data protection set forth in the Privacy Policy in accordance with applicable laws.

The international transfer of Personal Data is a condition for the use of the Platform and services. If the User no longer agrees with the international transfer of Personal Data at any time, contact us by email [info@olaclick.com] to request the deletion of his/her information and uninstall all applications, platforms and services related to OLACLICK.

Annex 1 — Integration With Third-Party Food Delivery Platforms

This Annex forms an integral part of the OLACLICK Privacy Policy and applies whenever a Partner Establishment activates an integration with any of the third-party food delivery platforms listed below (each, a "Delivery Platform"):

  1. Uber Eats
  2. Rappi
  3. iFood
  4. DiDi Food
  5. 99 Food
  6. Glovo
  7. PedidosYa

and any other equivalent third-party delivery platform that OLACLICK may technically integrate in the future. This Annex prevails over the general provisions of the Privacy Policy only in respect of personal data received from such Delivery Platforms.

A1.1. Role and Scope

By virtue of the technical integration established between the OlaClick Platform and the relevant Delivery Platform, OLACLICK TECHNOLOGIES CO. may receive and process, in its capacity as data processor and for the benefit of the corresponding Partner Establishment, a limited set of personal data transmitted by said Delivery Platform.

A1.2. Categories of Data Processed

  1. (i) Information relating to orders placed by end consumers, including the unique order identifier, the items ordered with their respective descriptions, quantities, unit and total prices, as well as any special instructions provided by the consumer;
  2. (ii) Personal information of the end consumer strictly necessary for the execution and delivery of the order, limited to full name, delivery address, and contact telephone number;
  3. (iii) Information relating to the operational status and availability of the Partner Establishment's store on the Delivery Platform; and
  4. (iv) Technical identifiers of the store required for establishing and maintaining the connection between both platforms.

A1.3. Purposes of Processing

  1. (i) The receipt, processing and management of orders from the Delivery Platform through the administration panel of the OlaClick Platform;
  2. (ii) The viewing by the Partner Establishment of the status and operational availability of its store in real time; and
  3. (iii) The technical management of the connection and disconnection of the store with the integration.

A1.4. Prohibitions and Limitations

OLACLICK TECHNOLOGIES CO. is expressly prohibited from using the personal data of the end consumer obtained through this integration for direct marketing, personalized advertising, consumer profiling, or any other commercial or promotional purpose beyond fulfilling the order that prompted its processing.

OLACLICK TECHNOLOGIES CO. declares that it does not store, process, or access any payment data of the end consumer, which is managed exclusively by the corresponding Delivery Platform and its duly authorized payment processors.

OLACLICK TECHNOLOGIES CO. will under no circumstances share order information from a Partner Establishment with other Partner Establishments or unauthorized third parties, and expressly undertakes not to market, assign, rent, or transfer, whether for profit or free of charge, the personal data obtained through this integration.

A1.5. Retention Periods

Order data received through the integration will be retained by OLACLICK TECHNOLOGIES CO. for as long as the Partner Establishment maintains an active account on the Platform. Disconnection from the integration by the Partner Establishment will result in the immediate cessation of receiving new data, without prejudice to the retention of previously received data for the period necessary to comply with applicable contractual, tax, and legal obligations, or until the Partner Establishment expressly requests its deletion in accordance with the procedure established in this Policy.

A1.6. Security Measures

  1. (i) All communications between the OlaClick Platform and the application programming interface (API) of each Delivery Platform will be conducted using HTTPS/TLS encryption protocols, ensuring data protection against interception or unauthorized access during transmission;
  2. (ii) Access tokens and authentication credentials required for the integration will be stored in encrypted form using technical mechanisms that prevent their exposure in plain text; and
  3. (iii) Access to personal data obtained through the integration will be restricted exclusively to OLACLICK TECHNOLOGIES CO. personnel expressly authorized to perform their duties, as well as to the Platform's automated systems strictly necessary for its operation, with all access duly recorded and subject to the internal audit controls established by the Company.

A1.7. Cross-reference to Delivery Platform Policies

Data processing in the context of each integration is governed jointly by this Privacy Policy and by the privacy policy and terms of use of the corresponding Delivery Platform, over which OLACLICK has no control or interference. The Partner Establishment is responsible for reviewing and complying with the policies of each Delivery Platform it integrates with.

Annex 2 — OlaClick Riders Mobile Application

This Annex forms an integral part of the OLACLICK Privacy Policy and applies to the use of the OlaClick Riders mobile application by delivery riders associated with Partner Establishments. It prevails over the general provisions only in respect of this mobile application.

A2.1. Description and Controller

OlaClick Riders is the mobile application dedicated exclusively to delivery riders associated with the Partner Establishments of the OlaClick Platform. It is available on Google Play under the identifier com.olaclick.apprider and is operated by OLA TECHNOLOGIES COMPANY S.A.C. as Data Controller. This application is distinct from the OlaClick web panel for Partner Establishments.

A2.2. Data Collected

Through the rider's device, OlaClick Riders collects: precise (GPS) and approximate (network/Wi-Fi) location, including latitude, longitude, accuracy, timestamp and speed; identity and contact data (name, email, telephone) entered during registration; the Firebase Cloud Messaging push notification token; technical device information (model, operating system, app version, non-persistent identifier generated by Firebase Installations); and diagnostic and performance data generated by Firebase Crashlytics and Firebase Analytics.

A2.3. Purposes of Processing

  1. Assign orders located near the rider.
  2. Share the rider's position in real time with the restaurant and the customer during an active order.
  3. Calculate routes and estimated delivery times.
  4. Authenticate the rider, send operational notifications, ensure security and prevent fraud.

The legal basis is the performance of the contract with the rider and the legitimate interest in the provision of the delivery service; the sending of push notifications is based on consent.

A2.4. Background Location Collection

OlaClick Riders collects the rider's location also when the application is closed or not in use (background access), in a strictly delimited manner: collection starts only when the rider opens a shift or is assigned an active order; during that time, a foregroundServiceType="location" service keeps a persistent notification visible indicating that tracking is active, and collection automatically stops when the shift is closed or when there are no longer any assigned orders.

Before requesting the ACCESS_BACKGROUND_LOCATION permission, the app displays an integrated screen to the rider (in-app prominent disclosure) describing the data accessed, the functions that depend on it and the possibility of revoking consent at any time from the system settings; the rider must press "I accept and continue" before the system permissions dialog is invoked. If the rider revokes the permission, OlaClick Riders will not be able to assign new orders until it is restored.

A2.5. Recipients and Sharing

  1. The Partner Establishment of the active order (rider name and real-time position to coordinate delivery).
  2. The end customer of the active order (real-time position during delivery and rider name).
  3. Amazon Web Services, Inc. in the U.S. as infrastructure and storage provider.
  4. Google LLC through Firebase Authentication, Cloud Messaging, Crashlytics, Analytics and Installations services for authentication, notifications, aggregate analytics and fraud prevention.
  5. Radar Labs, Inc. in the U.S. for map style provision and geocoding.

OLACLICK does not sell rider personal data and does not share it with third parties for advertising purposes. International transfers to the U.S. and other jurisdictions where OLACLICK operates are carried out with standard contractual clauses and technical measures equivalent to those required by applicable legislation.

A2.6. Security Measures

Data transmitted by OlaClick Riders travels encrypted via HTTPS/TLS 1.2 or higher; authentication tokens are stored locally in the operating system's encrypted storage (Android Keystore) and traffic to real-time services is signed with symmetric cryptography before leaving the device.

A2.7. Permissions Not Used

OlaClick Riders does not access contacts, calendar, SMS, calls, microphone, camera, photos or the device application inventory. The application does not use the Android Advertising ID and the data collected is not used for advertising personalization or measurement.

A2.8. Exercise of Rights

To exercise any of the rights described in Section 6 of this Policy in relation to OlaClick Riders, the rider may write to info@olaclick.com indicating "OlaClick Riders" in the subject line.