Privacy Policy

This Policy explains what personal data we collect, why we collect it and what you can do about it. It covers the foodchain.pro website and the FoodChain service (the “Service”).

1. Who processes your data

The controller of personal data is private entrepreneur Mykyta Oleksandrovych Ulianov, taxpayer number (RNOKPP) 3544906795 (“FoodChain”, “we”).

Questions about data processing: support@foodchain.pro.

We process data in accordance with the Law of Ukraine “On Personal Data Protection” and, if you are located in the European Economic Area, also in accordance with the General Data Protection Regulation (GDPR).

2. What data we process

2.1. Data you provide yourself

• Demo or partner programme request: your name, phone number, and the page or button the request was sent from.
• Registration in the Service: the data we receive from Poster during authorisation — your user name, email address, the name and identifier of your venue, and the integration access token.
• Support enquiries: the content of your message and any contact details you leave in it.
• Payments: the amount, date and status of the payment. We neither receive nor store payment card details — those are handled by the payment provider.

2.2. Data that comes from your venue

To run the Service we process data from your accounting system: product lists, invoices, stock levels, sales, prices, and the contact details of suppliers and staff (name, phone, role). With respect to this data we act on the instructions of the venue — see section 5.

2.3. Data collected automatically

• IP address, device type, browser, language, and the source of the visit.
• Actions on the website and in the Service: page views, clicks, visit duration.
• Cookies and similar technologies — see section 4.

3. Why we process data, and on what legal basis

• Providing access to the Service and supporting users — performance of the public offer agreement.
• Handling demo, partnership and call-back requests — your consent and steps taken at your request prior to entering into a contract.
• Issuing invoices, accepting payments, accounting and tax record-keeping — performance of the contract and a legal obligation.
• Security, abuse prevention and error diagnostics — our legitimate interest in a stable and protected Service.
• Web analytics and measuring advertising performance — your consent.
• Service messages (changes to how things work, invoices, updates) — performance of the contract. Marketing mailings — consent, which you can withdraw at any time.

4. Cookies and analytics

Essential cookies keep the website and the Service working — authorisation, security, remembering your settings. The site will not work without them.

Analytics and advertising cookies are loaded through Google Tag Manager: Google Analytics 4 for visit and behaviour statistics, and Meta Pixel for measuring advertising performance. They may record your actions on the site and build anonymised audiences.

If you visit the site from the European Economic Area, the United Kingdom or Switzerland, analytics and advertising cookies are switched on only after you have given consent in the banner. You can change your choice at any time using the “Cookies” link at the bottom of the page.

Whatever your region, you can opt out of analytics and advertising cookies: change your browser settings, install the Google Analytics opt-out add-on, or adjust your ad preferences in Meta. Video on the site is embedded in no-tracking mode (youtube-nocookie).

5. When we act on a client's instructions

For data that reaches the Service from your accounting system (clause 2.2), your venue is the controller of personal data and FoodChain is the processor, handling it on the venue's instructions and only to the extent needed to provide the Service. We do not use this data for our own purposes and we do not sell it.

If you are an employee, supplier or customer of a venue and you wish to exercise your rights over such data, please contact the venue — we will help them fulfil your request.

6. Who we share data with

We do not sell personal data. The following categories of recipients may have access to it:

• Cloud infrastructure and hosting providers (servers in the European Union) — hosting and storing the Service's data.
• Cloudflare — site delivery and protection against attacks; processes IP addresses and technical request data.
• Google and Meta — web analytics and advertising performance measurement.
• Poster — data exchange within the integration you connected yourself.
• Payment provider — JSC “Universal Bank” (monobank), for accepting payments.
• Communication service providers — handling requests, supporting users, sending service messages.

7. International data transfers

Some of the services listed above are located outside Ukraine — in particular in the European Economic Area and the United States. For such transfers we rely on the EU Standard Contractual Clauses or other mechanisms provided for by law, and we require our partners to maintain an adequate level of data protection.

8. How long we keep data

Data	Retention period
Demo requests and partner programme requests	12 months from the date of the last communication
Account and venue data	For the duration of the subscription and 12 months after it ends
Documents supporting financial settlements	1,095 days — a requirement of Ukrainian tax law
Technical and security logs	Up to 90 days
Web analytics data	Up to 14 months — the Google Analytics setting
Support correspondence	24 months

Once the period ends, the data is deleted or anonymised. If a dispute is ongoing, or there is a legal obligation to keep the data longer, the period is extended until that is resolved.

9. How we protect data

We use encryption of the communication channel (TLS), encrypted storage of access tokens, access rights granted on a least-privilege basis, backups and action logging. Only those people who need data for their work have access to it.

No method of transmitting or storing data is completely secure. If an incident occurs that threatens your rights, we will notify you and the competent authorities within the time limits set by law.

10. Your rights

• to know what data of yours we process, and to receive a copy of it;
• to request correction of inaccurate or incomplete data;
• to request deletion of data;
• to request restriction of processing;
• to object to processing based on legitimate interest and to marketing communications;
• to receive your data in a structured format and transfer it to another party;
• to withdraw consent at any time — this does not affect the lawfulness of processing carried out before the withdrawal;
• to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or, if you are in the EEA, with the supervisory authority where you live.

To exercise your rights, write to support@foodchain.pro. We will respond within 30 days, and we may ask you to confirm your identity so that we do not hand your data to someone else.

11. Automated decision-making

The Service produces purchasing recommendations based on your sales and stock levels. These recommendations are advisory — the decision is always made by the user, and they produce no legal consequences for individuals.

12. Children

The Service is intended for business use and is not aimed at anyone under 18. We do not knowingly collect children's data. If such data has reached us by mistake, let us know and we will delete it.

13. Changes to this Policy

The current version is always published on this page, with the update date shown at the top. We will notify you of material changes by email or within the Service at least 10 days before they take effect.

14. Contacts

Private entrepreneur Mykyta Oleksandrovych Ulianov, RNOKPP 3544906795
support@foodchain.pro
Public offer agreement