Privacy Policy

Welcome to Zupas ("Company," "we," "us," or "our"). We operate the website zupasgo.click and provide food-related products and services to our valued customers across the United States. We are deeply committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, place orders, or otherwise interact with us.

Please read this Privacy Policy carefully. If you disagree with its terms, please discontinue use of our website and services immediately. By accessing or using zupasgo.click, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy.

This Privacy Policy applies to all information collected through our website (zupasgo.click), as well as any related services, sales, marketing, or events.

1. Who We Are

Zupas is a food business operating in the United States. We provide customers with convenient access to food ordering, meal services, and related culinary experiences. As a data controller, we are responsible for determining how and why your personal data is processed.

2. Information We Collect

We collect various types of information in connection with the services we offer. The categories of personal information we collect include the following:

2.1 Personal Information You Provide Directly

When you register an account, place an order, contact us, or otherwise interact with our website, you may voluntarily provide us with personal information, including but not limited to:

• Identification Information: Full name, username, and profile picture.
• Contact Information: Email address, phone number, and mailing address (including delivery address).
• Account Credentials: Username, password, and security questions.
• Payment Information: Credit or debit card details, billing address, and other financial information necessary to process transactions. Note that full payment card details are processed by our secure third-party payment processors and are not stored on our servers.
• Order Information: Details about food items ordered, special dietary requirements, allergies, and delivery preferences.
• Communications: Content of messages you send us via email, contact forms, or customer support channels, including feedback, complaints, and inquiries.
• Promotional Participation Data: Information you provide when participating in surveys, contests, loyalty programs, or promotional campaigns.

2.2 Information Collected Automatically

When you access and use our website, we automatically collect certain information about your device and browsing behavior, including:

• Usage Data: Pages you visit, features you use, links you click, time spent on pages, and the referring URL.
• Device Information: IP address, browser type and version, operating system, device identifiers, screen resolution, and language settings.
• Log Data: Server log files that record your interactions with our website, including timestamps, error logs, and access records.
• Location Data: General geographic location derived from your IP address. If you grant permission, we may collect more precise location data via your device's GPS to facilitate delivery services.
• Cookies and Similar Technologies: We use cookies, web beacons, pixel tags, and similar tracking technologies to collect information about your browsing activity. Please see Section 8 of this Policy for more details.

2.3 Information from Third Parties

We may receive information about you from third parties, such as:

• Social media platforms when you connect your account or log in using social authentication (e.g., Facebook, Google).
• Delivery partners and logistics providers who share order status and delivery updates.
• Marketing partners and analytics providers who share aggregated or anonymized insights.
• Payment processors who confirm transaction status.
• Public sources and commercially available databases for identity verification purposes.

3. How We Use Your Information

We use the information we collect for a variety of legitimate business purposes. Specifically, we may use your personal information to:

3.1 Service Provision and Order Fulfillment

• Create and manage your account on our platform.
• Process and fulfill your food orders, including coordinating delivery.
• Send order confirmations, receipts, invoices, and delivery notifications.
• Respond to your inquiries, comments, feedback, and support requests.
• Manage your dietary preferences and allergen information for appropriate meal customization.
• Process payments and prevent fraudulent transactions.

3.2 Analytics and Service Improvement

• Monitor and analyze usage trends, traffic patterns, and user behavior to improve our website and services.
• Conduct internal research and development to enhance our food offerings and user experience.
• Perform quality assurance and testing of new features.
• Measure the effectiveness of our promotions and marketing campaigns.
• Generate aggregated, anonymized reports for business intelligence purposes.

3.3 Marketing and Communications

• Send you promotional emails, newsletters, special offers, and marketing communications about our food products and services, where you have consented or where we have a legitimate interest.
• Personalize your experience by delivering relevant content, product recommendations, and targeted advertisements based on your preferences and order history.
• Notify you about loyalty program rewards, points balances, and exclusive member benefits.
• Conduct surveys and collect feedback to improve our services.

You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email or by contacting us at [email protected].

3.4 Legal Compliance and Safety

• Comply with applicable laws, regulations, and legal obligations in the United States, including federal and state requirements.
• Enforce our Terms of Service and other agreements.
• Detect, investigate, and prevent fraud, abuse, security incidents, and other harmful or illegal activities.
• Protect the rights, property, and safety of Zupas, our customers, and the general public.
• Respond to lawful requests from law enforcement agencies and regulatory authorities.

4. Legal Bases for Processing

As a business operating in the United States, we process your personal data in accordance with applicable U.S. federal and state laws, including the Federal Trade Commission Act (FTC Act), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) for California residents, and other applicable state privacy laws.

Our legal bases for processing your personal information include:

• Contractual Necessity: Processing necessary to fulfill orders and provide services you request.
• Consent: Where you have given us explicit consent to process your data for specific purposes (e.g., marketing communications, precise location tracking).
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our services, preventing fraud, and maintaining the security of our platform.
• Legal Obligation: Processing required to comply with applicable laws and regulatory requirements.

5. Sharing Your Information with Third Parties

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. However, we may share your information in the following circumstances:

5.1 Service Providers and Business Partners

We share your personal information with trusted third-party service providers who assist us in operating our business and delivering our services. These providers are contractually obligated to maintain the confidentiality and security of your information and may only use it for the specific purposes for which it was disclosed. Categories of service providers include:

• Payment Processors: To securely handle credit/debit card transactions and billing (e.g., Stripe, PayPal, Square).
• Delivery and Logistics Partners: To coordinate and fulfill food delivery orders.
• Cloud Hosting Providers: To host our website infrastructure and data securely.
• Analytics Providers: To help us understand website traffic and user behavior (e.g., Google Analytics).
• Email and Communication Platforms: To send transactional and marketing emails on our behalf.
• Customer Support Tools: To manage and respond to customer inquiries efficiently.
• Marketing and Advertising Partners: To deliver targeted advertisements and measure campaign effectiveness.

5.2 Legal Requirements and Law Enforcement

We may disclose your personal information when required to do so by law or in response to valid legal processes, including subpoenas, court orders, government investigations, or requests from law enforcement agencies. We may also disclose information when we believe in good faith that disclosure is necessary to:

• Comply with applicable federal, state, or local laws.
• Protect the rights, property, or safety of Zupas, our customers, or the public.
• Prevent or investigate potential fraud or illegal activities.

5.3 Business Transfers

In the event of a merger, acquisition, asset sale, corporate reorganization, bankruptcy, or similar business transaction, your personal information may be transferred to the acquiring entity or successor in interest. We will provide notice before your information becomes subject to a different privacy policy.

5.4 With Your Consent

We may share your information with third parties in any other circumstances where you have provided your explicit consent for such sharing.

5.5 Aggregated or De-Identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you with third parties for research, analytics, marketing, or other business purposes.

6. Data Security

We take the security of your personal information very seriously. We implement a variety of industry-standard technical, administrative, and physical security measures designed to protect your personal data from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption: We use Secure Socket Layer (SSL) / Transport Layer Security (TLS) technology to encrypt data transmitted between your browser and our servers. Data stored in our systems is encrypted at rest using industry-standard encryption protocols.
• Access Controls: Access to personal information is restricted to authorized personnel on a need-to-know basis. All staff with access to personal data are trained in data protection best practices.
• Secure Payment Processing: Payment card data is processed through PCI-DSS compliant third-party payment processors. We do not store full payment card numbers on our systems.
• Firewalls and Intrusion Detection: We deploy firewalls, intrusion detection systems, and security monitoring tools to protect our network infrastructure.
• Regular Security Audits: We conduct periodic security assessments, vulnerability scans, and penetration testing to identify and remediate potential security risks.
• Incident Response: We have a documented data breach response plan to promptly identify, contain, and address any security incidents, and to notify affected individuals and relevant authorities as required by law.

7. Your Privacy Rights

Depending on your state of residence, you may have specific rights regarding your personal information. We are committed to honoring these rights in accordance with applicable U.S. privacy laws.

7.1 Rights for California Residents (CCPA/CPRA)

If you are a resident of California, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights:

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties with whom we share information.
• Right to Delete: You have the right to request deletion of personal information we have collected, subject to certain legal exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. We do not sell personal information for monetary consideration, but we may share data with advertising partners. You may opt out by contacting us.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit our use and disclosure of sensitive personal information to necessary purposes.
• Right to Non-Discrimination: You have the right not to be discriminated against for exercising your CCPA/CPRA rights.
• Right to Data Portability: You may request a copy of your personal information in a portable, machine-readable format.

To exercise your California privacy rights, submit a verifiable consumer request by emailing us at [email protected]. We will respond within 45 days as required by law, with a possible 45-day extension where reasonably necessary.

7.2 Rights for Residents of Other States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with applicable privacy laws may also have rights including access, correction, deletion, portability, and the right to opt out of targeted advertising. To exercise these rights, please contact us at [email protected].

7.3 General Rights (All Users)

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Correction: Request correction of inaccurate or outdated information.
• Right to Deletion: Request deletion of your personal data, subject to applicable legal exceptions.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.
• Right to Opt-Out of Marketing: Unsubscribe from marketing communications at any time.

To exercise any of these rights, please contact our Privacy Team at: [email protected]. We may need to verify your identity before processing your request to protect your privacy and security.

8. Cookie Policy

We use cookies and similar tracking technologies on zupasgo.click to enhance your browsing experience, analyze website traffic, and deliver personalized content and advertising.

8.1 Types of Cookies We Use

You can control cookies through your browser settings. Most browsers allow you to refuse cookies or delete them from your device. However, disabling certain cookies may affect the functionality of our website. For more detailed information about our cookie practices, please refer to our full Cookie Policy available on our website.

9. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected and to comply with our legal obligations. Our standard data retention periods are as follows:

When your personal information is no longer required, we securely delete or anonymize it in accordance with our data disposal procedures.

10. Children's Privacy

Zupas does not knowingly collect, solicit, or process personal information from individuals under the age of 18. Our food ordering services are designed for adults, and we require users to confirm their age during account registration.

If we discover that we have inadvertently collected personal information from a child under 18 without verifiable parental consent, we will take immediate steps to delete that information from our systems. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected] so we can take appropriate action.

We comply with the Children's Online Privacy Protection Act (COPPA) and do not knowingly market to children or allow minors to use our services without parental consent where required by law.

11. International Data Transfers

Zupas is based in the United States, and your personal information is primarily collected, processed, and stored within the United States. However, some of our third-party service providers may be located in, or operate servers in, other countries. In such cases, your personal data may be transferred to and processed in countries outside the United States.

When we transfer personal information internationally, we take steps to ensure that such transfers comply with applicable data protection laws and that adequate safeguards are in place to protect your information. These safeguards may include:

• Entering into data processing agreements with third-party processors that include standard contractual clauses or other approved mechanisms.
• Ensuring that recipient countries have adequate data protection laws recognized by applicable standards.
• Implementing additional technical and organizational security measures for cross-border data transfers.

By using our services, you acknowledge and consent to the transfer, processing, and storage of your personal information in the United States and other countries as described in this Privacy Policy.

12. Third-Party Websites and Links

Our website may contain links to third-party websites, services, or platforms that are not owned or controlled by Zupas. This Privacy Policy applies only to our website (zupasgo.click) and does not extend to any third-party sites.

We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites. We strongly encourage you to review the privacy policies of any third-party sites you visit. The inclusion of a link to a third-party website does not imply our endorsement of that website or its privacy practices.

13. Do Not Track Signals

Some web browsers have a "Do Not Track" (DNT) feature that signals to websites that you do not want your online activities tracked. Currently, there is no universally accepted standard for how websites should respond to DNT signals. At this time, our website does not respond to DNT browser signals. However, you can manage your tracking preferences through our cookie consent tools and by adjusting your browser settings.

Residents of certain states, such as California, have additional rights under laws like the California Online Privacy Protection Act (CalOPPA) and the CCPA/CPRA regarding online tracking and opt-out rights for targeted advertising.

14. How to File a Privacy Complaint

If you believe that we have not handled your personal information in accordance with this Privacy Policy or applicable privacy laws, we encourage you to contact us first so we can try to resolve your concern directly.

14.1 Contact Zupas Directly

You may submit a privacy complaint or inquiry by contacting our Privacy Team:

We will acknowledge receipt of your complaint within 5 business days and aim to resolve it within 30 business days.

14.2 Regulatory Authorities

If you are a resident of the United States and are dissatisfied with our response, you may file a complaint with the following authorities:

• Federal Trade Commission (FTC): The FTC enforces federal consumer protection laws, including privacy-related protections under the FTC Act.
  Website: www.ftc.gov
  Phone: 1-877-FTC-HELP (1-877-382-4357)
• California Privacy Protection Agency (CPPA) — California Residents Only: The CPPA is responsible for enforcing the CCPA/CPRA in California.
  Website: cppa.ca.gov
• State Attorney General: Residents of all U.S. states may also file complaints with their respective State Attorney General's office, which may have authority to investigate privacy violations under state consumer protection laws.

15. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our business practices, applicable laws, or technology. When we make material changes, we will update the "Last Updated" date at the top of this page and may notify you via email or a prominent notice on our website.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of zupasgo.click following the posting of any changes constitutes your acceptance of the updated Privacy Policy.

16. Governing Law

This Privacy Policy and any disputes arising from or related to it shall be governed by and construed in accordance with the laws of the United States and the applicable laws of the state in which you reside, without regard to conflict of law principles. Where applicable, California law (including the CCPA/CPRA) and federal law (including the FTC Act) shall apply.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please do not hesitate to contact us using the information below. We are committed to addressing your privacy concerns in a timely and thorough manner.