Õigusinfo

Personal data protection and privacy policy

Contents

In force from: 01.09.2026

This privacy policy explains how Smartfood Express OÜ (hereinafter “SmartFOOD” or “we”) processes personal data when a person uses the SmartFOOD website, places an order, uses a customer account, contacts customer service or otherwise communicates with us.

The purpose of this privacy policy is to give a clear overview of which personal data we process, why we process it, on what legal basis, to whom we may disclose it, how long we retain it and what rights a person has in relation to their data.

1. Controller

The controller of the personal data is:

Smartfood Express OÜ
Email: info@smartfood.ee
Phone: +372 505 2801

For questions relating to the processing of personal data or to exercising your rights, please contact us at the address above.

2. Whose data we process

We may process the data of the following people in particular:

SmartFOOD customers and users of a customer account;
visitors to the SmartFOOD website;
people who send us an enquiry, contact customer service or give feedback;
people who have subscribed to the newsletter;
participants in campaigns, applications or other SmartFOOD activities.

3. Which personal data we process

Contact and customer data

Name, email address, telephone number, delivery address, customer account details and other information the Customer submits when ordering or when communicating with us.

Order and service usage data

The chosen package, calorie level, order period, delivery days, pause days, choice of delivery time and address, dietary options, additional selections, order history and other data relating to the fulfilment of the order.

Payment data

We process transaction information relating to payment for an order to the extent necessary to identify the payment, fulfil the order, keep accounts and, where relevant, make refunds. Full bank card details are processed by the payment service provider and are not stored by SmartFOOD.

Website usage and technical data

Depending on your cookie choices, we may receive information about use of the website, for example IP address, device and browser information, pages visited, time spent and other similar technical data.

Marketing data

Where a person has subscribed to the newsletter or given other relevant marketing consent, we process their contact details and marketing-related usage data in order to send offers and information.

SmartFOOD does not ask for diagnoses or other health data in order to place an ordinary order. If a person sends us information on their own initiative about an allergy, an intolerance, a state of health or another health-related restriction, such information may be a special category of personal data. We process such information only to the extent necessary to assess the dietary option the person has requested or the suitability of the service, and, where relevant, on the basis of the person’s explicit consent.

4. Why and on what legal basis we process data

Purpose	Legal basis	Data
Placing and fulfilling an order	Entry into and performance of a contract	Order, contact, delivery and customer data
Managing the customer account and showing order history	Performance of a contract and SmartFOOD’s legitimate interest in ensuring the service works	Account and order data
Accepting payments and making refunds	Performance of a contract and compliance with legal obligations	Payment and order data
Accounting and retention of mandatory documents	Compliance with a legal obligation	Invoice, payment and order data
Customer service, answering enquiries and complaints	Performance of a contract or SmartFOOD’s legitimate interest in customer communication and in resolving possible claims	Contact, order and communication data
Technical functioning and security of the website	SmartFOOD’s legitimate interest and, for strictly necessary technologies, the need to provide the service	Technical and security data
Use of Google Analytics	Consent	Website usage and analytics data
Use of Meta Pixel and other marketing tracking	Consent	Website usage, advertising and device data
Sending newsletters and marketing offers	Consent or, where otherwise permitted by law, the relevant legal basis	Name, email and marketing-related usage data
Establishing, exercising or defending possible legal claims	SmartFOOD’s legitimate interest	Relevant customer, order, payment and communication data

Where processing is based on consent, a person has the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

5. How we collect personal data

We receive personal data primarily:

directly from the person, through an order, a customer account, a contact form, email, telephone or other communication;
in the course of using the SmartFOOD service, for example from the history of orders and payments;
through cookies and similar technologies when the website is used, in accordance with the cookie choices the person has made;
from the payment service provider, to the extent necessary to confirm the status of a payment and the transaction.

6. Cookies, Google Analytics and Meta Pixel

The SmartFOOD website uses cookies necessary for the website to function and, with the user’s consent, analytical and marketing cookies or similar technologies.

Strictly necessary cookies enable the core functions of the website and the ordering process, and consent is not asked for their use where they are indispensable for the service to work.

Google Analytics is used to analyse use of the website and to develop the service. Meta Pixel is used to measure the performance of advertising, to create audiences and to tailor SmartFOOD’s marketing better. These technologies are activated only after the user’s consent has been obtained.

The user can accept or refuse analytical and marketing cookies through the cookie banner and can change that choice later. Withdrawing consent must be as easy as giving it.

More detailed information about the cookies used, their service providers, purposes and lifetime is shown in SmartFOOD’s cookie settings or in separate cookie information. The list of cookies must be kept consistent with the technologies actually used on the website.

7. Newsletters and direct marketing

SmartFOOD may send newsletters, offers and other marketing information to people for whom there is a valid legal basis for doing so. Where marketing is based on consent, giving consent is voluntary and is not a precondition for placing a SmartFOOD order.

You can opt out of marketing messages at any time through the unsubscribe link in the newsletter or by writing to info@smartfood.ee. After you opt out we stop using that contact detail for direct marketing, unless there is another legal basis for retaining the data.

8. To whom we may disclose personal data

SmartFOOD does not sell personal data. In order to provide the service, we may give access to personal data or transfer it to service providers only to the extent necessary.

AS LHV Pank and entities involved in providing the LHV payment solution – for processing payments, including for the use of the LinkPay service;
providers of the website, the customer environment, servers and IT services – for the operation and maintenance of the systems;
delivery and logistics service providers and SmartFOOD’s couriers – for delivering the order;
the email and newsletter service provider – for customer communication and, with consent, for sending marketing;
Google – where the Google Analytics service is used, with the user’s consent;
Meta – where Meta Pixel and related advertising services are used, with the user’s consent;
accounting and other professional service providers, to the extent necessary for providing their service;
state authorities, courts or other competent bodies, where the obligation to transfer data arises from law.

Where necessary, we conclude agreements with service providers governing the processing of personal data, and we expect them to apply appropriate security measures to protect personal data.

9. Transfers of data outside the European Economic Area

Some of the international technology and marketing services SmartFOOD uses, including Google and Meta services, may involve the processing of personal data outside the European Economic Area. In that case data is transferred only where there is a legal basis for it under the GDPR and the required data protection measures are in place, for example an adequacy decision of the European Commission or appropriate contractual safeguards.

10. How long we retain personal data

We retain personal data only for as long as is necessary to fulfil the purpose for which the data was collected or to comply with an obligation arising from legislation. In determining the retention period we take into account the type of data, the purpose of processing, the contractual relationship, the limitation periods of possible claims and retention obligations arising from law.

we retain order and customer relationship data for the duration of the customer relationship and, after it ends, to the extent necessary to resolve possible claims and to comply with obligations arising from law;
we retain source accounting documents and related data for the period prescribed by law;
we retain customer service and complaint-related communication for as long as is necessary to resolve the matter and to defend possible claims;
we retain marketing data until consent is withdrawn or another legal basis for marketing ends, except for the minimum information needed to honour an opt-out;
the retention periods for cookie and analytics data depend on the technology used and are set out in the cookie settings.

Where data is no longer needed and there is no legal basis for retaining it, we delete or anonymise it.

11. Security of personal data

We apply reasonable technical and organisational security measures to protect personal data, aimed at preventing unauthorised access to, alteration, disclosure or loss of data, or other unlawful processing. Access to personal data is limited to people who need it for their work duties or in order to provide the service.

12. Your rights

Under the conditions set out in the GDPR, a person has the right:

to receive information about whether and how SmartFOOD processes their personal data;
to request access to their personal data;
to request the correction of incorrect or inaccurate data;
to request the erasure of personal data where there is no legal basis for continuing to process it;
to request the restriction of the processing of personal data;
to object to processing based on legitimate interest;
to object at any time to the use of personal data for direct marketing;
to receive the data they have submitted in a machine-readable form and to request its transfer to another controller, where the preconditions for this right are met;
to withdraw consent at any time, where processing is based on consent;
to lodge a complaint with the Estonian Data Protection Inspectorate or to go to court to protect their rights.

To exercise your rights, write to info@smartfood.ee. We respond to a request without undue delay and generally within one month at the latest. Where necessary, we may ask for additional information to verify identity before fulfilling a request.

13. Automated decisions and profiling

SmartFOOD does not take decisions in relation to a customer based solely on automated processing that would have a legal or similarly significant effect on the customer. With the user’s consent, marketing services may use online behaviour data to form advertising audiences and to personalise advertising.

14. Amendments to the privacy policy

We may amend the privacy policy from time to time where SmartFOOD’s services, the technologies used, data processing practices or legislation change. The version in force is published on the SmartFOOD website together with the date on which it takes effect.

15. Contact and complaints

For questions or requests relating to the processing of personal data, write to info@smartfood.ee.

If you consider that your rights have been infringed in the processing of your personal data, you have the right to contact the Estonian Data Protection Inspectorate.

Last updated 4. September 2026