私隱政策

呢個頁面只有英文版本，並以英文版本為準。

This policy explains what personal data MercadoBon collects, why, who it is shared with, how long it is kept and what you can ask MercadoBon to do with it.

1. Who is responsible, and who this policy is about

PhaseShift Technologies B.V., the company that operates MercadoBon, is responsible for the personal data described here. Its details are at the end of this page. For anything about your data, email felix@mercadobon.com.

The MercadoBon apps on Google Play and the App Store are published by FMGH LLC (United States), which owns and develops the MercadoBon software. Whichever app or website you use, PhaseShift Technologies B.V. stays responsible for your data; FMGH LLC handles it only as one of the service providers in section 5.

This policy covers three different groups of people, and what MercadoBon holds about each of them is different:

MercadoBon (also the Platform) means the marketplace at mercadobon.com and in the MercadoBon apps, operated by PhaseShift Technologies B.V. Where this policy says "you", it means whichever of the three groups you belong to; where a rule applies to only one of them, it names that group.

A Seller is an independent business, not part of MercadoBon. Where a Seller receives a Buyer's data it must use it only as set out in section 5, and it answers for its own use of that data.

2. What MercadoBon collects, and why

From a Buyer

MercadoBon does not store card details. Card numbers, expiry dates and security codes are entered on the payment provider's own secure page and never reach MercadoBon's systems. A Seller never sees them either.

From a Seller

The business name, Chamber of Commerce (KvK) number, business address and contact details, the business type chosen at sign-up, billing details, listings, orders, commission and statements, and the WhatsApp number and app devices MercadoBon sends order alerts to.

Before that, a business asking to sell on MercadoBon leaves its contact's name, the business name, what it sells, a phone number, and optionally an email address and a note, so MercadoBon can get in touch and agree terms. A Seller account is only opened once MercadoBon has approved the request.

From a Driver

Name, phone number and email address, the deliveries assigned to that Driver, any problem they report with an order when collecting it from a Seller (with a photo of the order where they take one), the messages they exchange with the Buyer while carrying an order, and — only while a delivery or a ride is in progress — their live position, plus the spot where they marked each order picked up. For a Driver who carries passengers, also the vehicle, its plate and seats, and their passenger licence and its expiry date, the rides they were offered and drove, and the cash they recorded as collected.

Automatically

Like any website, MercadoBon's servers receive technical data with every request — IP address, browser and device type, and the page requested — which is used to keep the site working and secure.

Only with your consent, the website also records your visit in more detail than the anonymous daily totals in section 11 — which pages you open and what you click there: the page (without anything after a "?" or "#", and without order or ride numbers), the link or button, the page you came from, your browser, device type, screen size, language and country. It is counted by software MercadoBon runs on its own server, without cookies and without storing your IP address, so it cannot follow you to other websites and is not shared with anyone (section 11).

3. What MercadoBon deliberately does not keep

• Delivery photos are deleted 7 days after delivery. They show the outside of a Buyer's home. The Buyer and the Seller can see the photo for the first 24 hours. After that only MercadoBon can see it, and MercadoBon keeps it only long enough to settle a claim that an Order never arrived (72 hours) or a Seller's question about the delivery.
• Messages between a Buyer and a Driver end with the delivery. They can only be sent from the moment the Driver collects the order until it is delivered, and they are deleted 30 days after the last one.
• A Driver's position is not a history. One current position per Driver is stored, overwritten with every update and deleted when their last delivery or ride is done. The only position kept after that is where the Driver marked an order picked up, for 30 days, so the Seller and MercadoBon can check the order was collected at the store.
• Card numbers are not stored.
• Personal data is never sold, and it is not shared for anyone else's advertising.

4. Why MercadoBon may use it

• To perform its contract with you: the account, orders, payment, delivery and refunds for a Buyer; the seller agreement and billing for a Seller; the deliveries assigned to a Driver.
• Because the law requires it: accounting, tax and business records.
• For MercadoBon's legitimate interests: keeping the Platform secure, preventing fraud and abuse of claims, and improving the service — always weighed against your interests.
• With your consent: marketing messages, recording visits to the website in detail (section 11), and a device's location or camera on the website or in the MercadoBon apps, such as using the Buyer's location to set where a ride starts. Consent can be withdrawn at any time.

5. Who it is shared with

Sellers get what they need to fulfil a Buyer's order: the Buyer's name, contact details, what was ordered (with any notes for the kitchen) and, where the Seller delivers it themselves, the delivery address. A Seller may use it only for that order — not for marketing, not on a mailing list, and not passed to anyone else — and must not use it to take the Buyer off the Platform. A Seller never sees the Buyer's delivery code or card details.

When a Buyer asks a wholesale Seller for a trade account, that Seller gets the Buyer's name, company name, email address, phone number and the note the Buyer wrote, to decide on the request and run the account. The same limits apply: for that account only.

Drivers delivering for a Delivery Partner get the Buyer's name, delivery address, phone number and what they are carrying, for that delivery only — and, when the Buyer chose their safe drop-off spot for that order, its description and photo, only until the order is delivered. A Seller's own Driver gets the same from that Seller.

While a Delivery Partner's Driver is carrying an order, its Buyer and its Seller see the Driver's live position on a map. The Seller and MercadoBon also see where the Driver marked the order picked up.

Where an order offers a chat with the Driver, the Buyer and a Delivery Partner's Driver can message each other on it while the Driver is carrying the order. The Buyer sees only the Driver's first name. MercadoBon reads those messages only to deal with a complaint about the delivery.

A Delivery Partner sees the ratings Buyers give its Drivers, with any comment, so it can follow up on how its Drivers deliver. They are never shown on the website or in the apps.

On a ride, the Driver who accepts it gets the Buyer's first name and phone number, the pickup area, pin and note, and — once the Buyer is in the vehicle — the drop-off pin and note, only while the ride is in progress. Before a Driver accepts, a ride offer shows only the two areas, the fare, the number of passengers and how far away the pickup is, never a pin. The Buyer sees the Driver's first name, their Delivery Partner, the vehicle and its plate and phone number while the ride is in progress, and the Driver's live position on a map from the moment the Driver accepts until the ride ends, never after. The Driver's Delivery Partner, which carries out the ride, may receive the ride's details to deal with a complaint or lost property.

Sellers and Drivers do not receive each other's personal data beyond what a handover needs: the Driver is told which Seller to collect from, and the Seller is told an order has been collected.

Service providers who work for MercadoBon and may use the data only on its instructions:

Authorities, where the law requires it, and MercadoBon's professional advisers where needed.

A company that buys MercadoBon or merges with it, under the same protections. This is not a Buyer in the sense used elsewhere in this policy.

6. Where the data is

MercadoBon's servers are in Germany. Some service providers process data elsewhere, including in the United States. Where data leaves the Caribbean Netherlands, MercadoBon relies on its agreements with those providers to protect it to the standard of this policy.

7. How long it is kept

After that the data is deleted, or anything that identifies a person is removed.

8. Your rights

Whether you are a Buyer, a Seller or a Driver, you can ask MercadoBon to:

• show you the personal data it holds about you;
• correct anything that is wrong — most of it you can change yourself in your account;
• delete your data, where MercadoBon is not required to keep it (the records behind past orders cannot be deleted);
• give you a copy in a portable format;
• stop using it for a particular purpose, or restrict it while a dispute is resolved;
• withdraw consent you gave, without affecting what was done before.

Deleting a Buyer account. A Buyer can delete their account themselves, in the MercadoBon app (Account → Delete account) or on the website under Account → Profile, after confirming their password. It happens at once and cannot be undone. Removed: the sign-in, name, email address, phone number, saved and delivery addresses, the delivery pin, the safe drop-off spot and its photo, the pins and notes on rides, the contact details and notes on any request to sell that did not lead to a Seller account, and what the Buyer wrote in claims, appointment notes and notes for the kitchen, with any photos added to a claim. Kept, without the Buyer's name or contact details: the records of past orders, payments, refunds and reviews, for as long as section 7 says. An account with an order, appointment or ride still in progress can be deleted once that has ended. A Buyer who also runs a shop on MercadoBon, a Seller or a Driver asks for deletion by email instead.

Email felix@mercadobon.com. MercadoBon answers within 30 days, and may first need to check who you are. If you are not satisfied with the answer, you can complain to the data protection authority.

9. Keeping it safe

MercadoBon's website and apps use encrypted connections (HTTPS). Passwords are stored only as hashes. Access to personal data inside MercadoBon is limited to the people who need it, and significant actions its staff take on accounts and orders are logged. Card data never touches its systems.

No system is perfectly secure. If a breach affects you, MercadoBon will tell you, and the authorities where the law requires.

10. Children

MercadoBon is not for anyone under 18. It does not knowingly collect children's data; tell MercadoBon if you think it has, and it will be deleted.

11. Cookies and similar technologies

MercadoBon uses only what the site needs to work: keeping you signed in, remembering a basket and a language, remembering on your device that you confirmed you are 18 or older (so you are asked only once), and keeping the site secure. There are no advertising or analytics cookies and no third-party trackers on the site.

Anonymous daily totals. To see which shops, products and links people find interesting, the site counts anonymously, without cookies, how often pages are viewed, products are added to a basket and orders are placed, which words are typed into the search box (a search that looks like an email address or a phone number is not counted), and which site or campaign link a visit came from. It also counts how often a shop's specials or top picks are shown and opened. So that one visitor counts once a day, the site sends a random identifier made for that visit. The server holds it, with the visitor's IP address, only in its working memory, never saves either to its database, and forgets both when it restarts. Only the daily totals are stored, never who did what, so they cannot be linked to you or your account.

Visits in more detail, only with your consent. Where the website asks, you can also let MercadoBon record your visit in more detail: the pages you open in turn and the links you click (section 2), to see which parts of the site help Buyers and which get in their way. Nothing of this is recorded until you choose "Accept": choosing "No thanks", or not answering, means nothing is loaded or sent for it. It sets no cookies, does not store your IP address, never records what you type, and runs on MercadoBon's own server, so no other company receives it. Your answer is remembered on your device for 12 months, then the website asks again. You can change it at any time under "Cookie settings" at the bottom of every page, or by clearing the site's data in your browser.

A browser that sends a "Do Not Track" or "Global Privacy Control" signal is not counted in either way, and is never asked.

To suggest dishes on the home page ("Suggested for you"), the site also remembers, on your device only, which restaurant dishes you opened or added to a basket in the last 60 days. That list is never sent to MercadoBon; the "Forget dishes I viewed" button on the home page, or clearing the site's data in your browser, deletes it. When you are signed in, the suggestions also use your own past Orders, which MercadoBon already keeps for your account. Suggestions are never based on other people's data and are not advertising: no Seller pays to appear there.

12. Changes to this policy

MercadoBon may update this policy. The current version is always on this page, with the date it last changed at the top. Account holders are told about material changes at least 14 days before they take effect.