Privacy Policy

1. INTRODUCTION

At Too Good To Go (“TGTG”) we are on a mission to minimise food waste. We do this by connecting Users of our App with Stores who have surplus food.

This privacy policy (“Policy”) explains how we process personal information of our Users, Partners and any other individuals with whom we interact as part of running our business and providing our Services.

2. ABOUT THIS POLICY

This Policy, which includes our Cookie Policies (to the extent applicable, a copy of which can be found on our Platforms or via the links in section 3 below) is designed to help you understand our information collection practices depending on your relationship with us.

The Policy should be read in conjunction with any other applicable policies, terms and conditions in place between you and us.

Any term or provision contained in this Policy shall not apply to the extent that it is incompatible with relevant applicable statutory laws and regulations in the country or jurisdiction that applies to your personal information.

If you are a User of the Platform within the EEA, Switzerland or UK the primary controller for your personal information is Too Good To Go ApS, company reg. no. 37561304, Landskronagade 66, 2100 Copenhagen, Denmark.

If your relation to us is not as a User of the Platform, the primary controller for your personal information will be the TGTG Entity that was originally responsible for collecting your personal information in a given country or jurisdiction. For our Partner Stores this will be the local TGTG entity with whom you are contracting.

If you are a resident of Canada, please see the section titled Canada Privacy Rights.

If you are a United States resident of California, Virginia, Colorado, Connecticut, or certain other U.S. states with comparable privacy legislation, please see the sections titled California Privacy Rights and Virginia/Colorado/Connecticut and Similar U.S. State Privacy Rights for specific disclosures with respect to our collection, use, and disclosure of your information and additional rights you have under applicable U.S. laws. If you are a resident of Nevada, you have the right to opt out of the sale of certain personal data that we have collected (or may collect) from you to data brokers or other third parties. You can exercise this right by emailing us at privacy@toogoodtogo.com with the subject line “Nevada Do Not Sell Request.”

If you access our Platform from the U.S. the TGTG entity responsible for collecting your personal information is:

Too Good To Go Inc.

c/o United Corporate Services, Inc.

874 Walker Road, Suite C

County of Kent, Delaware 19904

Business reg.no. 7779365

ACCESSIBILITY—IF YOU ARE HAVING ANY TROUBLE ACCESSING THIS POLICY, PLEASE EMAIL US AT PRIVACY@TOOGOODTOGO.COM, OR CONTACT US TOLL FREE AT 1-866-467-8688 AND ENTER THE CODE 1898, 24 HOURS A DAY, 7 DAYS A WEEK (ONLY USA).

3. TERMS OF REFERENCE

To make this Policy more user friendly, we want to start by introducing you to what we mean when using some of the key terms in this Policy.

• “App” refers to the TGTG app that can be downloaded to your phone or tablet.
• “EU” refers to the European Union.
• “EEA” refers to the European Economic Area (which includes all EU member states, Norway, Iceland and Liechtenstein).
• “Cookie Policy” (and collectively “Cookie Policies”) refers to the cookie policies for our Users and Stores, as applicable.
• “GDPR” refers to the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council).
• “Platform” is used to describe our Website, App and online services and products in unison.
• “Store” or “Partner” refers to the businesses (e.g. super markets, bakeries, canteens, restaurants, manufacturers etc.) using the Platform to make surplus food available for reservation.
• “Surprise Bag” refers to the surprise bags available for reservation in the App filled with a mix of surplus food items.
• “TGTG” (and variously “we”, “us” and “our”) refers to our company Too Good To Go ApS, Landskronagade 66, 2100 Copenhagen, Denmark and our corporate family of companies globally that are related by common ownership or control, and which as applicable in each case controls your personal information.
• “Website” covers all domains on *.toogoodtogo.com/*.
• “User” refers to you as a consumer using the TGTG Platform.

4. INFORMATION WE COLLECT FROM USERS

4.1 Information needed to use the App

When you use the App, we will collect some personal information about you as a User. Without it, we would not be able to provide all the services requested. This information includes:

• Geo-location: country and your precise or approximate location depending on whether you choose to (i) share your location with us, or (ii) plot in your location manually.
• Responses from trusted payment providers: we do not collect any credit card information. However, when you place a reservation in the App, we will collect responses from trusted payment service providers. Depending on the payment method, this may include a subscription ID that is sent to the payment service provider.
• Delivery information: if you make a purchase in the App, which is available for delivery, we will collect your name and address in order to deliver the purchased items to you. If you choose to provide your email and phone number for receiving notifications, we will also collect this information.

We process this personal information because it is necessary for performing the agreement with you for providing the Platform.

With respect to geo-location, we process this information based on your consent, which you provide (and may at any time revoke) in the settings on your phone or tablet.

We may also process this personal information based on our legitimate interests to:

• provide, improve and develop our Platform
• communicate with you
• provide, tailor, measure, and improve our advertising and marketing

as further explained in section 6 of this Policy. Where required by applicable legislation, we will ask for your consent before using your personal information for marketing purposes, including sending you direct marketing communications.

4.2 Information you choose to give us

You may choose to provide us with additional personal information about you. This information could include:

• Additional profile information: name, phone number, email, home address, work address, your gender identification, birth date and information you chose to give us regarding your preferences e.g., favourite Stores, dietary preferences, other preferred location and preferred pick-up time.
• Other information: such as when you fill in a form, respond to surveys, participate in promotions, contests, or sweepstakes as well as when you communicate with our customer care team. This may include demographic and eligibility information as well as health information if you choose to share it with us.

Our legal basis for this processing is our legitimate interest, or, where required by applicable legislation, your consent. If we rely on your consent for our processing, we will specifically ask for this.

Where we do not ask for your consent, we process this personal information because it is necessary for the purposes of the legitimate interests pursued by us in order to:

• provide, improve and develop the Platform
• communicate with you, including responding to your requests
• provide, tailor, measure, and improve our advertising and marketing

as further explained in section 6 of this Policy.

We will never ask for or require that you submit any of your sensitive personal data to us (also known as special categories of personal data). However, if you choose to share health information or other sensitive personal information with our customer care team on your own initiative, e.g. information on allergies, we process this information based on our legitimate interests and in order for us to be able to establish, exercise or defend legal claims, where this is necessary.

4.3 Information automatically collected when using the TGTG Platform

When you use the Platform, we will automatically collect some personal information. This may include:

• Usage Information: such as the pages or content you view, click on or share, the clickstream patterns and length of time spent on each site as well as searches you conduct, reservations and purchases you make and which services in our App you are a customer of.
• Log Data and Device Information: such as details about how you’ve used the Platform (including if you clicked on links to third party applications), IP address, access dates and times, hardware and software information, device type, device event information, unique identifiers (e.g. IDFA and IDFV), crash data, and the pages you have viewed or engaged with on the Platform and before or after using the Platform.
• Cookies and Similar Technologies: as described in our Cookie Policy.

We process this personal information based on our legitimate interests to:

• provide, improve or develop our Platform
• provide, tailor, measure, and improve our advertising and marketing

as further explained in section 6 of this Policy.

4.4 Information we collect from third parties

We collect personal information from other sources, such as:

• Third party services: If you link, connect, or login to the Platform using a third party service (e.g. Facebook), you direct the service to send us profile information such as your name and email as controlled by that service or as authorised by you via your privacy settings at that service.

We process this personal information based on your consent which you provide upon directing the third party service to send us your profile information.

4.5 Information collected from recipients of our email communications

TGTG makes use of external service providers to send out our email communications. These services may record the following information about recipients of our emails:

• who opens the email (IP address, user id, email address),
• when the email is opened (date and time),
• which links in the email that recipients are clicking on,
• whether the email is received and links are activated from a mobile device or a through a browser,
• which operating system is used, and
• Information about which communication/campaign from our side the above is related to.

TGTG receives reports from our external service providers with the information mentioned above. We use this information to analyse which links in our email communications readers click through to, and use this information to design our future email communications.

We process this information based on our legitimate interest in being able to organise future email communications on the basis of the information collected.

5. INFORMATION WE COLLECT FROM OUR PARTNERS, VENDORS AND OTHER BUSINESS CONTACTS

5.1 Information needed to use the Platform

When you register and create a Store account to make Surprise Bags available for reservation on the Platform or to use our digital solution to manage expiry dates within your Store, we collect some personal information about you as a contact person for your Store or as an individual Store owner.

This information includes:

• Profile information: name, email address, phone number, Store address, Store name, type of business, your role within the Store.
• Tax and banking information: your Store’s VAT number and bank details.

If you are an individual Store owner, we process this personal information because it is necessary for performing the agreement with you for your Store’s use of the Platform.

If you are an employee of a Store, our legal basis for processing this personal information is our legitimate interest in being able to provide the Platform.

We may also process the above personal information because it is necessary for the purposes of the legitimate interests pursued by us in order to:

• provide, improve and develop our Platform
• communicate with you
• provide, tailor, measure, and improve our advertising and marketing

as further explained in section 6 of this Policy. Our legal basis for this processing is our legitimate interest, or, where required by applicable legislation, your consent. If we rely on your consent for our processing, we will specifically ask for this.

5.2 Information automatically collected when using the Platform

When you use the Platform, we will automatically collect some personal information from your use of the system.

This may include:

• Usage Information: such as the pages or content you view, click on or share, the clickstream patterns and length of time spent on each site as well as searches you conduct, reservations and purchases you process and actions you perform on the Platform,
• Log Data and Device Information: such as details about how you’ve used the Platform, IP address, access dates and times, hardware and software information, device type, device event information, unique identifiers (e.g. IDFA and IDFV), crash data, and the pages you have viewed or engaged with before or after using the Platform,
• Cookies and Similar Technologies: as described in our Cookie Policy.

We process this personal information based on the legitimate interests pursued by us in order to:

• provide, improve or develop our Platform
• provide, tailor, measure, and improve our advertising and marketing

as further explained in section 6 of this Policy and in our Cookie Policy for the Store side of the Platform.

5.3 Information collected from our vendors and other business partners

As part of our daily operations and communication and interaction with our vendors and other business partners, we collect some personal information about you as a vendor or other business partner or as an employee of one of our vendors or business partners:

• Business contact information: name, email address, phone number, company name, address and type of business as well as your role within the business.
• Tax and banking information: your company’s VAT number and bank details, if you are an individually owned business.

If you are an individual business owner, we process this personal information because it is necessary for performing the agreement that we have with you.

If you are an employee of one of our business partners, our legal basis for processing this personal information is our legitimate interest in being able to fulfil the agreement with your employer.

We may also process the above personal information based on the legitimate interests pursued by us in order to:

• provide, improve and develop our Platform
• communicate with you
• provide, tailor, measure, and improve our advertising and marketing

as further explained in section 6 of this Policy.

5.4 Information you chose to give us

You may choose to provide us with additional personal information about you. This information could include:

• Email correspondence: information that you provide as part of our email correspondence with you.
• Other information: information that you provide to us on your own initiative in connection with support queries or other interaction that you have with us.

Our legal basis for this processing is our legitimate interest, or, where required by applicable legislation, your consent. If we rely on your consent for our processing, we will specifically ask for this.

Where we do not ask for your consent, we process this personal information because it is necessary for the purposes of the legitimate interests pursued by us in order to:

• provide, improve and develop the Platform
• communicate with you
• provide, tailor, measure, and improve our advertising and marketing

as further explained in section 6 of this Policy.

We will never ask for or require that you submit any of your special categories of personal data to us. However, if you choose to share health information or other special categories of personal information with us on your own initiative, we process this information based on our legitimate interests and in order for us to be able to establish, exercise or defend legal claims. In special circumstances, where required by applicable legislation, we may rely on your consent for our processing.

5.5 Information we collect from third parties

We collect personal information from other sources such as:

• Third party services: If you login to the Platform using a third party service (e.g. Facebook), you direct the service to send us profile information such as your name and email as controlled by that service or as authorized by you via your privacy settings at that service.

We process this personal information based on your consent which you provide when directing the service to send us the above information.

We may also collect personal information in the form of your name, contact details and other relevant business related information, e.g. your role and the company you work for, from publicly accessible sources such as:

• Websites, and
• Online directories

if we need to contact you for a specific purpose as part of our daily operations, or, where allowed under applicable legislation, for marketing purposes, where your consent is not required by the applicable legislation. Our legal basis for this processing is our legitimate interest in being able to get in contact with you as part of our daily operations and to promote our services.

5.6 Information collected from recipients of our email communications

TGTG makes use of external service providers to send out our email communications. These services may record the following information about recipients of our emails:

• who opens the email, (IP address, user id, email address)
• when the email is opened (date and time),
• which links in the email that recipients are clicking on,
• whether the email is received and links are activated from a mobile device or a through a browser,
• which operating system is used, and
• Information about which communication/campaign from our side the above is related to.

TGTG receives reports from our external service providers with the information mentioned above. We use this information to analyse which links in our email communications readers click through to, and use this information to design our future email communications.

We process this information based on our legitimate interest in being able to organise future email communications on the basis of the information collected.

You may at any time opt out of receiving our marketing emails by clicking the unsubscribe link in our marketing emails or by submitting your email to unsubscribe via this link: https://space.toogoodtogo.com/privacy.

6. HOW WE USE THE INFORMATION WE COLLECT

6.1 Provide, improve, and develop the Platform

We will use some of the personal information we collect about you for the purpose of providing you with the best possible Platform.

For Users of our App this includes:

• creating and managing your account with us and processing your reservations,
• personalizing and customizing your experience based on your interactions with the Platform, your search and purchase history as well as your profile information and preferences e.g., by showing you a map or list view of nearby Stores and suggesting the most relevant Stores,
• performing analytics, debugging, and conducting research,
• conducting analyses in order to provide you with relevant functionality.

For users of the Store side of our Platform this includes:

• creating and managing your Store’s account with us and processing reservations for Surprise Bags at your Store,
• inform your Store on orders, payment and required actions,
• inform Users of updates from your Store, e.g. cancellations,
• to manage payout to your Store for Surprise Bags sold,
• personalising and customising your experience based on your interactions with the Platform,
• performing analytics, debugging, and conducting research,
• conducting analyses in order to provide you with relevant functionality.

6.2 Communicate with you

We will use some of the personal information we collect about you for the purpose of allowing us to get in touch with you. This includes:

• responding to your e-mails and/or support inquiries,
• sending you notifications of technical or legal nature, e.g. upon revision of our policies, or if one of your reservations has been cancelled by a Store,
• sending you notifications and announcements about us and our products via email, SMS and/or push notifications to the extent that you are opted in to receiving such communications.

To the extent permitted by local law, we may send you marketing communications without relying on your consent as a legal basis or rely on your soft opt-in to receive such marketing communications, as applicable.

6.3 Provide, tailor, measure, and improve our advertising and marketing

For Users:

We will use some of the personal information collected about you for the purpose of helping us in our continuous efforts to spread the word about food waste. This may entail:

• personalizing, measuring, and improving our advertising,
• analyzing preferences in order to tailor our promotional messages, marketing, advertising, and other information,
• sending you promotional messages, marketing and advertising based on your preferences as well as social media advertising through social media platforms,
• administering surveys, contests, sweepstakes, or other promotional activities or events sponsored or managed by TGTG or its Partners, and inviting you to events and relevant opportunities.

For Partners or employees of Partners:

We will use some of the personal information collected about you for the purpose of helping us in our continuous efforts to spread the word about food waste. This may entail:

• personalizing, measuring, and improving our advertising,
• analyzing how you and our other Partners use the Platform in order to tailor our promotional messages, marketing, advertising, and other information,
• sharing your data with third parties such as our advertising networks (only if you have opted in to marketing cookies on the Store side of the Platform), to help us identify other people and businesses that may wish to join us in our mission of minimising food waste,
• sending you promotional messages, marketing and advertising based on your preferences as well as social media advertising through social media platforms,
• administering surveys or promotional activities or events sponsored or managed by TGTG or its Partners, and inviting you to events and relevant opportunities.

6.3.1 Targeted advertising

We may ourselves, or with third-party vendors, use your information to deliver targeted advertising to you when you use our Platform or visit other websites. Cookies, clickstream data, and other similar technologies may be used in this process. For example, if you are searching for information related to our services, we or our vendor may cause an advertisement to appear on other websites you view with information on our App and our services. This form of advertising, sometimes called “targeted advertising,” “behavioral advertising,” or “cross-context behavioral advertising,” enables us and our vendors to know about your interests in connection with the delivery of a specific ad. We believe that such advertising is helpful because it allows you to see advertisements that are relevant to your interests.

6.3.1.1 Supplementary information concerning the USA

We comply with the Self-Regulatory Principles for Online Behavioral Advertising as administered by the Digital Advertising Alliance (“DAA”).

You may opt out of receiving targeted ads from certain data and advertising partners that participate in certain industry self-regulatory programs. The DAA provides a website at www.aboutads.info/consumers with information about how to opt out of targeted advertising from some or all of the DAA’s participating companies. Additionally, the Network Advertising Initiative (“NAI”) offers a website at http://optout.networkadvertising.org/ where you can opt out of interest-based advertising from some or all of the NAI’s members. Please note that by opting out, you will continue to see generic advertising that is not tailored to your specific interests and activities.

For targeted advertisements delivered through mobile apps, Users may opt out of certain ads or reset advertising identifiers via their device settings. To learn how to limit ad tracking or to reset the advertising identifier on your iOS and Android device, visit the following links:

• iOS - https://support.apple.com/en-us/HT202074
• Android - https://support.google.com/ads/answer/2662922?hl=en

You can also install the DAA’s AppChoices app on your device to opt out of targeted advertising by certain providers, and to select system-level advertising preferences on your device (such as “Personalized Ads” on Apple devices, or “Opt out of Ads Personalization” on Android devices).

Finally, to learn more from the NAI about how to opt out of targeted advertising on mobile devices, you can also visit the following link: https://thenai.org/opt-out/mobile-opt-out/.

6.4 Automated decisions

TGTG uses automated decision-making in using your personal information for some services and products. An example is our fraud prevention and detection efforts on our Platform used to protect our business against fraudulent use of our services and to ensure the ongoing confidentiality, integrity, availability and resilience of our Platform.

You may request that TGTG provides information about the decision-making methodology and ask us to verify that the automated decision has been made correctly.

We may reject the request, as permitted by applicable law, including when providing the information would result in a disclosure of a trade secret or would interfere with the prevention or detection of fraud or other crime. However, generally in these circumstances we will verify that the algorithm and source data are functioning as anticipated without error or bias.

7. REASONS WE SHARE INFORMATION

7.1 Sharing with your consent or at your direction

Where you provide consent, we share your information as described at the time of consent, such as when authorising a third-party application or website to link to your TGTG account or participating in promotional activities with TGTG Partners or third parties.

If you have opted-in to marketing cookies on our Platform, we may share your data with third party advertising platforms to increase awareness of our Platform and mission, drive traffic to TGTG, or otherwise promote our Platform as further described in section 6.3 of this Policy and our Cookie Policies for Users and the Store side of the Platform, respectively.

7.2 The TGTG group

To support us in providing, promoting and improving the Platform, we may share personal information within our corporate family of companies globally that are related by common ownership or control. When we share data within the TGTG group, we have appropriate contractual as well as technical and organisational security measures in place to protect your personal information in accordance with applicable law.

7.3 Data processors

We may share personal information with service providers to help us run our business and deliver the Platform. These service providers may assist us to fulfil the purposes set out in this Policy, including (but not limited to) by:

• Processing payments for reservations, purchases and refunds on the Platform,
• hosting software functions which enable the functioning and development of our Platform,
• providing hosting services,
• supporting tools for improving the functionality, availability, resilience and security of the Platform,
• performing data analytics,
• providing performance measurements for our ads and campaigns,
• automating SMS, email and ads delivery, such as e.g. sending out newsletters,
• managing our social media and online advertising presence,
• providing integrated tools which helps us deliver customer care services.

Whenever we use a service provider to process personal data on our behalf, we make sure that they are contractually bound to protect your personal information by way of a data processing agreement.

Some of our service providers are established and process your personal information in countries that are not deemed as providing an adequate level of protection of personal data according to the laws of the EU/EEA, Switzerland and the UK. When this is the case, we make sure that your personal information is adequately protected by ensuring that appropriate safeguards are in place in accordance with the applicable law governing the transfer and as further explained in section 8 of this Policy.

We use Google “ReCAPTCHA” on our Website, which allows us to verify that you are not an automated software. To do so, this tool analyses different parameters, such as IP address, device information, and cursor movement patterns, which may lead to the processing of your personal information. ReCAPTCHA features are subject to the then-current versions of Google's Privacy Policy and Terms of Use.

7.4 Third party geo-location services

We use third party geo-location services, whom we share data with, to provide our Platform and to help us run our business as described below. These third party geo-location services may process personal information for their own purposes as controllers.

If you are a User of our Website we may share your approximate geo-location (city level) (subject to your consent as described in section 4.1) with our third party geo-location service provider, Google.

If you make a purchase in the App, which is available for delivery, we share the specified delivery address with our third party geo-location provider, Google, to validate the delivery address. Our legal basis for sharing this information is our legitimate interest in being able to verify that the specified delivery address is in fact an existing address so that our courier is able to deliver your order.

If you are a user of the Store side of the Platform, we share the address of your Store with our third party geo-location provider, Google, based on our legitimate interest in being able to see where your Store is located on a map for the purposes of the legitimate interests pursued by us in order to:

• provide, improve and develop the Platform
• communicate with you
• provide, tailor, measure, and improve our advertising and marketing.

Google Maps features and content is subject to the then-current versions of the: (1) Google Maps/Google Earth Additional Terms of Service at https://maps.google.com/help/terms_maps.html; and (2) Google Privacy Policy at https://www.google.com/policies/privacy/. We encourage you to familiarise yourself with these terms before using our Services.

7.5 Franchisors (only relevant for franchisees)

If you are an individually owned franchisee belonging to a franchise chain, we may share the following information with your franchisor depending on the agreement we have with your franchise chain:

• name
• email address
• Store name and address
• information about your Store’s use of the Platform (e.g. saved meals, save ratio)
• information about User experiences with your Store, incl. ratings
• transactional data, and
• information of relevance to the franchisor about communication and interactions that you have had with our care team.

If you are an employee of a franchisee, we may share your name and email address relevant for the Platform with the franchisor.

Our legal basis for sharing this personal information is our and the franchisor’s legitimate interest in being able to manage your franchise chain’s agreement with us and your Store’s presence on the Platform.

7.6 Public authorities

We may disclose your personal information to courts, law enforcement, governmental or public authorities, including to the police in connection with criminal investigations, only if and to the extent we are required or permitted to do so by law.

7.7 PR and media agencies

We may share your personal information with third parties such as PR, media and or other types of promotional agencies, if you have consented to participate in our promotional activities or have entered into a contract with us for participation in such promotional activities. Depending on the circumstances these PR and media agencies may be processing personal information as either independent controllers or as processors, processing personal information on our behalf and under our instruction. Where the PR or media agency is processing personal information as data processors, our relationship will be governed by a data processing agreement in accordance with applicable legislation.

7.8 Business transfers

In the event we are involved in a bankruptcy, insolvency, merger, acquisition or reorganisation event, your personal information may be transferred or shared as part of that transaction (e.g., for due diligence purposes) with advisors, counterparties, authorities and other relevant third parties as necessary. This Policy will continue to apply to your information also after the information has been transferred or shared with any new TGTG entity.

7.9 Sharing with other third parties

In order to provide you with our services, we may need to engage third party service providers such as freight carriers or logistics partners, to assist us in fulfilling our contractual obligations and for purposes of our legitimate interest in sending out advertisements. These service providers will have access to personal information solely for the purposes of performing the services on our behalf. We ensure that any third party service providers that we engage are bound by appropriate data protection and confidentiality obligations.

8. INTERNATIONAL DATA TRANSFERS

Any transfers of your personal information by TGTG originating from within the EU/EEA, Switzerland, or UK to third countries outside these territories will be based on an EU Commission adequacy decision or are governed by applicable Standard Contractual Clauses and/or Binding Corporate Rules or equivalent appropriate transfer mechanism, unless you are otherwise notified. Any other, non-EEA, Swiss or UK originating, international transfers of your personal information, will take place in accordance with the appropriate international data transfer mechanisms and safeguards applicable under the local law governing the transfer of your personal information.

You may request a copy of the transfer mechanism governing the transfer of your personal information by sending a request to privacy@toogoodtogo.com.

9. STORAGE PERIOD

We retain personal information for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include:

• the length of time we have an ongoing relationship with you and provide our Platform to you e.g., for as long as you have an account with us or keep using the Platform,
• whether there is a legal obligation to which we are subject as certain local laws require us to keep records of your transactions for a certain period of time before we can delete them, and/or
• whether retention is advisable in light of our legal position e.g., in regard to applicable statutes of limitations, litigation or regulatory investigations.

10. SECURITY

The security of your personal information and our Platform is a top priority for us.

We have put in place appropriate technical and organisational (including physical) security measures to protect your personal information from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the personal information transmitted, stored or otherwise processed by us.

We also only use suppliers that implement appropriate technical and organisational security measures in accordance with industry practises for good IT security.

11. YOUR RIGHTS

If you are in the EU/EEA, Switzerland or the UK, you have the following rights in relation to our processing of Personal Information about you, subject to the conditions and exceptions set out in applicable law:

• Right of access: you have a right to gain access to the information that we process about you.
• Right to rectification: you have a right to have incorrect information that we hold about you rectified.
• Right to erasure: you have the right to have information about you erased. However, please note that there may be limitations to exercising the right to erasure in accordance with applicable law.
• Right to restriction and objection: you have the right to ask us to restrict the processing of your information and similarly a right to object to processing.
• Right to data portability: you have the right to receive your personal information in a structured, commonly used and machine-readable format.
• Right to withdraw your consent: if processing of your personal information is based on consent, you have the right to withdraw your consent at any time. Please note that withdrawal of your consent will not affect the lawfulness of the processing carried out before you withdraw your consent.

Please note that certain personal data may be exempt from the above-mentioned rights pursuant to applicable data privacy laws, or other laws and regulations.

Please refer to Schedule 1 and 2 for US state specific rights. Please refer to Schedule 3 for data subject rights in Canada.

11.1 Easy access to exercise your rights directly in our App

Our App provides you with full control over your own personal information. We have incorporated privacy by design and privacy by default on our Platforms and have user-friendly features for you to be able to exercise your rights directly in the App, e.g. to delete your personal information as well as an option to retrieve a copy of the personal information that we process about you. If you wish to exercise your rights directly in the App, please visit your account settings in the App. 

You may also:

• unsubscribe from our newsletter
• request a copy of your data, or
• delete your account

by submitting your email address to us via this link: https://space.toogoodtogo.com/privacy.

11.2 Still have questions or wish to file a complaint

If the self-service that our App provides has not solved your query, or you wish to exercise other rights than provided for directly in the App or as set out above, you are welcome to contact us at: privacy@toogoodtogo.com.

We will make sure to answer your request without undue delay and in any event within one month of receiving your request. If your request is complex, we may need more time to process it, and can extend this deadline by two further months.

You always have the right to lodge a complaint with a data protection authority of competent jurisdiction, if you are not satisfied with our response. However, we encourage you to always reach out to us first so that we may have the opportunity to help you with your request.

The contact information for the Danish Data Protection Agency, which is the supervisory authority in Denmark where TGTG’s headquarter is established, is:

Website: https://www.datatilsynet.dk

E-mail: dt@datatilsynet.dk

Address: Carl Jacobsens Vej 35, DK-2500 Valby, Denmark

12. CHILDREN’S PRIVACY

Our Platform is intended for Users 18 years of age or older, and we do not knowingly collect personal information from data subjects under the age of 16. When we become aware that personal information (or other information that is protected under applicable law) from a child under 16 has been collected, we will use all reasonable efforts to delete such information from our databases. If you believe we might have any personal information from or about a child under 16, please contact us by using the information the section below titled “CONTACT INFORMATION.”

13. CHANGES TO THE POLICY

You can stay updated on any changes to this Policy by visiting our Website and App. In case we make material changes to the Policy, we will notify you on the Platform or by using the email you provided when signing up to our Platform.

14. CONTACT INFORMATION

If you have any questions about our processing of your personal information, please contact our privacy team using below contact details.

Where required under local law, we have appointed a data protection officer (DPO) in accordance with local legislation to handle your request.

Too Good To Go ApS, Landskronagade 66, 2100 Copenhagen, Denmark

Central Business Register (CVR) no.: 37561304

E-mail: privacy@toogoodtogo.com

SCHEDULE 1 - CALIFORNIA PRIVACY RIGHTS

The California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020, provides you with specific rights regarding your "personal information" as that term is defined under the CCA. This section describes the rights that California consumers have and explains how to exercise those rights. For the purposes of this section, personal information does not include: (i) information that is lawfully made available from federal, state or local government records; (ii) de-identified or aggregated data; or (iii) information excluded from the scope of the CCPA. To be clear, these rights are granted only to the extent that you are a California consumer and we are acting as a “business” under the CCPA with respect to your personal information. The rights in this section are not intended to grant you additional rights, but only your rights under the CCPA.

1. INFORMATION WE COLLECT, HOW WE COLLECT IT AND HOW WE USE IT

We have collected the following categories of personal information from consumers from the sources described in Section 4 (“INFORMATION WE COLLECT FROM USERS”) and Section 5 (“INFORMATION WE COLLECT FROM OUR PARTNERS, VENDORS AND OTHER BUSINESS CONTACTS”) of the Policy above, and have shared such personal information with the following categories of third parties within the last twelve (12) months:

The categories of personal information described above are retained and stored as described in Section 9 (“STORAGE PERIOD”) of the Policy above.

2. DISCLOSURE OF PERSONAL INFORMATION

We may disclose your personal information to a third party for a business purpose, or sell or share your personal information, subject to your right to opt out (see personal information Sales Opt-Out and Opt-In Rights, below). The information above under Information We Collect; How We Collect It; How We Use It describes the entities with which we may disclose your personal information.

3.RIGHTS TO YOUR INFORMATION

3.1 Right to know

As a California consumer, you have the right to request that we disclose certain information to you about our collection, use, disclosure, or sale/sharing of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request (see Exercising Your Rights, below), and subject to certain limitations that we describe below, we will disclose such information. You have the right to request any or all of the following:

• The categories of personal information we collected about you.
• The categories of sources from which the personal information is collected.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you (see Data Portability Rights below).

3.2 Right to delete

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Your Rights, below), we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. However, we may retain personal information that has been de-identified or aggregated. Furthermore, we may deny your deletion request if retaining the information is necessary for us or our service provider(s) to perform certain actions set forth under the CCPA, such as detecting security incidents and protecting against fraudulent or illegal activity.

3.3 Right to data portability

You have the right to request a copy of the personal information we have collected and maintained about you in the past 12 months. The CCPA allows you to request your information from us up to twice during a 12-month period. We will provide our response in a readily usable (and usually electronic) format.

3.4 Right to correct

You have the right to request the correction of any personal information we maintain about you.

3.5 Right to opt out of selling or sharing your personal information

You have the right to opt out of the sale or sharing of your personal information, along with the right to opt in to the sale of such information. We do not sell or share the personal information of consumers we actually know are less than 16 years of age, unless we receive affirmative authorization (the "right to opt-in") from either the consumer who is less than 16 (but greater than 13) years of age, or the parent or guardian of a consumer less than 13 years of age. To our knowledge, we do not sell or share the personal information of minors under 16 years of age.

To exercise the right to opt out, you (or your authorized representative) may submit a request to us by visiting the following Internet Web page: "Do Not Sell or Share My personal information". Alternatively, you may submit an opt-out request by emailing us at privacy@toogoodtogo.com. We will also treat Global Privacy Control browser signals as valid opt-out requests.

You may change your mind and opt back in to personal information sales at any time by clearing cookies in your browser settings and accept non-essential cookies on our website or by changing your preferences in the account settings of the app.

3.6 Right to limit the use of your sensitive personal information

You have the right to limit the use or disclosure of your sensitive personal information (“SPI”) if we are using your SPI beyond what is reasonable and proportionate to provide the requested goods or services. We do not collect, use or disclose your SPI, other than your precise geolocation for showing you nearby Stores in the App. You can limit our use or disclosure of your precise geolocation by removing our App’s access to your precise geolocation in the settings on your phone or tablet. If you are not a User of the App, we do not knowingly collect your SPI.

3.7 Right to non-discrimination

We will not discriminate against you for exercising any of your CCPA rights, including but not limited to, by:

• Denying you goods or services.
• Charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Providing you a different level or quality of goods or services.
• Suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

3.8 Exercising Your Rights

To exercise the rights described above, please contact us by using the following methods:

• Calling us at 1-866-467-8688 and enter the code 1898
• Emailing us at privacy@toogoodtogo.com
• For website Users: Visiting our California Rights page at https://space.toogoodtogo.com/privacy

Or, for App Users:

• Exercise your rights directly in your profile settings in the App. 

After submitting a request, we will take steps to verify your identity in order for us to properly respond and confirm that it is not a fraudulent request. In order to verify your identity, we will ask, at a minimum, that you provide your name, email address, and relationship to us, so that we can seek to match this information with the information existing in our systems. When providing us this information, you represent and affirm that all information provided is true and accurate. Depending on the request, if we are unable to verify that the consumer submitting the request is the same individual about whom we have collected personal information, we may contact you for more information, or we may not be able to meet your request.

Only you, or an agent legally authorized to act on your behalf, may make a verifiable request related to your personal information. If you are making a request as the authorized agent of a California consumer, we will ask you also submit reliable proof that you have been authorized in writing by the consumer to act on such consumer’s behalf.

We will make every effort to respond to your request within 45 days from when you contacted us. If you have a complex request, the CCPA allows us up to 90 days to respond. We will still contact you within 45 days from when you contacted us to let you know we need more time to respond.

4. NOTICE OF FINANCIAL INCENTIVE

We may offer various financial incentives, such as discounts or other benefits to customers from time to time. In particular, from time to time, we may offer you rewards when you create an account or sign up for our services. During the sign-up process and thereafter, we may collect personal information from you, such as identifiers (such as your name and email address), commercial information (such as purchase history and product preferences), inferences drawn about your preferences, and other categories of your personal information. We may use this personal information to tailor your experience and our communications to you based on products and services we think may be of interest to you, and for measurement and analytics. We believe that the benefits you receive from signing up for our services, including any rewards we may offer, are reasonably related to the value of your personal information.

You can opt into a financial incentive by following the applicable sign-up or participation instructions provided, and, for any ongoing benefits, you can opt-out at any time by following the unsubscribe or opt-out instructions for the applicable program or contacting us at privacy@toogoodtogo.com. In some cases, there may be additional terms and conditions applicable to a financial incentive, which we will present to you when you sign up for the financial incentive.

5. CALIFORNIA “SHINE THE LIGHT”

In addition to the above rights, under California Civil Code Section 1798.83 (“Shine the Light”), California residents may have the right to request in writing from businesses with whom they have an established business relationship: (a) a list of the categories of personal information, as defined under Shine the Light, such as name, email address, and mailing address, and the type of services provided to the customer that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third parties’ direct marketing purposes; and (b) the names and addresses of all such third parties. To request the above information, please contact us by email at privacy@toogoodtogo.com. If you do not want your personal information shared with any third party who may use such information for direct marketing purposes, then you may opt out of such disclosures by sending an email to us at privacy@toogoodtogo.com

6. CONTACT INFORMATION

If you have questions or concerns about this Policy, your California privacy rights, or our information practices, please email us at privacy@toogoodtogo.com.

SCHEDULE 2 - VIRGINIA/COLORADO/CONNECTICUT AND SIMILAR U.S. STATE PRIVACY RIGHTS

The Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act and similar laws in other U.S. states (“State Privacy Laws”) provide their consumers with specific rights regarding their personal data. To the extent that you are a resident of one of these states, this section describes your rights under the State Privacy Laws and explains how you may exercise these rights.

The categories of personal data we process, our purposes for processing your personal data, the categories of personal data that we share with third parties, and the categories of third parties with whom we share it are set forth in the terms of the Policy above.

1. RIGHTS TO YOUR INFORMATION

In addition to the rights set forth in our Policy, the State Privacy Laws provide you with the following rights:

• Right to know. You have the right to know whether we process your personal data and to access such personal data.
• Right to data portability. You have the right to obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another business without hindrance, where the processing is carried out by automated means. You may request such personal data up to twice annually, subject to certain exceptions.
• Right to delete. You have the right to delete personal data that you have provided by or that we have obtained about you. Please note that we may deny such request if the requested deletion falls under an exception as set forth in the State Privacy Laws. Additionally, if you request deletion of your personal data and we have obtained such information from a third-party source, we may retain such data by keeping a record of the deletion request and the minimum data necessary to ensure that your personal data remains deleted from our records and that such retained data is not used for any other purpose, or we may opt you out of the processing of such personal data for any purpose except for those allowed under the State Privacy Laws.
• Right to opt out. You have the right to opt out of the processing of the personal data for purposes of: (i) targeted advertising; (ii) the sale of personal data; or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. As of the latest date of the Policy:
• We DO process personal data for the purposes of targeted advertising;
• We DO NOT sell your personal data for monetary or other valuable consideration (while we do share your personal data with third parties for purposes of targeted advertising, we do not believe this constitutes a “sale” under State Privacy Laws); and
• We DO NOT engage in profiling decisions based on your personal data that produce legal or similarly significant effects concerning you.
• Right to correct. You have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes for which we process it.
• Right to nondiscrimination. You have the right not to receive discriminatory treatment by us for the exercise of your privacy rights. Unless permitted by the State Privacy Laws, we will not:
• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

2. HOW TO EXERCISE YOUR RIGHTS

2.1 Verifying your identity

To exercise any of your privacy rights, or if you have any questions about your privacy rights, you may contact us by:

• Emailing us at privacy@toogoodtogo.com
• Visiting our privacy rights page at https://space.toogoodtogo.com/privacy

After submitting a request, we will take steps to verify your identity in order for us to properly respond and/or confirm that your request is not fraudulent. We may contact you for additional information as reasonably necessary to authenticate your request, but if we are ultimately unable to authenticate your request using reasonably commercial efforts, then we may not be able to comply with it.

Only you or your authorized agent may make a verifiable request related to your personal data. If you are making a request as the parent or legal guardian of a known child regarding the processing of that child’s personal data, we may ask you to submit reliable proof of your identity.

3. RESPONSE TIME

3.1 Your right to appeal

We will make every effort to respond to your request within 45 days from when you contacted us. If you have a complex request, the State Privacy Laws allow us up to 90 days to respond. We will contact you within 45 days from when you contacted us to inform you of the need for additional time and the reason for such extension. We may charge you a reasonable fee to cover administrative costs if your requests are manifestly unfounded, excessive, or repetitive.

If we decline to take action on a request that you have submitted, we will inform you of our reasons for doing so, and provide instructions for how to appeal the decision. You will have the right to appeal within a reasonable period of time after you have received our decision. Within 60 days (45 days for residents of Colorado) of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, we will provide you with a method for contacting your state attorney general’s office to submit a complaint.

SCHEDULE 3 - CANADA PRIVACY RIGHTS

If you access our Platform from Canada, the TGTG entity responsible for collecting your personal information is:

Too Good To Go Technology Ltd.

Suite 2600, Three Bentall Centre, 595 Burrard Street

P.O. Box 49314, Vancouver, British Columbia V7X 1L3

Business reg. no. 774534069BC0001

Where Canadian privacy laws apply, including with respect to Users of our Platform in Canada and employees and owners of Stores based in Canada, notwithstanding any other lawful basis identified in the Privacy Policy, we collect, use and disclose personal information with consent, except where otherwise permitted or required by law. Depending on the circumstances, we may rely on express or implied consent, as permitted by applicable law.

We maintain personal information on secure servers. Personal information is accessible to authorized personnel who require access for the purposes described in this Privacy Policy.

Under Canadian privacy laws, you have the following rights in relation to our processing of personal information about you, subject to the conditions and exceptions set out in applicable law:

• Right of access: you have a right to request access to the information that we process about you.
• Right to rectification: you have a right to have incorrect, incomplete or inaccurate information that we hold about you rectified.
• Right to erasure: you have the right to have information about you erased in certain circumstances..
• Right to withdraw your consent: you have the right to withdraw your consent to our processing of your personal information at any time, subject to contractual and legal restrictions. Your withdrawal will not affect the lawfulness of the processing carried out before you withdraw your consent.

Please note that the above mentioned rights are subject to certain exceptions, and we may take reasonable steps to verify your identity before responding to a rights request.

To exercise any of these rights, please contact the data protection officer for Canada using the contact information listed in section 14 or where applicable, use our self-serve options described in section 11.1 of the Policy.

SCHEDULE 4 - AUSTRALIA PRIVACY RIGHTS

If you access our Platform from Australia, the TGTG entity responsible for collecting your personal information is:

Too Good To Go Australia Pty Ltd

C/- Tricor Services (Australia) Pty Ltd, Level 3, 1049 Victoria Road,

West Ryde, NSW 2114.

ABN: 65 675 037 000

Where Australian laws apply, including with respect to Users of the Platform in Australia and employees and owners of Stores based in Australia, we collect, hold, use, and disclose your personal information in accordance with the Australian Privacy Principles (APPs) as set out in the Privacy Act 1988 (Cth) (Privacy Act).

Where the Privacy Act applies, the terms ‘personal information’ and ‘sensitive information’ will have the meanings given to them under the Privacy Act.

The lawful basis for our processing of personal information under the Privacy Act may be different from the lawful basis articulated in the Policy above. Where the Privacy Act applies, we will only collect sensitive information with consent, unless an exception applies.

We maintain personal information on secure servers and in accordance with Section 10 of the Policy above. Personal information is accessible to authorized personnel who require access for the purposes described in the Policy above.

1. INFORMATION WE COLLECT

We collect personal information and other data as described in Section 4 (“INFORMATION WE COLLECT FROM USERS”) and Section 5 (“INFORMATION WE COLLECT FROM OUR PARTNERS, VENDORS AND OTHER BUSINESS CONTACTS”) of the Policy above.

1. HOW WE USE THE INFORMATION WE COLLECT

We use personal information and other data for the purposes described in Section 6 (“HOW WE USE THE INFORMATION WE COLLECT“) of the Policy above.

1. YOUR RIGHTS

Under the Privacy Act, you have the following rights in relation to our processing of personal information about you, subject to the conditions and exceptions set out in the Privacy Act:

• Right to access: you have a right to gain access to the information that we hold about you.
• Right to correction: you have a right to have inaccurate, out of date, incomplete, irrelevant or misleading information that we hold about you corrected.
• Right to withdraw your consent: you have a right to withdraw your consent at any time.
• Right to opt out of direct marketing: you have a right to opt out of the receipt of direct marketing communications from us, to opt out of the use or disclosure of your personal information by us for the purpose of direct marketing or to request the source of such information.

To exercise any of these rights, please contact the privacy officer for Australia using the contact information listed in Section 14 of the Policy above or, where applicable, use our self-serve options described in Section 11.1.

1. COMPLAINTS

If you wish to complain about our processing of your personal information, or should you perceive any breach of the APPs in our processing, please contact the privacy officer for Australia using the contact information listed in section 14 of the Policy above.

We will make every effort to review and respond to your complaint within thirty (30) calendar days from when you contacted us.

It will not always be possible to resolve a complaint to your satisfaction. If you are not satisfied with our response to a complaint, you have the right to contact the Office of the Australian Information Commissioner (at www.oaic.gov.au/contact-us) to lodge a complaint.

1. DISCLOSURE OF PERSONAL INFORMATION TO THIRD PARTIES

We disclose personal information and other data to third parties for the purposes described in Section 7 (“REASONS WE SHARE INFORMATION”) of the Policy above.

1. CROSS-BORDER DISCLOSURE OF PERSONAL INFORMATION

Some personal information will likely be disclosed to some of our related entities or other third parties who are located outside of Australia or held on servers located outside of Australia.

In the case of our related entities, personal information may be disclosed to our related TGTG entities located in countries including Austria, Belgium, Canada, Czechia, Denmark, France, Germany, Ireland, Italy, Norway, Poland, Portugal, Spain, Sweden, Switzerland, The Netherlands, United Kingdom and United States.