Privacy Policy - ZipZest
Privacy Policy – Customers
This policy explains how your personal data is processed when you visit a restaurant's online shop on ZipZest, place an order through it, create a customer account or publish a review. If you are a restaurant owner, please see the Restaurant Privacy Policy instead.
1. Who is responsible for your data?
Two parties are involved, each for different processing activities:
The restaurant you order from is responsible for the data relating to your order (your contact details, delivery address, order content, notes and payment). It uses this data to prepare, deliver and invoice your order. ZipZest processes it on the restaurant's behalf, as a processor. The restaurant's contact details are shown in its shop.
ZipZest is responsible for the data relating to your ZipZest customer account, the reviews you publish, the newsletter emails you have subscribed to, and the Platform's security and statistics. ZipZest is operated by:
The Design Clinic Junod, Sous-l'Église 6, 2043 Boudevilliers, Switzerland – [email protected]
We process data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the European Union's General Data Protection Regulation (GDPR).
2. Data collected
When you order: first and last name, company (optional), email, phone, delivery address and the corresponding geographic coordinates, billing address if different, products ordered, how and when you receive the order, discount code used, payment method and status, and any notes you enter.
Notes and allergies: if you mention an allergy or other health information in the notes, it is passed on to the restaurant solely to prepare your order. Only include what is necessary.
Online payment: your card or TWINT details are entered directly with Stripe and are never accessible to ZipZest or the restaurant. We only receive the payment status and reference.
Customer account (if you create one): first and last name, email, password (stored encrypted), phone, address, language, your order history, date you accepted the Terms, and marketing preferences.
Reviews: rating, comment, date, the restaurant concerned and your account name.
Technical data: IP address, date and time of access, browser, operating system and pages visited, collected automatically for the security and proper functioning of the Platform.
3. Why do we use your data?
| Purpose | Responsible party | Legal basis |
|---|---|---|
| Processing, preparing, delivering and invoicing your order, keeping you informed of its status | Restaurant (ZipZest as processor) | Performance of the contract |
| Checking whether an address is within the delivery zone | Restaurant (ZipZest as processor) | Performance of the contract |
| Managing the restaurant's customer list and its accounting obligations | Restaurant | Legitimate interest; legal obligations |
| Managing your customer account and order history | ZipZest | Performance of the contract |
| Publishing and moderating reviews | ZipZest | Performance of the contract; legitimate interest |
| Sending you information and news from ZipZest | ZipZest | Consent (can be withdrawn at any time) |
| Ensuring security, preventing fraud and abuse | ZipZest | Legitimate interest; legal obligations |
| Producing anonymous usage statistics | ZipZest | Legitimate interest |
Restaurants are not allowed to use your contact details to send you advertising without your consent.
4. Who receives your data?
- The restaurant you order from, and its authorised staff.
- The restaurant's delivery provider, if it uses one (e.g. SwissLivraisonPro): only the data needed for delivery (name, phone, address, order content and notes).
- Stripe, to process online payments. Stripe acts as an independent controller for certain processing (in particular fraud prevention and its regulatory obligations); see Stripe's privacy policy.
- Our technical providers, who are contractually bound to protect your data:
| Provider | Role | Place of processing |
|---|---|---|
| Infomaniak Network SA | Hosting of the Platform, databases, backups and Matomo | Switzerland |
| Cloudflare, Inc. | DNS, web application firewall (WAF) and attack protection | Global network (headquartered in the USA) |
| Amazon Web Services EMEA SARL (Amazon SES) | Sending emails (order confirmations, account, news) | European Union (Stockholm, Sweden) |
| Mapbox, Inc. | Search and geolocation of delivery addresses | USA |
- Authorities, where required by law.
We do not sell or rent your data.
5. Transfers abroad
Your data is hosted in Switzerland. Some providers may process it in the European Union or the United States. EU countries provide a level of protection recognised as adequate by Switzerland. For other countries, we ensure that appropriate safeguards are in place, such as certification under the Swiss-U.S. Data Privacy Framework where the provider holds it, or standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC).
6. Retention
- Orders: kept for the restaurant for as long as it needs them, in particular for its accounting obligations (up to 10 years), and deleted at the latest when it stops using ZipZest, subject to those obligations.
- Customer account: until you or we delete it. You can delete it at any time from your profile; your account data is then erased, but orders already passed on to restaurants remain with them.
- Reviews: for as long as they are published; they are deleted together with your account.
- Marketing consent: until withdrawn.
- Technical logs: a limited period, as needed for security and incident analysis.
- Backups: erased according to their rotation cycle.
7. Emails
After an order, you receive service emails (confirmation, status updates). If you agreed to it when ordering or signing up, ZipZest may also send you information and news. You can unsubscribe at any time via the link in each email or from your profile.
8. Cookies
We use no advertising or tracking cookies. The only cookies we use are strictly necessary:
- Session cookie: stores your cart and keeps you logged in;
- Security cookie (XSRF-TOKEN): protects forms against attacks;
- Language cookie: remembers your chosen language;
- Cloudflare cookies: where applicable, tell human visitors apart from malicious bots.
You can delete or block cookies in your browser settings, but you will then no longer be able to place an order.
9. Audience measurement (Matomo)
We use Matomo, an audience measurement tool that we host ourselves on our servers in Switzerland. Browsing data remains under our sole control: it is neither shared with third parties nor transferred abroad.
Matomo is configured to protect your privacy:
- no cookies are set;
- your IP address is anonymised (truncated) before anything is stored;
- no individual identification or cross-site tracking takes place.
The information collected (pages viewed, device and browser type, approximate region, referring site) is used solely to produce aggregated statistics. You can opt out at any time using the opt-out form below.
10. Security
Your data is protected by appropriate technical and organisational measures: encrypted connections (HTTPS), hosting in Switzerland, web application firewall, encrypted passwords, access restricted to authorised persons and regular backups.
11. Your rights
You may at any time:
- obtain information about the data processed about you and receive a copy of it;
- have inaccurate data corrected;
- request the deletion of your data, subject to legal retention obligations;
- object to certain processing;
- withdraw your consent to newsletter emails;
- receive your data in a common format (portability).
For data relating to an order, please contact the restaurant concerned first. You can also write to us: we will pass your request on to the restaurant and help it respond. For your account, your reviews and ZipZest emails, write to us directly at [email protected].
We may ask you to verify your identity. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, where the GDPR applies, with the data protection authority of your country of residence.
12. Changes
We may update this policy to reflect changes to the Platform or the law. The version in force is the one published on this page. If you have an account, we will inform you of material changes by email.
Last updated: 3 October 2026