Privacy Policy - ZipZest
Privacy Policy – Restaurants
This policy explains how ZipZest processes the personal data of restaurant owners, their Team Members and visitors to the zipzest.ch website. If you are ordering from a restaurant, please see the Customer Privacy Policy instead.
1. Controller
The Design Clinic Junod, Sous-l'Église 6, 2043 Boudevilliers, Switzerland ("ZipZest", "we", "us").
For any data protection questions: [email protected]
We process your data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the European Union's General Data Protection Regulation (GDPR).
2. Roles: your data and your Customers' data
- Your data (account, Restaurant, subscription, support): ZipZest is the controller. This is what this policy covers.
- Your Customers' data provided when they place Orders: you are the controller and ZipZest acts on your behalf as processor, under the Data Processing Agreement annexed to the Restaurant Terms.
3. Data we collect
User account: first and last name, email address, phone number, password (stored encrypted), language, role within the Restaurant, two-factor authentication settings, date you accepted the Terms, and marketing preferences.
Restaurant: trading name, company name, address, contact details, VAT/UID number, logo, images, menus, opening hours, delivery zones and Service settings.
Subscription and billing: chosen plan, payment and invoice history, Stripe customer ID. Your card details are entered directly with Stripe; ZipZest has no access to them.
Your Customers' online payments: ID and status of your connected Stripe account, enabled payment methods. Detailed information about your business and your bank details are provided directly to Stripe.
Integrations: data required for the integrations you enable (e.g. connection token for a delivery provider, data imported from GloriaFood or Just Eat at your request).
Communications: exchanges with our support (emails, requests); delivery and open status of our newsletter emails (see section 8).
Technical data: IP address, date and time of access, browser, operating system, pages visited and error logs, collected automatically for the security and proper functioning of the Platform.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing your account and Restaurant, providing the Service | Performance of the contract |
| Managing the subscription, billing and collection | Performance of the contract; legal obligations (accounting) |
| Technical support, including temporary access to your dashboard | Performance of the contract; legitimate interest |
| Sending service emails (Orders, security, invoices, changes to the Terms) | Performance of the contract |
| Sending you information and news about ZipZest | Consent (can be withdrawn at any time) |
| Ensuring security, preventing fraud and abuse | Legitimate interest; legal obligations |
| Producing usage statistics and improving the Service | Legitimate interest |
| Listing your Restaurant in the zipzest.ch directory | Performance of the contract |
| Complying with our legal obligations and enforcing our rights | Legal obligations; legitimate interest |
5. Recipients and processors
We do not sell or rent your data. We only share it with the providers needed to run the Service, who are contractually bound to protect it:
| Provider | Role | Place of processing |
|---|---|---|
| Infomaniak Network SA | Hosting of the Platform, databases, backups and Matomo | Switzerland |
| Cloudflare, Inc. | DNS, web application firewall (WAF) and attack protection | Global network (headquartered in the USA) |
| Amazon Web Services EMEA SARL (Amazon SES) | Sending transactional and newsletter emails | European Union (Stockholm, Sweden) |
| Stripe Payments Europe Ltd. and Stripe group companies | Subscription payments; your Customers' online payments to your Stripe account | Ireland, USA and other countries |
| Mapbox, Inc. | Address search and geolocation | USA |
When you connect your Stripe account or enable an integration (e.g. SwissLivraisonPro), the necessary data is exchanged with that third party, which processes it under its own responsibility and terms.
We may also disclose data to authorities where required by law, or to our advisers (lawyer, fiduciary) who are bound by professional secrecy.
6. Transfers abroad
Your data is hosted in Switzerland. Some of the providers above may process data in the European Union or the United States. EU countries provide a level of protection recognised as adequate by Switzerland. For other countries, we ensure that appropriate safeguards are in place, such as certification under the Swiss-U.S. Data Privacy Framework where the provider holds it, or standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC).
7. Retention
- Account and Restaurant: for the duration of the contract, then deleted or anonymised within a reasonable time after the Restaurant or account is deleted.
- Invoices and accounting records: 10 years, in accordance with the Swiss Code of Obligations (Art. 958f CO).
- Technical logs: a limited period, as needed for security and incident analysis.
- Backups: erased according to their rotation cycle.
- Marketing consent: until withdrawn.
8. Newsletter emails
With your consent, we send you information and news about ZipZest (new features, tips, offers). To measure interest in these emails, we record whether an email has been opened using a small image embedded in the message. You can unsubscribe at any time via the link in each email or from your profile. Service emails relating to your account are sent regardless of this choice.
9. Cookies and local storage
We use no advertising or tracking cookies. The only cookies we use are strictly necessary:
- Session cookie: keeps you logged in and stores your cart;
- Security cookie (XSRF-TOKEN): protects forms against attacks;
- Language cookie: remembers your chosen language;
- Cloudflare cookies: where applicable, tell human visitors apart from malicious bots.
Display settings for the kitchen display and the order status screen are saved in your browser's local storage and are not sent to us.
You can delete or block cookies in your browser settings, but some features (login, ordering) will then no longer work.
10. Audience measurement (Matomo)
We use Matomo, an audience measurement tool that we host ourselves on our servers in Switzerland. Browsing data remains under our sole control: it is neither shared with third parties nor transferred abroad.
Matomo is configured to protect your privacy:
- no cookies are set;
- your IP address is anonymised (truncated) before anything is stored;
- no individual identification or cross-site tracking takes place.
The information collected (pages viewed, device and browser type, approximate region, referring site) is used solely to produce aggregated statistics to improve the Platform. You can opt out at any time using the opt-out form below.
11. Security
We protect your data with appropriate technical and organisational measures: encrypted connections (HTTPS), hosting in Switzerland, web application firewall, encrypted passwords, two-factor authentication, access restricted to authorised persons and regular backups. Since no system is completely foolproof, we recommend using a unique password and enabling two-factor authentication.
12. Your rights
You may at any time:
- obtain information about the data we process about you and receive a copy of it;
- have inaccurate data corrected;
- request the deletion of your data, subject to our legal retention obligations;
- object to certain processing, in particular processing based on our legitimate interest;
- withdraw your consent to newsletter emails;
- receive your data in a common format or ask for it to be transferred to another provider (portability).
To exercise these rights, write to us at [email protected]. We may ask you to verify your identity. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, where the GDPR applies, with the data protection authority of your country of residence.
13. Changes
We may update this policy to reflect changes to the Service or the law. The version in force is the one published on this page. In case of material changes, we will inform you by email or in the dashboard.
Last updated: 3 October 2026