Privacy Policy

Introduction

This policy explains how ShopyLink SARL (“ShopyLink”, “we”, or “our”) collects, uses, and protects personal data belonging to solution users and website visitors.

We protect your privacy in accordance with the GDPR and Luxembourg data-protection laws.

Data controller

The data controller is:

• ShopyLink SARL
• RCS : B296597
• Registered office: 58 Station Avenue, 4130 Esch-sur-Alzette, Luxembourg
• Email: contact@shopylink.lu

Data collected

Restaurant, company, and team data

• Name, email, phone number, and role in the organisation
• Restaurant or company name, address, opening hours, zones, menus, products, prices, stock, and service settings
• Credentials, login logs, management actions, and usage data
• Billing information, payments, and ShopyLink credit-balance movements where applicable

Ciyou end-customer data

• Name, phone number, and email where provided
• Delivery address, instructions, basket, order history, preferences, and loyalty data
• Order statuses, incidents, support messages, and information required for delivery tracking

Driver data

• Identity, contact details, availability, mission status, and delivery history
• Approximate position or geolocation while actively using the driver app or during a delivery, when this feature is enabled
• Device technical data, activity logs, and security-related information

StaffLink employee data

• Identity, professional contact details, position, department, site, manager, and internal status
• Schedules, working hours, time records, lateness, absences, leave, tasks, approvals, and related histories
• HR documents, supporting files, support exchanges, and data needed for team administration
• Device technical data, login logs, roles, permissions, and security actions

Browsing data

• IP address, browser, device, pages visited, visit duration, cookies, and authorised trackers

Purposes of processing

Data is processed to provide, secure, and improve ShopyLink, Ciyou, and StaffLink.

• Creating and administering restaurant, driver, company, employee, and team accounts
• Managing menus, orders, preparation, deliveries, notifications, and support
• Assigning deliveries to drivers and tracking operational progress
• StaffLink management of schedules, time records, absences, tasks, documents, approvals, and internal reports
• Billing, contract management, accounting compliance, and complaint handling
• Security, fraud prevention, technical diagnostics, product improvement, and performance measurement

Legal basis

• Contract performance: processing required to provide the Service
• Consent: marketing communications, withdrawable at any time
• Legitimate interest: service improvement and security
• Legal obligation: retention of billing data

Retention periods

• Professional account data: contract duration, then archived according to legal obligations
• Order, delivery, and support data: the period needed for operations, complaints, and accounting obligations
• StaffLink schedule, time-record, absence, task, document, and approval data: contract duration, then archived according to legal obligations or Customer instructions
• Driver geolocation data: limited to the activity needed for delivery tracking, then restricted or aggregated where possible
• Browsing data and cookies: according to consent settings and applicable legal requirements

Data recipients

Data is shared only where necessary for the service to work.

• The relevant restaurant receives the information needed to prepare and track the order
• The assigned driver receives the information needed for pickup and delivery
• The StaffLink employer or administrator receives the information needed to manage its team and internal processes
• ShopyLink teams and hosting, messaging, support, payment, and business-tool providers may access strictly necessary data
• Competent authorities may receive information where required by law

Our commitment

ShopyLink does not sell users' personal data.

Transfers outside the EU

Data is hosted in the European Union. Appropriate GDPR safeguards, such as standard contractual clauses and certifications, apply to third-country transfers.

Data security

We implement appropriate technical and organizational measures, including encryption, access controls, regular backups, and continuous infrastructure monitoring.

Your rights

Under the GDPR, you have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time.

To exercise these rights, email contact@shopylink.lu.

Complaint

You may lodge a complaint with Luxembourg’s National Commission for Data Protection (CNPD): cnpd.public.lu.

Policy changes

Changes will be published on this page with an updated date. Please review it regularly.

Contact

For questions about this policy:

• Email: contact@shopylink.lu
• Address: ShopyLink SARL, 58 Station Avenue, 4130 Esch-sur-Alzette, Luxembourg