Privacy Policy

Last updated: 6th November 2023

Summary "First Layer" – Privacy Policy

1. Who processes personal data?

As detailed in the Legal Notice, HONEST GREENS is the owner of the Honest Greens App (hereinafter, the "App") and the Websites (which includes the WebApp).

However, both this Website (for the purpose of requesting general information or job offers) and the App and WebApp (for the purpose of placing orders in restaurants) are used by the HONEST GREENS companies that own each of the Honest Greens restaurants listed in the aforementioned Legal Notice, which act as data controllers for the personal data of Users (i.e. the people who browse and interact with them) who place orders at the specific restaurant or in relation to job offers or to obtain general information.

When operations involve joint processing, HONEST GREENS and the HONEST GREENS companies involved will do so as joint controllers under the terms of Article 26 of the GDPR .

2. Under what rules is personal data processed?

In order to access, browse and use the App, WebApp or Websites, it is mandatory to read and, where applicable, accept the Legal Texts (i.e. the Legal Notice, this Privacy Policy , the Terms and Conditions and the Cookies Policy) that regulate its use.

The processing of the User's personal data will be carried out in accordance with the provisions of this Privacy Policy, and may include processing based on their express consent in the cases provided for by law.

The use of non-technical cookies will require the User's prior consent, which can be managed at any time through the settings panel available in the App, the WebApp or the Websites, in accordance with the provisions of the Cookies Policy.

Further details on the use of automated data and artificial intelligence (AI) are provided below.

3. What data is processed?

The personal data processed will depend on the browsing and actions required by the User (whether for restaurant orders or job offers).

For example, we use location if the User allows it, to show you the nearest restaurant.

And, if the User invites a friend to the Websites', App or WebApp, we need their email address to send them the invitation.

This data is as follows:

• Contact details: name, email address, telephone number, and addresses (home, office or similar) for deliveries .
• Third-party data: when the User invites others or purchases gift cards, their data and that of third parties is processed.

The User guarantees that they have obtained a valid legal basis, including express consent where necessary.

• Business users (Honest Base): the email addresses of employees or designated beneficiaries are processed.

The business customer guarantees the lawfulness of the processing of this data.

• Profile data: when registering with Google or Apple accounts, the User's profile information is accessed.

The privacy policy of these third parties shall apply.

• Order and banking details: order details, purchase history, and bank card details used for the transaction.
• Communication data: opinions, queries, support, complaints, and preferences.
• Connection and location data: IP address, device type, location (when consented to), and other technical information.

This data is not linked to identification data and is only processed for security and fraud prevention purposes.

• Automatically generated data: When using the App, WebApp or Websites, certain data related to the User's preferences, browsing patterns and consumption habits is automatically generated (e.g. most visited restaurants, most consumed products, frequency of orders or approximate geolocation for deliveries) , which is also processed using artificial intelligence (AI) systems.

When the User completes the registration form, they provide with their name, telephone number and email address .

When requesting home or office delivery services, the User provides with the address(es) of their home, office or similar, which are stored in the User's account .

When the User invites a friend or any other person to join the App and WebApp and create an account, or purchases a gift card for them, collects the names and email addresses of both parties in order to offer discounts or welcome rewards .

When the User shares the personal information of others with HONEST GREENS and HONEST GREENS companies, the User is responsible for ensuring that they have obtained the appropriate permission to do so.

When the User is a company that is a customer of Honest Base services, which designates the employees/beneficiaries who will be part of it, the email addresses of these employees/beneficiaries are collected in order to link them to the discount or reward system pre-agreed between HONEST GREENS ( , where applicable, with the HONEST GREENS company ) and the company in question.

When the customer of Honest Base services shares the personal information of their employees with HONEST GREENS or a HONEST GREENS company, the customer is responsible for having sufficient legal basis to do so.

Whenand the user is a natural person who is interested in filling a vacancy in a job that we publish, the data from their CV is collected that they provide or send us (including data on their previous work experience) processed with the relevant HONEST GREENS companies for the vacancy corresponding to the job to be filled in order to arrange the corresponding interview and, where appropriate, to carry out the recruitment with the corresponding additional data necessary relating to their membership number and ID card number.

Profile data When the User's data is entered into the registration form via their Google or Apple user account, HONEST GREENS and the relevant HONEST GREENS company receive the User's profile data from the user account of these third parties.

The platform provider's privacy policy will apply to the User's interactions and to the collection, use and sharing of the User's personal information.

HONEST GREENS will keep the access password associated with the User's account and established by the User during the registration phase confidential.

Data accessed in "Sign in with Google" HONEST GREENS will only access your email address and full name to create your profile.

No other data will be used.

Order and banking data When the User places orders with any of the HONEST GREENS restaurants, the transaction information (credit card details; specifically, the name, card number, expiry date and CVV number) is provided to HONEST GREENS .

Regarding payments and transactions, data relating to the amount, currency and payment method used shall be processed in accordance with the applicable legislation in the place of service or sale (EUR in Spain and France; GBP in the United Kingdom), solely for the proper execution of the order and compliance with the corresponding accounting, tax and consumer obligations.

The App and WebApp also record details of the order history associated with the User's account.

Communication and shipping data Such data is processed when the User communicates with HONEST GREENS for any purpose, such as giving feedback, requesting help or support, making complaints, etc.

Likewise, when the User requests to receive communications about HONEST GREENS products and services, restaurants, newsletters.

The User's personal data, such as their preferences regarding products and services, gender, location (if expressly consented to by the User), or other information from the social media user account ( if the User has registered with their social media account ) may be used to create User profiles for marketing purposes or suggestions for contacting friends.

These profiles do not imply any automated decision-making that may affect the User's rights and interests, apart from what is detailed in the Legal Texts above regarding the use of artificial intelligence.

In any case, the User may deactivate the use of their data for marketing profiling at any time from the App/WebApp settings panel or by clicking on the unsubscribe link in each communication.

Further information on the logic applied can be requested at hello@hg.uk.

Connection data Information about the User's device, IP address, online activity, location-based information or similar information may be collected by HONEST GREENS and HONEST GREENS companies for statistical and security purposes (i.e. to prevent identity theft, fraudulent orders or undeliverable deliveries).

HONEST GREENS and HONEST GREENS companies do not link this information to Users' identification data nor do they keep records for purposes other than those described in this Privacy Policy.

Employment data Social Security number, identification number, date of birth, union data and data required regulationsby mandatory.

The User undertakes to provide true, accurate, current and complete personal information. r, where applicable, the User guarantees that they have informed and obtained the consent of third parties for the use of the App, the WebApp, and its functionalities when the User has provided third-party data.

4. Are artificial intelligence systems used in the App?

Yes.

Certain features may be partially automated using artificial intelligence (AI) technologies, such as:

• Personalised product or menu recommendations;
• Automatic customer service via chat or form;
• Analysis of behaviour patterns to improve service.

Recommendations are generated automatically based on order history, most visited restaurants and browsing preferences.

In any case, there is always human supervision and no exclusively automated decisions are made that produce legal effects.

HONEST GREENS and HONEST GREENS companies guarantee that the use of automated systems does not involve decisions without human intervention that produce legal or significant effects for the User.

When interacting with an automated system, will clearly inform you, in accordance with Regulation (EU) 2024/1183 (AI Act) .

5. What are the purposes and legal bases for the processing of Personal Data?

The legal bases for the processing of personal data vary depending on the purpose of the processing of such data.

In particular, the purposes and legal bases for the processing of personal data are as follows:

• To create, manage and administer the User's account, based on the performance of the contract.
• To process and manage orders, including communicating them to local restaurants, delivery networks or other service providers involved in the services offered on the App and WebApp, based on the performance of the contract.
• To manage complementary services related to gift cards and loyalty discount programmes, based on the performance of the contract.
• To contact the User in the event of incidents, delays, errors in the order or delivery, security alerts and/or administrative notifications by email, in accordance with the execution of the contract.
• To answer questions and improve the service and user experience, based on the legitimate interest of efficiency and continuous improvement.
• To send promotions, discounts and offers, as well as to administer surveys and other types of market research, compile statistics on aggregated or pseudonymised data or for similar research and development purposes, based on legitimate interest and, where applicable, based on the User's express consent.

In any case, the User may choose not to receive commercial and promotional communications from HONEST GREENS and HONEST GREENS companies or withdraw their consent at any time.

• To deal with complaints and claims, based on legal obligations,
• To ensure security, based on legitimate interest.

In particular, to enable the secure functions of the App and WebApp, such as sending the User's security codes and remembering the details of the User's device and the connection data from which the User connects to the App and WebApp.

• To be able to track delivery personnel to find out the status and estimated delivery time of the order, based on the legitimate interest of offering a quality service to customers.
• To interview candidates interested in filling a job vacancy and, where appropriate, to hire them.
• To comply with applicable laws, the requirements of judicial or administrative authorities, based on legal obligations.
• To defend the rights of HONEST GREENS and HONEST GREENS companies and their suppliers, including the filing of any lawsuits and defence of legal claims or to prevent and investigate fraudulent, harmful and/or illegal activities, including cyberattacks and identity theft, based on legitimate interest.
• Finally, HONEST GREENS and HONEST GREENS companies may create profiles for commercial and service improvement purposes, without adopting automated decisions with legal or significantly similar effects (Art. 22 GDPR), based on legitimate interest.

Likewise, HONEST GREENS and HONEST GREENS companies will use such data solely to offer personalised features, improve the service and develop new products or promotions, without sharing them with third parties without the User's express consent.

6. What are the retention periods for personal data?

The data collected through the App and Websites will be kept by HONEST GREENS and HONEST GREENS companies for the period strictly necessary to fulfil the purposes indicated above and, in any case, for as long as the User's account remains active on the App and WebApp.

CVs will be kept for a maximum of one year after they have been submitted by the candidate to HONEST GREENS or HONEST GREENS companies if the candidate has not been hired for the vacancy, in case other vacancies become available during the following year so that HONEST GREENS and HONEST GREENS companies can offer the candidate such a vacancy if appropriate.

Once the account has been deleted, or after the right of erasure has been exercised, the data will remain blocked until any legal liabilities that may arise from the processing of the data or the provision of the service have expired, in accordance with current legislation.

For example, here are some examples:

a) Spain:

• 5 years for claims arising from contractual obligations (Art. 1964 Civil Code).
• 6 years for commercial and accounting obligations (Art. 30 Commercial Code).
• 4 years for tax matters (Art. 66 General Tax Law).

b) France:

• 5 years for contractual actions (Art. 2224 Civil Code).
• 10 years for commercial and accounting obligations (Commercial Code).
• 3 years for consumer matters relating to goods and services (Code de la consommation).

c) England and Wales (United Kingdom):

• 6 years for simple contracts and civil liability actions (Limitation Act 1980).
• 3 years for personal injury.
• In matters of consumer protection and data protection, the 6-year limitation period generally applies.

7. Who are the recipients of personal data?

Based on legitimate interest, User data may be made available by HONEST GREENS and HONEST GREENS companies to IT service providers, such as hosting and email servers, as well as financial institutions for the collection of payments, transport companies for home deliveries or external accounting firms for the processing of invoices.

The data may also be transferred to other companies, as Honest Greens restaurants are managed by several companies that need access to User data or, where appropriate, the transfer of such data in order to provide an efficient service or, where applicable, in relation to a job offer.

Details of all HONEST GREENS companies that own Honest Greens restaurants can be found in the Legal Notice.

The foregoing shall also be understood to be without prejudice to any legally required data transfers.

HONEST GREENS and HONEST GREENS companies may transfer information relating to User preferences between themselves, which allows HONEST GREENS companies that own Honest Greens restaurants to offer various discounts and/or promotions based on these preferences, as well as to share with the companies that manage Honest Greens restaurants the ratings and comments posted by Users in order to improve the service provided and enhance the User experience.

However, once the order has been placed, access to personal data is only enabled for the company Honest Greens Barcelona S.A.U, so that Users receive the necessary support in relation to orders being processed through the chat hosted on the App and WebApp.

In addition, HONEST GREENS and HONEST GREENS companies may give access to User data to the following service providers:

• AMAZON WEB SERVICES, for hosting the App, whose servers are located in Ireland.

For more information, visit: https://d1.awsstatic.com/onedam/marketing-channels/website/aws/en_US/legal/approved/privacypolicy/AWS_Privacy_Notice_2025-07-02_ES_LA.pdf.

• STUART DELIVERY, S.L.U., for goods transport and home delivery services, and to allow Users to track the delivery person via the App and WebApp.

For more information, visit: https://stuart.com/privacy/

• UBER EATS ESPAÑA, for goods transport and home delivery services, and to allow Users to track the delivery person via the App and WebApp.

For more information, visit: https://www.uber.com/legal/es/document/?name=privacy-notice&country=spain&lang=es-es

• GLOVOAPP SPAIN PLATFORM, S.L.U., for goods transport and home delivery services, and to allow Users to track the delivery person through the App and WebApp.

For more information, visit: https://glovoapp.com/docs/es/legal/privacy/?country=es

• APPLE PAYMENTS, INC, as the provider of the APPLEPAY service that provides the App's payment gateway service.

Apple Payments, Inc. is established in the United States, so the provision of services involves an international transfer of data.

However, Apple Payments, Inc. applies the appropriate legal safeguards for international data transfers by having formalised the Standard Clauses required by the European Commission for the legitimacy of the processing, which can be viewed here: https://www.apple.com/es/legal/privacy/.

• ADYEN, as the payment processing platform used for the payment gateway service.

ADYEN is based in Amsterdam, the Netherlands.

For more information on how it may process personal data, please visit: https://www.adyen.com/es_ES/privacy-policy

• SENGRIND (TWILIO, INC.), for communications with users, sending user security codes for authentication during the application registration phase, and other email marketing purposes.

Sendgrid is a subsidiary of Twilio, Inc. located in the United States, so the provision of services involves an international transfer of data.

However, Twilio, Inc. applies the appropriate legal safeguards for international data transfers by having formalised the Standard Contractual Clauses, which can be viewed here.

For more information on the processing of personal data, please visit: https://sendgrid.com/resource/general-data-protection-regulation-2/

• CLEVERTAP (WizRocket), for communications with users, sending user security codes for authentication during the application registration phase, and other email marketing purposes.

Clevertap is located in the United States, so the provision of services involves an international transfer of data.

For more information on the processing of personal data, please visit: https://clevertap.com/privacy-policy/

• ZENDESK, for managing interactions with the Honest Greens customer service team, including queries, incidents, and requests made via chat or web form.

Zendesk, Inc. is based in the United States, so the provision of these services involves international data transfer.

Zendesk is certified under the Data Privacy Framework (DPF) approved by the European Commission.

For more information, visit: https://www.zendesk.es/company/agreements-and-terms/privacy-notice/

• DELIVEROO (Roofoods Ltd.), for delivery services for orders placed through the App in certain locations and to allow Users to track the status of their order.

Deliveroo is based in the United Kingdom, so it may involve an international transfer of data.

The company applies Standard Contractual Clauses approved by the European Commission to ensure an adequate level of protection.

For more information, visit: https://deliveroo.co.uk/privacy

• JELP DELIVERY, for managing order deliveries through the App, tracking via API and routes for delivery drivers.

Jelp Delivery is based in Tijuana, Mexico, so the provision of these services involves an international transfer of data.

Honest Greens applies appropriate legal safeguards for these international transfers, through standard contractual clauses ("SCCs") approved by the European Commission, or another equivalent protection mechanism in accordance with the GDPR.

For more information, visit: https://www.jelp.delivery/legal/privacy HONEST GREENS and HONEST GREENS companies reserve the right to modify or add suppliers, adopting adequate security safeguards in all cases.

8. What are my rights in relation to the processing of my personal data? (ARCOPOL and DATA ACT rights)

Within the limits established by mandatory data protection regulations (including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – GDPR and Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights - LOPDGDD), the User may exercise their rights of access, rectification, erasure, objection, restriction of processing and portability, as well as the right not to be subject to automated decisions, including profiling.

In particular, with regard to the right of access to data generated by the use of the App and WebApp, in accordance with Regulation (EU) 2023/2854 (Data Act), the User has the right to access the data generated by them, including data on purchasing habits, products ordered, frequency, approximate location of orders and preferences, to the extent that such data is technically accessible and does not contain third-party data or trade secrets.

The User may request direct access to this data in a structured, commonly used and machine-readable format, as well as authorise a third party to receive it, by sending a request to hello@hg.uk.

HONEST GREENS and HONEST GREENS companies will provide such access within a reasonable period of time, in accordance with the Data Act, at no cost to the User and without prejudice to the provisions of personal data protection regulations.

Likewise, in accordance with the Data Act, the User may authorise a third party of their choice to access their data generated through the use of the App and WebApp, provided that the third party complies with reasonable technical and security requirements, and may revoke such authorisation at any time.

HONEST GREENS and HONEST GREENS companies will provide such access with the express consent of the User, in accordance with the Data Act.

With regard to data protection, insofar as the processing of data is based on the consent given by Users, they may withdraw such consent at any time without this affecting the legitimacy of the processing carried out prior to such revocation.

Likewise, Users have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD - www.aepd.es).

Users may do all of the above through the contact details indicated in the Legal Notice and, in any case, by writing to , hello@hg.uk, or , indicating or attaching reasonable means of proving their identity .

9. How can I delete my account?

The steps to delete an account from the App or WebApp are as follows: This can be done from the online ordering website at the following address: https://app.honestgreens.com/user-profile or from the Honest Greens App itself on the user profile screen.

To access this section, the user must first log in to their account.

If you are unable to access your account, please contact hello@hg.uk.

Once in this section, go to the settings tab, click on the last button "delete account" and follow the steps.

10. Changes to the Privacy Policy

HONEST GREENS and HONEST GREENS companies reserve the right to modify the processing of data at any time and, accordingly, this Privacy Policy and other Legal Texts ( Cookies Policy, Legal Notice and Terms and Conditions) detailed above, informing the User of this through the contact details provided, with the advance notice required by mandatory regulations.

In the event of modifications that require the express acceptance of the User, such acceptance will be requested before they come into effect.

The User may cancel their account without penalty, in accordance with the procedure set out in the Legal Texts, if they do not accept the new conditions.