Krifoo — Legal Documentation, Privacy Policy & Terms

1. Scope and Applications

This Privacy Policy sets forth the principles under which Krifoo ("we", "us", or "our") governs the collection, recording, storage, and processing of personal data. This document applies to all users interacting with our mobile applications and related web services:

Krifoo Mobile: Consumer client application for iOS (Bundle ID: com.krifoo.mobile) and Android (Package Name: com.krifoo.mobile). Used by customers to view restaurant menus, execute table reservations, place takeaway and delivery orders, and monitor order progression.
Krifoo Admin: Merchant client application for iOS (Bundle ID: com.krifoo.admin) and Android (Package Name: com.krifoo.admin). Used by licensed restaurant operators and kitchen personnel to accept orders, manage catalog availability, organize seating, and execute point-of-sale receipt printing.
Web Applications & APIs: Hosted at https://krifoo.co.uk.

Notice on Data Monetization

Krifoo does not sell, lease, commercialize, or rent consumer personal data or device geolocation coordinates to third-party data brokers, advertising networks, or marketing intermediaries.

2. Categories of Data Collected

We process personal data provided directly by users and technical telemetry generated through system interaction:

2.1 Customer Profile & Transaction Data (Krifoo Mobile)

Identification Records: Full legal name, verified mobile contact number, email address, and optional avatar photograph.
Fulfillment Addresses: Delivery locations, street designations, postal codes, and specific courier access instructions.
Transaction Histories: Item line-orders, dining reservation schedules, special dietary annotations, subtotal and tax amounts, and timestamps.
Payment Information: Encrypted payment tokens. Payment card numbers, expiration dates, and CVVs are handled exclusively by Level 1 PCI-DSS certified payment processors. Krifoo does not retain unencrypted payment credentials.
Communications & Feedback: Support inquiries, ratings, reviews, and damaged item reports submitted through support channels.

2.2 Commercial Partner Data (Krifoo Admin)

Commercial Entity Records: Registered restaurant business name, operating premises address, manager contact details, and corporate identifiers.
Catalog & Operational Content: Menu specifications, pricing matrices, dish availability statuses, table capacities, and kitchen schedules.
Hardware Identifiers: Bluetooth hardware addresses, local network IP addresses, and printer specifications (e.g., Epson TM-m30III, ESC/POS hardware) utilized for thermal ticket printing.

2.3 Telemetry & Technical Metrics

Device Diagnostics: Hardware manufacturer, device model, operating system build, network operator, and network IP addresses.
Performance Data: Application crash stack traces, API response latencies, and system event logs.

3. Hardware & System Permissions

In compliance with Apple App Store Review Guideline 5.1.1 and Google Play Developer Policies, permissions are requested strictly on an as-needed basis:

Permission Type	Application Scope	Technical Key	Functional Justification
Location (GPS / Network)	Krifoo Mobile	`ACCESS_FINE_LOCATION` `NSLocationWhenInUseUsageDescription`	Enables discovery of nearby restaurants, validates delivery radii, and assists in accurate address selection. Revocable in OS settings.
Optical Camera	Krifoo Mobile	`CAMERA` `NSCameraUsageDescription`	Enables scanning of physical QR codes affixed to dining tables to load in-restaurant digital menus.
Photo Library / Storage	Both Applications	`NSPhotoLibraryUsageDescription` `READ_MEDIA_IMAGES`	Facilitates profile avatar updates and permits attaching visual evidence when filing order damage claims.
Push Notifications	Both Applications	`POST_NOTIFICATIONS`	Transmits critical order lifecycle events: order acceptance, preparation state, dispatch, and reservation status.
Bluetooth & Local Network	Krifoo Admin	`BLUETOOTH_CONNECT` `NSLocalNetworkUsageDescription`	Discovers and communicates with POS thermal ticket printers and kitchen hardware over Bluetooth or local Wi-Fi.
System Wake Lock	Krifoo Admin	`WAKE_LOCK`	Prevents merchant operational terminals from sleeping during business shifts to avoid missed orders.

4. Processing Purposes

Personal data is processed under contractual necessity, statutory obligation, and legitimate commercial interests:

Order Fulfillment: Relaying order details to merchant kitchens, facilitating delivery routing, and confirming table reservations.
Account Verification: Authenticating user sessions via One-Time Passcodes (OTP) and defending against automated credential abuse.
Operational Communications: Issuing transactional receipts, order progression updates, and resolving customer service requests.
Merchant Operations: Powering kitchen dispatch screens, automated thermal ticket printing, and sales accounting.
Legal & Statutory Compliance: Adhering to applicable taxation, accounting standards, and food product traceability laws.

5. Third-Party Disclosures

Data is transferred only to authorized processors bound by data protection obligations:

Partner Restaurants: Merchant kitchens receive only the item specifications, recipient first name, phone number, and physical delivery address necessary for fulfillment.
Geographic Information Services: Google Maps Platform API is utilized to translate coordinates and calculate transit times under Google's Privacy Policy.
Push Notification Gateways: Firebase Cloud Messaging (FCM) and Expo Push Service are utilized to deliver real-time operational notifications.
Payment Gateways: Certified PCI-DSS Level 1 payment processors receive tokenized payment authorizations.
Statutory Authorities: Disclosures made strictly when required by enforceable judicial orders or statutory mandates.

6. Data Retention Schedules

Active Profile Data: Maintained for the duration of active account registration.
Fiscal & Transaction Records: Preserved for up to six (6) years following the end of the relevant financial year in compliance with UK HM Revenue & Customs (HMRC) and Companies Act statutory requirements.
Transit Telemetry: GPS coordinates are processed transiently in memory and discarded upon order completion.
Account Deletion Requests: Personal profile identifiers are permanently erased from production databases within thirty (30) days of verified request receipt.

7. Account & Data Erasure (Apple Guideline 5.1.1(v) Compliant)

Users hold the right to obtain the permanent erasure of their account records and personal data:

Erasure Procedures

Direct In-App Erasure: Navigate to Profile → Personal Info → Delete Account within Krifoo Mobile.
Web Submission: Utilize the Account Deletion Tab within this portal.
Written Request: Issue an email to admin@krifoo.co.uk with the subject header "Account Deletion Request".

8. Security Safeguards

We implement administrative, logical, and physical security measures. Network communications utilize TLS 1.2 / TLS 1.3 encryption. Production databases are encrypted at rest with AES-256. Database access is strictly confined to authorized systems engineers under least-privilege principles.

9. Protection of Minors

Our services are not directed to individuals under thirteen (13) years of age (or under sixteen (16) within the UK and European Economic Area). We do not knowingly solicit or maintain personal data from minors. In the event an unauthorized minor account is identified, it will be deleted immediately upon notification.

10. UK GDPR & Statutory Rights

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, data subjects within the United Kingdom possess enforceable statutory rights regarding their personal data:

Right of Access (Subject Access Request - SAR): Obtain confirmation and a copy of your personal data held by Krifoo free of charge.
Right to Rectification: Require rectification of inaccurate or incomplete personal records.
Right to Erasure ("Right to be Forgotten"): Request permanent deletion of personal records where retention is no longer legally mandated.
Right to Restriction of Processing: Request restricted handling of personal records during dispute resolution.
Right to Data Portability: Obtain personal data in a structured, commonly used, machine-readable format.
Right to Object: Object at any time to direct marketing or processing founded upon legitimate commercial interests.

Statutory requests are resolved without charge within one (1) calendar month. Requests may be directed to our compliance desk at admin@krifoo.co.uk.

UK Supervisory Authority (ICO)

You maintain the statutory right to lodge a formal complaint with the UK data protection supervisory authority: the Information Commissioner's Office (ICO) (https://ico.org.uk | Telephone: 0303 123 1113 | Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF).

11. Amendments

This Privacy Policy may be updated to reflect procedural, regulatory, or technical changes. Material modifications will be accompanied by in-app notices or direct email communication prior to the effective date.

12. Compliance Contact

Compliance Desk

Entity: Krifoo Technologies

Email: admin@krifoo.co.uk

Domain: https://krifoo.co.uk

1. Acceptance of Terms

These Terms and Conditions constitute a legally enforceable agreement between you and Krifoo Technologies ("Krifoo", "we", "us"). By accessing or utilizing the Krifoo Mobile Application (com.krifoo.mobile), the Krifoo Admin Application (com.krifoo.admin), or related platforms, you accept and agree to be bound by these terms.

Notice of Mandatory Compliance

If you do not accept these terms in full, you must cease use of the applications immediately and uninstall them from your hardware.

2. Eligibility and User Accounts

Users must be at least 18 years of age (or the age of legal majority in the applicable jurisdiction) to execute orders or register as a merchant partner. Registration requires true and accurate mobile contact information. Users remain liable for all transactions conducted under their session tokens.

3. Marketplace Ordering & Takeaway

Krifoo acts as an intermediary platform connecting consumers with independent dining establishments. Contracts for the purchase and delivery of meals are executed directly between the consumer and the fulfilling restaurant. Stated preparation and delivery timelines are non-binding estimates influenced by kitchen volume and road conditions.

4. Table Reservations

Dine-in reservations are confirmed only once accepted by the respective merchant through Krifoo Admin. In the event a dining party does not arrive within fifteen (15) minutes of the reserved time, the merchant reserves the right to reallocate the table.

5. Pricing, Charges, VAT & Payments (GBP £)

All prices, delivery charges, platform service fees, and gratuities displayed on Krifoo are denominated in Pound Sterling (GBP, £). Product prices are inclusive of applicable UK Value Added Tax (VAT) at the prevailing statutory rate.

Partner merchants establish individual menu pricing. Item subtotals, VAT breakdowns, delivery fees, and applicable platform service fees are clearly presented before checkout authorization. Payments are settled in GBP (£) through certified PCI-DSS Level 1 payment gateways (debit cards, credit cards, Apple Pay, Google Pay) or Cash on Delivery where explicitly permitted by the fulfilling restaurant.

6. Cancellations, Refunds & Consumer Rights

6.1 Perishable Goods Exemption (Consumer Contracts Regulations 2013)

Under Regulation 28(1)(b) of the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, statutory 14-day distance selling cooling-off periods do not apply to the supply of foodstuffs liable to deteriorate or expire rapidly. Users may cancel orders through the application within sixty (60) seconds of submission. Once kitchen meal preparation has commenced, orders cannot be cancelled or refunded for change of mind.

6.2 Substandard, Missing or Damaged Items (Consumer Rights Act 2015)

In accordance with the Consumer Rights Act 2015, meals supplied must be of satisfactory quality, fit for purpose, and match their menu descriptions. Notice of incorrect, missing, or physically damaged items must be submitted via Order History or by email to admin@krifoo.co.uk within two (2) hours of delivery, accompanied by photographic evidence. Confirmed claims will be resolved promptly via item replacement, merchant credit, or refund in GBP (£) to the original payment method within 3 to 7 business days.

7. Merchant Obligations (Krifoo Admin)

Operators utilizing Krifoo Admin warrant strict compliance with UK Food Hygiene Regulations, Food Safety Act 1990 standards, and local environmental health authority licensing. Merchants are responsible for maintaining hardware connectivity for thermal ticket printers (Epson TM-m30III, ESC/POS hardware) and preserving customer contact confidentiality.

8. Dietary & Allergen Disclaimer (UK Food Information Regulations)

Critical Food Safety Notice (14 Statutory UK Allergens)

In accordance with the Food Information Regulations 2014 and UK Food Standards Agency (FSA) mandates, food businesses are legally required to provide accurate information regarding the fourteen (14) recognized allergens: celery, cereals containing gluten, crustaceans, eggs, fish, lupin, milk, molluscs, mustard, tree nuts, peanuts, sesame seeds, soybeans, and sulphur dioxide/sulphites.

Krifoo acts as an intermediary technology platform and does not prepare foodstuffs. All recipe descriptions and allergen notices are provided directly by partner restaurants. Diners with severe food allergies, intolerances, or coeliac conditions must contact the restaurant kitchen directly to confirm ingredient handling and cross-contamination precautions prior to ordering.

9. Proprietary Intellectual Property

All application source code, designs, typography, brand marks, and software compilation rights are the exclusive property of Krifoo Technologies. Users receive a revocable, non-exclusive license solely for authorized operational use.

10. Prohibited Conduct

Prohibited activities include: submitting fictitious orders, automated scraping of menu data, verbal or physical harassment of couriers or merchant personnel, fraudulent refund submissions, and software reverse engineering.

11. Disclaimer of Warranties

THE SERVICES ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR UNINTERRUPTED EXECUTION.

12. Limitation of Liability

Nothing in these Terms excludes or limits Krifoo's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability that cannot be lawfully excluded or limited under the Consumer Rights Act 2015 or the Unfair Contract Terms Act 1977.

Subject to the foregoing, Krifoo shall not be liable for indirect, incidental, or consequential losses, or loss of profits. In all circumstances, Krifoo's total aggregate liability arising out of or in connection with any order or claim shall not exceed the transaction value of the disputed order or £50.00 GBP, whichever is higher.

13. Termination

We reserve the right to suspend or terminate access without notice in the event of documented fraudulent behavior, abusive conduct, or breach of these Terms.

14. Governing Law & Jurisdiction

These Terms, their subject matter, and formation (including non-contractual disputes or claims) are governed by and construed in accordance with the laws of England and Wales.

Both parties agree that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with these Terms, save that consumers resident in Scotland or Northern Ireland may also initiate proceedings in their respective home jurisdictions.

15. Legal Notice Desk

Formal Legal Contact

Department: Legal & Governance