Vendor Privacy Policy
This Privacy Policy aims to clarify what personal data we process, why we process it, who receives your data and how you can exercise your legal rights. Accordingly, in this Privacy Policy, “personal data” means any data which directly or indirectly identifies you as a person, and in a form in which access to or processing of the data is practicable (like the combination of your full name and address, or a user ID connected to your identity). Similarly, “processing” refers to any operation performed on your personal data, for example the collection, storage, use, disclosure, or destruction of your personal data.
1. Who are we?
We are Delivery Hero Food Hong Kong Limited (“foodpanda”, “we”, “us” or “our”) and we are located at 23/F, Tower Two, Times Square, 1 Matheson Street, Causeway Bay, Hong Kong.
With regard to your privacy, it’s us who decide how and for what purposes your personal data is processed. In data protection language that makes us a so-called “Data User” (the party responsible for how your personal data is processed).
If you have any questions related to your personal data and/or would like to reach out to our data protection officer, you can contact us at privacy@foodpanda.hk.
2. What categories of personal data do we process?
| Data Categories | Explanation |
|---|---|
| Company Data | Name, Address, Tax ID, Geolocation Data, Order Data, Trading Licence, Contact Data, Order History |
| Proprietor Data | Name, Surname, Address, ID Data, Contact Information |
| Technical Data | Device Data, Language Settings, Usage Data |
| Order Data | Order IDs, Product Names and Quantities, Order History, Delivery Related Data |
| Financial Data | Bank Account, Tax ID, Payment Recipient Data |
| Customer Support Data | Content of Support Chat |
3. What do we do with your personal data?
In order to provide services on our vendor portal, we use various tools and systems that are necessary for the operation of the app. Accordingly, we collect, process and store the following categories of personal data when you use the app:
We process the above categories of personal data for the following purposes:
| Purpose | Description and Legal Basis |
|---|---|
| Account Creation and Maintenance | The data we request during the account creation process is necessary to take the first step in establishing a business relationship with you so that we can provide you with our services. We only ask for your data that is necessary for this purpose. Categories of personal data:
|
| Order Processing & Delivery | The following data is necessary for us to conclude your order and ensure the successful delivery. Categories of personal data:
|
| Payment | On a regular basis, your data will be shared with payment providers to facilitate the payment process. Categories of personal data:
|
| Product Analytics | We analyse the usage of the Vendor Portal in order to ensure its security, optimization and effectiveness. Accordingly, Vendor Portal generates and uses anonymous data about the device you used to access. Categories of personal data:
|
| Communication | Different tools are used for communication between you and the partnering entity via email, pushes, SMS or messaging platforms such as WhatsApp etc. The purpose of the processing is the communication of necessary information between the parties involved to ensure we can adequately process your order. Categories of personal data:
|
| Direct Marketing / Online Marketing | We may send you newsletters and promotions via email, pushes, SMS or messaging platform such as WhatsApp, etc. informing you about new offers, deals or campaigns that are available for you on our platform. We will only send electronic communications if you have given us your express consent. You can opt out at any time via message preferences or by contacting privacy@foodpanda.hk. Categories of personal data:
|
4. Who will receive your data and under what circumstances?
You can trust that, within our company, only those staff members will receive access to your personal data who need them in order to fulfill their professional duties. In certain scenarios, we also need to share your personal data with recipients outside of our company set out below. Please be assured that your data is shared with these recipients only to the extent necessary for the specified purposes and only as we are legally permitted to do so.
A. Delivery Hero group companies
We are part of an international group of companies, including our group’s headquarters located with Delivery Hero SE in Berlin, Germany. In order to utilize our resources efficiently, we utilize our group-wide shared technological support services. In certain situations, we might also share limited data with other group companies, for example, to assist with payment collection or to implement platform security measures.
Delivery Hero group companies are bound by strict intra-group data transfer agreements ascertaining compliance with data protection requirements whenever sharing personal data.
B. Data processors
We use various third-party service providers who process your personal data under our instructions. Our user platforms and databases run on cloud resources provided by the EU subsidiaries of Google Cloud Platform and Amazon Web Services. We use marketing and communications tools provided by companies such as SalesForce or Braze. Our finance and accounting platforms are provided by SAP.
C. Other third parties and service providers
In addition to data processors, we also work with third parties such as consultants, lawyers or accountants who process your data independently for legal reasons or to protect our interests. Under no circumstances will we sell or rent your personal data to third parties without your explicit, informed consent.
D. Mergers & acquisitions, change of ownership
In the event of a merger or acquisition, we may need to disclose limited information to that company and their advisors under professional confidentiality obligations. We will ensure that we only disclose the minimum amount of information necessary.
E. Prosecuting authorities, courts and other public authorities
From time to time we may be requested to disclose personal data to public authorities to bring or defend legal claims, protect our rights, or address security concerns, such as cooperating in the detection and prevention of crime or responding to court orders.
5. How do we transfer your personal data to other jurisdictions?
We may transfer personal data to jurisdictions other than the jurisdiction in which you use our services. Where such transfers take place, we take appropriate measures to ensure an adequate level of protection is afforded to your personal data as required by law. For example, when transferring data from Hong Kong, we take safeguards to ensure compliance with data protection requirements.
6. What are your legal rights?
Under the data protection laws, you are entitled to the following rights:
| Right to access | You have the right to ascertain whether we hold personal data of which you are the data subject and obtain a copy. Subject to a reasonable fee, we will respond within forty (40) days. |
| Right to correction | If you notice that your personal data is inaccurate, you can request that we correct it. We will respond within forty (40) days. |
To exercise your rights, you may email the Data Protection Officer at privacy@foodpanda.hk or write to 23/F, Tower 2, Times Square, 1 Matheson Street, Causeway Bay, Hong Kong.
7. How do we use Artificial Intelligence (AI)?
We may use AI to improve our services, such as providing personalized content, product recommendations, or AI Agent chatbots. These technologies may collect and process personal data provided by you. Our intention is not to collect sensitive personal data through AI; therefore, we ask that you avoid providing any sensitive data. You have the right to contact support agents to request human intervention or opt out of AI-related data processing at any time.
8. How long do we keep your data?
We retain your personal data for as long as it is necessary to achieve the purposes described above, determined by the nature of the data and legal retention obligations. We generally delete your data after the purposes have been fulfilled, unless we have a legal right or consent to retain it longer.
9. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. By continuing to collaborate with us as our vendors, you are deemed to consent to our updates. We encourage you to regularly review this Privacy Policy to keep updated.
10. Prevailing Language
The English language version of this Privacy Policy Statement shall control in all respects and shall prevail in case of any inconsistencies with translated versions.
Last modified: 1st April 2026