Privacy Policy

We receive information directly from you, from the relevant Restaurant, payment provider, or connected service, automatically from your device or use of the services, or by generating it through the requested service.

Information marked as required is needed to provide the requested account, order, payment, or other service. If it is not provided, the relevant service may not be available. Other fields are optional.

These descriptions apply to the features available in the service you use. In the consumer app, supported sign-in methods may provide a verified email address or phone number and an account identifier. Available loyalty features may use membership, points, rewards, redemption history, and a device installation identifier. With the relevant device permission, precise location may be used to show nearby Restaurants or verify presence for a loyalty event. You can manage location permission in your device settings.

In the consumer app you can add a profile photo. You can choose a photo on your device or use the photo of the Google account you sign in with. Fiest stores an uploaded photo privately in the EU and shows it only to you in the app, unless you share it as described in Section 9. The photo is deleted when you replace or remove it or delete your account. A profile photo is optional.

To record a visit or apply a benefit, your membership is identified when restaurant staff scan the member code in your app or Wallet pass, when you scan a Restaurant's QR code or tap its NFC tag, or when you tap your phone on a Fiest terminal. Fiest then records your membership, the Restaurant, and the time and method of the event. QR codes are read on your device; the camera image is not sent.

If a Restaurant offers its gift cards in the Fiest app, the app shows you that Restaurant's gift cards sent to the verified email address of your account, and you can add a card by entering or scanning its code. The app shows the card's balance, validity, code and transactions; a suggested card's code is shown only after you add it. The Restaurant issues the card and sees its balance and use, but not whether it has been added to a Fiest account. Linking a card to your account is part of your Fiest account, for which Fiest is controller, but the gift card and its transactions remain the Restaurant's records. A card can be in only one Fiest account at a time. You can remove a card from your account in the app. Removing it does not change its balance, expiry date or redemption terms, or cancel the card.

If a Restaurant offers rewards for inviting friends, you can share an invitation as a link, code, QR code or image through your own apps, and accept invitations from others. Fiest does not read your phone's contacts. Fiest processes your invitation codes and links, the Restaurants and offers you include, who accepted whose invitation and when, the resulting rewards and the Orders they are used on. People who open your invitation see the offer and the Restaurants you chose. The person who invites and the friend may see each other's first name, and the Restaurant sees the invitation rewards used with it.

If you allow notifications, the app registers a push token for your device and links it to your account so that we can tell you how your orders are progressing and send other notifications you have chosen. The app's Inbox keeps messages about your Orders, rewards and offers for a limited time, also when notifications are off. On iPhone, you can also follow an Order on the Lock Screen. You can turn notifications off in the app or in your device settings. If you join a Restaurant's loyalty program, you can choose to receive its news and offers as notifications. The Restaurant decides their content, and Fiest delivers them on its behalf. You can turn them off for one Restaurant or for all Restaurants in the app.

We use personal data to provide accounts and requested services, process orders and payments, issue receipts, provide support, protect and improve the services, prevent misuse, communicate where permitted, and meet legal obligations. With your consent, Fiest emails you about Fiest and about rewards and offers from participating Restaurants.

A Restaurant may enable analytics based on its own transaction data. Where a Restaurant's agreement with Fiest provides for it, Fiest may also create anonymous statistics on the Restaurant's instructions from data combined across several businesses. We may use genuinely anonymous information for service improvement, benchmarks, and analytics models. Anonymous information is not personal data.

Connected applications, payment providers, and AI features process the information needed for the feature the user chooses. The relevant providers are identified in the sub-processor register or in the feature. A connected provider applies its own terms and privacy notice where it acts independently.

Fiest does not currently make decisions about an individual that produce legal effects or similarly significantly affect them based solely on automated processing. If a service introduces such processing, for example automated fraud or abuse prevention, Fiest will describe it and the safeguards under Article 22 of the GDPR, including the right to human intervention, before it starts.

Notifications about your orders and your account are part of the service you requested. Promotional notifications are sent only with your consent.

You may object to processing based on legitimate interests. We will stop unless compelling legitimate grounds or legal claims justify continued processing. An objection to direct marketing stops that processing.

Fiest Oy is controller where it determines the purposes and means of processing for its own customer relationships, billing, security, account, support and other communications, service administration, service-usage analysis and improvement, and marketing. This includes your Fiest account, the invitations you share or accept through it, and Fiest-wide loyalty, gift card, benefit or referral programmes whose rules Fiest sets and whose benefits can be used across Restaurants. Programme terms and privacy notices are provided when you join.

A Restaurant is generally controller for its customer, order, payment-linked, Restaurant-specific loyalty and analytics data. It determines the lawful basis and provides required notices. Fiest processes this data on its instructions under the Data Processing Agreement at https://fiest.io/en/data-processing-agreement, including when providing support. Restaurant-specific notices may also apply. Linking an order to your Fiest account and showing it in your order history is part of your Fiest account, for which Fiest is controller; the order and its payment remain the Restaurant's records.

Where a Restaurant's agreement with Fiest provides for it, Fiest also acts as processor when anonymising Restaurant Data on documented Restaurant instructions for the Restaurant's selected reporting, analytics and benchmarking services under the DPA. These instructions do not cover anonymisation solely for Fiest's own purposes. Only demonstrably anonymous results fall outside data-protection law; pseudonymised data remains personal data. Fiest does not use remaining personal data for an independent purpose unless the applicable roles, lawful basis, transparency, retention and data-subject safeguards have been established.

For catering requests or reservations sent directly to a specified Restaurant through Fiest, the Restaurant generally controls the data and Fiest processes it on its behalf. Acknowledging a request does not necessarily confirm the event or reservation; the service explains when it is confirmed.

Where a Service determines which Restaurants receive your enquiry, booking or request, Fiest controls its collection, checks and distribution. Each recipient Restaurant controls its response and later use. For any jointly controlled step, the applicable service terms allocate responsibilities under Article 26 of the GDPR, the Service notice explains the essence of that arrangement, and you may exercise your rights against either controller.

Payment providers and other connected services may act independently or directly for the Restaurant under their own agreements and privacy notices.

Continued retention is limited to the relevant records and purpose. It does not justify keeping an entire account history or unrelated message content.

Finnish accounting law requires accounting vouchers and transaction correspondence for at least six years from the end of the calendar year in which the financial year ended. Financial statements, accounting books, the chart of accounts and the list of accounting records and materials must remain for at least ten years from the end of the financial year. A specific legal obligation may require another period. These rules apply to accounting material, not automatically to every personal detail in an order, enquiry or account.

Restaurant-controlled data follows the Restaurant's documented instructions and the retention, return and deletion terms of the DPA and service agreement. A Restaurant or another provider may lawfully retain its own records after Fiest deletes its copy or your account. Uninstalling an app does not delete the account.

You can delete your Fiest account in the app (Profile > Account details > Delete account) or by following the instructions at https://fiest.io/en/app/delete-account. Account deletion immediately disables sign-in and initiates deletion of your profile, profile photo, loyalty memberships, balances and activity, push tokens and Wallet registrations without undue delay. We retain only the limited records necessary for the lawful purposes described above, including evidence of consent or objection, legal obligations and the establishment, exercise or defence of legal claims. Loyalty passes already added to Apple Wallet or Google Wallet are deactivated; Google may keep a deactivated Google Wallet pass, including your name, under its own terms, and you can remove it in Google Wallet. Order and payment records that Restaurants and payment providers keep for accounting are not deleted, but they are no longer linked to a Fiest account. Error reports, security logs and backups are deleted on their normal schedule.

Contact legal@fiest.io to ask which retention period or criterion applies to your data or to request deletion.

We use cookies and similar browser storage as follows.

In signed-in business services, Fiest may process limited usage and error information linked to the account where reasonably necessary to support, secure, and improve the service. This processing is based on Fiest's legitimate interests, and you may object to it. Optional analytics and session recording require consent where the law requires it. You may reject or withdraw consent through Cookie preferences in the website footer or the analytics/privacy settings in the relevant application, without affecting necessary functions. Catering uses consent-based page and form-step analytics with session recording disabled. The Fiest consumer app does not use product analytics or session recording. It sends limited technical error and performance information to the monitoring providers described in Section 8. Analytics choices apply to the service in which you make them; changing a website preference does not automatically change another application's settings. Providers used in a payment, embedded content, or another requested third-party service may use their own storage under their privacy notices.

We process technical, error, performance, and security information where reasonably necessary to operate, protect, support, and improve the services.

Fiest uses service providers both for its own activities as controller and to process Restaurant Data on behalf of Restaurants. The role depends on the data and purpose. We require by contract that service providers processing personal data on our behalf use it only on our instructions and protect it to at least the standard described in this policy.

The Restaurant-data sub-processor register at https://fiest.io/en/subprocessors identifies providers, purposes, and processing locations for Fiest's processing on behalf of Restaurants. It is not a list of every recipient used for Fiest's own controller activities described above. Using a provider for those activities does not by itself appoint that provider as a Restaurant-data sub-processor.

Connected channels: where available, you can connect a messaging app or an AI assistant to Fiest and use Fiest through it to ask for information, make changes and receive scheduled messages you subscribe to. Fiest sends what you ask for or subscribe to, limited to what your role in Fiest allows, for example tasks, team members' names and the contact details you add, sales and order summaries, and alerts. Fiest does not send the contact details of the Restaurant's customers, such as their phone numbers and email addresses, to a connected channel. In a conversation with a Fiest bot, Fiest makes a change only after you confirm it. When a Fiest bot reads a message, including a voice message, Fiest sends it together with the names of the Restaurant's team members to the AI service providers listed in the sub-processor register. The provider of a connected channel processes your conversation, including Fiest's replies, under its own terms and privacy policy. It is not a Fiest sub-processor and does not process the conversation on Fiest's behalf. Fiest is controller for the connection details and processes your requests and their results on the Restaurant's behalf as Restaurant Data. You can disconnect in Fiest at any time. Do not send health information or other special categories of personal data through a connected channel.

Fiest adds a channel to this list before it becomes available and states any information the channel carries beyond what is described above.

Payment providers and services selected or connected by a Restaurant may process data under their own agreements and legal roles. Their own privacy notices apply.

We disclose data to the Restaurants that need it to provide what you asked for. For an order or a loyalty benefit that is the Restaurant you ordered from. If a Service passes your request on, more than one Restaurant may receive it before you choose between them. We also disclose data to the service providers described in Section 8, to professional advisers where necessary, and to authorities when required by law. When a user uses a connected channel, the information they ask for or subscribe to, which may include information about team members and the Restaurant's orders, is disclosed to that channel's provider as described in Section 8. When your membership is identified, the Restaurant's staff see the name in your profile and the benefits you can use, and the Restaurant can see your membership and activity in its own programme. When you order in the app, the contact details in your Fiest account that the Order needs, such as your name and email address and, for some Orders, your phone number, are written on the Order so that the Restaurant can recognise you and contact you about it.

If the app lets you share your profile with a Restaurant and you choose to, for example when you join its loyalty programme, Fiest discloses to that Restaurant only the details the app shows you before you agree, such as your name, profile photo, email address and phone number. Sharing is optional, and declining does not affect your membership or orders. The Restaurant then controls its use of these details under its own privacy notice, for example to recognise you or to contact you. You can stop sharing with a Restaurant at any time in the app. This stops further sharing but does not affect sharing that took place before. To have details the Restaurant has already received deleted, contact the Restaurant.

Some providers and their support operations may process data outside Finland or the EEA, including in the United States. Hosting data in the EEA does not by itself exclude access from another country. The location and protection applicable to a transfer depend on the receiving entity and the service used.

For transfers for which Fiest is responsible, Fiest relies on a European Commission adequacy decision where the destination and recipient are covered by that decision. Otherwise, Fiest uses the Commission's Standard Contractual Clauses or another mechanism permitted by the GDPR, assesses the protection of the transferred data, and applies supplementary safeguards where required. A provider's general privacy notice alone does not establish the safeguard for Fiest's transfer.

You can request information about the recipients and destination countries relevant to your data, the applicable transfer mechanism, and a copy of the relevant safeguards by emailing legal@fiest.io. We may redact information needed to protect other people's data, confidential commercial details, or security, while providing the information necessary to explain the protection for your data. Where a Restaurant or connected provider is responsible for a separate transfer, its privacy notice and contact details explain how to request the corresponding information.

Depending on the circumstances, you may have the right to access, correct, delete, restrict, or receive your personal data, object to certain processing, withdraw consent, and lodge a complaint with a supervisory authority.

If processing is based on your consent, you may withdraw it at any time through the relevant settings or by contacting us. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

For Restaurant-controlled data, contact the relevant Restaurant first. Fiest assists the Restaurant under the Data Processing Agreement. For processing controlled by Fiest, use the available account controls or contact legal@fiest.io. We may verify your identity and may retain data where law permits or requires it.

You may lodge a complaint with the Office of the Data Protection Ombudsman in Finland or another competent supervisory authority.

Website: tietosuoja.fi Email: tietosuoja@om.fi Address: PL 800, 00531 Helsinki

Fiest's restaurant platform is a business tool for adults. The consumer ordering and loyalty services are not directed at children under 13, and we do not knowingly create accounts for them. A minor may place an order that is customary for their age under Finnish law, as described in the Consumer Terms. If you believe a child has given us personal data without the required permission, contact legal@fiest.io. We will assess the report and take the steps required for our role, including deletion where required.

We use technical and organisational measures appropriate to the nature and risk of the processing. If a personal data breach is likely to create a high risk to you, we will notify you as required by law. Please protect your account and device and contact us if you suspect misuse.

We may update this policy when the Platform, providers or legal requirements change. We preserve versioned copies and update the date below. We notify affected individuals of material changes through the app, by email or through another appropriate direct channel, sufficiently in advance for them to understand the change and exercise their rights. Where applicable law requires information or consent before new processing begins, we provide that information or obtain that consent beforehand. A change required immediately by law or needed to address an urgent security risk may take effect sooner only where legally permitted, with notice as soon as reasonably practicable. This version takes effect on 4 November 2026. For registered Restaurants, the updated Terms of Service and Data Processing Agreement take effect on 5 December 2026, the date given in the notice sent to them. Changes to contractual commitments remain subject to the Terms of Service and DPA.