Privacy Policy
Last updated: September 21, 2026
This policy explains which personal data we process when you use our food-ordering and loyalty app, why we process it, who we share it with, and what rights you have.
If the Greek and English versions differ, the Greek version governs.
1. Who we are
Field | Value |
|---|---|
Legal name | STIQ MONOPROSOPI IDIOTIKI KEFALAIOUCHIKI ETAIREIA (STIQ ΜΟΝΟΠΡΟΣΩΠΗ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΕΙΑ), trading as “STIQ” |
Legal form | Single-member Private Company (Μονοπρόσωπη Ι.Κ.Ε. / PC) — incorporated 23/02/2022 |
Registered address | 2 Papanikoli St., Chalandri, Attica, 15232, Greece |
ΑΦΜ (VAT number) | 801766890 |
ΔΟΥ (tax office) | Cholargos Tax Office (Δ.Ο.Υ. Χολαργού) |
ΓΕΜΗ | 162941601000 (EUID: ELGEMI.162941601000) |
Contact email | |
Phone | |
Brand names | Protein Garden (operated by STIQ MONOPROSOPI P.C.) |
Controller: STIQ MONOPROSOPI P.C., VAT 801766890, as sole controller for all brands operating in the app.
Data protection officer (DPO): No Data Protection Officer appointed. No appointment required. For any data protection matter contact privacy@stiq.gr.
Privacy email: privacy@stiq.gr
The app is developed and operated by STIQ MONOPROSOPI P.C., which is the controller for all user data. It currently hosts one brand: Protein Garden.
2. Scope
This policy covers:
the Protein Garden app for iOS and Android
the server systems that serve the app
the public web pages for terms, privacy, account deletion and data download
It does not cover third-party sites you open from the app (for example a maps app you choose).
3. Processing table
Purpose | Data categories | Legal basis | Recipients | Retention | Transfer |
|---|---|---|---|---|---|
Account and login | Name, email, phone, hashed password, required birthdate (15+), terms stamp | Performance of a contract (Art. 6(1)(b)) | Our hosting | For the life of the account, then anonymisation or anonymised when the account is deleted | — |
Google / Apple login | Provider id, email/name from the provider (Apple may omit email), tokens, registration ticket | Performance of a contract (Art. 6(1)(b)) | Google; Apple | While linked; tokens are revoked when the account is locked | Where the recipient processes outside the EEA: see section 6 |
Order and pickup | Order lines, customer name/email/phone, notes, declared allergens, store | Performance of a contract (Art. 6(1)(b)) | Grubtech (kitchen system); the store till | Unpaid temporary order: 30 minutes. Completed orders: 5 years from the end of the relevant tax year — after anonymisation the row remains without contact details | — |
Payment | Amount, Viva transaction codes, status | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) for accounting records | Viva Wallet. We do not store card numbers on our server. You enter card data on Viva’s hosted page (WebView). | 5 years, as the tax records above | Where the recipient processes outside the EEA: see section 6 |
Environmental fee / VAT / tip | Amounts calculated on the cart | Legal obligation (Art. 6(1)(c)) — VAT, environmental levy | — | With the order | — |
Loyalty (points, stamps, coupons, vouchers, referrals, tiers) | Balances, point ledger, codes, stored value | Performance of a contract (Art. 6(1)(b)) — loyalty programme terms | The store till, if a voucher or coupon is applied there | Points: 12 months from the date earned. Coupons and vouchers: until the displayed expiry date. On account deletion, points, stamps, coupons and vouchers are deleted. | — |
Operational push (order, chat) | FCM device token, platform | Performance of a contract (Art. 6(1)(b)) — operational notifications, not commercial communication | Firebase Cloud Messaging | Devices inactive 90 days are removed. You can turn off categories in notification settings. | Where the recipient processes outside the EEA: see section 6 |
Marketing push / newsletter | Email, push token, marketing preference | Consent (opt-in; signup box starts unchecked). Express consent (Art. 6(1)(a) GDPR and Art. 11 Law 3471/2006). Withdrawable at any time. | Firebase (push); email mailer Amazon SES | Until withdrawn | Where the recipient processes outside the EEA: see section 6 |
Nearby stores | Device location (while the app is in use) | Consent (Art. 6(1)(a)) via your device's location permission | Google Maps (map tiles). We do not store a GPS trail on the server. | No location history kept | Where the recipient processes outside the EEA: see section 6 |
Support chat | Message text, attachments; for guests: name, phone, temporary guest identifier | Performance of a contract (Art. 6(1)(b)) — customer support | Pusher (delivery); file storage AWS S3 eu-central-1 (Frankfurt) | 24 months from the last message; also deleted when the account is anonymised | Where the recipient processes outside the EEA: see section 6 |
In-app issue reports | Screenshots, app/OS version | Performance of a contract (Art. 6(1)(b)) | — | 12 months from resolution | — |
Allergens you declare | declared allergens on cart and order | Your explicit consent (Art. 9(2)(a) GDPR). Declaring allergens is optional and you provide it yourself. | Grubtech (if sent to the kitchen) | With the order. Removed from order history when the account is anonymised. | Where the recipient processes outside the EEA: see section 6 |
Usage measurement (first-party + Firebase Analytics / Crashlytics) | device identifier, session identifier, screen/cart events, crash reports | Consent (Art. 4(5) Law 3471/2006). Off by default; collection starts only once you grant it. Guests are not stored. | Firebase | 14 months, automatically purged; sooner if you withdraw consent or delete your account | Where the recipient processes outside the EEA: see section 6 |
Personalisation (“Perfect for you”) | Your order history, preferences and reviews | Consent (Art. 6(1)(a)). You may withdraw it at any time in privacy settings and object to personalisation for marketing purposes (Art. 21(2)). | — (processed solely on our own systems) | Deleted when the account is anonymised | — |
Biometrics (Face ID / fingerprint) | We do not store a template. The device unlocks the stored login token. | We do not process a biometric template | — | On-device only | — |
Consent proof | Type, value, IP, user agent, policy version | Legal obligation, GDPR Art. 7(1) | — | Audit rows are kept; IP and user agent are cleared on anonymisation | — |
Security and abuse | Login logs (email, IP, UA), revoked tokens | Legitimate interest (Art. 6(1)(f)) — system security and abuse prevention | — | 12 months | — |
GDPR requests | Email, verification link | Legal obligation Arts. 12/15/17 | Email mailer | Verification link: 24 hours | — |
4. Where the data comes from
From you: registration, profile, cart, order, chat, consents, allergens you declare.
From the device: push token, install id, location when you allow it, Firebase identifiers.
From others: Google or Apple on social login; Viva for payment status; Grubtech for kitchen status; the STIQ engine for segment labels.
5. Recipients and processors
The table below is complete. We use no other payment provider and no SMS provider.
Recipient | Role | Region |
|---|---|---|
Grubtech | Order / menu fulfilment | Where the recipient processes outside the EEA: see section 6 |
Pusher | Realtime (chat / status) | cluster |
Viva Wallet | Payments and refunds | Where the recipient processes outside the EEA: see section 6 |
Google Firebase | Push, telemetry, crashes, Remote Config | Where the recipient processes outside the EEA: see section 6 |
Google Maps | Store map | Where the recipient processes outside the EEA: see section 6 |
Google Sign-In / RISC | Login and revocation | Where the recipient processes outside the EEA: see section 6 |
Apple | Sign in with Apple | Where the recipient processes outside the EEA: see section 6 |
AWS S3 | File storage | eu-central-1 (Frankfurt) · Within the EEA — no Chapter V mechanism required |
Email mailer | Verification, data export | Amazon SES |
StiQ WebPOS | In-store member link | Our own system (STIQ P.C.) — not a third-party recipient |
The unofficial Google Translate PHP library is used in admin tooling, not in the consumer app.
6. International transfers
Our infrastructure is located in the European Union. The database (Amazon RDS), the application server, file storage (Amazon S3) and background processing run in the eu-central-1 (Frankfurt) region. Real-time messaging (Pusher) runs on the eu cluster. No transfer outside the EEA takes place for this data.
Some recipients listed in section 5 may, in the course of their operations, process data outside the EEA — in particular Google (Firebase, Maps, Sign-In), Apple, Amazon SES, Grubtech and Viva Wallet. To the extent such a transfer occurs, it relies on:
the EU–US Data Privacy Framework adequacy decision, where the specific recipient is certified; or
Standard Contractual Clauses (Implementing Decision (EU) 2021/914), accompanied by a transfer impact assessment and any supplementary measures.
You may request a copy or description of the safeguards applying to a specific recipient at privacy@stiq.gr.
7. Retention
The system currently enforces:
loyalty points: 12 months from the date earned
coupons: deactivated after the displayed expiry date
carts: 14 days idle
unpaid temporary orders: 30 minutes
POS visits: 30 minutes
inactive push devices: 90 days
technical logs of order exchange with the kitchen system (Grubtech): 30 days
in-app account deletion: login locked immediately; anonymisation within 30 days or sooner if staff approve
In summary: analytics events 14 months; API, payment and login logs 12 months; support chat 24 months from the last message; automated database backups 35-day rolling. Analytics rows are also deleted when you withdraw consent and on anonymisation; chat on anonymisation.
8. Your rights
You have GDPR Arts. 15–22: access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and objection to automated decisions where they apply.
How to exercise them:
In the app: Profile → Privacy and legal → download my data / request deletion / delete account
Public web pages for account deletion and data download, accessible without the app
Email: info@stiq.gr
We respond within one month (Art. 12 GDPR).
Deleting the account in the app signs you out immediately. Data is anonymised when our team approves or automatically after 30 days, unless you have an ongoing order. Anonymisation removes contact details from orders and deletes points, stamps, coupons, vouchers and their usages, carts, devices, analytics events, support chats together with their attachments, reviews, address, declared allergens in order history, notification settings and login logs. Orders remain without identifying details for as long as tax law requires. A copy may remain in automated database backups for up to 35 days after anonymisation, without being restored into live use; backups are used solely for disaster recovery. For copies held by recipients (Firebase, Grubtech, Viva) we pass your request on and inform you of the outcome. The portability file (stiq_my_data.json) includes profile, orders, points, stamps, coupons, vouchers, chats, consents and analytics events.
Withdrawing personalisation consent stops the “Perfect for you” recommendations. Withdrawing analytics consent stops our usage measurement and Firebase Analytics / Crashlytics immediately and deletes the usage events stored for you. Withdrawing marketing consent stops promotional notifications and marketing emails.
9. Complaint to the Hellenic DPA
You may lodge a complaint with the Hellenic Data Protection Authority (ΑΠΔΠΧ), 1-3 Kifisias Avenue, 115 23 Athens, https://www.dpa.gr, contact@dpa.gr, +30 210 6475600.
10. Device identifiers and “cookies”
See device identifiers and cookies policy. For storing or reading anything on your device (SDKs, local storage, identifiers) the only viable basis is consent (Law 3471/2006 Art. 4 §5). We do not rely on legitimate interest for that.
11. Children
The age of valid consent for information-society services in Greece is 15 (Law 4624/2019). Every new account (by email or via Google / Apple) requires a date of birth, and the app does not accept registration by anyone under 15. If we find that an account has been created by a child under 15, we delete it. If you are a parent or guardian with a concern, contact privacy@stiq.gr.
12. Automated decision-making and profiling
We do not use personalised pricing.
“Perfect for you” recommends menu items from your history, only with personalisation consent. It does not refuse an order.
“Perfect for you” recommendations are computed on our own systems from your order history, preferences and reviews. They produce no legal effects and do not significantly affect you within the meaning of Art. 22 GDPR: they do not affect prices, rights or access to the service.
13. Security
We apply technical and organisational measures proportionate to the risk (Art. 32 GDPR). Among them:
Passwords are stored only in hashed form, never in readable form.
Access to the service uses temporary tokens that are revoked immediately on sign-out or account lock.
Connection settings for third-party providers are stored encrypted.
On your device, the login token is kept in the operating system's secure storage and excluded from device backups.
App-to-server communication takes place only over an encrypted connection (HTTPS), with optional additional encryption of the payload.
The payment screen does not allow screenshots.
Your card details are entered and processed exclusively within Viva Wallet's environment; they never reach our servers.
We hold no ISO 27001 or SOC 2 certification and make no such claim.
14. Changes
We will update the “last updated” date and we notify you in the app 15 days before any change, and by email for material changes. We will not change the legal basis without a fresh notice where required.
15. Contact
STIQ MONOPROSOPI P.C., 2 Papanikoli St., Chalandri 15232, Greece · info@stiq.gr · +30 210 700 4650