Privacy Policy

This Privacy Policy describes how Zupas ("we," "us," or "our") collects, uses, discloses, and safeguards your personal information when you visit our website at zupas-meal.rest, place orders, use our services, or otherwise interact with us. Please read this policy carefully. By accessing or using our website and services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.

We are committed to protecting your privacy and handling your personal data in an open and transparent manner. This Privacy Policy applies to all users of our website, mobile platforms, and any other services we provide in connection with our food business operations.

1. Information About Us

Zupas is a food business operating in the United States. Our contact details for all privacy-related matters are as follows:

For all privacy-related inquiries, requests, and complaints, please use the contact details listed above. We will respond to your inquiries within a reasonable timeframe and no later than the periods required by applicable law.

2. Scope and Applicable Law

This Privacy Policy governs our data processing activities conducted in the United States. Our privacy practices comply with applicable United States federal and state privacy laws, including but not limited to:

• The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), applicable to California residents
• The Federal Trade Commission Act (FTC Act), which prohibits unfair or deceptive practices in commerce, including those related to privacy and data security
• The Children's Online Privacy Protection Act (COPPA)
• The CAN-SPAM Act governing commercial email communications
• Other applicable state privacy laws as they come into effect

Where applicable, we also honor rights and obligations under emerging state privacy laws, including the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and similar legislation in other states.

3. Information We Collect

We collect various types of information in connection with your use of our website and services. The categories of personal information we may collect include:

3.1 Information You Provide Directly

When you interact with us — whether by placing an order, creating an account, contacting customer support, signing up for promotions, or otherwise communicating with us — you may provide us with the following types of personal information:

• Identity Information: Your first and last name, username, or similar identifiers
• Contact Information: Email address, postal address, telephone number, and delivery address
• Account Credentials: Passwords and other authentication information
• Payment Information: Credit card numbers, debit card details, billing address, and other financial information necessary to process transactions (note: full payment card details are processed by our secure third-party payment processors and are not stored on our servers)
• Order Information: Details about the food items you order, dietary preferences, special instructions, and order history
• Communications: Content of messages, feedback, reviews, or other communications you send to us
• Marketing Preferences: Your preferences regarding receiving marketing communications from us
• Dietary and Health Information: Any allergen information or dietary restrictions you voluntarily provide to us to facilitate your food orders

3.2 Information Collected Automatically

When you visit our website at zupas-meal.rest, we automatically collect certain technical and usage information through cookies, web beacons, pixels, and similar tracking technologies. This includes:

• Device Information: IP address, device type, operating system, browser type and version, device identifiers, and mobile network information
• Usage Data: Pages you visit, links you click, time spent on pages, referring URLs, search terms used on our site, and navigation patterns
• Log Data: Server logs that record access times, errors encountered, and other diagnostic information
• Location Data: General geographic location derived from your IP address, and precise location data if you grant permission through your browser or device
• Cookie Data: Information stored in cookies and similar technologies placed on your browser or device (see Section 9 for more details)
• Transaction Data: Details about transactions you carry out through our website, including the date, time, and amount of each transaction

3.3 Information From Third Parties

We may receive information about you from third parties, including:

• Social Media Platforms: If you connect your social media account to our services or interact with our social media pages, we may receive profile information permitted by your social media settings
• Analytics Providers: Aggregated or anonymized data from analytics services we use to understand website traffic and user behavior
• Payment Processors: Transaction confirmation and fraud prevention signals from our payment processing partners
• Delivery Partners: Order status updates and delivery confirmation from third-party delivery service providers
• Marketing Partners: Information that helps us better target advertising to potential customers, subject to the third party's privacy practices

4. How We Use Your Information

We use the personal information we collect for specific, legitimate purposes. We will only use your information for the purposes described below, or for purposes compatible with those described:

4.1 Service Provision and Order Fulfillment

• To process and fulfill your food orders and deliver products to your specified address
• To create and manage your account on our website
• To communicate with you about your orders, including confirmation, updates, and delivery notifications
• To process payments and issue receipts or invoices
• To handle returns, refunds, and customer service requests
• To accommodate dietary preferences and allergen requirements you have communicated to us

4.2 Business Operations and Improvement

• To operate, maintain, and improve our website, app, and services
• To understand how users interact with our platform and identify areas for improvement
• To conduct internal research, data analysis, and product development
• To monitor the technical performance and security of our systems
• To develop new menu items, features, and services based on customer preferences

4.3 Marketing and Promotions

• To send you promotional communications, special offers, and newsletters — but only where you have consented to receive such communications or where we have a legitimate interest in contacting you about similar products and services
• To personalize your experience on our website, including showing you relevant menu items and promotions based on your order history and preferences
• To deliver targeted advertising through third-party advertising networks, where permitted by law
• To administer contests, sweepstakes, loyalty programs, or other promotional activities

You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any email we send, or by contacting us at [email protected].

4.4 Legal and Compliance Purposes

• To comply with applicable laws, regulations, and legal processes
• To enforce our Terms of Service and other applicable agreements
• To detect, prevent, and investigate fraud, security breaches, and other harmful or illegal activities
• To protect the rights, property, and safety of Zupas, our customers, and the public
• To respond to lawful requests from public authorities, including law enforcement agencies

5. Legal Basis for Processing

We rely on the following legal bases when processing your personal information:

• Performance of a Contract: Processing necessary to fulfill your orders and provide you with requested services
• Legitimate Interests: Processing for our legitimate business interests, such as improving our services, preventing fraud, and marketing similar products to existing customers, where these interests are not overridden by your rights and interests
• Consent: Where you have given us specific consent, such as for marketing emails or certain types of cookies
• Legal Obligation: Processing necessary to comply with our legal obligations under applicable United States law

6. Sharing Your Information With Third Parties

We do not sell your personal information to third parties for their own independent marketing or business purposes. However, we may share your information with third parties in the following circumstances:

6.1 Service Providers and Business Partners

We share personal information with trusted third-party service providers who assist us in operating our business. These parties are contractually obligated to handle your information only as directed by us and in accordance with this Privacy Policy. Our service providers include:

• Payment Processors: Companies that securely handle payment transactions on our behalf
• Delivery Partners: Third-party delivery services that fulfill and deliver orders to customers
• Cloud and Hosting Providers: Companies that provide infrastructure, data storage, and computing services
• Analytics Providers: Services such as Google Analytics that help us understand website usage
• Email and Marketing Platforms: Tools we use to communicate with customers and send promotional materials
• Customer Support Tools: Platforms that help us manage customer service inquiries
• Fraud Prevention Services: Third parties that help us detect and prevent fraudulent activity

6.2 Legal Requirements and Protection of Rights

We may disclose your personal information if required to do so by law, or if we believe that such disclosure is necessary to:

• Comply with a legal obligation, court order, subpoena, or governmental request
• Protect and defend the rights or property of Zupas
• Prevent or investigate possible wrongdoing in connection with our services
• Protect the personal safety of users of our services or the public
• Protect against legal liability

6.3 Business Transfers

In the event that Zupas undergoes a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of its assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.

6.4 Aggregated or De-Identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you with third parties for research, marketing, analytics, and other purposes.

7. Data Security

We take the security of your personal information seriously and implement a variety of technical, administrative, and physical security measures designed to protect your personal information from unauthorized access, use, alteration, and disclosure. Our security measures include:

• Encryption: Sensitive data, including payment information, is transmitted using Secure Socket Layer (SSL) technology and encrypted both in transit and at rest
• Access Controls: Access to personal information is restricted to employees and contractors who need it to perform their job functions, and all such personnel are subject to confidentiality obligations
• Security Audits: We conduct regular internal and external security reviews and vulnerability assessments
• Incident Response: We maintain an incident response plan to address any potential data breaches promptly and in accordance with applicable law
• Third-Party Security: We require our service providers to maintain appropriate security standards and contractually obligate them to protect your information
• Employee Training: Our staff receive regular training on data protection practices and security awareness

In the event of a data breach that affects your personal information, we will notify you and the appropriate regulatory authorities as required by applicable law, including state breach notification laws in effect across the United States.

8. Your Privacy Rights

Depending on your state of residence and applicable law, you may have certain rights regarding your personal information. We are committed to honoring these rights in accordance with applicable law.

8.1 Rights Available to All Users

• Right to Know / Access: You have the right to request information about the personal data we hold about you, including the categories of data collected, the purposes for which it is used, and the categories of third parties with whom it is shared
• Right to Correction: You have the right to request that we correct inaccurate or incomplete personal information about you
• Right to Deletion: You have the right to request that we delete personal information we hold about you, subject to certain exceptions required by law
• Right to Opt Out of Marketing: You may opt out of receiving marketing communications from us at any time

8.2 Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: The right to know what personal information we collect, use, disclose, and sell or share
• Right to Delete: The right to request deletion of personal information we have collected from you
• Right to Correct: The right to request correction of inaccurate personal information
• Right to Opt Out of Sale or Sharing: The right to direct us not to sell or share your personal information with third parties. We do not sell personal information as defined under the CCPA/CPRA
• Right to Limit Use of Sensitive Personal Information: The right to limit our use of sensitive personal information to certain permitted purposes
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny goods or services, charge different prices, or provide a different level of service because you exercised your privacy rights
• Right to Data Portability: The right to receive a copy of your personal information in a portable, readily usable format

8.3 How to Exercise Your Rights

To exercise any of your privacy rights, please contact us using any of the following methods:

• Email: [email protected]
• Website: zupas-meal.rest

We will verify your identity before processing your request to protect the security of your personal information. We will respond to verifiable consumer requests within 45 days of receipt. If we require more time, we will inform you of the reason and extension period in writing. We will not charge a fee for processing your request unless it is excessive, repetitive, or manifestly unfounded, in which case we will explain the basis for any fee charged.

You may also designate an authorized agent to submit a request on your behalf. If you use an authorized agent, we may require written proof of the agent's authorization and may verify your identity directly.

9. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyze website traffic, and deliver relevant advertising. Below is a brief overview of our cookie practices.

9.1 Types of Cookies We Use

• Strictly Necessary Cookies: These cookies are essential for the website to function properly, including maintaining your shopping cart and account session. You cannot opt out of these cookies
• Performance and Analytics Cookies: These cookies collect information about how visitors use our website, such as which pages are visited most often. We use this information to improve our website
• Functionality Cookies: These cookies allow our website to remember your preferences, such as your location, language, and order history
• Marketing and Advertising Cookies: These cookies are used to deliver advertisements that are relevant to you and your interests, and to track the effectiveness of our advertising campaigns

9.2 Managing Your Cookie Preferences

You can control and manage cookies through your browser settings. Most browsers allow you to refuse or accept cookies, delete existing cookies, and set preferences for certain websites. Please note that disabling certain cookies may affect the functionality of our website.

For more detailed information about the specific cookies we use and how to manage your preferences, please refer to our Cookie Policy available on our website.

10. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Our general data retention practices are as follows:

When we no longer need your personal information, we will securely delete or anonymize it. If deletion is not immediately possible (for example, because information is stored in backup archives), we will securely isolate your personal information from further processing and delete it when feasible.

11. Children's Privacy

Zupas is intended for use by individuals who are at least 18 years of age. We do not knowingly collect, use, or disclose personal information from children under the age of 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take immediate steps to delete that information from our records.

In compliance with the Children's Online Privacy Protection Act (COPPA), if you are a parent or legal guardian and you believe that your child under the age of 13 has provided us with personal information, please contact us immediately at [email protected] so that we can take appropriate action.

We encourage parents and guardians to monitor their children's online activities and to help enforce this policy by instructing their children never to provide personal information through our website without their permission.

12. International Data Transfers

Zupas is based in the United States, and your personal information is primarily stored and processed in the United States. If you access our services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence.

By using our services, you acknowledge and consent to the transfer of your information to the United States for the purposes described in this Privacy Policy. We take appropriate measures to ensure that any international data transfers are conducted in compliance with applicable law, including implementing appropriate contractual safeguards where required.

If you have questions about our international data transfer practices, please contact us at [email protected].

13. Third-Party Links and Services

Our website may contain links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements or practices. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Third-party services we may integrate with include social media platforms (such as Facebook, Instagram, and Twitter), food delivery platforms, mapping services, and payment gateways. Each of these services operates under its own privacy policy, which we encourage you to review.

14. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want to have your online activities tracked. Our website does not currently respond to DNT signals. However, we provide you with choices regarding the use of cookies and similar technologies as described in Section 9 of this Privacy Policy.

As DNT standards and technology continue to evolve, we will revisit and update our approach to DNT signals as appropriate.

15. California Shine the Light Law

California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. If you are a California resident and wish to make such a request, please contact us at [email protected] with "California Shine the Light Request" in the subject line.

16. How to File a Complaint

If you believe that we have not complied with this Privacy Policy or applicable data protection laws, we encourage you to first contact us directly so that we can address your concerns:

• Email: [email protected]
• Website: zupas-meal.rest

We will investigate all complaints we receive and aim to resolve them promptly and fairly. If you are not satisfied with our response, you may escalate your complaint to the relevant regulatory authority:

16.1 Federal Regulatory Authorities

• Federal Trade Commission (FTC): The FTC enforces consumer protection laws and investigates complaints about unfair or deceptive business practices, including privacy violations. You may file a complaint at www.ftc.gov or call 1-877-FTC-HELP (1-877-382-4357)

16.2 State-Level Regulatory Authorities

• California Office of the Attorney General: California residents may file privacy complaints with the California Attorney General's Office at oag.ca.gov. The CPRA also established the California Privacy Protection Agency (CPPA), which has authority to enforce California privacy laws
• Other State Attorneys General: Residents of other states may contact their state's Attorney General office for privacy-related complaints

17. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. We will notify you of any material changes by posting the updated Privacy Policy on this page with a revised "Last Updated" date. In the event of significant changes, we may also notify you by email or through a prominent notice on our website prior to the change becoming effective.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our website and services after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please do not hesitate to contact us. We are committed to addressing your concerns and responding to your inquiries in a timely and professional manner.

We will make every effort to respond to privacy-related inquiries and requests within 30 days of receipt, or within any shorter period required by applicable law. For urgent matters, we encourage you to mark your email with "PRIVACY – URGENT" in the subject line.

This Privacy Policy was last updated on June 21, 2026. © 2026 Zupas. All rights reserved.