Privacy Policy

1. Introduction

Panda Express ("we", "our") operates the panda-express.ch website and the Panda Express mobile app. This privacy policy explains how we collect, use, store, and protect your personal information in accordance with the Swiss Federal Data Protection Act (FADP) and the EU General Data Protection Regulation (GDPR).

2. Data we collect

We collect the following information when you use our services:

• Account information: name, email address, phone number
• Delivery addresses: street, postal code, city, delivery instructions
• Order data: order history, food preferences, order notes
• Payment data: payments are processed securely by Stripe. We never store full card numbers
• Technical data: IP address, browser type, device identifiers for push notifications

3. How we use your data

Your data is used to:

• Process and deliver your orders
• Manage your account and preferences
• Send you order-related notifications (push, SMS)
• Run our loyalty programme and promotional codes
• Improve our services and your user experience
• Comply with our legal obligations

4. Data sharing

We only share your data with:

• Stripe: for secure payment processing
• Supabase: for secure database hosting (servers in Europe)
• Expo / Apple / Google: for push notifications
• Twilio: for SMS notifications (if enabled)

We never sell your personal data to third parties.

5. Data security

We implement appropriate security measures to protect your data: encryption in transit (TLS/SSL), role-based access controls (RLS), secure password storage, and regular security audits.

6. Your rights

Under the FADP and GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate information
• Right to erasure: request deletion of your data — submit a request
• Right to portability: receive your data in a structured format
• Right to object: object to the processing of your data

7. Data retention

We retain your personal data for as long as your account is active or as necessary to provide our services. Order data is retained for 10 years in accordance with Swiss legal accounting obligations.

8. Cookies

We use essential cookies for site functionality (authentication, cart). We do not use advertising tracking cookies. Language preferences are stored in your browser's local storage.

9. Contact

For any questions about this privacy policy or to exercise your rights, contact us:

10. Changes

We reserve the right to modify this privacy policy at any time. Changes will be published on this page with an updated revision date.