Privacy Policy

Last Updated: 1 April 2026

1. Introduction and Our Commitment to Your Privacy

This Privacy Policy explains how ninito AS ('ninito', 'we', 'us') collects, uses, shares, and protects your personal data when you use our platform, including our websites, mobile applications, and in-store kiosks (collectively, the 'Platform').

Our goal is to be transparent about the data we process and to make it easy for you to understand and control it.

This policy is here to inform you. Where we need your consent for specific processing (such as certain marketing or precise location), we will ask for it separately, for example in your profile settings or through your device's permission dialogs, and you can change your mind at any time.

2. At a Glance: Our Data Processing Model

One Global ninito Account: You create a single account with ninito that works across all restaurants and shops ('Merchants') on our Platform.
Who Is Responsible for What: ninito is the controller for your global account and for the operation, security, and improvement of the Platform, including the cross-merchant analytics and personalization described in this policy. Each Merchant is the controller for your orders with it, its loyalty program, and its own marketing to you; for that data, ninito acts as the Merchant's processor and hosts and processes it on the Merchant's behalf.
Where to Direct Requests: For anything concerning your ninito account or ninito's own processing, contact ninito (Section 14). For anything concerning your orders with a Merchant, its loyalty program, or its marketing, the Merchant is the controller and your request should be addressed to that Merchant; if you send such a request to ninito, we will forward it to the Merchant without undue delay.

3. The Data We Collect

A. Information You Provide Directly:

Account Registration Data: When you create a ninito account, we collect your Full Name, Phone Number, Email Address, and Date of Birth. We use your date of birth to verify that you meet the age requirement for the Platform and for age-restricted purchases.
Order Information: When you place an order, we collect order details, delivery addresses, special instructions, and any other information you choose to provide.
Payment Information: We collect payment details which are immediately tokenized and processed by our secure payment partners. ninito does not store your full credit card number.
Communications: If you contact us, we collect the content of those communications.
User-Generated Content: If you post reviews, ratings, photos, or other content on the Platform, we collect and store that content.

B. Information We Collect Automatically (Usage, Device & Tracking Data):

As you use our Platform, we automatically collect information about how you interact with it and the devices you use. This helps us understand user behavior, improve our service, prevent fraud, and provide personalized experiences.

Usage and Behavioral Data: We collect information about how you interact with the Platform, including features you use, pages you visit, buttons and links you click, search queries, time spent, navigation paths, and other engagement metrics. Our analytics are first-party: we analyse this usage in our own systems, and we do not use third-party session-replay, screen-recording, or cross-site tracking tools (see Section 7).
Technical and Device Information: We collect technical data, including your IP address, device type, device model, operating system and version, browser type and version, screen resolution, device or installation identifiers, network information, connection type, internet service provider, and other similar technical information.
Location Information: With your explicit consent, we may collect your precise geolocation data (including GPS coordinates) in real-time. We may infer your approximate location (for example, your city or region) from your IP address to show you nearby Merchants and for security and fraud prevention. (Legal basis: legitimate interest.) Precise or real-time geolocation is only collected with your consent. We share location with a Merchant only as needed to fulfil an order you place with that Merchant; any location included in the sales analytics we provide to Merchants is aggregated and does not single you out.
Cookies and Similar Technologies: We use only strictly necessary cookies and similar technologies (such as local storage) to operate the Platform: keeping you signed in, remembering your cart and preferences, security, and fraud prevention. We do not use advertising cookies and we do not track you across other websites or services (see Section 7).

C. Information We May Collect from Other Sources:

Payment Providers: We may receive confirmation of your payment status, transaction details, and fraud risk assessments from our payment partners.
Merchants: Merchants may provide us with information regarding order issues, customer feedback, or other relevant details.
Publicly Available Sources: We may collect information from publicly available sources for identity verification and fraud prevention.
External Sources: Where we obtain information about you from external sources, we will tell you the categories of data and their source, and we will only do so where we have a lawful basis, and solely for identity verification and fraud prevention.

4. How We Use Your Data

To Provide and Manage Our Service: We use your data to operate the Platform, process orders, manage your account, provide customer support, and deliver the services you request. (Legal Basis: Performance of a Contract)
To Communicate With You: We use your data to send transactional messages, order updates, customer service responses, and other operational communications. (Legal Basis: Performance of a Contract)
To Improve and Personalize the Platform (including AI and machine learning): We analyse how you use the Platform - including what you order and where you order from across Merchants - and we use analytics, artificial intelligence, and machine learning to understand these patterns, improve our services, develop new features, make ordering easier, and show you more relevant content, recommendations, and offers. We also use location data to tailor services to your area and to improve delivery. (Legal Basis: our legitimate interest in operating, securing, and improving the Platform for analytics and product development; and your consent for personalized offers and marketing that draw on your activity across Merchants.)
For Marketing: We send you promotional messages and show you personalized offers in your account based on your consent, which you manage in your profile settings. Where permitted by the applicable marketing law of your country of residence, we may market our own similar services to existing users by email or SMS, with an opt-out in every message. We do not share your data with third-party advertising networks and we do not serve third-party targeted advertising. (Legal Basis: Consent; for marketing our own similar services to existing users, our legitimate interest within the limits of applicable marketing law)
For Safety, Security, and Fraud Prevention: We use your data to detect and prevent fraud, abuse, security incidents, and other harmful activities, and to protect the rights and safety of ninito, Merchants, and other users. (Legal Basis: our legitimate interest in keeping the Platform secure and preventing fraud)
To Comply with Legal Obligations: We use your data to comply with applicable laws, regulations, legal processes, and governmental requests. (Legal Basis: Legal Obligation)
For Research and Aggregated Analytics: We analyze data in aggregate and anonymized form to understand trends, usage patterns, and to conduct research. (Legal Basis: our legitimate interest in understanding and improving how the Platform is used; once data is anonymized, it is no longer personal data)
For Sales Analytics and Business Intelligence: We make reporting and analytics available to each Merchant about that Merchant's own sales and its own customers, acting as that Merchant's processor; the Merchant is the controller for this processing. Any analytics we provide to Merchants that draw on activity across multiple Merchants are aggregated and do not identify you. We never share your identifiable order or purchase history with one Merchant with any other Merchant.
For Profiling: We may use automated processing, including profiling, to understand your preferences, personalize your experience, suggest relevant offers, and help detect fraud. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. You can object to profiling used for marketing at any time (see 'Marketing, Profiling, and Your Choices'). (Legal Basis: our legitimate interest in personalizing and securing the Platform, or your consent where required.)

Account registration data is needed to create and secure your account; without it, we cannot provide the Platform to you. Providing other data is optional, although some features (for example delivery) require the data needed to perform them.

With Merchants You Interact With: When you place an order with a Merchant, join its loyalty program, or otherwise actively use your account with that Merchant (for example at its point of sale, kiosk, app, or webshop), we share your relevant account data with that Merchant, including your name, contact information, your order history with that Merchant, and your loyalty program information for that Merchant. Location data is shared with a Merchant only as needed to fulfil an order you place with it. We never disclose your identifiable order or purchase history with one Merchant to any other Merchant; anything a Merchant receives that draws on activity across Merchants is aggregated and does not identify you. ninito itself uses data across Merchants only to operate and improve the Platform and to personalize your own experience, as described in Section 4; this internal use does not give any Merchant access to your history with a different Merchant.
With Our Service Providers: We share your data with third-party vendors who perform services on our behalf and on our documented instructions, including hosting providers, payment processors, analytics providers, marketing platforms, customer service tools, and email service providers.
For Legal Reasons and Business Transfers: We may share data if required by law, legal process, or governmental request, or in connection with a merger, acquisition, bankruptcy, or sale of assets.
In Aggregated or Anonymized Form: We may share data with third parties where it has been aggregated or anonymized so that it no longer identifies you.

6. Marketing, Profiling, and Your Choices

Per-Merchant Consent: Your consent to receive marketing is always specific to one Merchant. Each Merchant controls their own marketing communications to you.
Profiling for Promotions: With your marketing consent, we and the Merchants may analyze your purchase history, browsing behavior, preferences, and other data to send you personalized offers and recommendations. This may involve automated profiling to tailor offers to you. As stated in Section 4, we do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, and you can object to profiling for marketing at any time.
Loyalty Programs and Marketing: Some Merchants run their loyalty programs together with their marketing, so opting out of a Merchant's marketing can affect your participation in that Merchant's loyalty program. The full rules, including what happens to benefits already earned, are in Section 7 of the ninito Platform Terms.
Your Right to Opt Out: You can withdraw your marketing consent at any time through your profile settings, the unsubscribe link in marketing emails, or by contacting us. Withdrawing your consent does not affect the lawfulness of any processing carried out before you withdrew it. You will still receive necessary service and order-related messages, which are not marketing.
What Changes If You Opt Out: If you opt out of marketing or object to profiling for marketing, you may see fewer personalized offers and may not be able to take part in some promotions, but you can continue to browse and order on the Platform.

7. Cookies and Similar Technologies

We use only strictly necessary cookies and similar technologies (such as local storage). They keep you signed in, remember your cart and preferences, distribute load, and protect the Platform against fraud and abuse. Because these are necessary to provide the service you request, they do not require consent, and we therefore do not show cookie consent banners.

We do not use third-party advertising or cross-site tracking cookies, we do not use third-party session-replay or screen-recording tools, and our usage analytics are first-party and designed to work without storing or reading anything on your device beyond what is strictly necessary. You can delete or block cookies in your browser settings, but blocking strictly necessary cookies may prevent parts of the Platform from working (for example, staying signed in).

8. Data Retention and Deletion

We keep account data for as long as your account is active, and thereafter no longer than necessary for the purposes described in this policy, typically no more than 36 months after the account becomes inactive or is closed. Order, transaction, and accounting records are kept for the period required by applicable bookkeeping and tax law in the country concerned (typically five years in Norway and Denmark, and seven years in Sweden). We do not keep personal data longer than needed for the purpose or required by law. When you delete your profile from your last remaining Merchant, or request global deletion, we will erase or anonymize your data in accordance with applicable law, unless we are required or permitted to retain it for longer. Even after deletion, we may retain certain data in backup systems for a limited period.

9. Security

We implement reasonable technical and organizational measures designed to protect your data from unauthorized access, disclosure, alteration, and destruction. However, no method of transmission or storage is completely secure, so while we work hard to protect your data, we cannot guarantee absolute security.

10. International Data Transfers

Where we transfer your data outside the European Economic Area (EEA), we make sure it is protected by appropriate safeguards under Chapter V of the GDPR, such as an adequacy decision or the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.

Subject to applicable law, you have the right to Access your data, Rectify inaccurate data, Erase your data in certain circumstances, Restrict processing, Object to processing (including profiling), and Data Portability. You can exercise these rights by contacting us at policy@ninito.no. Please note that these rights are not absolute and may be limited by applicable law; where you object to processing based on legitimate interests, we will stop unless we have compelling legitimate grounds that override your interests, rights, and freedoms. Your right to object to processing for direct marketing (including profiling for marketing) is absolute and we will always honour it. If your request concerns your orders with a Merchant, its loyalty program, or its marketing, that Merchant is the controller; you can contact it directly, or we will forward your request to it without undue delay. You also have the right to lodge a complaint with your local data protection authority: in Norway, Datatilsynet (www.datatilsynet.no); in Sweden, Integritetsskyddsmyndigheten (IMY, www.imy.se); in Denmark, Datatilsynet (www.datatilsynet.dk).

We will respond to your requests within the timeframes required by law. In some cases, we may require additional information to verify your identity before processing your request. We may deny requests that are unreasonably repetitive, excessive, or manifestly unfounded.

12. Business Transfers

If ninito is involved in a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will require the recipient to continue protecting your data in line with this policy and applicable law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy here and update the 'Last Updated' date, and we will let you know of significant changes where appropriate. We encourage you to review this policy occasionally to stay informed.

14. Contact Us

For any questions or to exercise your rights, please contact us.

ninito AS (org. no. 923 377 654)
Email: policy@ninito.no
Address: Selma Ellefsens Vei 10, 0581 Oslo, Norway

15. Children's Privacy

The Platform is not intended for use by individuals under the age of 18, and we use the date of birth you provide at registration to enforce this requirement. We do not knowingly allow accounts for, or collect personal data from, children under 18. If you are under 18, you must not use the Platform or provide any personal data to us. If we become aware that we have collected data from a child under 18, we will take steps to delete such information.

16. Third-Party Links and Services

The Platform may contain links to third-party websites, services, or applications that are not owned or controlled by ninito. This Privacy Policy does not apply to such third-party services. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you access.

17. How We Rely on Your Choices

This Privacy Policy is provided to inform you about how we process your personal data. We rely on consent only where the law requires it - for example, for certain marketing or precise location data - and where we do, we ask for that consent separately in your profile settings or through your device's permission dialogs, and you can withdraw it at any time. For other processing, we rely on the legal bases set out in Section 4. You can exercise your rights and manage your choices as described in this policy.