Privacy at Zuppra
Privacy Policy
A transparent account of what we collect, why we need it, and the choices that remain yours.
Privacy at a glance
We collect the information needed to run a trusted catering marketplace, protect payments, support bookings, and meet legal obligations. We do not sell personal data. Exact event and payment details are shared only where needed for the service, safety, or law.
Who this policy covers
This Policy explains how Zuppra, the operator of the Zuppra marketplace in Dubai, UAE, processes personal data when you visit the Platform, create an account, plan or service an event, communicate, pay, submit documents, contact support, or exercise a privacy right.
Zuppra acts as controller for Platform account, marketplace, trust, payment-status, support, and administration data. A caterer may separately act as controller for information it receives to quote for or deliver an event and must use that information lawfully.
Information we collect
The information varies by how you use Zuppra. It may include:
- Identity and account data: name, email, mobile number, avatar, authentication and account role.
- Event and booking data: date, location, guest count, budget, menu, dietary and allergy information, instructions, quotes, changes, cancellations, reviews, and disputes.
- Business and compliance data: business profile, licences, certificates, insurance, Foodwatch information, team roles, packages, tax and payout references.
- Payment data: amount, currency, status, provider references, refunds, and chargeback or dispute records. Full card details are handled by the payment provider and are not stored by Zuppra.
- Communications and evidence: messages, support requests, uploaded documents, photographs, and other materials you choose to provide.
- Technical and usage data: IP address, device and browser information, request and security logs, cookie identifiers, and interaction data.
Where information comes from
We receive information directly from you; from another booking participant or authorised team member; from payment, communications, identity, hosting, and analytics providers; from Dubai Pulse or Foodwatch and other permitted public or regulatory sources; and from security or fraud-prevention checks.
If you provide another person’s information—for example a venue contact or guest dietary requirement—you must have authority to do so and share only what is necessary.
How and why we use information
We process personal data only for specific, lawful purposes, including:
- Creating accounts, authenticating users, and managing team permissions.
- Matching event briefs with caterers and enabling quotes, bookings, messages, payments, refunds, payouts, reviews, and notifications.
- Verifying caterers, documents, and marketplace integrity.
- Preventing fraud, duplicate payments, abuse, security incidents, and improper chargebacks.
- Investigating complaints, preserving evidence, resolving disputes, and enforcing agreements.
- Providing support, improving accessibility and performance, and understanding service use.
- Complying with accounting, tax, consumer, data-protection, sanctions, court, and regulatory obligations.
- Sending service communications and, where permitted or consented to, marketing that can be opted out of at any time.
Public and private information
Caterer names, profiles, packages, service areas, ratings, reviews, verification indicators, and selected imagery may be public. Event briefs may be visible to eligible caterers, but Zuppra is designed to withhold sensitive contact and precise location information until the relevant access condition is met.
Do not place phone numbers, exact private addresses, payment details, identity documents, or confidential information in public titles, descriptions, reviews, or profile fields.
How long information is kept
We keep personal data only as long as needed for the purposes described above. Retention depends on account status, booking and payment lifecycle, dispute or chargeback windows, fraud and safety needs, and accounting, tax, consumer, limitation, and regulatory requirements.
An account-deletion request has a 30-day grace period in which it may be cancelled. After that period, account PII is anonymised unless a lawful exception applies. Closing an account does not erase transactional records that must be retained for confirmed bookings, outstanding payments, disputes, legal claims, security, or compliance. When retention is no longer justified, information is deleted, anonymised, or securely isolated.
How information is protected
We use technical and organisational safeguards designed for the sensitivity of the information, including encryption of selected personal and compliance data, access controls, role-based permissions, authentication protections, audit records, secure transport, backups, and monitoring.
No service can guarantee absolute security. You must use a strong unique password, protect verification codes, limit team access, and notify us immediately if you suspect compromise. If a breach creates a legally reportable risk, we will take the notification steps required by applicable law.
International processing
Some providers or support operations may process data outside the UAE. Where personal data is transferred internationally, we apply the conditions and safeguards required by UAE data-protection law, considering the destination, provider commitments, security, and available legal transfer mechanism.
Your privacy rights
Subject to applicable law and valid exceptions, you may ask to:
- Receive information about processing and access personal data held about you.
- Correct incomplete or inaccurate information.
- Delete information that is no longer required or withdraw consent where consent is the basis.
- Restrict or object to certain processing, including direct marketing.
- Receive or transfer information in a technically feasible portable format.
- Raise a concern about automated processing or complain to the competent UAE authority.
Children
Zuppra is not intended for people under 18 and we do not knowingly create accounts for them. An adult arranging an event involving children should not submit children’s personal data unless necessary, authorised, and handled with appropriate care.
Changes and contact
We may update this Policy to reflect law, technology, providers, or service changes. Material updates will be highlighted through the Platform or by email and will show a new effective date.
For privacy questions or rights requests, contact privacy@zuppra.com. For booking or account support, contact support@zuppra.com. Arabic and English versions are intended to have the same meaning; applicable UAE law governs any unresolved difference.
When the details matter, we are here.
Visit the Help Centre for clear next steps before opening a dispute.