1. Introduction

This Privacy Policy explains how One Dinner Away S.R.L. (“Provider”, “we”) collects, uses, stores, and protects your personal data in connection with the One Dinner Away platform and services.

One Dinner Away S.R.L. acts as the data controller within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation) (“GDPR”).

Certain third-party service providers act as data processors on our behalf. Other third parties (such as WhatsApp, Telegram or Stripe) may act as independent controllers.

We are committed to protecting your privacy and complying with applicable data protection laws, including GDPR and relevant Romanian legislation.

Depending on the context, we rely on the following legal bases for processing:

• performance of a contract (Art. 6(1)(b) GDPR);
• compliance with legal obligations (Art. 6(1)(c) GDPR);
• legitimate interests pursued by the Provider (Art. 6(1)(f) GDPR);
• your consent, where required (Art. 6(1)(a) GDPR).

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to such withdrawal.

2. Data We Collect

Once you interact with the One Dinner Away platform (website, telephone, email, contact forms, blog) we may collect personal data from you in the following ways:

• Directly from you — when you create an account, fill in forms (including partially completed forms), participate in events, or contact us;
• Automatically through the use of the platform — we collect technical data such as IP address, device type, browser information, and usage data through cookies and similar technologies;
• From certain third-party services — where applicable, we may receive personal data from communication tools (e.g. WhatsApp, Telegram) when you interact with us; email and marketing platforms (e.g. Brevo, Mailgun) for sending communications; social media and advertising platforms (e.g. Meta, Facebook, Instagram, TikTok) for analytics, advertising, and user engagement; event and community platforms (e.g. Luma, Meetup, Eventino) when you register or interact with our events; and partner platforms (e.g. Airbnb Experiences) where our events or services are listed.

We may process the following categories of personal data:

• Personal information: Name, email address, phone number, date of birth, city, profile photo, gender, interests.
• Booking & transaction information: Event selections, ticket purchases, subscriptions. Payment data is handled by third-party processors (e.g., Stripe) and not stored by us.
• Questionnaire responses: Interests and preferences to help match participants for dinners and the events we create.
• Communication data: Emails, messages, or contact information you provide when contacting us.
• Usage and technical data: Login history and app activity for analytics and service improvement.
• Third-party data: Information from platforms you use to interact with us (such as WhatsApp, Telegram), event booking platforms (such as Eventino, Meetup or Luma), or our marketing tools. We only receive this data when you use these services to join our community or book an event.

Note: When you register via Meetup, Luma or Eventino, we receive your name, email, and any RSVP answers you provided on those platforms to facilitate your attendance.

Note: We do not automatically add you to groups. Only users who have participated in a dinner are invited to join a WhatsApp and Telegram group, and joining is entirely voluntary.

We only collect personal data that is necessary for the purposes described in this Privacy Policy. Where you provide additional optional information, you do so voluntarily.

3. Special Categories of Data & User-Provided Content

3.1 Voluntary Disclosure of Sensitive Data

One Dinner Away does not explicitly solicit "Sensitive Categories" of data (e.g., political opinions, religious beliefs, or sexual orientation). If you voluntarily disclose such information in open-text fields (like your "Bio"), you acknowledge that we will process it as part of your profile. We encourage you to only share information you are comfortable being visible to other members or platform administrators.

3.2 Dietary Requirements

Information regarding food allergies or dietary restrictions is classified as health data under GDPR. We collect this solely for your safety and to coordinate with hosts.

• Consent: By filling out these fields, you provide explicit consent for us to process this health data.
• Opt-Out: This is strictly voluntary. You may opt-out by leaving these fields blank or deleting the data from your profile.

Note: Opting out may limit our ability to guarantee allergen safety at events.

4. How We Use Your Data

4.1 Purposes of processing

We process personal data for the following purposes:

• To provide and manage our Services — including account creation, event booking, ticketing, subscriptions, and participation in events;
• To facilitate the matching between users — including analyzing profile information and preferences to suggest compatible groups of participants for dinners and social events;
• To communicate with users & provide customer support — including sending booking confirmations, updates, or service-related information;
• To improve our Services and Platform — including analytics, service optimization, and understanding user behavior;
• To ensure platform security and prevent misuse — including monitoring for fraud, abuse, or violations of the Terms and Conditions;
• To comply with legal obligations — including accounting, tax, and regulatory requirements;
• To send marketing communications.

4.2 Legal basis for processing

The legal bases for the processing activities described above are as follows:

• Points a), b), c) and d): processing is based on the performance of a contract (Art. 6(1)(b) GDPR);
• Points e) and f): processing is based on the legitimate interests of the Provider (Art. 6(1)(f) GDPR);
• Point g): processing is based on compliance with a legal obligation (Art. 6(1)(c) GDPR);
• Point h): processing is based on your consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time.

5. About Your Data

We do not sell or rent your personal data.

Data may be shared with the following categories of recipients:

• Payment processors (e.g., Stripe), which act as independent data controllers for transactions;
• WhatsApp and Telegram, in cases where users decided to participate in community groups (you consent to joining);
• Public authorities or institutions, if disclosure is required by law;
• Service providers acting as data processors on our behalf, for purposes of internal operations (such as hosting providers, CRM systems, and IT support tools), with us relying on their privacy policies.

We take appropriate steps to ensure that all third-party recipients process personal data in accordance with applicable data protection laws.

6. Data Storage and Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or alteration. We retain personal data only for as long as necessary to fulfill the purposes for which it is collected.

7. Your Rights

Under GDPR, users have the following rights:

• The right to access their personal data;
• The right to rectification of inaccurate or incomplete data;
• The right to erasure (“right to be forgotten”), subject to legal obligations;
• The right to restrict or object to processing of data for specific reasons, including but not limited to marketing purposes;
• The right to data portability;
• The right to withdraw consent at any time, where processing is based on consent;
• The right to lodge a complaint with the Romanian data protection supervisory authority (ANSPDCP);
• The consent given for non-essential personal data processing (such as membership in the WhatsApp or Telegram community groups, and subscription to our newsletter) may be withdrawn at any time.

Requests to exercise these rights may be submitted to adrian@onedinneraway.com.

8. Cookies and Analytics

Our platform may use cookies or similar technologies to ensure the platform functions correctly and to improve your experience. We categorize these as follows:

• Essential: Necessary for logins, security, and core functionality. These are always active.
• Analytics & Functional: Used to understand traffic and remember your preferences. These are only activated with your prior consent via our cookie banner.

You can manage your preferences or "Reject All" non-essential tracking through our cookie banner at any time. While you can also disable cookies in your browser, doing so may break certain features of the platform.

9. Changes to the Privacy Policy

We reserve the right to update this Privacy Policy at any time. The updated Privacy Policy will apply from the date it becomes effective.

Changes will be communicated via email or other reasonable means. Where required, we will seek your consent or provide appropriate notice before such changes take effect.

The updated Privacy Policy will be made available on the platform, and the date of the latest revision will be indicated. We encourage users to review this Policy periodically. Continued use of the services after such changes constitutes acceptance of the modified Privacy Policy.

10. Contact Information

For questions or concerns about this Privacy Policy, how we handle your personal data, or if you wish to exercise your rights under applicable data protection laws, please contact us at adrian@onedinneraway.com.