Partner Privacy Notice
This notice applies to people who apply to or take part in the IQFood Partners program. App users: see the Privacy Policy.
It explains how IQFood processes the personal data of applicants, partners and the people who act for them (for example a company’s director or contact person). It is given under articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (GDPR).
1. Who is the controller
GUŢAN N. ANDREI PERSOANĂ FIZICĂ AUTORIZATĂ (“IQFood”), a Romanian sole trader (PFA) with its registered office at Bulevardul Bucureștii Noi nr. 136, parter, ap. 5, Sector 1, București, Romania, registered in the Romanian Trade Register under no. F2026039000002 (EUID ROONRC.F2026039000002), tax identification number (CUI) 55385290. Contact for any privacy question or request: partnerships@iqfood.app.
2. What data IQFood processes
- Identity and contact: name, legal name, display name, email, address, country, language, and the Partner Portal account used to sign in.
- Application and verification: the answers in the application form (partner type, profiles, audience size range, topics, languages, business status, professional status), the verification code and the result of the ownership check, and a hash of the IP address used to apply.
- Public profile information: handles, links, public audience figures and the public content about IQFood.
- Business and tax: entity type, tax residence, VAT and tax identification numbers (including foreign ones), the VIES check result, certificates of tax residence, invoices, CNA status, and registration and professional-status confirmations.
- Tax identification for non-residents: the identification details needed to obtain a Romanian tax identification number for a partner not resident in Romania (for an individual, the details of an identity document).
- Payout: account holder, IBAN, BIC, currency and the history of changes.
- Contract and signing evidence: the texts accepted and their fingerprints, the special clauses and declarations accepted, the typed name and role, the login method, the check of the one-time code sent by email, the date and time, the IP address and the user agent.
- Program activity: the partner’s codes, aggregated statistics, ledger lines, statements, payouts and tax records.
- Communications: emails and messages exchanged with IQFood.
- Security: Partner Portal sign-in and activity records needed to keep the program secure.
3. Why, and on what legal basis
- To assess applications and take steps before concluding the partner agreement at the applicant’s request (GDPR art. 6(1)(b)).
- To perform the agreement: attribution, statements, payouts, support and communications about the program (art. 6(1)(b)).
- To meet legal obligations in accounting and tax, including invoices, withholding, VAT and tax returns (art. 6(1)(c)).
- To prevent fraud and misuse, verify channel ownership, keep the program secure and establish, exercise or defend legal claims, including through the signing evidence (legitimate interests, art. 6(1)(f)).
- To check compliance with the disclosure and claims rules in the partner’s public content (legitimate interests, art. 6(1)(f)).
For the people who act for a partner that is a company (for example its director), the legal basis is IQFood’s legitimate interest in concluding and performing the agreement with that partner (art. 6(1)(f)). Showing the partner’s display name and partner code, as the first sentence of clause 11.4 of the agreement allows, is needed to perform the agreement (art. 6(1)(b)). Where IQFood uses the partner’s name, image, voice or content with the partner’s separate consent (clause 11.3 and the second sentence of clause 11.4), the partner may withdraw that consent at any time for future use, without affecting earlier use.
IQFood does not use partner data for advertising and does not sell it.
4. Automated decisions
The pause in clause 14.1(b) of the partner agreement is a decision based on automated processing, used because it is needed to perform the agreement (GDPR art. 22(2)(a)). How it works: it starts when more than 20% of at least 5 transactions on which the partner earned a Performance Fee have been refunded or reversed. What it does: confirmation and payment of the Performance Fee are held while it lasts, and the partner code and link keep working. A person who can lift the pause reviews it within 5 business days. The partner may obtain that review, give its point of view and contest the decision at partnerships@iqfood.app.
5. Who receives the data
- Service providers acting for IQFood: Google (Firebase and Google Cloud hosting, databases, functions and storage; Google Workspace email), Amazon Web Services (Amazon SES, email delivery) and Cloudflare (website, Partner Portal delivery and bot protection).
- IQFood’s bank (currently Revolut Business) to make payouts, and IQFood’s accountant.
- Tax and other public authorities, courts and professional advisers, where required by law or needed to defend legal claims.
- A successor to the IQFood business, if the partner agreement is transferred.
Some providers may process data outside the European Economic Area. Such transfers rely on an adequacy decision (including the EU-US Data Privacy Framework, where applicable) or on the European Commission’s Standard Contractual Clauses. A copy of the Standard Contractual Clauses is available on request at partnerships@iqfood.app.
6. How long IQFood keeps the data
| Data | Retention |
|---|---|
| Rejected or waitlisted applications | 6 months after the decision, then deleted |
| Accounting and tax documents (invoices, self-billed invoices, payout statements, payment records, certificates of tax residence and their translations, VIES checks, withholding and VAT records) | 5 years from 1 July of the year after the end of the financial year to which they relate (Law no. 82/1991, article 25, as amended by Law no. 36/2023), and longer while a tax audit, dispute or claim about them is pending |
| The agreement, amendments and signing evidence (including the IP address and user agent) | Until 5 years after the last payout or ledger line under the agreement, or until the end of the period above for the accounting documents of the last payout, if that is later, and longer while a claim or proceeding about the agreement is pending |
| Partner profile, payout details and application data of accepted partners | For the duration of the relationship; after it ends, only what is contained in the records above is kept |
| Program statistics and the ledger | As accounting records (see above) |
| Communications | With the contract file where they concern the agreement, payments or a dispute; otherwise up to 2 years |
| Data about referred users (not about the partner) | The partner never receives it; IQFood pseudonymises referred users’ account identifiers in its partner records 120 days after the account is deleted and its last ledger line |
7. Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability, within the limits set by the GDPR. You can exercise these rights at partnerships@iqfood.app. Where IQFood must keep data under a legal obligation, it cannot erase it before the end of the retention period. You can lodge a complaint with the Romanian supervisory authority (ANSPDCP, dataprotection.ro) or the authority in your country.
8. Is providing the data required
The data in the partner profile and the tax documents are required to conclude and perform the partner agreement and to meet IQFood’s legal obligations. Without them IQFood cannot activate the partnership or make payouts.
9. Where the data comes from
Mostly from you. IQFood also uses public information from your channels, the result of VIES checks and the program statistics generated by IQFood’s systems.