Privacy Policy · Time2Eat

This Privacy Policy ("Policy") describes how Time2Eat ("Company", "we", "us", or "our") collects, uses, processes, stores, discloses, and protects personal data in connection with your use of the Time2Eat mobile application and all associated services (collectively, the "Platform" or "App").

Time2Eat operates as a community food safety platform where registered users submit illness reports and food safety observations about restaurants in Indonesia (with primary operations in Bali) and Thailand. Because the Platform processes personal data, including health-related data, across two distinct legal jurisdictions, this Policy is carefully structured to comply with both:

The Indonesian Personal Data Protection Law, Law No. 27 of 2022 ("PDP Law"); and
The Thailand Personal Data Protection Act B.E. 2562 (2019), as amended ("PDPA").

PLEASE READ THIS POLICY CAREFULLY. By registering for an account or using the Platform, you confirm that you have read and understood this Policy and that you consent to the processing of your personal data as described herein. Where explicit consent is required by law, particularly for the processing of health-related special category data; we will seek your separate, specific consent at the point of collection.

For Indonesian Users: This Policy is issued in accordance with Law No. 27 of 2022 on Personal Data Protection and other applicable regulations of the Republic of Indonesia.

For Thai Users: This Policy is issued in accordance with the Personal Data Protection Act B.E. 2562 (2019) and other applicable regulations of the Kingdom of Thailand.

DEFINITIONS

"Personal Data" means any information relating to an identified or identifiable natural person, including name, email address, IP address, device identifiers, location data, and any health-related information, as defined under the PDP Law 2022 and the PDPA.

"Special Category Data" or "Sensitive Personal Data" means personal data that is subject to heightened protection under applicable law, including data relating to health, illness, medical history, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, biometric data, and criminal records.

"Health Data" means any personal data pertaining to the physical health, medical condition, symptoms, or foodborne illness experiences of a data subject, as submitted through the Platform in a Community Report.

"Community Report" means a user-submitted report, rating, observation, or description of a food safety incident or foodborne illness experience at a restaurant, submitted through the Platform.

"Data Controller" means Time2Eat, which determines the purposes and means of the processing of personal data collected through the Platform.

"Data Processor" means any third-party entity that processes personal data on behalf of Time2Eat pursuant to a written agreement.

"Processing" means any operation or set of operations performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, dissemination, restriction, erasure, or destruction.

"PDP Law" means Indonesia's Law No. 27 of 2022 on Personal Data Protection.

"PDPA" means Thailand's Personal Data Protection Act B.E. 2562 (2019), as amended.

"User" means any natural person who accesses, registers on, or uses the Platform.

IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER

The Data Controller responsible for the processing of your personal data under this Policy is:

Time2Eat

Community Food Safety Platform

Primary Operations: Bali, Indonesia | Secondary Operations: Thailand

Privacy Enquiries: privacy@time2eat.app

Disputes & Takedown: disputes@time2eat.app

General Support: support@time2eat.app

If you have any questions, concerns, or requests regarding this Policy or the processing of your personal data, please contact us at privacy@time2eat.app. We aim to respond to all privacy-related enquiries within fourteen (14) business days.

CATEGORIES OF PERSONAL DATA WE COLLECT

Account and Registration Data

When you register for a Time2Eat account, we collect the following personal data:
Full name or username;
Email address;
Password (stored in encrypted, hashed form — never in plaintext);
Date of account creation;

Account preferences and settings.

Community Report Data (Including Health Data)

When you submit a Community Report through the Platform, we collect:
The content of your report, including descriptions of symptoms, illness, or food safety observations;
The name and location of the Restaurant to which the report relates;
The date and time of the reported incident;
Any photographs or images you choose to attach;
Your self-reported health symptoms, where included in your report.

Important: Descriptions of foodborne illness symptoms and health experiences constitute Health Data and Special Category Data under both the PDP Law 2022 (Pasal 4) and the PDPA (Section 26). We process this data only with your explicit, informed consent, as provided at the point of submission.

Device and Technical Data

When you access the Platform, we automatically collect certain technical data, including:
Device type, model, and operating system;
Unique device identifiers (e.g., advertising ID, device ID);
App version and build number;
Internet Protocol (IP) address;
Mobile network information;
App crash logs and diagnostic data;

Time zone and language settings.

Location Data

With your permission, we may collect approximate or precise location data to assist you in identifying nearby restaurants and to associate Community Reports with geographic locations. You may disable location access at any time through your device settings, though this may limit certain Platform features.

Usage and Analytics Data

We collect data about how you interact with the Platform, including:
Pages and features accessed within the App;
Search queries entered;
Time and duration of sessions;
Reports viewed, submitted, or bookmarked;
In-app actions and navigation patterns.

Communications Data

If you contact us via email or through any support channel, we will collect and retain the content of your communications, including your email address, the subject matter of your enquiry, and any attachments provided.

Data We Do Not Collect

We do not collect or process the following categories of data unless separately and expressly required for a specific, disclosed purpose:
Payment card information or banking details;
Government-issued identification numbers;
Biometric data;
Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, except where voluntarily included by a User in a Community Report (in which case the provisions of Section 5 apply).

PURPOSES AND LEGAL BASES FOR PROCESSING

Overview

We process your personal data only for specified, explicit, and legitimate purposes, and only where we have a valid legal basis for doing so under applicable law. The table below summarises our primary processing activities, purposes, and corresponding legal bases under both the PDP Law 2022 and the PDPA.

Account Registration and Platform Access

We process your registration data — including your name, email address, and account credentials — solely to create and manage your account and authenticate your identity when you log in. This processing is necessary to perform the contract between us: without it, we simply cannot provide you with access to the Platform. It is carried out on the basis of contractual necessity under Article 20(b) of the Indonesian PDP Law 2022 and Section 24(3) of the Thailand PDPA.

Processing of Community Reports

When you submit a Community Report, we receive, store, and display it on the Platform so that other registered Users can access it for food safety purposes. This is the core function the Platform exists to serve, and processing your report data is inseparable from delivering it. We do this on the basis of legitimate interests under the Indonesian PDP Law 2022 and the Thailand PDPA — the legitimate interest being the community's access to honest, first-hand food safety information, which we consider reasonable and proportionate when balanced against your rights and interests as a User.

Processing of Health Data in Community Reports

If you choose to include descriptions of foodborne illness symptoms or other health-related information in a Community Report, that data is classified as Special Category Data under both Indonesian and Thai law and is therefore subject to a higher level of protection. We will never process this data without your explicit, specific, and informed consent, which we obtain separately at the point of submission — distinct from your general acceptance of the Terms of Service and withdrawable by you at any time. To the extent that the community food safety purpose of the Platform engages the public interest in public health protection.

Platform Safety, Security, and Moderation

We process certain user data to keep the Platform safe, honest, and functional for everyone on it. This includes detecting and addressing abuse, fraud, false reports, violations of our Terms of Service, and any content or conduct that poses a risk to the safety of Users, Restaurants, or the wider public.

Analytics and Platform Improvement

We analyse how Users interact with the Platform — including which features are used, how sessions flow, and where technical issues arise — in order to fix bugs, improve performance, and build a better experience over time. This is a standard and proportionate use of data that any responsibly operated digital platform carries out, and we do so on the basis of legitimate interests under the PDP Law 2022 and the PDPA, balanced against your right not to have your data used in ways that are unexpected or intrusive.

Legal Compliance and Regulatory Obligations

There are circumstances where we are legally required to process or disclose your personal data — for example, to respond to a valid court order, cooperate with a government investigation, or meet our obligations under applicable data protection, electronic transactions, or cybercrime legislation in Indonesia and Thailand. In those situations, we have no discretion to refuse, and processing is carried out purely to fulfil that legal obligation rather than for any commercial or operational purpose of our own.

Communications and Support

When you reach out to us with a question, a technical issue, or a dispute, we process your contact details and the content of your communication in order to respond helpfully and resolve your concern. We also use your contact information to send you service-related notifications — such as updates to these Terms or this Policy, or important changes to how the Platform operates. We do this partly on the basis of your consent and partly because keeping you informed about the service you are using is a legitimate and reasonable interest that any responsibly operated platform would act on.

SPECIAL CATEGORY DATA — HEALTH DATA FRAMEWORK

Classification as Special Category Data

Illness reports and descriptions of foodborne illness symptoms submitted through the Platform constitute Health Data, which is classified as special category personal data (sensitive personal data) under both:
Article 4 of the Indonesian PDP Law 2022, which identifies health and medical data as a category of specific personal data requiring heightened protection; and
Section 26 of the Thailand PDPA, which explicitly lists health data as sensitive personal data subject to stricter processing requirements. In recognition of the sensitivity of this data, we will only collect your health and medical information where you have freely and voluntarily chosen to provide it — no report requires you to disclose personal health details, and if you have previously consented to the collection of such data, you may

withdraw that consent and opt out at any time, for any reason, entirely at your own discretion, with no consequence to your continued use of the Platform.

Explicit Consent Mechanism

Before you submit any Community Report that contains health-related information, the App will present you with a clear, plain-language consent notice that:
Identifies the categories of health data being collected;
Explains the specific purpose for which your health data will be processed;
Explains who may have access to your health data on the Platform;
Informs you of your right to withdraw consent at any time;
Is separate and distinct from your general acceptance of the Terms of Service.

Your explicit, affirmative consent will be recorded electronically with a timestamp. We will not process your health data without this separate explicit consent.

Purpose Limitation

Health data collected through Community Reports will be processed only for the following specific purposes:
Displaying your Community Report to other registered Users of the Platform for food safety information purposes;
Enabling the moderation and dispute resolution procedures described in our Terms of Service;
Complying with applicable legal obligations, including lawful government requests;

Detecting and preventing fraudulent or abusive reports; and

Aggregated, anonymised analysis to identify food safety trends (where data is irreversibly anonymised prior to any such analysis).

We will not use your health data for any other purpose, including direct marketing, profiling for commercial purposes, or sale to third parties.

Data Minimisation

We apply the principle of data minimisation to health data. We collect only the health-related information you voluntarily include in your Community Report. We do not require you to provide a medical diagnosis, clinical records, or any information beyond what you choose to disclose about your personal experience. You are not required to include health data in a Community Report; you may submit a report relating to general hygiene or food safety observations without disclosing personal health information.

Withdrawal of Consent for Health Data

You may withdraw your explicit consent to the processing of your health data at any time by:
Using the account settings function within the App to delete specific Community Reports; or
Contacting us at privacy@time2eat.app with a request to delete or anonymise your health data.

Withdrawal of consent will not affect the lawfulness of processing that occurred prior to withdrawal. Where a Community Report containing your health data has been publicly visible on the Platform and may have been viewed by other Users prior to your withdrawal request, we cannot retroactively remove that information from those Users' awareness, but we will remove the data from the Platform promptly upon request. Once consent is withdrawn we are required to cease all processing and delete your personal data within 72 hours and under the Thailand PDPA, we are required to delete, destroy, or anonymise your personal data — including any copies and backups — without delay and within 90 days of receiving your request.

HOW WE COLLECT PERSONAL DATA

Data Provided Directly by You

We collect personal data that you actively provide to us, including:
Information entered during account registration;
Community Reports submitted through the App;
Photographs or images you choose to upload;
Communications you send to our support or disputes email addresses;

Preferences and settings you configure within the App.

Data Collected Automatically

When you access or use the Platform, certain data is collected automatically through cookies, software development kits (SDKs), and similar technologies, including device identifiers, IP addresses, session data, and usage analytics. This data is collected to operate, maintain, and improve the Platform.

Data from Third-Party Sources

Where you choose to register or log in to the Platform using a third-party authentication service (such as Google Sign-In or Apple Sign-In), we will receive certain account data from that service in accordance with your permissions and the third party's privacy policy. We do not control the data practices of third-party authentication providers.

Location Data

Location data is collected only with your explicit prior permission, as requested through your device's operating system permissions prompt. You may revoke location permissions at any time through your device settings.

DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

Principle of Restricted Disclosure

We do not sell, rent, trade, or otherwise disclose your personal data to third parties for their own commercial purposes. Where we do share your data, it is only with third-party service providers — known as Data Processors — that we engage specifically to help us operate the Platform, including cloud infrastructure and hosting providers, analytics services, push notification providers, customer support platforms, and fraud detection and security monitoring services. Every Data Processor we work with is contractually bound to process your personal data solely on our instructions, to maintain appropriate technical and organisational security measures, and to comply fully with the PDP Law 2022 and the PDPA and we will not engage any service provider that cannot demonstrate sufficient guarantees of that compliance.

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of Time2Eat's assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will provide notice of any such transfer and ensure that the receiving entity is bound by privacy obligations no less protective than those in this Policy.

Aggregated and Anonymised Data

We may share aggregated, anonymised data that cannot reasonably be used to identify any individual with third parties for research, public health, or commercial purposes. Such data is not personal data and is not subject to the restrictions in this Policy.

CROSS-BORDER DATA TRANSFERS

Nature of Cross-Border Transfers

Time2Eat's Platform infrastructure may involve the storage or processing of your personal data on servers located outside Indonesia and Thailand, including through cloud service providers whose infrastructure operates across multiple jurisdictions. Such transfers may occur to countries that do not have data protection laws equivalent to those of Indonesia or Thailand. This will be done as per the applicable laws of Indonesia PDP law and Thailand PDPA Law.

Safeguards

Regardless of where your personal data is processed, Time2Eat implements consistent technical and organisational security measures to protect it in accordance with this Policy. Our Data Processing Agreements with third-party service providers impose data protection obligations that mirror the requirements of both the PDP Law 2022 and the PDPA.

DATA RETENTION PERIODS

General Principle

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with legal obligations, to resolve disputes, and to enforce our agreements. When personal data is no longer required for any of these purposes, it will be securely deleted or irreversibly anonymised.

Retention Schedule

Account Registration Data: Retained for the duration of your active account, plus a period of thirty-six (36) months following account closure or deletion. This retention period is maintained to address any retrospective legal claims, disputes, or regulatory enquiries arising from your use of the Platform.

Community Reports (General): Retained for a period of sixty (60) months (five years) from the date of submission, or until deletion is requested through the applicable procedure, whichever is earlier. Retention is maintained to preserve the integrity of the community food safety record and to enable dispute resolution processes.

Community Reports Containing Health Data: Retained for the same period as general Community Reports (60 months from submission), subject to the right of withdrawal of consent described in Section 5.5. Upon a valid withdrawal request, health data will be deleted or anonymised within 72 hours for Indonesian Users, in accordance with the PDP Law 2022, and within 90 days for Thai Users, in accordance with the PDPA and the PDPC Notification on Criteria for Deletion, Destruction and De-identification. The stricter Indonesian timeframe will apply where a User's jurisdiction cannot be determined.

Device and Technical Data: Retained for a period of twenty-four (24) months from collection, after which it is deleted or anonymised for analytical purposes.

Location Data: Precise location data, where collected, is retained only for the duration of the session in which it is used and is not stored beyond that session. Approximate location data associated with a Community Report (e.g., geographic region) is retained for the same period as the associated Community Report.

Communications and Support Data: Retained for a period of thirty-six (36) months from the date of your last communication with us, or longer where required for active legal proceedings or regulatory compliance.

Analytics and Usage Data: Anonymised or aggregated analytics data may be retained indefinitely as it can no longer identify you as an individual.

Extended Retention for Legal Proceedings

Where personal data is relevant to an ongoing or reasonably anticipated legal proceeding, regulatory investigation, or dispute resolution process, we may retain that data beyond the periods stated above until the conclusion of such proceedings. We will inform you of any such extended retention where we are permitted to do so by law.

Deletion Procedures

Upon expiry of the applicable retention period, personal data will be securely deleted from our active systems. Residual copies that may exist in backup systems will be deleted in the ordinary course of our backup rotation schedule, which operates on a cycle not exceeding ninety (90) days.

DATA SECURITY

Security Measures

Time2Eat implements appropriate technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:
Encryption of data in transit using Transport Layer Security (TLS);
Encryption of data at rest using industry-standard encryption protocols;
Storage of passwords in hashed, salted form using robust cryptographic algorithms;
Access controls limiting employee and contractor access to personal data on a need-to-know basis;
Regular security audits and vulnerability assessments;
Multi-factor authentication for administrative access to systems containing personal data;
Incident response procedures for detecting and responding to data security events.

Limitations of Security

While we apply industry-standard security practices, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your personal data. You are responsible for maintaining the security of your account credentials and for notifying us promptly if you suspect any unauthorised access to your account.

Data Breach Notification

Indonesian Users: In the event of a personal data breach that is likely to pose a high risk to your rights and freedoms, we will notify the relevant Indonesian supervisory authority and, where required, affected Users, within the timeframe prescribed by the PDP Law 2022 and applicable implementing regulations.

Thai Users: In the event of a personal data breach, we will notify the Office of the Personal Data Protection Committee (PDPC) without delay and, where the breach is likely to result in high risk to you, we will also notify you as soon as reasonably practicable.

YOUR DATA SUBJECT RIGHTS

Overview of Rights

Subject to applicable law, you have the following rights in relation to your personal data held by Time2Eat. The rights available to you may vary depending on whether you are an Indonesian User (governed by the PDP Law 2022) or a Thai User (governed by the PDPA), as described below.

Right of Access

Both Jurisdictions: You have the right to obtain confirmation of whether we process your personal data, and to receive a copy of the personal data we hold about you, together with information about how it is processed. You may exercise this right by submitting a request to privacy@time2eat.app.

Right to Rectification

Both Jurisdictions: You have the right to request the correction or completion of inaccurate, incomplete, or misleading personal data we hold about you. Requests for rectification of account data can also be made directly within the App's account settings.

Right to Erasure (Right to be Forgotten)

PDP Law 2022 (Indonesia): You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful, subject to any overriding legal obligations requiring retention.

PDPA (Thailand): You have the right to request deletion or destruction of your personal data, subject to applicable exceptions including legal obligations, the exercise of legal claims, and public interest grounds.

Right to Restriction of Processing

PDPA (Thailand): You have the right to request restriction of the processing of your personal data in certain circumstances, including where you contest the accuracy of the data or have objected to processing pending verification of legitimate grounds.

PDP Law 2022 (Indonesia): Equivalent rights to restrict or limit processing are provided under the PDP Law 2022 where processing lacks a lawful basis or where you contest the accuracy of the data.

Right to Data Portability

Both Jurisdictions: Where technically feasible and to the extent required by applicable law, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that we transmit that data to another data controller.

Right to Object to Processing

Both Jurisdictions: You have the right to object to the processing of your personal data where that processing is based on legitimate interests, including profiling. Where you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.

Right to Lodge a Complaint

Indonesian Users: You have the right to lodge a complaint with the competent supervisory authority in Indonesia responsible for personal data protection under the PDP Law 2022.

Thai Users: You have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) in Thailand where you believe your personal data has been processed in violation of the PDPA.

How to Exercise Your Rights

To exercise any of the rights described in this Section, please submit a written request to: privacy@time2eat.app

Please include your full name, registered email address, and a clear description of the right you wish to exercise. We will respond to your request within thirty (30) calendar days. In complex cases, we may extend this period by a further thirty (30) days, and will notify you of any such extension. We may request additional information to verify your identity before processing your request.

COOKIES AND TRACKING TECHNOLOGIES

Use of Cookies and SDKs

The Platform may use cookies, local storage, software development kits (SDKs), and similar tracking technologies to collect technical and usage data, maintain your session, and support analytics functions. Mobile applications typically use device-level identifiers and SDKs rather than browser cookies.

Types of Tracking Technologies

Essential Technologies: Necessary for the basic operation of the App, including session management and authentication. These cannot be disabled without disrupting core Platform functionality.

Analytics Technologies: Used to collect data about how you use the App, including features accessed and session duration. This data is used to improve the Platform. Where consent is required under applicable law, we will request it before deploying analytics technologies.

Third-Party SDKs: We may integrate third-party SDKs for analytics, push notifications, and crash reporting. These SDKs may collect device identifiers and usage data subject to the third-party provider's privacy policy. We will disclose all material third-party SDKs in the App's privacy nutrition label (Apple App Store) and data safety section (Google Play).

Managing Tracking Preferences

You may manage your tracking preferences through your device's operating system settings, including by resetting your advertising identifier or disabling personalised tracking. For iOS devices, you may control App Tracking Transparency (ATT) permissions. For Android devices, you may opt out of personalised advertising through device settings.

CHILDREN'S PRIVACY

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from persons under 18 years of age. If you are a parent or guardian and believe that a minor has provided us with personal data without your consent, please contact us at privacy@time2eat.app and we will take prompt steps to delete such data. If we become aware that we have collected personal data from a child without appropriate consent, we will delete it from our systems as soon as practicable.

APP STORE PRIVACY COMPLIANCE

Apple App Store — Privacy Nutrition Label

In accordance with Apple's App Store privacy requirements, Time2Eat maintains an accurate and up-to-date App Privacy Nutrition Label that discloses all categories of data collected by the App, the purposes for which that data is used, and whether data is linked to your identity. The categories disclosed include, but are not limited to, health and fitness data (illness reports), identifiers, usage data, and diagnostics. This label is available on the App's App Store product page.

Google Play — Data Safety Section

In accordance with Google Play's Data Safety requirements, Time2Eat maintains an accurate Data Safety disclosure that identifies all personal data collected and processed by the App, how that data is used and shared, and the security practices applied to that data. The Data Safety section is available on the App's Google Play product page and is updated whenever there is a material change to our data practices.

Health Data Disclosure

Because Community Reports may contain health-related data, this category is expressly disclosed in both the Apple App Privacy Nutrition Label and the Google Play Data Safety section. The disclosure confirms that health data is collected with explicit user consent and is used exclusively for the community food safety purpose of the Platform, in accordance with this Privacy Policy.

CHANGES TO THIS PRIVACY POLICY

We may update this Policy from time to time to reflect changes in our data practices, applicable law, or Platform features. When we do, we will update the "Last Updated" date, notify you by email or in-app notification, and where changes affect how we process your special category data, seek your explicit consent before those changes take effect. Your continued use of the Platform after any update constitutes your acceptance of the revised Policy.

We encourage you to review this Policy periodically. Your continued use of the Platform after the effective date of any updated Policy constitutes your acceptance of the changes, to the extent permitted by applicable law.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us at:

Time2Eat — Data Protection Office

Privacy & Data Rights: privacy@time2eat.app

Disputes & Takedown: disputes@time2eat.app

General Support: support@time2eat.app

We aim to respond to all privacy-related requests and enquiries within fourteen (14) business days. Where a request is complex or involves a large volume of data, we may extend this period and will notify you accordingly.

ACKNOWLEDGEMENT

BY USING THE TIME2EAT PLATFORM, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS PRIVACY POLICY IN ITS ENTIRETY, THAT YOU UNDERSTAND HOW YOUR PERSONAL DATA WILL BE COLLECTED, USED, AND PROCESSED, AND THAT YOU CONSENT TO SUCH PROCESSING AS DESCRIBED HEREIN. WHERE EXPLICIT CONSENT IS REQUIRED FOR THE PROCESSING OF SPECIAL CATEGORY DATA, INCLUDING HEALTH DATA, SUCH CONSENT WILL BE SEPARATELY SOUGHT AND RECORDED AT THE POINT OF COLLECTION.