Munch Privacy Policy

Munch is currently an unincorporated New Zealand business operated by Munch.

When Munch becomes an incorporated company, this Privacy Policy will be updated to identify the relevant company.

Website: munchapp.co.nz

Privacy and support email: admin@munchapp.co.nz

Privacy Officer

Munch has appointed a Privacy Officer responsible for overseeing Munch’s privacy practices and responding to privacy enquiries, access requests, correction requests and complaints.

The Privacy Officer can be contacted at: admin@munchapp.co.nz

This Privacy Policy applies to personal information collected through:

• the Munch iOS application;
• the Munch Android application;
• munchapp.co.nz;
• consumer Munch accounts;
• business and restaurant Munch accounts;
• Munch customer support;
• Munch marketing communications;
• offer and redemption activity;
• business onboarding; and
• other services operated by Munch that link to this Privacy Policy.

When you create and use a Munch account, we may collect:

• your name;
• email address;
• mobile phone number;
• date of birth;
• Munch user or account ID;
• account authentication information;
• saved or favourited venues or offers;
• offer and redemption history;
• notification preferences;
• marketing preferences;
• content you upload or submit;
• communications you send to Munch; and
• other information you choose to provide.

We collect this information where it is reasonably necessary to create and operate your account, provide Munch’s services, maintain security or provide features you request.

Munch may allow users to create or access an account using:

• Sign in with Apple; or
• Sign in with Google.

If you use one of these services, Munch may receive information that you have authorised the provider to make available to us, such as:

• your name;
• email address;
• provider account identifier; and
• other basic authentication information.

If you use Apple’s Hide My Email feature, Munch may receive an Apple-generated relay email address rather than your personal email address.

Munch does not receive your Apple ID password or Google account password.

Your use of Apple or Google services is also subject to the privacy practices of the relevant provider.

Munch collects date of birth to:

• confirm eligibility to use Munch;
• provide an age-appropriate experience;
• manage access to age-restricted content or offers where relevant;
• meet legal, safety or platform requirements; and
• prevent underage use of age-restricted offers.

Munch is intended for users aged 13 years and older.

Some businesses, products, services or offers accessible through Munch may have a higher legal age requirement.

For example, alcohol-related products or offers may only be purchased or redeemed by people who meet the applicable legal purchasing age and any identification requirements imposed by the participating business or applicable law.

Munch uses location information to help users discover businesses and offers near them.

If you give Munch permission to access your device location, Munch may access your location while you are using the app in order to:

• identify nearby restaurants, cafés, bars and other participating businesses;
• show nearby offers;
• calculate approximate distance from a venue;
• display businesses and offers on a map;
• order search results based on location; and
• provide other location-based functionality requested by you.

Munch does not intentionally collect your location continuously while the app is closed.

Munch does not require background location tracking for its normal functionality.

Where possible, you may instead search for or select an area manually.

You can disable Munch’s access to your location at any time through your device settings.

Munch uses Apple Maps and Apple mapping services for certain location and mapping functionality on supported devices.

Munch does not sell your location information.

Munch does not use precise location information for third-party targeted advertising.

Munch is designed to use location to provide nearby results rather than to create a continuous record of your movements.

We do not intentionally create or maintain a continuous location history showing everywhere a user has travelled.

Certain technical logs may temporarily contain location-related information where this is necessary to provide a requested service, maintain security, diagnose technical problems or prevent fraud.

Such information will not be retained longer than reasonably necessary for those purposes.

Businesses may create or manage listings and offers through Munch.

For business users, we may collect:

• name of the business;
• trading name;
• business address;
• contact person’s name;
• business email address;
• business telephone number;
• position or relationship to the business;
• website and social media links;
• opening hours;
• menu or product information;
• logos and photographs;
• business descriptions;
• offers and promotions;
• offer availability times;
• redemption information;
• account information;
• communications with Munch;
• invoicing information; and
• other information reasonably necessary to operate the business’s Munch account.

Information about a business that does not identify an individual may not constitute personal information.

Where business information identifies a person, such as a sole trader, owner, manager or staff member, Munch will treat that information appropriately as personal information.

Consumers do not currently make payments to Munch through the Munch app.

Participating businesses may be charged by Munch through direct monthly invoicing outside of the mobile application.

For business invoicing and accounting purposes, Munch may collect or retain:

• business name;
• billing contact;
• billing email address;
• invoice amounts;
• payment status;
• payment references;
• transaction records; and
• other records reasonably necessary for accounting or taxation purposes.

Munch does not currently collect or store consumer credit or debit card details through the Munch app.

Financial and business records may be retained for longer periods where required by New Zealand taxation, accounting or other legal obligations.

When you view, save, activate or redeem an offer, Munch may record information including:

• the offer;
• the participating business;
• your Munch account identifier;
• the date and time;
• whether an offer was redeemed;
• redemption identifiers or codes;
• redemption status; and
• information reasonably necessary to prevent duplicate or fraudulent redemptions.

We may use redemption information to:

• make the redemption function work;
• verify that an offer has been used;
• enforce redemption limits;
• prevent fraud or misuse;
• resolve disputes;
• measure offer performance;
• provide businesses with aggregate or transactional redemption reporting; and
• improve Munch.

Participating businesses can receive confirmation that a Munch offer has been redeemed.

Businesses are not provided with unnecessary private information about the consumer simply because an offer has been redeemed.

For example, Munch does not ordinarily provide the restaurant with your:

• personal email address;
• personal phone number;
• password;
• date of birth;
• precise device location;
• unrelated Munch activity; or
• private account information.

A business may receive information reasonably required to verify the redemption, such as:

• confirmation that the offer has been redeemed;
• the relevant offer;
• redemption date or time;
• redemption identifier; and
• redemption status.

Information may be disclosed where required by law or where reasonably necessary to investigate fraud, misuse or a dispute.

Munch may allow consumers or businesses to create, upload or submit content.

This may include:

• reviews;
• comments;
• photographs;
• business photographs;
• profile content;
• venue information;
• offer information;
• descriptions; and
• other content submitted through Munch.

When you intentionally submit content for public display, that content may be visible to other Munch users.

You should not include sensitive personal information in public reviews, comments, photographs or other public content.

Munch may collect information associated with submitted content, including:

• the account that submitted it;
• submission date and time;
• moderation status; and
• reports made about the content.

Munch may moderate, restrict, remove or retain records relating to content where reasonably necessary to:

• enforce Munch’s Terms of Use;
• maintain community safety;
• investigate complaints;
• prevent fraud or abuse;
• respond to legal requirements; or
• protect Munch, its users or participating businesses.

When an account is deleted, Munch will also delete or appropriately de-identify user-generated content associated with that account unless there is a legitimate legal or safety reason for retaining particular information.

When you use Munch, we may automatically receive limited technical information including:

• device type;
• operating system;
• app version;
• browser type;
• IP address;
• language;
• login and session information;
• security logs;
• app interactions;
• pages or screens viewed;
• offers viewed;
• saved items;
• feature usage;
• crash information;
• performance information; and
• other technical information reasonably required to operate and secure Munch.

We use this information for purposes including:

• providing Munch;
• maintaining security;
• preventing fraud;
• diagnosing errors;
• understanding feature usage;
• improving performance; and
• developing Munch.

The Munch website may use cookies or similar technologies that are reasonably necessary to:

• operate the website;
• maintain sessions;
• remember user preferences;
• maintain security; and
• prevent abuse.

Munch does not currently use advertising pixels or third-party cross-site tracking technologies such as Meta Pixel or TikTok Pixel.

Munch does not currently use information collected through its website to build advertising profiles across unrelated websites.

If Munch introduces non-essential analytics, advertising or tracking technology in the future, this Privacy Policy will be updated and any consent or disclosure required by applicable law will be implemented.

Munch does not currently:

• sell consumer personal information;
• sell consumer location data;
• share consumer personal information with data brokers;
• use Meta advertising SDKs within the app;
• use TikTok advertising SDKs within the app;
• use personal information for third-party behavioural advertising; or
• track users across unrelated companies’ apps or websites for targeted advertising.

If Munch introduces functionality that constitutes tracking under Apple or Google platform requirements, Munch will comply with the relevant consent and disclosure requirements before using that functionality.

Munch may use personal information to:

• create and manage accounts;
• authenticate users;
• operate the Munch website and app;
• provide nearby offers;
• provide maps and location-based results;
• personalise relevant content;
• display participating businesses;
• facilitate and verify offer redemptions;
• prevent duplicate redemptions;
• communicate with users;
• communicate with participating businesses;
• provide customer support;
• send security notifications;
• send service notifications;
• send marketing communications where permitted;
• send push notifications;
• administer business accounts;
• manage business invoicing;
• detect and prevent fraud;
• protect the security of Munch;
• moderate user-generated content;
• resolve complaints and disputes;
• maintain and improve Munch;
• understand how features are used;
• develop new features;
• comply with legal obligations; and
• establish, exercise or defend legal rights.

We will not use personal information for a materially unrelated purpose where doing so would be inconsistent with applicable privacy law.

Munch may communicate with users through:

• email;
• SMS;
• app push notifications; and
• messages within Munch.

Service communications

We may send messages reasonably necessary to operate your account, including:

• verification messages;
• security alerts;
• password reset information;
• important account notices;
• redemption information;
• changes to Munch’s services; and
• privacy or legal notices.

Marketing communications

Where permitted, Munch may send promotional communications regarding:

• new Munch offers;
• participating businesses;
• new features;
• competitions or promotions;
• nearby deals; and
• other Munch news.

You can unsubscribe from marketing communications using the unsubscribe method provided in the communication or by contacting: admin@munchapp.co.nz

Opting out of marketing does not prevent Munch from sending necessary service or security communications.

Push notifications can also be disabled through your device settings.

Munch only shares personal information where reasonably necessary for a legitimate purpose, where you have authorised the disclosure, or where disclosure is otherwise permitted or required by law.

Information may be shared with the following categories of recipient.

Participating businesses

Only information reasonably necessary to administer or verify Munch offers and redemptions.

Technology providers

Providers that assist with:

• hosting;
• databases;
• authentication;
• website operation;
• app operation;
• communications;
• security;
• backups;
• customer support; and
• other technical infrastructure.

Apple

Apple services may be used for:

• Sign in with Apple;
• Apple Maps;
• iOS functionality;
• app distribution; and
• related Apple services.

Google

Google services may be used for:

• Google account authentication;
• Android functionality;
• app distribution; and
• related Google services.

Professional advisers

Information may be provided where reasonably necessary to accountants, lawyers, insurers and other professional advisers subject to appropriate confidentiality obligations.

Authorities

Munch may disclose personal information where required or permitted by law, including in response to appropriate legal process or where reasonably necessary to investigate unlawful conduct, fraud or serious safety or security incidents.

Business transactions

If Munch’s business is incorporated, sold, merged, reorganised or transferred, relevant information may be transferred as part of that transaction subject to appropriate privacy and confidentiality protections.

Some technology providers used by Munch may process or store information outside New Zealand.

Where personal information is processed using overseas service providers, Munch will take reasonable steps to ensure appropriate privacy and security protections are in place.

Munch remains responsible for personal information where applicable New Zealand privacy law treats an overseas service provider as processing information on Munch’s behalf.

Where personal information is disclosed to an overseas organisation for its own purposes, Munch will comply with applicable requirements relating to overseas disclosures.

Munch takes reasonable technical and organisational steps to protect personal information against:

• loss;
• unauthorised access;
• misuse;
• unauthorised disclosure;
• alteration; and
• destruction.

These measures may include:

• encrypted network connections;
• HTTPS;
• secure account authentication;
• password hashing;
• access controls;
• restricted administrative access;
• secure databases;
• backup systems;
• software updates;
• security logging; and
• appropriate controls over service providers.

No online service can guarantee absolute security.

Users are responsible for maintaining the confidentiality of their account credentials and should contact Munch if they believe their account has been compromised.

Munch aims to retain personal information only for as long as reasonably necessary for the purpose for which it may lawfully be used.

Active accounts

Account information is generally retained while your Munch account remains active and while it is reasonably required to provide Munch’s services.

Deleted accounts

When you delete your account, Munch will begin deleting personal information associated with the account.

Munch’s target is to complete deletion of ordinary account information from active production systems within 30 days, unless particular information must legitimately be retained for legal, fraud-prevention, security or dispute-resolution purposes.

Backups

Deleted information may remain temporarily within secure system backups.

Munch’s intended backup retention period is up to 30 days, after which backups are overwritten or deleted through the normal backup cycle.

User-generated content

Content associated with a deleted account will be deleted or appropriately de-identified unless Munch has a legitimate reason to retain particular information.

Business and tax records

Invoices, accounting records and related business records may be retained for at least seven tax years or for another period where required by applicable law.

Security and dispute records

Certain records may be retained for longer where reasonably necessary to investigate fraud, enforce Munch’s Terms, resolve a dispute, protect users or comply with law.

De-identified information

Munch may retain aggregated or genuinely de-identified information that can no longer reasonably identify an individual.

You can request deletion of your Munch account through the Munch app and through the Munch website.

In the app

Account deletion is available through the account or settings area of the Munch application.

On the website

An account deletion facility is available through:

munchapp.co.nz/support#delete-account

Account deletion means deletion of the user’s account and associated personal information, rather than simply disabling or freezing the account.

Munch may require reasonable authentication before deleting an account in order to prevent unauthorised deletion.

Some limited information may be retained where reasonably necessary or required by law.

You may request confirmation of whether Munch holds personal information about you and may request access to personal information you are entitled to receive under applicable New Zealand privacy law.

Requests can be sent to: admin@munchapp.co.nz

Munch may need to verify your identity before providing personal information.

There are limited circumstances in which access may legally be refused or information may be withheld.

If you believe personal information held by Munch is incorrect, incomplete or out of date, you may request correction.

Some information may also be editable through your Munch account.

Correction requests can be sent to: admin@munchapp.co.nz

Depending on the relevant feature, you may be able to:

• disable location access;
• manually search for a location;
• disable push notifications;
• unsubscribe from email marketing;
• unsubscribe from SMS marketing;
• change account details;
• change communication preferences;
• request access to your information;
• request correction of your information;
• remove uploaded content;
• disconnect third-party authentication; and
• delete your Munch account.

If you withdraw permission for information that is necessary to provide a particular feature, that feature may no longer function.

Munch is not intended for children under 13 years of age.

Users must not create a Munch account if they are under 13.

If Munch becomes aware that an account has been created by a child under 13 in circumstances where Munch should not hold the information, Munch may delete the account and associated information.

Parents or guardians who believe Munch is holding information relating to a child under 13 may contact: admin@munchapp.co.nz

Munch will take additional care when handling information relating to younger users.

Munch may separately maintain business-development information relating to restaurants, cafés, bars and other prospective business partners.

This information is kept separate from consumer app profiles and is not used to build profiles of Munch consumers.

Business contact information may come from:

• publicly available business websites;
• public business directories;
• information supplied directly by the business;
• professional networking information;
• referrals; or
• other legitimate sources.

Where this information identifies an individual, such as a business owner or manager, Munch will handle it as personal information.

Where New Zealand privacy law requires Munch to notify a person that their information was collected indirectly, Munch will take reasonable steps to provide the required information unless an applicable exception applies.

Munch maintains processes for responding to suspected privacy and security incidents.

If a breach occurs, Munch will take reasonable steps to:

• contain the incident;
• investigate what happened;
• determine what information was affected;
• reduce potential harm;
• correct relevant security weaknesses; and
• prevent recurrence.

Where a privacy breach is notifiable under New Zealand law, Munch will notify the New Zealand Office of the Privacy Commissioner and affected individuals as required.

Restaurants, cafés, bars and other businesses displayed through Munch are generally independent businesses.

If you provide personal information directly to a participating business outside Munch — for example by:

• making a booking;
• purchasing directly from the business;
• joining the business’s loyalty programme;
• contacting the business; or
• visiting its external website —

that business’s own privacy practices may apply.

Munch is not responsible for the independent privacy practices of third-party businesses.

Munch may contain links to websites or services operated by third parties.

This Privacy Policy applies to Munch and does not govern information independently collected by third-party websites or services.

You should review the privacy information supplied by those providers where relevant.

Munch may update this Privacy Policy where:

• Munch introduces new features;
• the way personal information is handled changes;
• service providers change;
• legal requirements change; or
• Apple, Google or other platform requirements change.

The current version will be available at: munchapp.co.nz/privacy

The date at the beginning of this Privacy Policy will show when it was last updated.

Where a change materially affects the way Munch handles personal information, Munch may provide additional notice through the app, website, email or another appropriate method.

If you have a privacy concern or complaint, please contact Munch’s Privacy Officer first:

Privacy Officer – Munch
admin@munchapp.co.nz

Munch will consider privacy complaints and endeavour to respond appropriately.

You may also have the right to make a complaint to the Office of the Privacy Commissioner of New Zealand.

For privacy questions, requests or concerns:

Munch
Website: munchapp.co.nz
Email: admin@munchapp.co.nz

For privacy enquiries, include “Privacy” in the subject line where practical.