CloudCityFood Merchant Privacy Policy
Effective Date: 27 January 2026 | Applies to: Merchants on the CloudCityFood platform
Introduction
CloudCityFood respects and values the privacy of Merchants and related individuals.
This CloudCityFood Merchant Privacy Policy (“Policy”) applies to the collection, use, storage, sharing, and protection of relevant Personal Data and business information when a Merchant applies to join the Platform, operates a store, manages products, receives and processes Orders, receives settlement payments, participates in Platform activities, or uses other Merchant Services through the CloudCityFood Merchant application, Merchant portal, web-based management system, or other Merchant service channels.
This Policy explains:
- the categories of Merchant and related-person information we collect;
- why we need to process such information;
- which store information may be displayed to Customers and Riders;
- the circumstances in which we may share information with service providers or other relevant parties;
- how long such information may be retained;
- how Merchants and related individuals may access, correct, delete, or control relevant information; and
- how privacy complaints or requests for internal review may be submitted.
This Policy primarily protects information that identifies or can be linked to a natural person. Store names, product prices, opening hours, public menus, and similar purely commercial information may not in themselves constitute Personal Data. However, where such information identifies or can be linked to an individual business owner, responsible person, contact, or employee, CloudCityFood will apply appropriate protections in accordance with this Policy.
Before submitting an onboarding application or using the Merchant Services, please read and understand this Policy carefully. Where separate consent is required under applicable requirements, device-permission rules, or Platform arrangements, we will provide a separate permission request, prominent disclosure, or other appropriate notice and seek the necessary authorization.
Commitment Not to Sell Personal Data
CloudCityFood does not sell or rent the Personal Data of Merchant owners, responsible persons, contacts, or employees, and will not transfer such Personal Data to unrelated third parties in exchange for money or other commercial benefit.
Without appropriate authorization, we will not provide Personal Data that directly identifies a relevant individual to unrelated third parties for their own independent advertising or marketing purposes.
This Section does not prevent CloudCityFood from processing or sharing information where reasonably necessary to:
- verify Merchant identity, legal status, and onboarding eligibility;
- display store, product, pricing, and operating-status information;
- receive, prepare, deliver, and complete Orders;
- process payments, refunds, commissions, Platform service fees, and settlements;
- provide cloud hosting, technical support, messaging, and customer service;
- conduct security reviews, anti-fraud investigations, and dispute handling; or
- comply with tax, accounting, audit, regulatory, judicial, or other applicable obligations.
Information We Collect
CloudCityFood collects information only to the extent reasonably necessary to review Merchant onboarding, provide Merchant Services, process Orders, complete settlements, protect transaction security, handle complaints, and fulfil applicable obligations.
3.1 Information Provided by the Merchant
When applying to join the Platform, undergoing verification, or using the Merchant Services, a Merchant may be required to provide:
- the name of the Merchant, business, store, or operating entity;
- store address, map location, opening hours, and contact telephone number;
- the name and contact details of the legal representative, owner, responsible person, contact, or store administrator;
- identity documents, identity-verification materials, and necessary identification numbers;
- company registration documents, business licences, operating permits, or other legal-status documents;
- food-business, food-safety, hygiene, industry-specific, or other operating qualifications and permits;
- tax-registration information, tax-identification details, or information required for invoicing or filing;
- bank-account, KBZPay receiving-account, or other settlement-account information;
- store logo, store photographs, brand materials, and business descriptions;
- product or menu-item names, descriptions, ingredients, allergen information, prices, stock levels, photographs, and categories;
- delivery-area settings, preparation times, packaging fees, and other operating settings;
- the name, telephone number, role, and Account permissions of Merchant employees, operators, or sub-account users;
- information provided in connection with Order handling, out-of-stock confirmations, refunds, responses to reviews, complaints, appeals, or customer-support communications; and
- supporting evidence, photographs, documents, or other materials voluntarily uploaded by the Merchant.
The Merchant must ensure that all information provided is true, accurate, complete, lawful, valid, and that the Merchant is authorized to submit it to CloudCityFood.
Where a Merchant provides information about a legal representative, responsible person, contact, employee, beneficial owner, or other individual, the Merchant must ensure that the relevant person has been appropriately informed and that any authorization required for the submission and processing of such information has been obtained.
The Merchant must promptly update the information in the Merchant App or notify CloudCityFood if there is any change to its business licence, operating permit, settlement account, store address, or contact details.
3.2 Information Automatically Collected
When a Merchant owner, administrator, or employee logs in to or uses the Merchant Services, we may automatically collect:
- IP address, device model, device brand, operating system, and system version;
- Merchant App or web-portal version, language, time zone, and network status;
- device identifiers, application-instance information, and necessary security identifiers;
- login time, logout time, login location, and Account online status;
- operation logs, error logs, crash logs, and security logs;
- records of Orders accepted, rejected, cancelled, confirmed, prepared, marked ready, and completed;
- product-listing, delisting, repricing, inventory, and business-status changes;
- out-of-stock, refund, partial-refund, after-sales, and complaint-handling records;
- business-performance data such as Order volume, sales value, average Order value, cancellation rate, completion rate, and ratings;
- commission, Platform service fee, promotional subsidy, discount-sharing, and settlement-adjustment records; and
- information generated through cookies, local storage, software development kits, or similar technologies.
Device information, log information, and business data may constitute Personal Data where they are linked to a Merchant Account, responsible person, contact, telephone number, store, or Order record. Such information should not automatically be treated as anonymous information.
3.3 Store Location Information
We may collect, verify, and retain the Merchant’s store address, map coordinates, and operating area for the following purposes:
- displaying the store to nearby Customers;
- determining whether the store is within a supported service area;
- calculating the delivery area, delivery distance, and delivery fee;
- helping Riders travel to the store for collection;
- identifying duplicate, false, or abnormal store listings; and
- resolving disputes relating to store addresses, collection points, or delivery.
The Merchant App will not continuously track the personal location of a Merchant owner or employee merely because that person is logged in to the Merchant Account.
Where a Merchant voluntarily uses a map-selection, store-location, or address-verification feature, the Merchant App may request device-location permission while that feature is being used. Unless CloudCityFood provides a separate prominent disclosure and obtains any necessary authorization, such permission will not be used to continuously track the personal movements of Merchant owners or employees.
Purposes for Which We Process Information
4.1 Providing and Performing Merchant Services
We may use relevant information to:
- review the Merchant’s legal status, operating qualifications, and licences;
- verify the business owner, responsible person, contact, and settlement account;
- create, activate, and manage Merchant Accounts and stores;
- display the store, products, prices, opening hours, and operating status to Customers;
- receive, confirm, prepare, cancel, and complete Orders;
- transmit Order information to the Merchant and the assigned Rider;
- handle out-of-stock items, incorrect products, refunds, and other Order issues;
- calculate commissions, service fees, promotional subsidies, and other settlement amounts;
- settle Order proceeds with the Merchant;
- provide business reports, statements, reconciliation, and customer support; and
- provide cloud-printing, automatic Order acceptance, or other Merchant operating tools.
4.2 Account and Transaction Security
We may use relevant information to:
- verify the authenticity of Merchant identity, legal status, and qualification information;
- prevent false onboarding, misuse of licences, and unlicensed operation;
- prevent unauthorized use of Merchant Accounts;
- detect abnormal logins, unusual devices, and abnormal Account activity;
- prevent fraudulent Orders, false transactions, Order manipulation, and settlement abuse;
- investigate abnormal refunds, repricing, sales, or settlements;
- investigate food-safety, product-quality, incorrect-item, and Order complaints;
- handle fraud, Account compromise, payment disputes, and other security incidents; and
- protect the safety and lawful rights of Customers, Merchants, Riders, CloudCityFood employees, and the public.
4.3 Improving the Platform and Merchant Services
We may use relevant information to:
- analyse Merchant App functions and Platform business operations;
- improve Order distribution, Order acceptance, preparation, and delivery coordination;
- optimize settlement, reconciliation, and refund processes;
- analyse Order completion, cancellation, complaints, and service quality;
- improve Merchant experience and system stability;
- develop new Merchant functions, operating tools, and Platform services; and
- conduct internal statistics, financial reconciliation, audits, and business analysis.
4.4 Notifications and Communications
We may send notifications to the Merchant’s responsible person, contact, or authorized employees concerning:
- new Orders;
- Order cancellations, out-of-stock items, refunds, and complaints;
- settlement payments, statements, and reconciliation;
- Account, security, and abnormal-login alerts;
- operating-status changes and system maintenance;
- updates to operating rules, agreements, or this Policy; and
- qualification expiry, document updates, or re-verification.
Where appropriate authorization has been obtained, we may also send Platform-activity notices, traffic-promotion opportunities, marketing tools, operating suggestions, training information, or cooperation opportunities.
The Merchant may stop receiving non-essential marketing communications, but may not disable service notifications necessary for Order completion, Account security, settlement reconciliation, or Platform operations.
Basis for Processing Information
We may process relevant information on one or more of the following grounds:
- to review the Merchant’s onboarding application and perform the service arrangement between the Merchant and CloudCityFood;
- where necessary to receive and complete Orders, process refunds, calculate commissions, and complete settlements;
- based on the authorization or consent voluntarily provided by the Merchant or relevant individual;
- where reasonably necessary to protect the safety of the Platform, Customers, Merchants, Riders, and employees;
- where reasonably necessary to prevent fraud, investigate complaints, handle food-safety matters, and maintain orderly transactions;
- where reasonably necessary to improve services, maintain system security, and conduct necessary business analysis; or
- where necessary to comply with tax, accounting, audit, regulatory, judicial, or other applicable obligations.
Where processing is based on consent, the relevant person may withdraw that consent. Withdrawal will not affect processing carried out before withdrawal and will not prevent CloudCityFood from continuing to process information necessary to complete Orders, settle funds, protect safety, or comply with applicable obligations.
How We Share Information
CloudCityFood shares information only where reasonably necessary in connection with Merchant Services and Order fulfilment.
6.1 Information Displayed or Provided to Customers
To help Customers select a Merchant and complete an Order, we may publicly display or provide:
- store name, brand, and store logo;
- store address or approximate location;
- Merchant contact number or an in-Platform contact function;
- opening hours and operating status;
- product names, photographs, descriptions, prices, and stock status;
- ingredient, allergen, or other product notices;
- delivery area, estimated preparation time, and applicable fees; and
- store ratings, reviews, and Platform-promotion information.
The Merchant acknowledges and agrees that the above information constitutes public business information reasonably necessary to provide services to Customers.
We will not publicly display unnecessary information such as identity documents, private residential addresses, private telephone numbers, or complete settlement-account details.
6.2 Information Shared with Riders
To enable collection and delivery, we may provide the assigned Rider with:
- store name, address, and map location;
- store contact number or an in-Platform contact function;
- operating status, collection point, and collection instructions;
- Order items, quantities, and necessary packaging information;
- preparation status and estimated collection time; and
- information relating to unavailable items, cancellation, refunds, or other Order issues.
Riders may use such information only to complete the relevant Order and must not use it for harassment, marketing, or any unrelated purpose.
6.3 Information Shared with Service Providers
We may share necessary information with service providers acting on behalf of CloudCityFood, including:
- KBZPay, banks, and other payment or settlement providers;
- cloud-hosting, server, and data-storage providers;
- SMS, verification-code, and notification providers;
- mapping, location, and address-service providers;
- customer-support, technical-support, and data-analysis providers;
- identity-verification, qualification-verification, security-monitoring, and anti-fraud providers; and
- finance, audit, insurance, or professional advisers.
Such service providers may process information only within the scope authorized and entrusted by CloudCityFood and may not use it for their own independent and unrelated purposes.
6.4 Legal and Safety Requirements
We may retain, use, or disclose necessary information where:
- requested by a government authority, court, or regulatory body with lawful authority;
- necessary to verify business licences, operating permits, food-safety documents, or tax information;
- necessary to investigate suspected fraud, theft, unlawful operation, or unauthorized Account use;
- necessary to investigate food safety, product quality, false advertising, or consumer complaints;
- necessary to handle payment, refund, commission, tax, or settlement disputes;
- necessary to protect the personal or property safety of Customers, Merchants, Riders, employees, or the public;
- necessary to establish, exercise, or defend the lawful rights of CloudCityFood or another relevant party; or
- necessary to handle complaints, insurance, arbitration, litigation, or other dispute proceedings.
6.5 Corporate Transactions
If CloudCityFood undergoes a merger, acquisition, reorganization, financing, asset transfer, or business succession, relevant Merchant information may be transferred to transaction participants or a successor entity to the extent reasonably necessary.
We will require the receiving party to continue protecting such information to a standard no lower than that set out in this Policy. Where such a change may materially affect the rights of the Merchant or relevant individuals, we will provide notice through reasonable means.
Settlement and Payment Information
To calculate and complete Merchant settlements, we may collect, use, and retain:
- bank-account, KBZPay-account, or other receiving-account information;
- the Account holder’s name and necessary identity-verification information;
- Order number, Order amount, and payment method;
- product amount, packaging fee, and other Order charges;
- Platform commission, service fees, and other agreed charges;
- discounts, subsidies, and promotional cost-sharing;
- refunds, partial refunds, and cancellation amounts;
- adjustment amounts, deductions, and supplementary settlement amounts;
- settlement cycles, settlement times, and settlement status;
- failed, returned, or reprocessed payment records; and
- information required for financial reconciliation, tax, audit, and dispute resolution.
CloudCityFood generally will not request a Merchant’s bank password, KBZPay payment password, SMS verification code, or third-party Account login password.
Banks, KBZPay, and other payment or settlement providers apply their own privacy policies and service terms to information they independently collect and process.
Employee Accounts and Permission Management
Where supported by the Platform, a Merchant may create sub-accounts for responsible persons, administrators, finance staff, Order-acceptance staff, or other employees.
The Merchant must:
- create Accounts only for persons with a genuine business need;
- assign permissions appropriate to each employee’s role;
- avoid allowing multiple persons to share the same Account or password;
- promptly revoke access when an employee changes role, leaves employment, or no longer requires access;
- accept corresponding management responsibility for actions taken through Accounts authorized by the Merchant; and
- not use employee Accounts to create false Orders, process improper refunds, or conduct other improper activities.
CloudCityFood may retain records of Account creation, permission changes, logins, and operations for Account security, audit, complaint handling, and dispute resolution.
Cookies and Similar Technologies
The Merchant portal, web-based management system, related websites, or certain Merchant functions may use cookies, local storage, software development kits, or similar technologies to:
- maintain login status;
- remember language, region, and operating settings;
- protect Account and system security;
- analyse feature usage;
- identify technical errors;
- improve App and webpage performance; and
- prevent fraud and abnormal activity.
The Merchant may manage such technologies through device or browser settings. Disabling essential technologies may prevent certain Merchant functions from operating properly.
Data Storage and Cross-Border Processing
Depending on the systems used by CloudCityFood and its technology providers, relevant information may be stored and processed in Myanmar or may be processed or hosted by authorized service providers located in other countries or regions.
Such cross-border processing may include cloud hosting, technical support, data analytics, or other processing services.
Where cross-border processing occurs, CloudCityFood will take reasonable measures to:
- restrict the purposes and scope for which the recipient may process the information;
- require the recipient to comply with confidentiality and security obligations;
- restrict unauthorized access, use, and onward disclosure; and
- apply security measures appropriate to the nature of the information.
Where separate consent is required for relevant cross-border processing, we will provide an appropriate notice and request the necessary authorization.
Information Security
CloudCityFood will implement reasonable technical and organizational measures appropriate to the nature, sensitivity, and processing risks of the relevant information to protect it against unauthorized access, use, disclosure, alteration, loss, or destruction.
Such measures may include:
- security measures for data transmission and storage;
- Account authentication and permission management;
- restrictions on employee and service-provider access;
- access logs, operational logs, and security monitoring;
- data backup and recovery measures;
- device, Account, and abnormal-login detection; and
- security-incident investigation and response procedures.
Business qualifications, identity information, and settlement-account information may materially affect the rights and interests of the Merchant or related individuals. CloudCityFood will restrict access to such information and use it only to the extent necessary for onboarding review, Order processing, settlement, audit, complaint handling, or compliance with applicable obligations.
No method of internet transmission or electronic storage can guarantee absolute security. If an information-security incident may materially affect a Merchant or related individual, we will take reasonable containment and remedial measures based on the nature of the incident and, where appropriate, notify the affected party.
Data-Retention Periods
We retain relevant information only for as long as necessary to fulfil the purposes described in this Policy.
Our general retention principles are as follows:
- Account and Entity Information: Retained while the Merchant relationship remains active and for as long as necessary for qualification review and service provision.
- Business Licences and Operating Qualifications: Retained for as long as necessary to verify operating eligibility, handle regulatory or safety matters, and comply with applicable obligations.
- Order and Transaction Records: Retained for the periods required for tax, accounting, audit, regulatory, and dispute-resolution purposes.
- Settlement, Commission, and Reconciliation Records: Retained for as long as necessary to complete payment, reconciliation, tax, audit, and dispute resolution.
- Product and Operating Records: Retained for as long as necessary to provide store services, handle complaints, and verify historical transactions.
- Complaint and Customer-Support Records: Retained for as long as necessary to complete investigations, handle appeals, and prevent repeated disputes.
- Log and Security Records: Retained for a reasonable period based on security risks, technical requirements, and internal retention rules.
- Marketing-Consent Records: After consent is withdrawn, records may be retained where necessary to demonstrate the original consent and subsequent withdrawal.
After the applicable retention period expires, we will delete, anonymize, or otherwise appropriately dispose of the information, unless continued retention is required for legal, tax, accounting, audit, regulatory, judicial, insurance, or dispute-resolution purposes.
Merchant Account Closure and Data Deletion
A Merchant may request closure of its Merchant Account through an Account-closure function supported by the Merchant App or by contacting CloudCityFood Customer Support.
Closure of a Merchant Account may require completion of the following steps:
- stop accepting new Orders;
- complete or cancel all outstanding Orders;
- complete outstanding settlement and financial reconciliation;
- resolve incomplete refunds, complaints, and disputes;
- return any equipment or materials owned by CloudCityFood; and
- complete any other exit procedures required under the Merchant Agreement.
After receiving a valid request and completion of the necessary exit procedures, we will, within a reasonable period and generally within ninety (90) days, delete or anonymize Merchant Account Personal Data that is no longer required.
The following information may not be deleted immediately after Account closure:
- Order and settlement records that must be retained for tax, accounting, audit, or regulatory purposes;
- information required to complete outstanding settlement, refunds, deductions, or financial reconciliation;
- information required to handle complaints, food-safety matters, insurance matters, appeals, or disputes;
- information reasonably necessary to prevent fraud, investigate unlawful operation, or protect safety; and
- other information required to be retained under applicable obligations.
Account closure will not automatically release the Merchant from any Order, settlement, refund, complaint, compensation, tax, or other obligation or liability that arose before closure.
Where a Merchant ceases operating only one store but continues to operate other stores, CloudCityFood may close the relevant store without closing the Merchant’s entire entity-level Account.
Minors and Merchant Eligibility
CloudCityFood Merchant Services are primarily available to companies, business organizations, sole proprietors, or other lawful business entities that are duly established and possess the qualifications required for their operations.
A natural person registering or administering a Merchant Account on behalf of a Merchant should generally be at least eighteen (18) years of age and authorized to submit information, accept applicable terms, and operate the Account on the Merchant’s behalf.
The Merchant must ensure that:
- its business entity is duly established or otherwise lawfully qualified to operate;
- the business licences and operating permits it submits are genuine and valid;
- its approved business scope covers the products or services offered through the Platform;
- where food or other regulated products are involved, all required permits have been obtained; and
- minors are not independently authorized to manage settlement, refunds, or other significant Account permissions.
If we discover that a Merchant lacks the required qualifications, has submitted false information, or has used another person’s qualifications without authorization, we may restrict, suspend, or close the relevant Account and may restrict the use or retention of related information as appropriate.
Rights and Choices of Merchants and Related Individuals
Subject to identity verification, Merchant authorization, system capability, and reasonable legal restrictions, a Merchant or relevant individual may:
- ask whether we hold Personal Data relating to them;
- request access to Personal Data relating to them;
- correct information that is inaccurate, incomplete, or no longer current;
- update business licences, operating permits, contact details, or settlement-account information;
- adjust or revoke employee sub-account permissions;
- request closure of the Merchant Account and deletion of information that is no longer required;
- withdraw consent where processing is based on consent;
- refuse or stop receiving marketing and promotional communications;
- submit questions, complaints, or appeals concerning the processing of Personal Data; and
- request a reasonable review of a decision affecting the Account, settlement, or relevant rights.
To protect Merchant Accounts, Orders, and settlement security, we may require verification of the applicant’s identity, Merchant authorization, and supporting evidence.
We may limit or refuse a request, after providing an explanation, where the request is clearly repetitive, lacks reasonable grounds, exceeds technical feasibility, interferes with a security or regulatory investigation, or may infringe the rights of Customers, Riders, employees, or other persons.
Requests may be submitted to:
cloudcitymm@gmail.com
We will generally acknowledge receipt or provide an initial response within fifteen (15) Business Days. Complex requests may require additional time, in which case we will provide a reasonable progress update.
Platform Activities, Promotions, and Marketing Choices
Based on the Merchant’s business category, service area, Order performance, and Platform activity participation, we may send information concerning:
- Platform marketing campaigns;
- traffic-promotion opportunities;
- discounts, subsidies, and promotional activities;
- new service areas or new functions;
- Merchant training and operating suggestions; and
- advertising products or other cooperation opportunities.
Except for information required to complete Orders, manage Accounts, provide security notices, or complete settlements, we will not provide relevant Personal Data to unrelated third parties for their own independent advertising or marketing purposes without appropriate authorization.
The Merchant may stop receiving non-essential marketing communications through Merchant App settings, applicable unsubscribe instructions, or Customer Support.
Stopping marketing communications will not affect Order alerts, Account-security notices, settlement reconciliation, rule updates, or other essential service communications.
Third-Party Services and Links
The Merchant App may contain links, software development kits, or functions provided by third-party payment, banking, mapping, communications, cloud-service, or other service providers.
Information independently collected and processed by a third party is governed by that third party’s privacy policy and service terms.
CloudCityFood recommends that the Merchant and its Account users review the relevant third-party privacy notice before using such services.
This Policy does not govern information-processing activities independently carried out by third parties that have no service, control, or cooperation relationship with CloudCityFood.
Changes to This Privacy Policy
We may update this Policy to reflect changes in Merchant Services, technology, business operations, applicable requirements, or information-processing practices.
We will provide reasonable advance notice through the Merchant App, website announcements, email, or other reasonable means where a material change involves:
- collecting a new important category of information;
- introducing a significant new purpose for processing Personal Data;
- expanding the categories of recipients or scope of information sharing;
- changing how business qualifications or settlement-account information is processed;
- changing Merchant Account-closure or data-retention rules; or
- materially and adversely affecting the rights of Merchants or related individuals.
General wording changes, contact-detail updates, or changes that do not materially affect rights may take effect when published.
An updated Policy will not retrospectively alter processing activities completed before its effective date unless another appropriate basis applies or we have expressly notified the affected party.
Complaints, Dispute Resolution, and Contact Us
If a Merchant or related individual believes that CloudCityFood has processed relevant Personal Data in a manner inconsistent with this Policy, they may:
1. send an email to cloudcitymm@gmail.com;
2. provide the Merchant Account, store name, relevant Order details, or a description of the event;
3. explain the specific issue and requested outcome; and
4. provide reasonable proof of identity, Merchant authorization, or Order information where requested.
We will generally acknowledge receipt of the complaint and begin handling it within seven (7) Business Days.
After completing the investigation, we will explain the outcome or any further steps that may be available.
If the complainant is not satisfied with the internal outcome, they may seek assistance from a competent consumer-protection, commercial, tax, judicial, or other relevant authority.
Company: CLOUDCITY INTERNET SERVICE CO., LTD
Brand: CloudCityFood
Email: cloudcitymm@gmail.com
Website: www.cloudcitymm.com