This policy explains what personal data we collect when you order on https://lavash-house.bg, why, on what legal basis, who we share it with, how long we keep it and what rights you have under Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and the Bulgarian Personal Data Protection Act. This is a translation of the Bulgarian original.
1. Controller
40F EOOD („40Ф“ ЕООД, trade name LAVASH HOUSE), UIC 207126459, registered office and address of management: Rakovina St., 8256 Sveti Vlas, Nessebar Municipality, Burgas Province, Bulgaria; phone +359875309089. We are not required to appoint a data protection officer; please send any questions to the contacts above.
2. What data we process
- When you order: name, phone, delivery address and address comment, order comment, whether we should call to confirm, promo code and payment method.
- Order history linked to your phone number: number, date, items, amount and status of your orders.
- Technical data: IP address when ordering, server log entries (IP address, date and time, requested page, browser) and the cookies described in section 10.
- Communication: the content of calls, emails and messages you send us.
- Health data: we do not ask for it. If you mention an allergy or intolerance in a comment yourself, we use it only to prepare your order safely, based on your explicit consent given by providing it (Art. 9(2)(a) GDPR).
Your name, phone and (for delivery) address are needed to fulfil the order; without them we cannot accept it. Everything else is optional.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Accepting, preparing and delivering your order, contacting you about it, status notifications (order page) | Performance of the contract — Art. 6(1)(b) GDPR |
| Payments and refunds; receipts, invoices and accounting | Contract and legal obligations under the Accountancy Act, the VAT Act and Ordinance No. N-18 — Art. 6(1)(b) and (c) |
| Complaints, withdrawals, disputes and defence of legal claims | Legal obligation and legitimate interest — Art. 6(1)(c) and (f) |
| Website security, abuse prevention and enforcing promo code conditions (e.g. “first order only”) | Legitimate interest — Art. 6(1)(f) |
| Showing operators how many orders you have placed and their total, so they recognise regular customers | Legitimate interest — Art. 6(1)(f) |
| Map on the Delivery and Contacts pages (OpenStreetMap) | Legitimate interest — Art. 6(1)(f) GDPR: showing where the restaurant is and where we deliver |
Where we rely on legitimate interest, we have assessed that it does not override your rights; you may object (section 7). We do not make decisions based solely on automated processing that have legal effects on you, and we do not profile you.
4. Recipients
- Our operators, cooks and couriers — only the data they need for the order.
- LLC “Hosting Ukraine” (Ukraine.com.ua), Kyiv, Ukraine — hosting of the website, database and email, as a processor.
- Telegram (Telegram FZ-LLC, United Arab Emirates) — new orders (number, items, amount, name, phone, address and comments) are sent to a private working group of our operators.
- OpenStreetMap Foundation, United Kingdom — map tiles (OpenStreetMap) on the Delivery and Contacts pages. The Foundation receives your IP address; no cookies are set.
- Our accountant and legal advisers — under a duty of confidentiality.
- Public authorities (National Revenue Agency, Consumer Protection Commission, Food Safety Agency, courts, prosecution, police) — where required by law.
We do not sell your data or share it with third parties for advertising.
5. Transfers outside the European Union
5.1. Our hosting provider’s servers are located in Ukraine, for which the European Commission has not adopted an adequacy decision. The transfer is based on the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You may request a copy from us.
5.2. The operators’ working group in Telegram may involve a transfer of data outside the EU. It is necessary for the performance of the contract with you — to receive and fulfil your order (Art. 49(1)(b) GDPR).
5.3. The OpenStreetMap Foundation is based in the United Kingdom, a country for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).
6. Retention periods
- Name, phone, address and comments in an order — 3 years from the order, after which they are erased automatically. A customer profile with no orders during that period is deleted.
- Order number, date, items and amounts (without your contact details) — as long as required by the Accountancy Act (up to 10 years).
- IP address when ordering — 6 months.
- Server log — up to 14 days.
- Messages in the operators’ Telegram group — up to 1 month, after which they are deleted automatically.
- In case of a complaint or dispute — until it is finally resolved.
7. Your rights
You have the right: of access to your data (Art. 15 GDPR); to rectification (Art. 16); to erasure (Art. 17); to restriction of processing (Art. 18); to data portability (Art. 20); to object to processing based on legitimate interest (Art. 21) — and to direct marketing at any time without giving reasons; to withdraw consent at any time without affecting the lawfulness of processing before withdrawal (Art. 7(3)).
To exercise your rights, call or write to us at the contacts in section 1. We reply within one month (for complex requests up to three months, in which case we will let you know). We may ask you to confirm your identity, for example by calling from the phone number you ordered with.
You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg) or with the supervisory authority of the EU country where you live or work.
8. Security
Only staff who need the data for their work have access to it, with personal accounts and roles. Card details never pass through our servers. We apply technical and organisational measures against unauthorised access, loss and alteration of data.
9. Children
The website is not intended for persons under 14 and we do not knowingly collect their data. We sell alcohol to adults only.
10. Cookies
Cookies are small files the website stores in your browser. We use only the following:
| Name | Purpose | Lifetime |
|---|---|---|
| lavash-house-session | Strictly necessary: keeps your cart and session on the website | 4 hours |
| XSRF-TOKEN | Strictly necessary: protects forms against forged requests | 4 hours |
Strictly necessary cookies do not require consent because the website cannot work without them. We do not use analytics or advertising cookies; if we start to, we will ask for your consent first. The OpenStreetMap map on the Delivery and Contacts pages sets no cookies.
11. Changes
We may update this policy; the new version is published on this page with the date from which it applies.