Privacy Policy

1. Controller

The controller of your personal data is the merchant named at the top of this page. For any question about your data, email us or write to the correspondence address. We have not appointed a data protection officer, as the law does not require one for our activity.

2. What we process and why

• Order: name, phone, email, delivery address, note, the products, the amounts, the payment method and the order status — to prepare, deliver and confirm the order and to call you when needed. Basis: performance of the contract (Art. 6(1)(b) GDPR).
• Checkout confirmations: which versions of the Terms, the Cancellation terms and this policy you confirmed, and when — as evidence of the contract. Basis: legal obligation and our legitimate interest in proving the contract terms (Art. 6(1)(c) and (f)).
• Card payment: the payment reference, amount, currency and status received from the bank. We never receive card data (number, expiry, CVV) — it is entered only on the bank's page. Basis: performance of the contract and legal obligations.
• Account (optional): name, email, phone, password (only as an irreversible hash), saved addresses and order history. Basis: contract (Art. 6(1)(b)).
• Complaints and correspondence: the message and contact details — to answer and resolve the matter. Basis: contract and legal obligation.
• Technical data: IP address and request times in the hosting provider's server logs — for security and troubleshooting. Basis: legitimate interest (Art. 6(1)(f)).

The order data is needed to carry out the order — without it we cannot deliver. We do not ask for consent for this processing. We send no marketing messages, do no profiling and do not sell data.

3. Recipients and processors

• The Restaurant's staff, including whoever delivers the order — only as needed for it.
• Render Services, Inc. (USA) — hosting of the site and the database (processor).
• Resend (Plus Five Five, Inc., USA) — sending the order emails (processor).
• The bank servicing the virtual POS terminal — only when you pay by card; it processes the card data as an independent controller under its own policy.
• Google — only if you press “Show the map” on the Contacts page; the map then loads from a Google server, which receives your IP address and may set its own cookies.
• Our accountant and public authorities — where the law requires it.

Where a processor stores data outside the European Economic Area, the transfer takes place under appropriate safeguards under Chapter V GDPR (an adequacy decision or the European Commission's standard contractual clauses).

4. Retention

• Order data (including the checkout confirmations): as long as needed for delivery, complaints and possible disputes — no longer than the general five-year limitation period (Art. 110 of the Bulgarian Obligations and Contracts Act). Data forming part of accounting records is kept for the period set by the Accountancy Act.
• Account: until you delete it. Deleting removes the account, the password and the addresses, and takes the name, email, phone, address and note out of the orders; only the number, date, products and amounts remain.
• Correspondence and complaints: until the matter is resolved and for the period of any dispute.
• Server logs: for a short technical period set by the hosting provider.

5. Your rights

You have the right of access, rectification, erasure, restriction, portability and to object to processing based on legitimate interest. Email us or write to the correspondence address — we reply within one month. You can also delete your account yourself from your profile page.

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg.

6. Contact about your data

• Phone: 064 801 999
• Email: pizzapazzopln@gmail.com
• Correspondence address: 37 Dimitar Konstantinov St., floor 4, apt. 5, 5800 Pleven, Bulgaria

7. Security

The connection to the site is encrypted (HTTPS). Passwords are stored only as a hash, sessions use signed httpOnly cookies and access to the admin area is role-restricted.

8. Cookies

The site uses only strictly necessary cookies and local storage. There are no analytics or advertising cookies. The Google map loads only after you ask for it. Details are in the Cookie Policy.

9. Children

The site is not intended for account creation by persons under 16 without the consent of a parent or guardian.

10. Changes

The date and version of this policy are shown at the top. The version you read when ordering is recorded with the order.