Privacy policy

Who processes the data

The data controller is TODO_§16 (Sorry Sara, operator — details from Hanna), 3 Kalofer St, Burgas, Bulgaria. For data protection questions, write to TODO_§16_email.

What data we collect and why

We collect only the data needed for the specific service:

• Table reservation: name, date and time, number of guests, phone or Telegram — to confirm and hold your seat. Basis: Art. 6(1)(b) GDPR (performing your request).
• Event tickets: name and payment data are processed by Stripe; we keep only the fact of purchase and confirmation. Basis: Art. 6(1)(b).
• Newsletter: e-mail with double opt-in. Basis: consent, Art. 6(1)(a) — you can withdraw it any time.
• Analytics and marketing: only after your explicit consent via the cookie banner. Basis: consent, Art. 6(1)(a).

Retention periods

We keep data only as long as needed: reservation data until the event is over and a short period after; accounting data for paid tickets per statutory periods; newsletter e-mail until you unsubscribe.

Sub-processors

We use trusted providers that process data on our behalf:

• Brevo (Sendinblue, EU) — sending e-mail and managing the newsletter.
• Clouding.io (EU, Spain) — hosting the website and database.
• Stripe — processing ticket payments.
• Google / Google Tag Manager — analytics and marketing tags, only after consent.
• Google Maps — loading the map, only after marketing consent.

Your rights

You have the right to access, rectification, erasure, restriction and portability of your data, the right to object, and the right to withdraw consent at any time. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP).

To exercise your rights, write to us at TODO_§16_email.