PRIVACY POLICY

1. General Provisions

1.1. This Privacy Policy describes the principles governing the collection, use, storage and protection of personal data when using the Abra Kebabra website and services.

1.2. Restaurants operating under the Abra Kebabra brand may be operated by different legal entities. As a general rule, the controller of personal data relating to a specific order is the legal entity operating the restaurant selected by the Customer (hereinafter the Controller).

1.3. The details of the specific Controller are made available to the Customer during the ordering process and are also indicated on the payment document or purchase receipt related to the order.

1.4. A Data Subject is a natural person whose personal data are processed, including an Abra Kebabra customer or website visitor.

1.5. Personal data are processed in accordance with applicable data protection legislation. Personal data are processed lawfully, fairly, transparently and securely and only for specified purposes.

2. Personal Data Collected

2.1. Depending on the service used and the Customer's activities, the following personal data may be processed:

• first and last name;
• telephone number;
• email address;
• delivery address;
• order details and order history;
• payment-related information;
• communications relating to customer service and complaints;
• technical data relating to the use of the website, to the extent that such processing is necessary or permitted.

2.2. Personal data are primarily obtained directly from the Customer when placing an order, using the Abra Kebabra website or communicating with customer service.

2.3. The Customer is responsible for ensuring that the information provided is accurate and up to date.

3. Purposes and Legal Bases for Processing Personal Data

3.1. Personal data are processed primarily for the following purposes:

• receiving, processing and fulfilling orders;
• delivering or handing over orders;
• processing and administering payments;
• providing customer service and communicating with the Customer;
• handling complaints and resolving disputes;
• complying with accounting and other legal obligations;
• ensuring the security and proper functioning of the website and services;
• protecting legitimate interests and establishing, exercising or defending legal claims;
• marketing, where an appropriate legal basis exists.

3.2. Depending on the purpose of processing, the legal basis for processing personal data may, in accordance with Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR), be:

a) the Data Subject has given consent to the processing of their personal data;

b) processing is necessary for the performance of a contract to which the Data Subject is a party or in order to take steps at the request of the Data Subject prior to entering into a contract;

c) processing is necessary for compliance with a legal obligation to which the Controller is subject;

f) processing is necessary for the purposes of the legitimate interests pursued by the Controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject.

3.3. The processing of personal data necessary to fulfil an order is generally not based on the Customer's consent but is necessary for the performance of the contract concluded with the Customer.

3.4. Where the processing of personal data is based on consent, the Data Subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4. Retention of Personal Data

4.1. Personal data are retained only for as long as necessary for the purpose for which they were collected or as required to comply with legal obligations.

4.2. Personal data contained in accounting source documents are retained in accordance with the retention periods prescribed by law.

4.3. Data relating to orders and customer communications are retained for as long as necessary to fulfil the order, handle potential complaints and disputes, and establish, exercise or defend legal claims.

4.4. Personal data processed for marketing purposes on the basis of consent are processed until the consent is withdrawn or until processing is no longer necessary for the relevant purpose.

4.5. After the applicable retention period has expired or the purpose of processing has ceased, personal data are deleted or anonymised unless further retention is required or permitted by law.

5. Disclosure and Transfer of Personal Data

5.1. Personal data may, to the extent necessary, be disclosed to service providers involved in fulfilling an order or providing another service, including:

• payment service providers;
• courier and transport service providers;
• IT and website service providers;
• accounting and other support service providers;
• other service providers where this is necessary to provide the service or comply with a legal obligation.

5.2. Personal data are disclosed to third parties only to the extent necessary to provide the relevant service or fulfil another lawful purpose.

5.3. Where a delivery partner is used to deliver an order, the information necessary to complete the delivery is provided to the delivery partner.

5.4. Personal data may be disclosed to public authorities or other persons where such disclosure is required by law.

6. Security of Personal Data

6.1. Appropriate technical and organisational security measures are implemented to protect personal data against unauthorised access, disclosure, alteration, loss, destruction or other unlawful processing.

6.2. Access to personal data is granted only to persons who require such access to perform their duties or obligations related to the provision of services.

7. Rights of the Data Subject

7.1. The Data Subject has the right to request information about the processing of their personal data and to obtain access to their personal data.

7.2. The Data Subject has the right to request the correction of inaccurate or incomplete personal data.

7.3. Under the conditions provided by law, the Data Subject has the right to request the deletion of their personal data or restriction of processing.

7.4. In cases provided by law, the Data Subject has the right to object to the processing of their personal data.

7.5. Where processing is based on consent, the Data Subject has the right to withdraw their consent at any time.

7.6. Under the conditions provided by law, the Data Subject may have the right to receive personal data they have provided in a structured, commonly used and machine-readable format and to transmit those data to another controller.

7.7. To exercise their rights, the Data Subject may contact the relevant Abra Kebabra restaurant or use the contact details published on the Abra Kebabra website.

7.8. If the Data Subject considers that their rights have been infringed in connection with the processing of personal data, they have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

8. Direct Marketing

8.1. Direct marketing communications are sent where there is an appropriate legal basis for doing so.

8.2. The Data Subject may opt out of direct marketing at any time by using the unsubscribe option provided in the marketing communication or by contacting Abra Kebabra using the contact details published on the website.

8.3. Opting out of direct marketing does not affect the sending of communications necessary for fulfilling an order or providing another service used by the Customer.

9. Cookies

9.1. The Abra Kebabra website may use cookies and similar technologies to ensure the proper functioning of the website, improve the user experience, compile statistics and, with the Customer's consent, for other purposes.

9.2. More detailed information about the cookies used, their purposes and how to change cookie preferences is provided in the website's Cookie Policy.

10. Amendments to the Privacy Policy

10.1. This Privacy Policy may be amended as necessary, including due to changes in services, data processing practices or applicable legislation.

10.2. The current version of the Privacy Policy is published on the Abra Kebabra website.

10.3. Personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Estonian Personal Data Protection Act and other applicable Estonian and European Union legislation.