Personal data processing policy

1. Data controller

The controller is TOOO «Firma Verasen», UNP 500059621.

Address: 1 Ozheshko Street, 230023 Grodno, Republic of Belarus. Phone: +375 33 680 00 06.

2. Purposes of processing

• placing, preparing and delivering (or handing over for pickup) your orders;
• contacting you about an order: clarifying details and an operator call if you requested one;
• feedback and handling your requests;
• complying with legal requirements, including accounting.

3. Data we process

• name;
• phone number;
• delivery address: settlement, street, house, apartment, entrance, floor and courier note;
• order history: items, price, fulfilment and payment method, comment, date and time;
• for registered users — profile data, saved addresses and records of the consent given;
• short-lived technical data used to prevent abuse: your IP address is processed in hashed form and kept for a few minutes.

4. Legal basis

We process personal data on the basis of your consent, which you confirm with a checkbox on the checkout or registration form. The version of the consent is recorded. You cannot place an order on the website without it.

5. Who receives your data

Data is shared only as far as needed to fulfil an order: with the iiko restaurant automation software we use to receive orders, and with staff and couriers who handle the order. For registered users, the phone number may be passed to the provider that sends verification codes.

We do not sell personal data and do not use it for marketing mailings.

6. Storage and protection

The controller takes legal, organizational and technical measures to protect personal data against unauthorized access, alteration and disclosure, and ensures storage in line with the requirements of the legislation of the Republic of Belarus.

7. Retention periods

Personal data is kept no longer than the purposes of processing and the law require. Order data needed for accounting and other mandatory records is kept for the periods set by law; once they end, the data is deleted or anonymized.

Profile data is kept until you delete the account or withdraw consent. When an account is deleted, order records that must be retained are anonymized: name, phone and address are removed.

8. Your rights

Under Law No. 99-Z you have the right to:

• withdraw your consent to personal data processing;
• receive information about how your personal data is processed and demand corrections if it is incomplete, outdated or inaccurate;
• receive information about disclosure of your data to third parties;
• demand that processing stops and your data is deleted where there is no ground for processing;
• appeal the controller's actions to the authority protecting the rights of data subjects (the National Personal Data Protection Centre of the Republic of Belarus) or to a court.

9. How to exercise your rights

Send a request to the controller at the address above or call +375 33 680 00 06. A signed-in user can delete the account in the personal account area.

Withdrawing consent does not affect processing required for orders already placed, within the limits set by law.

10. Cookies and technical data

For signed-in users the website uses a protected session cookie. The cart is stored in your browser on your device and contains no personal data.

If you click «Show map» on the delivery page, your browser will load a map from a third-party service. No requests to it are made before that.

11. Changes to this Policy

The controller may update this Policy. The current version is always available on this page, with its date shown at the top.