Privacy Policy

Who we are

This policy covers Hat Gao (58 Vasiliou Voulgaroktonou, Nicosia 1010, Cyprus), trading as [registered business/legal entity name] ([company registration number, if applicable]) — the "data controller" responsible for the personal data described below.

Contact us about privacy at hatgao.restaurant@gmail.com or +35722002235.

What we collect

• Your name and phone number (required to take an order).
• Your email address (optional — only if you want an order confirmation emailed to you).
• What you ordered, any notes you add, and your order history with us.
• If you order delivery once that's available: your delivery address, used to arrange collection by our courier partner Wolt.

We never see or store your full card number. Card payment is handled entirely by Stripe, our payment processor — we only receive confirmation that a payment succeeded or failed.

Why we use it, and on what basis

• To fulfil your order (necessary to perform our contract with you) — preparing your food, contacting you about it, and arranging collection or delivery.
• To keep financial and tax records (a legal obligation under Cyprus tax law).
• To prevent fraud and keep the ordering system secure (our legitimate interest, balanced against your rights).

We don't use your data for advertising, and we don't sell it to anyone.

Who we share it with

Each of these only receives what it needs to do its specific job, under its own contract with us:

• Stripe — payment processing.
• Resend — sending your order confirmation email, if you gave us one.
• Vercel and Neon — hosting the website and database that store your order.
• Wolt — once delivery is available, your name, phone number, and delivery address, so a courier can bring you your order.

How long we keep it

Order and payment records: at least [retention period — accountant to confirm] from the order date, to meet Cyprus tax record-keeping requirements. We keep it only as long as we're required or need to for the reasons above, then delete it.

Cookies and local storage

Our customer site doesn't use advertising or analytics cookies today. It uses:

• A login session cookie, but only for our own staff signing in to manage the kitchen and menu — not set for customers browsing or ordering.
• Your shopping cart, saved in your own browser (not sent to us until you check out) so it's still there if you refresh the page or come back later.

Because none of this is used for tracking or advertising, no cookie consent banner is required. If that changes — for example, if we ever add analytics — we'll add one and update this section.

Your rights

Under the GDPR, you can ask us to access, correct, delete, or export your personal data, or object to how we use it. Contact us using the details above. If you're not satisfied with our response, you can complain to Cyprus's data protection authority, the Office of the Commissioner for Personal Data Protection.

Changes to this policy

If we make a material change, we'll update the date at the top of this page. Continuing to order from us after a change means you accept the update.