Privacy Policy

The data controller is Krasi 75 OOD, company no. (ЕИК) 202233222, VAT No. BG202233222, with registered seat and address of management at: 6000 Stara Zagora, kv. Samara 3, bl. 9, fl. 8, ap. 62. Establishment (Lindo restaurant): kv. Samara 3, block 6, Stara Zagora. Manager: Krasimir Raychev.

For questions about your personal data: email admin@lindo.bg, phone +359 886 223 244. We are not required to appoint a Data Protection Officer; the contacts above handle all requests.

• Identity and contact: name, email, phone.

• Delivery addresses: street/number, entrance/floor/apartment, notes and geographic coordinates (to calculate the delivery zone and fee).

• Account data: sign-in via Google or via email with a password and confirmation code, saved addresses, language choice, newsletter consent.

• Order data: order contents, amounts, payment and fulfilment method, history.

• Payment data: handled directly by ProCredit Bank's virtual POS under the 3-D Secure standard. We never see or store your card number or CVV — we only receive transaction references (for refunds and accounting).

• Technical data: IP address, device/browser type, cookies and security data (e.g. the Cloudflare Turnstile anti-bot check at sign-in).

• Fulfilling your order and running your account — on the basis of performance of a contract (Art. 6(1)(b) GDPR).

• Complying with legal obligations — accounting, tax and consumer-protection law (Art. 6(1)(c)).

• Security, abuse/bot prevention (Turnstile), operating and improving the service — on the basis of legitimate interest (Art. 6(1)(f)).

• Marketing emails/newsletter — only with your explicit consent (Art. 6(1)(a)), which you can withdraw at any time without affecting your orders.

We share data only with providers needed to run the service, each acting on our instructions under a contract:

• ProCredit Bank (AD) — card payment processing and refunds.

• Hetzner Online GmbH (Germany, EU) — hosting of the site and database (data-processing agreement in place).

• Cloudflare, Inc. — anti-bot protection (Turnstile) and network security.

• Google Ireland/LLC — account sign-in via Google (when you choose it).

• Resend / our email provider — sending sign-in and notification emails.

• OpenStreetMap / Nominatim — maps and address lookup.

• Our staff and couriers — to prepare and deliver your order.

We do not sell or rent personal data. We may disclose data to competent authorities where the law requires it.

Core processing and hosting are in the EU. Some providers (e.g. Cloudflare, Google, our email provider) may also process data in the USA. Such transfers rely on the European Commission's adequacy decision — the EU-US Data Privacy Framework — and/or the Commission's Standard Contractual Clauses as appropriate safeguards.

• Account data — while your account is active.

• Order data and accounting documents — for the period required by the Accountancy Act and tax law (as a rule, up to 10 years).

• Marketing data — until you withdraw consent.

When you delete your account, the data is removed after a 14-day grace period; accounting records for past orders are retained for the legally-required period, with unnecessary personal data anonymised.

You have the right to access, rectify, erase (“right to be forgotten”), restrict processing, data portability and to object, and to withdraw consent at any time.

You can delete your account and personal data directly from your account settings (“Delete account”). For other rights, email admin@lindo.bg — we respond within one month.

If you believe your rights have been infringed, you may lodge a complaint with the Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, tel. +359 2 915 3 518, kzld@cpdp.bg, www.cpdp.bg.

We do not carry out automated decision-making with legal effect on you, nor profiling for such purposes. Calculating the delivery zone/fee is technical and produces no legal effect.

We apply appropriate technical and organisational measures: encrypted connection (HTTPS/TLS), access controls, and card data is entered only on the bank's secure page.

The service is not intended for children. We do not knowingly collect data of persons under 14 without parental/guardian consent. Alcohol is sold only to persons over 18 (see the Terms of Use).

We use only strictly-necessary cookies (sign-in, security, cart and preferences) and no advertising or tracking cookies. See the Cookie Policy (/cookies) for details.

We may update this policy; the current version and its date are published here. For questions: admin@lindo.bg or +359 886 223 244.