Privacy Policy

NatoMaki Sushi Bar, Saripolou Square, Limassol, Cyprus, is the data controller for the personal data described in this notice. We operate the website natomaki.com.cy and the mobile applications “NatoMaki” (for customers) and “NatoMaki Staff” (for our couriers and kitchen team).

Contact for any privacy matter: info@natomaki.com.cy · +357 95 96 43 50. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR; the e-mail above reaches the person responsible for privacy requests.

Providing your name, phone, address and e-mail is necessary to place an order — without them we cannot conclude or perform the contract. Everything based on consent is optional and refusing it does not affect your ability to order.

We do not process special categories of data (Article 9 GDPR). If you tell us about an allergy or dietary requirement in an order note, we use it only to prepare that order safely and it is deleted with the order data.

We use no tracking cookies, no advertising cookies and no third-party analytics or marketing pixels. Nothing is placed on your device beyond what the shop needs to function: your sign-in session, your shopping cart, your chosen language, security checks, and the record that you have seen this notice.

Because these are strictly necessary, they are set without a consent prompt, in line with the exemption in Article 99 of the Cyprus Law 112(I)/2004 on the Regulation of Electronic Communications and Postal Services and the ePrivacy Directive 2002/58/EC. You can clear them at any time in your browser or device settings.

The “Find us” section of the website embeds a Google map. When that map loads, your browser contacts Google directly, so Google receives your IP address and may set its own cookies under its privacy policy. We do not receive any data from the map and we do not use it to track you. Inside the NatoMaki apps no cookie notice is shown, because only the strictly necessary storage above is used.

If we ever introduce storage that is not strictly necessary — for example analytics to see which dishes are popular — we will ask for your consent in a banner before anything is loaded, and you may withdraw it at any time via “Privacy & cookies” in the footer.

We never sell your personal data and never use it for third-party advertising. We share it only with the recipients we need to run the shop, each bound by a data processing agreement under Article 28 GDPR where they act as our processor:

• Stripe — card payments, refunds and tips (an independent controller for payment and anti-fraud purposes).
• Our hosting, database and e-mail providers — storing your account and orders and sending order confirmations.
• Apple and Google — technical delivery of push notifications to your device.
• Google Maps — displaying addresses, delivery zones and routes.
• Our own staff and couriers — the courier delivering your order sees the delivery address, order contents and phone number for that order only.
• Public authorities, our accountants or lawyers — only where we are legally required or need to defend a legal claim.

Our servers and databases are hosted in the European Union (Ireland). Some providers (Stripe, Apple, Google) may process limited data in the United States or other countries outside the European Economic Area. Where that happens, the transfer is protected by the European Commission’s Standard Contractual Clauses under Article 46 GDPR and, where applicable, by the provider’s certification under the EU–US Data Privacy Framework adequacy decision. You may request a copy of the safeguards used by writing to us.

We do not take decisions about you based solely on automated processing, and we do not carry out profiling within the meaning of Article 22 GDPR. Stripe applies automated fraud checks to card payments; a declined payment can always be resolved by contacting us and paying by another method.

All traffic to natomaki.com.cy and both apps is encrypted with HTTPS. Passwords are stored only as salted hashes. Access to customer and order data is restricted by role — couriers see only their own runs, and staff accounts are protected by row-level access rules in the database. Delivery PIN codes are never shown to couriers. Location data is deleted as soon as a delivery ends. If a personal data breach is likely to result in a risk to your rights, we will notify the Cyprus Commissioner within 72 hours and inform you where the law requires it (Articles 33 and 34 GDPR).

Under the GDPR you have the right to:

• access your personal data and receive a copy (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased — “the right to be forgotten” (Art. 17);
• restrict our processing (Art. 18);
• receive your data in a portable, machine-readable format or have it sent to another provider (Art. 20);
• object to processing based on our legitimate interests, and to direct marketing at any time (Art. 21);
• withdraw any consent at any time, without affecting processing that already took place (Art. 7(3)).

Write to info@natomaki.com.cy. We answer within one month, which we may extend by two further months for complex requests, telling you why. Exercising your rights is free of charge; we may ask you to confirm your identity so that we do not disclose data to the wrong person.

You can delete your account yourself at any time: sign in and use natomaki.com.cy/delete-account on the website, or Account → Delete account in the NatoMaki app. The deletion is immediate and permanent — your sign-in, profile, saved addresses and notification tokens are removed and you cannot sign in again.

You may also ask us to do it, by writing from your registered e-mail address to info@natomaki.com.cy with the subject “Delete my account”; we complete such requests within 30 days. Invoice and order records that Cypriot tax and VAT law obliges us to keep are retained for 7 years, restricted to accounting use only, and then deleted. Published reviews are anonymised or removed on request.

Our service is intended for people aged 16 and over — the age of digital consent in Cyprus under Law 125(I)/2018. We do not knowingly collect data from children under 16; if you believe we have, contact us and we will delete it.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to lodge a complaint with the Cypriot supervisory authority, the Office of the Commissioner for Personal Data Protection, Nicosia — dataprotection.gov.cy — or with the authority in your country of residence, and to a judicial remedy before the Cypriot courts.

We update this notice when our processing changes. The date at the top always shows the current version, and for significant changes we notify you in the app or by e-mail before they take effect.