Privacy policy

Most of it comes directly from you — by phone, when you order or book. The rest arises from using the site.

• Your name and phone number when you book or order
• A delivery address, only when you ask for delivery — taken on the phone, not on this site
• An email address if you sign up for the newsletter
• The content of an email you send us, including a job application and anything in it
• Pseudonymised visit statistics, only if you allow statistics cookies

We take no card details, on this site or anywhere on it — there is no online payment. We do not ask for special categories of data. If you tell us about a health matter so we can feed you safely — an allergy or an intolerance — we use it for that order and nothing else, and we do not record it afterwards.

Every purpose is tied to a service you actually asked for, and each has a legal basis.

• To confirm a booking and deliver an order — performance of a contract, or steps taken at your request before entering one
• To tell you if opening hours change — our legitimate interest in reaching a customer who is expecting us
• To answer an enquiry or a job application — our legitimate interest in conducting business correspondence
• To send the newsletter — your consent, which you can withdraw at any time
• To count visits to the site — your consent, given through the cookie banner
• To keep the accounting records the law requires of us — a legal obligation

Each kind of data has its own period.

• Booking and order details — 30 days after your visit, unless an invoice makes them an accounting record, which the law requires us to keep for longer
• An email enquiry — 12 months
• A job application — 12 months, unless you ask us sooner to delete it
• A newsletter address — until you unsubscribe, and the link is in every message; unsubscribing stops the mail and records your withdrawal, and we delete the profile on request
• Visit statistics — 14 months, the retention Google Analytics is configured to
• Server logs held by our host — as long as that provider keeps them, for security and diagnosis

We do not sell personal data and we do not hand it to third parties for marketing. We share it only with providers acting on our behalf under a duty of confidentiality.

• The delivery driver gets only the address and phone number
• Hosting and site delivery — Vercel Inc.
• Site content database and uploaded images — Convex Inc.
• Newsletter delivery — Klaviyo Inc., only if you subscribed
• Sign-in for the staff area — Clerk Inc. Its script is loaded on every page of this site, not only the staff pages, so your IP address and browser reach Clerk on any visit
• Visit statistics — Google Analytics, only with your consent
• Consent management — Cookiebot, which is how you refuse the rest
• The map on the home and contact pages is served by Google, and loads only once you ask for it

Some of these providers process data outside Bosnia and Herzegovina and the European Economic Area. Where that happens, the transfer relies on standard contractual clauses or another appropriate safeguard.

At any time you can ask us for:

• A copy of the data we hold about you
• A correction to anything inaccurate
• Deletion of all of it
• Restriction of how we use it, while a question about it is open
• An objection to processing we base on our legitimate interest
• A copy in a portable form, for data you gave us under consent or a contract
• Withdrawal of any consent you have given, which we act on without asking why

Write to the address above and we answer within 30 days. If you are not satisfied with the answer, you can complain to the Personal Data Protection Agency of Bosnia and Herzegovina (Agencija za zaštitu ličnih podataka u Bosni i Hercegovini) — you do not need our permission, and you can go to them instead of us.

If this policy changes, the new text goes on this page with a new effective date and version. This version replaces the one dated 5 September 2026, which described fewer of the providers above.