Privacy policy

What this covers

This policy explains how Cod Father OOD — the company that runs the COD FATHER restaurant — processes personal data when you use this site, call or write to us, place an order, or apply for a job with us. The company’s details and how to reach us are in the card above.

We follow Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR) and the Bulgarian Personal Data Protection Act.

What we process

Only what the purpose needs:

• An order — your name and phone, and an email if needed.
• An allergy or intolerance, if you tell us about it — only so we can prepare your food safely.
• An enquiry by email — your name and address and what you write to us.
• A phone call — the number you call from and what you tell us.
• A job application — your CV and anything else you send us.
• A visit to the site — the technical data every browser sends: IP address, type of browser and device, which page was requested and when.
• Visit analytics — only if you press "Accept": which pages are read, on what kind of device and roughly from which city (see the cookie policy).

The "How far am I?" button asks your browser for your location only when you press it. The distance is worked out on your device; the location is not sent to us or stored.

The basket on the site sends no order — it is a list for you until you call us, and it stays in your browser. We do not sell data, show advertising or build profiles.

Why, and on what legal basis

• Orders — to fulfil them: a contract, and steps before it at your request (GDPR art. 6(1)(b)).
• Allergy information — with your explicit consent, when you tell us (art. 9(2)(a)). You can withdraw it at any time, but then we cannot adapt your food to the allergy.
• Answering an enquiry — our legitimate interest in replying to the person who wrote to us (art. 6(1)(f)), or steps before a contract when you ask about an order (art. 6(1)(b)).
• Recruitment — steps before an employment contract at your request (art. 6(1)(b)).
• Accounting, tax and consumer protection — legal obligations (art. 6(1)(c)).
• Running and securing the site, and defending ourselves in a dispute — legitimate interest (art. 6(1)(f)).
• Visit analytics — only with your consent (art. 6(1)(a) and art. 4a of the Electronic Communications Act). Withdraw it at any time with "Cookie choice" at the foot of any page; withdrawing does not affect what was processed before.

How long we keep it

• Orders — your name and phone up to 30 days after the order; accounting documents for as long as the Accountancy Act and the tax laws require (up to 10 years).
• Allergy information — only until that order is fulfilled.
• Enquiries — until the matter is closed and then no more than 12 months, unless needed for an order, a complaint or a dispute.
• Job applications — up to 6 months after recruitment ends, unless you allow us to keep them longer (art. 25k of the Personal Data Protection Act).
• Technical records (logs) of our services — up to 30 days.
• Visit analytics — Google keeps the data for at most 14 months; the cookies in your browser expire after 2 years or when you decline.

After these periods we delete the data or make it anonymous.

Who else receives it

We do not sell data or hand it over for advertising. It is received only by:

• Google — as a processor on our behalf: Firebase Hosting serves the pages; Google Cloud (Firestore and Cloud Storage) serves the current menu and the dish photos. Our email is with Google too.
• Google Analytics — only if you accept analytics.
• The people who keep our accounts — the data in accounting documents.
• Public authorities (the National Revenue Agency, the Consumer Protection Commission, the Food Safety Agency, the courts, etc.) — only when the law requires it.

Instagram and Facebook are plain links — the site embeds nothing from them and sends them no data. If you open them, their own terms apply.

Data outside the EU

The menu and the dish photos are in Google data centres in Frankfurt. Google may also process data in other countries, including the United States. Google LLC takes part in the EU–US Data Privacy Framework, covered by the European Commission’s adequacy decision of 10 July 2023; otherwise Google uses the standard contractual clauses approved by the Commission.

Your rights

At any time you can ask to:

• see your data and get a copy;
• have inaccurate data corrected;
• have it erased (the "right to be forgotten");
• restrict its processing;
• take it with you in a machine-readable format;
• object to processing based on legitimate interest;
• withdraw consent — without affecting what was processed before.

Write to the email in the card above. We reply within one month; for a complex request this can be extended by two more months, and we will tell you. We may ask you to confirm who you are, so that we never give your data to someone else.

You have the right to complain to the Commission for Personal Data Protection — 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592.

Do you have to give us your data

No. Without a phone number, though, we cannot confirm an order, and without an email or a phone number we cannot reply to you.

Children

The site is not meant for children under 14 and we do not knowingly collect their data. If you think a child has sent us data, write to us and we will delete it.

Automated decisions

We make no decisions based solely on automated processing and do no profiling (GDPR art. 22).

Security

The site works only over a secure connection (HTTPS). Your data is seen only by the people working on your order or enquiry.

Cookies

What we keep in your browser and how to change your choice — see the cookie policy.

Changes

When we change this policy, we publish the new text here with a new "Effective from" date at the top.