Privacy noticeYour data, kept safe.

01In short

• We only collect the data needed for what you ask us: preparing an order, answering you, reviewing an application.
• We do not sell your data and we do not use it for personalised advertising.
• Your card details never pass through us: Stripe handles them.
• Statistics and maps are switched on only if you consent.
• You can ask us at any time to see, correct or delete your data: write to info@kebabberiagroup.com.

This notice explains how we process personal data when you use kebabberiagroup.com, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).

02Who processes your data

The data controller is Kebabberia Group, Via De Cesare Raffaele 11, 70122 Bari (BA), Italy.

• Privacy email: info@kebabberiagroup.com

For any question about this notice or your data, write to the address above.

03What data we collect and why

Each feature of the site uses only the data it needs. For each one you will find which data, what for, and the legal basis (Art. 6 GDPR).

Online orders for pickup

• Data: name, phone, email, chosen restaurant, pickup time, products and customisations, notes, amount, payment method, payment status and order number.
• Why: to prepare your order, contact you if there is a problem, send you the confirmation and keep our accounts.
• Legal basis: performance of the contract (Art. 6(1)(b)) and tax and accounting obligations (Art. 6(1)(c)).

Online payments

• Data: you enter them directly in Stripe’s form. We only receive the outcome, the amount and a transaction reference, never your card number.
• Why: to take payment, handle refunds and prevent fraud.
• Legal basis: performance of the contract (Art. 6(1)(b)). Stripe processes some data as an independent controller, for its own anti-fraud and anti-money-laundering duties, under its privacy policy.

Service emails

• Data: email, name, details of the order or request.
• Why: to send you the order confirmation and our replies, and to alert the restaurant to a new order. We send them through Resend.
• Legal basis: performance of the contract or of steps you ask us to take before one (Art. 6(1)(b)).

Offers and news (only if you choose)

• Data: name and email, if you tick the optional box at checkout or in the franchise form.
• Why: to send you Kebabberia offers and news.
• Legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time through the link in every email or by writing to us. Without the tick we never send you promotions.

Contact form

• Data: name, email, phone (optional), topic, restaurant and order number (optional), message.
• Why: to answer your request or complaint.
• Legal basis: steps you ask us to take (Art. 6(1)(b)) and our legitimate interest in handling customer requests (Art. 6(1)(f)).

Franchise applications

• Data: every field of the form: first and last name, email, phone, how and when you prefer to be contacted, country, region, city and area of interest, current occupation, experience in food service and in running a team, the role you would have in the business, number of restaurants and partners, timing, available capital range, how you would fund it, whether you have premises (address and size), your motivation and how you heard about us. If you arrive from a campaign, also where you came from (UTM parameters, landing page, referring site).
• Why: to review the application, get back to you and understand which channels work.
• Legal basis: steps you ask us to take before a contract (Art. 6(1)(b)) and, for where you came from, legitimate interest (Art. 6(1)(f)).
• While you fill it in, the draft is saved only on your device for 30 days, without the consents. It reaches us only when you press Send.

Job applications

• Data: name, email, phone, city, the role and restaurant you are interested in, message and, if you attach it, your CV as a PDF.
• Why: to review your application and invite you to an interview.
• Legal basis: steps before a contract (Art. 6(1)(b)) and Article 111-bis of the Italian Privacy Code for CVs sent on your own initiative.
• Put only what is needed in your CV: leave out health data, opinions and other special categories, except those the law requires (for example membership of protected categories).

Usage statistics (only with consent)

• Data: pages visited, actions on the site (for example “add to cart”), device and browser type, approximate location. No name, email or phone; we strip order codes from page addresses.
• Why: to see which pages work and where an order gets stuck, so we can improve the site. We use Google Analytics 4, loaded through Google Tag Manager.
• Legal basis: consent (Art. 6(1)(a)), given or refused in the cookie banner.

Restaurant map (only with consent)

• Data: IP address and technical device data, which your browser sends to Google when the map loads.
• Why: to show you our restaurants on the map and directions to get there.
• Legal basis: consent (Art. 6(1)(a)): the map loads only if you accept third-party content or tap “Show map”.

Form protection

• Data: IP address, browser data and technical interaction signals, read by Cloudflare Turnstile.
• Why: to check that forms are filled in by a person, not an automated program.
• Legal basis: legitimate interest in the security of the site (Art. 6(1)(f)). It is not used for advertising.

Browsing and security

• Data: IP address, date and time, page requested, browser. They are recorded by the servers that host the site.
• Why: to run the site, defend it from attacks and fix faults.
• Legal basis: legitimate interest (Art. 6(1)(f)).

The site also saves some information in your browser (for example your cart): see the cookie page.

04How long we keep it

We keep data only for as long as needed. Then we delete it or make it anonymous.

If there is a dispute, we may keep the data needed to defend ourselves until it is over.

05Who receives your data

Inside Kebabberia only the people who need your data can see it: the restaurant preparing your order sees only its own orders, applications are read only by the people who hire staff or partners, each with a personal login.

We use providers that process data on our behalf, as processors (Art. 28 GDPR), under a contract that requires them to protect it:

• Vercel Inc.: website hosting.
• Neon Inc.: database, on servers in the European Union (Frankfurt).
• Cloudflare Inc.: form protection (Turnstile) and storage of uploaded files, such as CVs.
• Resend Inc.: sending service emails.
• Google Ireland Ltd: Tag Manager, Analytics and Maps, only with your consent.
• Stripe Payments Europe Ltd: online payments (partly as an independent controller, see above).

Data may also be shared with our accountant and advisers, for legal obligations, and with the authorities when the law requires it. We never sell or hand over your data to anyone for marketing.

06Data outside the European Union

Some providers (Vercel, Neon, Cloudflare, Resend, Stripe, Google) are US companies or part of groups based in the United States, so some data may be processed outside the EU.

In these cases the transfer is protected by a European Commission adequacy decision (the EU-US Data Privacy Framework of 10 July 2023, for companies that have joined it) or by the standard contractual clauses approved by the Commission (Decision 2021/914). You can ask us for a copy of these safeguards.

07Your rights

At any time, free of charge, you can ask us to:

• access your data and get a copy (Art. 15);
• correct or complete it (Art. 16);
• delete it (Art. 17), except what we must keep by law, such as the tax records of orders;
• restrict its use (Art. 18);
• receive it in a machine-readable format, or have it sent to another controller (portability, Art. 20);
• object to processing based on our legitimate interest (Art. 21);
• withdraw consent whenever you like (Art. 7(3)): it applies from then on and does not affect what was done before. For cookies, just use the Manage cookie preferences button.

To exercise them, write to info@kebabberiagroup.com. We reply within one month; if the request is complex we may extend this by two more months, and we will tell you (Art. 12). To protect you, we may ask you to confirm your identity.

08Complaints to the Garante

If you think we are not handling your data correctly, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00186 Rome, www.garanteprivacy.it, or go to court. We would appreciate it if you wrote to us first: we will try to sort it out straight away.

09Required and optional data

Required fields in the forms are marked: without that data we cannot prepare the order or answer the request. Everything else is optional, and leaving optional data out has no consequences.

10No automated decisions

We do not take decisions based solely on automated processing, including profiling, that have legal effects on you (Art. 22). Applications are always read by a person. The anti-bot check on the forms is automatic but only blocks submissions from programs: if it fails, you can try again or write to us.

11Children

The site is aimed at adults. If you are under 14, do not send us personal data without a parent (Art. 2-quinquies Italian Privacy Code). Job applications are open only to people who have reached the legal minimum working age. If we find we have received a minor’s data without permission, we delete it.

12How we protect data

• The site always uses an encrypted connection (HTTPS).
• Each person on the team has a personal login, limited to what they need.
• CVs are kept in a private archive, under random file names, and never travel as email attachments.
• Card data stays with Stripe, which is PCI DSS certified.

13Changes to this notice

If we change the way we process data, we update this page and the date at the top. If the change is significant, we will tell you clearly on the site.