Privacy Policy

1. Who we are

Shahrayar operates the restaurants listed on this site and is the data controller for the personal data described below. You can reach us at downtown@shahrayar.example or 12 Vitosha Boulevard, Sofia, Bulgaria.

2. What we collect

• Account details — name, email address, phone number, and a hashed password.
• Order details — items, delivery or collection address, delivery notes, and order history.
• Payment data — handled entirely by our payment processor. Card numbers never reach our servers; we store only the result of the transaction and the last four digits.
• Location — only the delivery coordinates you choose on the map, and only to quote a delivery fee and route the courier.
• Technical data — IP address, device and browser type, and pages viewed, used to keep the service secure and working.

3. Why we use it

To take and deliver your order (performance of a contract); to keep accounts and payments secure and to prevent fraud (legitimate interests); to meet tax and accounting duties (legal obligation); and to send marketing messages, which we do only with your consent and which you can withdraw at any time.

4. Cookies

We use cookies that are strictly necessary — your session, your selected branch, your language, and the contents of your cart. Non-essential analytics cookies are set only if you accept them, and you can change that choice whenever you like.

5. Who we share it with

Only with processors who need it to run the service: our payment provider, delivery couriers, and our hosting and email providers. They act on our instructions and cannot use your data for their own purposes. We never sell personal data.

6. How long we keep it

Order records are kept for as long as tax law requires. Account data is kept while your account is open and deleted within 30 days of you closing it, except where we must retain it longer by law.

7. Your rights

You may request a copy of your data, correct it, delete it, restrict or object to its processing, or receive it in a portable format. Email us and we will respond within one month. If you are unhappy with our response you can complain to the Bulgarian Commission for Personal Data Protection.

8. Security

Data is transmitted over TLS, passwords are stored hashed and salted, and access to production systems is restricted and logged. No system is perfectly secure, but we will notify you and the regulator of a breach where the law requires it.

9. Children

The service is not directed at children under 16, and we do not knowingly collect their data. Contact us if you believe a child has provided us with personal data and we will delete it.

10. Changes

We will post any change to this policy on this page and update the date above. Significant changes will be notified by email where we hold your address.