Privacy Policy
PRIVACY POLICY
This website Privacy Policy regulates how its owner UAB „Amber Food„ (hereinafter - the Company, We), processes the personal data of its customers and/or visitors (hereinafter - Users, You) and other persons and ensures the security of personal data. This Privacy Policy applies to the following websites: https://www.charliepizza.lt, https://www.katpedele.lt, https://www.lacrepe.lt and https://www.noriukortele.lt. When used below, the term "Website" refers to the privacy policy of the website on which it is published.
WHO ARE WE?
Restaurant chain belongs to UAB „Amber Food“, provider of catering services, legal entity code 301675046, registered office address: Upės st. 9-1, LT-09308 Vilnius, tel. +370 615 42162. The owner of https://www.charliepizza.lt, https://www.katpedele.lt, https://www.lacrepe.lt and https://www.noriukortele.lt (websites and the controller of the personal data processed there is UAB "Amber Food".
We care about your privacy and the security of your personal data, and we are fully committed to processing the data of our Users and other persons only in accordance with the established principles and requirements for the processing of personal data. This Privacy Policy applies in conjunction with the Terms of Sales and the Cookie Policy published on our Website. If you have any questions about personal data processing or would like to obtain more information on personal data processing, please contact us at [email protected].
WHEN DO WE PROCESS YOUR PERSONAL DATA?
We only collect and process your personal data when it is necessary to achieve our legitimate purposes and when we have a legal basis to do so. The Company processes personal data:
- When you have given your consent to the processing of your personal data for a specified purpose or purposes;
- When it is necessary to perform the contract or transaction concluded with you or to take action at your request before concluding the contract or transaction;
- When required to do so by law;
- When the processing of personal data is necessary to achieve the legitimate interests of the Company.
WHAT PERSONAL DATA DO WE PROCESS?
- When you purchase goods at our e-shop, we process:
- Name
- Telephone number
- Payment details (bank, payment card or account number). Please note that the Company uses the payment services provided by UAB „OPAY Solutions“ to make payments and does not directly process your payment data: the User shall submit the payment data to the OPAY payment system, which shall process them in accordance with the personal data processing policy of this system and its General Terms and Conditions of the Payment Services Agreement. After you make a payment, we get informed about the transaction by the OPAY payment system or your bank.
- Technical data (IP address)
Purpose of data processing – payment for goods that the User has purchased at our e-shop
Legal basis of data processing – conclusion and execution of the purchase and sale agreement / transaction between the User and the Company
Duration of data processing – data confirming the fact of the contract / transaction and information related to the conclusion of the contract / transaction and documents confirming financial transactions - 10 years after the conclusion of the contract / transaction; and other data - 5 years.
We note that if the service is provided by a partner of the Company, the relevant provisions on the use of these services are contained in the partners' service provision agreements/rules.
- When you purchase goods or pay for services at our service locations and request an invoice, we process:
- Name, surname
- Telephone number
- Email address
- Street address
- Payment details (bank, payment card or account number)
Purpose of data processing – sales of goods and / or services (invoicing)
Legal basis of data processing – execution of the purchase and sale agreement / transaction between the User and the Company
Duration of data processing - 10 years after the conclusion of the contract/transaction, data confirming the fact of the conclusion of the contract/transaction and information related to the conclusion of the contract/transaction and documents confirming financial transactions are processed.
- When you register your NORIU card, we process:
- name, surname
- telephone number
- email address
- country, city of residence
- address (optional)
- date of birth
- NORIU card No.
Purposes of data processing:
- NORIU card registration so that its holder can use the privileges provided by it;
- informing NORIU card holders about offers and promotions provided to NORIU card holders;
- identification of NORIU card registered holder, in order to provide them with applicable discounts, to block the card when it is reported lost or damaged, or in order to issue a new NORIU card after the expiry of the previous NORIU card.
Legal basis of data processing – the consent you express by registering the card online and by checking the relevant fields, having previously familiarized yourself with this Privacy Policy and the NORIU Terms of Use.
Duration of data processing – the registered NORIU card is valid for 2 (two) years; after its validity expires, cardholder data is stored for 3 months.
- When you register your existing NORIU card or virtual NORIU card on the Greet platform, UAB "Greet menu" as the joint data controller processes:
- NORIU card number.
Purposes of data processing:
- identification of NORIU card registered holder to provide them with applicable discounts.
Legal basis of data processing – the consent you express by registering the card on the platform and by checking the relevant fields, having previously familiarized yourself with the applicable Privacy Policies and the applicable Terms of Use.
Duration of data processing – as long as the user account on the Greet platform is valid.
As another data controller, UAB "Greet menu" processes the data of users registered on the Greet platform in accordance with its Service Terms and Conditions and Privacy Policy
- When you subscribe to our newsletters and promotional SMS messages when acquiring a NORIU card, we process:, we process:
- Telephone number
- Email address
The purpose of data processing is communication related to marketing
The legal basis for data processing is the user's consent is given when filling out the NORIU card holder form
Data processing term - a period not exceeding 3 years or until you withdraw your consent.
- When you use our Website to opt out of our newsletters and promotional SMS messages, we process:
- Telephone number
- Email address
The purpose of data processing is communication related to marketing
The legal basis for data processing is the User's consent, granted by an act of voluntary data submission
Data processing term - 6 months from the submission of the request
- When you provide feedback about our goods and services on our Website, we process:
- Name, surname
- Telephone number
- Email address
- Feedback text, which may contain other information related to your person that you have provided
The purpose of data processing is to improve the quality of services and goods
The legal basis for data processing is the User's consent, granted by an act of voluntary data submission
Data processing term - 6 months as of providing feedback.
- When you call Quality Line to provide your feedback about our goods and services on our Website, we process:
- Name (surname is optional)
- Telephone number
- Email address
- Feedback text, which may contain other information related to your person that you have provided
The purpose of data processing is to manage customer complaints and problems
The legal basis for data processing is the customer’s consent, granted by an act of voluntary data submission
Data processing term is until the complaint or problem is resolved.
- When you apply for job vacancies in restaurant chain, we process:
- Name, surname
- Email address and other contact data specified by you
- Data proving your education and work experience, as well as other data and information that you provide in your resume (CV), which you submit when filling out the form in the Career section of the Website
The purpose of data processing is employee recruitment to vacant positions (examining the suitability of candidates for specific positions)
The legal basis for data processing is your consent, which you express by filling out the form and sending your resume (CV) in order to get a job in the Company.
Data processing term - no longer than 6 months.
- When you visit the premises of our restaurants and/or the territory where video surveillance is carried out, we process:
- Your image captured by video surveillance cameras;
- Other features of a physiological nature (e.g. gestures/gait characteristics)
The purpose of data processing is the protection of individuals and the Company's property, prevention of criminal acts, clarification of the circumstances of incidents.
The legal basis for data processing is the Company's legitimate interests in ensuring the security of the territory and premises, as well as the security of persons (the Company's employees and visitors) and property.
The term of data processing is 2 weeks from the creation of records
Processing of personal data on the Website using cookies
When you visit the Website, we process your IP address, network and location data when you provide it. This data is collected with your consent, using cookies and other similar technologies. More information about the cookies used on the Website is available in our Cookie Policy.
Processing of personal data of minors
If you are a minor between 14 and 18 years of age, and you would like to use this Website or our goods and services at our service locations in such a way that you would have to provide your personal data to us, you can do so only with the consent of your parents or guardians, unless as per the law you have the right to independently dispose of your income. In any case, if you are a minor between 14 and 18 years old, we will process your personal data only when you confirm that you have the consent of your parents or guardians (you will indicate this on the Website).
TO WHOM WE MAY TRANSFER YOUR PERSONAL DATA?
For the processing of your personal data, we may involve third parties - service providers (data processors): companies providing financial and accounting services, companies providing data center services or web hosting services, companies providing information technology infrastructure services, companies creating, providing, maintaining and developing software, as well as other service providers to whom your personal data is disclosed only to the extent necessary for the provision of their services.
The data processors that we contract may only process your personal data in accordance with the clear instructions provided by us and may not use them for other purposes or transfer them to other persons. In each specific case, only the necessary personal data are provided to the processor, i.e., only such personal data that are necessary for the specific purpose of the processing or the provision of the service. To ensure the security of your personal data, we only use data processors who are committed to and can comply with appropriate data security requirements and confidentiality obligations.
WHERE DO WE PROCESS YOUR PERSONAL INFORMATION?
We only process your personal data in the European Union / European Economic Area (EU / EEA). We do not currently transfer your personal data to third countries. If there is a need to transfer your personal data to third countries, we will inform you before the transfer takes place and we will ensure the legality and security of the transfer (application of the necessary transfer mechanisms and security measures).
WHAT RIGHTS DO YOU HAVE?
As a data subject, you have all the rights set out in the General Data Protection Regulation, which you can exercise by visiting the Company or applying by e-mail [email protected]:
- know about the processing of your personal data: to receive information about whether we process your personal data and, if such personal data is processed, the right to access your personal data;
- apply for a correction of your personal data if you find that your personal data we process is inaccurate;
- apply with a request to suspend the processing of your personal data, except for storage, in case the access to your personal data reveals that the data is incorrect, incomplete or inaccurate or is processed unlawfully;
- apply with a request to delete your personal data ("right to be forgotten"), except when your data must be stored based on the legal obligations applicable to the Company or the determination, execution and defense of legal requirements;
- object to the processing of your personal data when such data is processed or is intended to be processed on the basis of a legitimate interest pursued by the Company;
- where technically possible, obtain a copy of personal data relating to you which you have provided to the Company, which is processed by automated means and the processing of which is based on your consent or a contract, in a commonly used, computer-readable format and transfer to another data controller (right to data portability);
- to revoke your consent to the processing of your personal data at any time by submitting a notice to the Company by either clicking on the e-mail link at the end of the letter (in the case of direct marketing) or by sending your request to the Company by e-mail.
You can exercise your rights yourself or through agents. In order to exercise your rights, you must come to the Company's Administration Office (Upės g. 9-1, LT-09308 Vilnius) in person and submit your application there, or you can submit your application by email [email protected]. When executing your request, we have the right and obligation to verify your identity, which will always be carried out in the simplest and most convenient way for you. By submitting your request, you can verify your identity in one of the following ways:
- if the request is submitted upon arriving directly at the Company, you must present your identity document to our employee;
- if the request is submitted by mail or through an authorized person, you must submit a notarized copy of your identity document along with the request;
- if the request is submitted by electronic means, it must be electronically signed or submitted by e-mail from your e-mail address which is known to us.
In case of reasonable doubts regarding the identity of the natural person who submitted the request, the Company has the right to request additional information necessary to confirm your identity (for example, by asking a question about what goods or services you have recently purchased, etc.).
The request must be clear, provide your name and surname, contain the information what rights you wish to exercise and to what extent, and how you would like to receive a response. If you submit your request electronically, the above listed information must also be provided electronically, unless you request the response in a different format.
We will make every effort to process your requests and provide you with the information as soon as possible, but no later than in 30 calendar days from the date of receipt of your request. If due to certain circumstances, such as the complexity of the submitted request (e.g., if it is necessary to seek the assistance of data processors) or due to the excessive number of requests processed by the Company, the Company may not process the request in time, therefore the processing period may be extended by a maximum of two additional months after informing you in advance.
Requests are processed and the information and data are provided free of charge, but we reserve the right, in certain cases, to either waive your rights (where the request is unreasonable or disproportionate or repetitive), or impose fees set by the Head of the Company for provision of information and data to cover administrative costs related to the fulfillment of the request in accordance with the requirements of legal acts and (in cases of identified obvious abuse of the data subject's rights, and unreasonably repeated requests for information, data, copies, documents, etc.).
If you believe that the actions or failure to act by the Company violate your rights or legal requirements, you have the right to file a complaint with the supervisory authority - the State Data Protection Inspectorate.
VALIDITY OF PRIVACY POLICY
This Privacy Policy is approved and effective as of December 29, 2023. We reserve the right to review and update this Privacy Policy on a regular basis or as necessary. We will notify you of any updates on our Website.