Privacy Policy

Piatto Collezione respects your privacy and processes the personal data of website visitors in accordance with Regulation (EU) 2016/679 ("GDPR"), the Bulgarian Personal Data Protection Act, and other applicable legislation.

This Privacy Policy explains what personal data we may collect through the website https://piatto.bg/, why we process it, with whom it may be shared, and what rights you have.

1. Who Is the Data Controller?

The data controller is:

VIZU 2014 OOD Company Registration Number (UIC): 204673455 Registered Office and Address: 49 Vladayska St., Floor 1, Apt. 1, Krasno Selo District, Sofia 1606, Bulgaria

Establishment: Piatto Collezione, 5 Verila St., Sofia, Bulgaria

Phone: +359 883 762 222 Contact Email: restaurant@piatto.bg

For questions regarding the processing of your personal data, you can contact us at the email address provided above.

2. What Personal Data Do We Process?

Depending on how you use the Website, we may process the following categories of personal data.

2.1. Contact Form Data

When you submit an inquiry through the Website, we may collect:

• full name;
• phone number;
• email address;
• message content;
• any other information you voluntarily include in your inquiry.

2.2. Reservation Data

When making a table reservation, the following information may be processed:

• name;
• phone number;
• email address;
• reservation date and time;
• number of guests;
• information necessary to manage the reservation;
• additional information voluntarily provided by you.

Online reservations may be processed through an external reservation system.

2.3. Event Inquiry Data

When submitting an inquiry about a private or corporate event, we may process:

• name and contact details;
• organization or company, where applicable;
• preferred date;
• number of guests;
• type of event;
• menu and event planning preferences;
• other voluntarily provided information.

2.4. Order-Related Data

When an order is placed through an external delivery or pickup platform, personal data is generally provided directly to the respective platform.

Depending on our relationship with the platform, we may receive information necessary to prepare and fulfill the specific order.

Any processing carried out independently by the external platform is governed by its own Privacy Policy.

2.5. Technical Data

When you visit the Website, limited technical data may be processed automatically, including:

• IP address;
• date and time of access;
• browser type and version;
• operating system and device type;
• pages visited;
• technical logs and error information;
• information related to the use of cookies and similar technologies.

3. For What Purposes and on What Legal Basis Do We Process Personal Data?

Responding to Inquiries

We process the information you provide to respond to questions, inquiries, and requests.

The legal basis may be taking steps at your request before entering into a contract, as well as our legitimate interest in communicating with customers and interested parties.

Reservations

Personal data is used to receive, organize, confirm, and manage reservations.

The legal basis is taking steps at your request before entering into a contract and/or the performance of a contract.

Event Organization

We use personal data to prepare offers, communicate regarding event arrangements, and, once an agreement has been reached, provide the requested services.

The legal basis is taking pre-contractual steps and performing a contract.

Compliance with Legal Obligations

In certain cases, we are required to process or retain information to comply with accounting, tax, consumer protection, or other applicable legal obligations.

The legal basis is compliance with a legal obligation.

Website and Information Systems Security

We may process technical logs and other necessary information to prevent misuse, cyberattacks, and security breaches.

The legal basis is our legitimate interest in maintaining the security and proper functioning of the Website.

Analytics, Statistics, and Marketing

Optional analytics, advertising, and similar technologies are used only where an appropriate legal basis exists and, where required by law, after obtaining your prior consent.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

4. Do We Send Marketing Communications?

We do not use personal data provided through contact forms or reservations to send electronic marketing communications merely because you have contacted us.

Where we offer the option to subscribe to promotional or marketing communications, such messages are sent only where a valid legal basis exists and consent has been obtained, when required.

You may withdraw your consent at any time.

5. With Whom Do We Share Personal Data?

Where necessary, we may use service providers who assist us in operating our business and Website, including:

• hosting and technical infrastructure providers;
• website maintenance and development providers;
• email service providers;
• reservation system providers;
• information security service providers;
• accounting and legal advisors;
• ordering and delivery platforms, where applicable;
• analytics service providers, where you have given the necessary consent.

The Website integrates an external reservation system provided through Reservation.Tools.

The Website may also contain integrated services or links to Google services, including Google Maps, as well as social media platforms and external ordering platforms.

Some of these providers may process personal data as independent data controllers. In such cases, their processing activities are governed by their respective privacy policies.

6. Transfers of Data Outside the European Economic Area

Certain technology service providers may process information outside the European Economic Area (EEA).

Where we transfer personal data internationally, we use the applicable safeguards provided under the GDPR, such as an adequacy decision, the European Commission's Standard Contractual Clauses, or another legally recognized transfer mechanism.

7. How Long Do We Retain Personal Data?

We do not retain personal data longer than necessary for the purposes for which it was collected.

As a general principle:

• data from general inquiries may be retained for up to 12 months after communication has ended;
• data related to reservations and events is retained for the period necessary to manage them and for up to 12 months thereafter, unless a longer retention period is justified;
• information forming part of accounting, tax, or other mandatory records is retained for the periods required by applicable law;
• technical logs are retained for a reasonable period necessary for security and troubleshooting purposes;
• data processed on the basis of consent is retained until consent is withdrawn or the relevant purpose no longer applies, unless another legal basis justifies continued retention.

In the event of a legal dispute or where necessary to protect legal rights, certain data may be retained for the applicable statutory limitation period.

8. How Do We Protect Your Personal Data?

We implement appropriate technical and organizational measures tailored to the nature of the personal data being processed and the associated risks, including measures for:

• restricting access;
• protecting information systems;
• managing user access rights;
• creating backups where necessary;
• preventing unauthorized access, alteration, disclosure, or destruction;
• working with service providers under appropriate contractual safeguards.

No method of transmitting or storing information can be guaranteed to be completely secure. However, we take reasonable and appropriate measures to minimize risks.

9. Your Rights

Subject to the conditions set out in the GDPR, you have the right to:

• obtain confirmation as to whether we process your personal data;
• access your personal data;
• request the correction of inaccurate or incomplete data;
• request the deletion of your data where the legal requirements are met;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive your data in a structured, commonly used, and machine-readable format where the right to data portability applies;
• withdraw your consent at any time;
• not be subject to a decision based solely on automated processing where the relevant GDPR conditions apply;
• lodge a complaint with the competent supervisory authority.

To exercise your rights, please contact us at:

restaurant@piatto.bg

We may request additional information only where necessary to verify your identity and protect your personal data against unauthorized access.

10. Complaints to the Commission for Personal Data Protection

If you believe that your personal data is being processed in violation of applicable law, you have the right to lodge a complaint with:

Commission for Personal Data Protection (CPDP) Sofia 1592, Bulgaria 2 Prof. Tsvetan Lazarov Blvd.

Information about current contact details and complaint submission procedures is available on the CPDP's official website.

11. Personal Data of Third Parties

If you provide us with another person's personal data, for example in connection with a group reservation or event, you must have a valid basis for sharing that information with us and, where necessary, inform the individual concerned.

Please do not include unnecessary sensitive personal data in the free-text fields of our contact forms.

12. Minors

The Website is not specifically intended to collect personal data from children.

If you have reason to believe that a child has provided us with personal data without the necessary authorization, you may contact us so that we can take appropriate action.

13. Cookies

The Website may use cookies and similar technologies.

Detailed information about these technologies, their purposes, and how to manage your preferences is available in our Cookie Policy:

https://piatto.bg/biskvitki/

14. External Links

The Website may contain links to external websites.

Once you leave our Website, any processing of personal data by the respective third party is governed by its own rules and policies.

We recommend reviewing the Privacy Policy of the relevant service.

15. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect changes in how we process personal data, the services we use, or applicable legislation.

The latest version will always be published on this page, together with the date of the last update.

Data Controller: Vizu 2014 OOD Company Registration Number (UIC): 204673455 Registered Address: 49 Vladayska St., Floor 1, Apt. 1, Krasno Selo District, Sofia 1606, Bulgaria Email: restaurant@piatto.bg Phone: +359 883 762 222