Privacy policy
The short version: we collect what we need to cook and deliver your food, we never sell your data, and you can ask us to delete it any time. The long version is below.
On this page
01Who we are
Ember & Bun Restaurants S.A. (“Ember & Bun”, “we”, “us”) operates the Ember & Bun restaurants, website and mobile app in Greece. Our registered office is Ermou 42, 105 63 Athens. We are the data controller for the personal data described in this policy.
This policy explains what personal data we collect when you visit a restaurant, use our website or app, order food, join our newsletter or contact us, and how we use and protect it under the EU General Data Protection Regulation (GDPR) and Greek Law 4624/2019.
02Information we collect
Information you give us: your name, email address, phone number, delivery address, order history, dietary preferences and anything you write to us through the contact form or customer support.
Information collected automatically: device type, browser, IP address, approximate location (only if you allow it), pages visited and how you interact with our website and app.
Payment information: card payments are processed by our payment provider. We never see or store your full card number.
03How we use your information
To take, prepare and deliver your order and let you know when it is ready. Our legal basis is the performance of a contract with you.
To run your account and rewards balance, answer questions and handle refunds or complaints.
To send marketing emails if you have opted in. Every email has an unsubscribe link, and we will never sell your email address.
To improve our menu, website and app, prevent fraud and meet our legal and tax obligations.
06International transfers
Some of our service providers store data outside the European Economic Area. When that happens we rely on European Commission adequacy decisions or Standard Contractual Clauses to keep your data protected to the same standard.
07How long we keep it
Order and payment records are kept for ten years to meet Greek tax law. Account data is kept while your account is active and deleted 24 months after your last order. Contact form messages are deleted after 12 months.
Marketing preferences are kept until you unsubscribe, after which we keep only your email on a suppression list so we do not contact you again.
08Your rights
You can ask to access, correct, delete or export your personal data, and you can object to or restrict how we use it. Where we rely on consent, you can withdraw it at any time.
To use any of these rights, email privacy@emberandbun.gr. We reply within one month. If you are unhappy with our answer you can complain to the Hellenic Data Protection Authority (www.dpa.gr).
09Children
Our website and app are not aimed at children under 15 and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
10Security
We use encryption in transit, access controls and regular security reviews to protect your data. Staff only access personal data when they need it for their job.
No system is perfectly secure. If a breach affects you, we will tell you and the Hellenic Data Protection Authority as the law requires.
11Changes to this policy
We review this policy at least once a year. If we make significant changes, we will tell you by email or with a notice on our website before they take effect.
Questions about your data? Email our Data Protection Officer at privacy@emberandbun.gr or write to Ember & Bun Restaurants S.A., Ermou 42, Syntagma, 105 63 Athens, Greece.