PRIVACY POLICY
Last updated: 06.04.2026
1. INTRODUCTION
S.C. CHIC HUB CAFE S.R.L. (hereinafter referred to as the "Operator") respects the confidentiality of your personal data and is committed to protecting it in accordance with Regulation (EU) 2016/679 (GDPR) and applicable national legislation, including Romanian Law No. 190/2018.
This Privacy Policy describes what personal data we collect, why we collect it, how we use it and what your rights are.
2. OPERATOR IDENTITY
S.C. CHIC HUB CAFE S.R.L. Tax ID (CUI): 49891250 Trade Registry No.: J2024007299403 Registered office: Splaiul Independentei Nr. 202B, Room 42, Sector 6, Bucharest, Romania
Data protection contact: office@chichubcafe.ro
3. WHAT PERSONAL DATA WE COLLECT
Depending on how you interact with our Website, we may collect the following categories of data:
a) Online orders:
- Full name
- E-mail address
- Phone number
- Selected pickup/dining location
- Order history and consumption preferences
b) Reservations:
- Full name
- E-mail address
- Phone number
- Date, time and number of guests
c) Newsletter:
- E-mail address
d) Contact form:
- Full name
- E-mail address
- Message content
e) Loyalty programme:
- Full name
- E-mail address
- Phone number
- Purchase history and accumulated points
f) Technical data collected automatically:
- IP address
- Browser type and device
- Pages visited and visit duration
- Cookies (as per the Cookie Policy)
4. PURPOSES AND LEGAL BASES FOR PROCESSING
| Purpose | Legal basis | Data used |
|---|---|---|
| Processing and fulfilling orders | Performance of a contract (Art. 6(1)(b) GDPR) | Name, e-mail, phone, order details |
| Managing reservations | Performance of a contract | Name, e-mail, phone, reservation details |
| Sending order/reservation confirmations and notifications | Performance of a contract | E-mail, phone |
| Issuing fiscal documents | Legal obligation (Art. 6(1)(c) GDPR) | Name, order data |
| Administering the loyalty programme | Performance of a contract | Name, e-mail, phone, purchase history |
| Sending newsletters and marketing communications | Consent (Art. 6(1)(a) GDPR) | |
| Responding to contact form enquiries | Legitimate interest (Art. 6(1)(f) GDPR) | Name, e-mail, message |
| Improving the Website and traffic analysis | Legitimate interest | Technical data, cookies |
| Fraud prevention and Website security | Legitimate interest | IP address, technical data |
5. DATA RETENTION PERIODS
- Order data: 5 years from the order date (fiscal and accounting obligations).
- Reservation data: 6 months from the reservation date.
- Newsletter data: until consent is withdrawn (unsubscribe).
- Contact form data: 12 months from resolution of the enquiry.
- Loyalty programme data: for the duration of participation, plus 12 months from deactivation.
- Technical data (logs, IP): maximum 12 months.
After the retention period expires, data is deleted or anonymised.
6. DATA DISCLOSURE
Your personal data may be shared with the following categories of recipients, strictly to the extent necessary:
- Payment processor (Stripe Inc.): for processing card payments in compliance with PCI-DSS standards. Stripe privacy policy: https://stripe.com/privacy
- E-mail service provider: for sending order confirmations, notifications and newsletters.
- Hosting provider (Romarg): for storing and operating the Website.
- POS system (Ebriza): for transmitting orders to the point of sale. Only data necessary for order processing (name, phone, ordered products).
- Public authorities: where a legal obligation exists (e.g. ANAF, law enforcement).
We do not sell, rent or transfer your personal data to third parties for marketing purposes.
7. DATA TRANSFERS OUTSIDE THE EU/EEA
Some of our service providers (e.g. Stripe) may process data outside the European Economic Area. In such cases, the transfer is carried out on the basis of:
- Standard contractual clauses approved by the European Commission; or
- An adequacy decision by the European Commission for the respective country; or
- Other appropriate safeguards in accordance with Art. 46 GDPR.
8. DATA SECURITY
The Operator implements appropriate technical and organisational measures to protect personal data, including:
- Secure HTTPS connection across the entire Website
- Password storage in encrypted format (hashing)
- Restricted access to personal data (authorised personnel only)
- CSRF protection and rate limiting on public forms
- Access monitoring and logging
9. YOUR RIGHTS
As a data subject, you have the following rights under the GDPR:
a) Right of access — you may request confirmation of whether your data is being processed and a copy thereof.
b) Right to rectification — you may request the correction of inaccurate data or the completion of incomplete data.
c) Right to erasure ("right to be forgotten") — you may request the deletion of your data, subject to legal retention obligations.
d) Right to restriction of processing — you may request limitation of processing in certain circumstances.
e) Right to data portability — you may request to receive your data in a structured, commonly used and machine-readable format.
f) Right to object — you may object to processing based on the Operator's legitimate interest.
g) Right to withdraw consent — at any time, without affecting the lawfulness of processing carried out prior to withdrawal. For the newsletter, you may use the unsubscribe link in any e-mail.
h) Right not to be subject to automated decision-making — we do not use fully automated decision-making processes that produce legal effects.
To exercise any right, send an e-mail to office@chichubcafe.ro. We will respond within a maximum of 30 calendar days.
10. COOKIES
The Website uses cookies. Detailed information about the types of cookies used, their purpose and management options are available in the Cookie Policy, accessible on the Website.
11. POLICY CHANGES
The Operator reserves the right to update this Privacy Policy at any time. The updated version will be published on the Website, indicating the date of the last modification. We recommend checking this page periodically.
12. COMPLAINTS
If you believe your data protection rights have been infringed, you have the right to lodge a complaint with:
The National Supervisory Authority for Personal Data Processing (ANSPDCP) B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania Website: https://www.dataprotection.ro E-mail: anspdcp@dataprotection.ro
S.C. CHIC HUB CAFE S.R.L. Tax ID: 49891250 | J2024007299403 office@chichubcafe.ro | +40 736 309 680