Back to the menu

Last updated: 6 September 2026

Who we are and how to reach us

The controller of the personal data collected through this site is SEPO EOOD, company ID (EIK) 106623083, registered office: 12 Vasil Kolarov Street, Kozloduy, Bulgaria, represented by Sergey Popov — the company that runs Bistro “Pri Sergo”. For any question about your personal data you can contact us on the phone number given on the “Contacts” page. We answer personally — no call centres, no forms.

What data we collect and why

We require no registration, create no customer accounts and ask for no password. We collect only the data without which we cannot fulfil your specific request:

• For a delivery order: name, contact phone, delivery address, the location pinned on the map and, optionally, a note or instructions for the courier. We use them solely to prepare and deliver that order and to reach you about it if needed.
• For a pickup order: only name and phone.
• For a catering request: additionally the event date and time and the number of guests, so we can plan the preparation.
• If you request an invoice: company name, company ID (EIK), VAT number and accountable person. We pass these to our accountant solely to issue the invoice.
• If you rate your order: the rating and an optional comment. Please do not include personal data (names, phone numbers, addresses) in the comment text.

We never see or store card numbers. When paying by card you enter its details directly on the secure page of the payment provider Stripe. All we keep is a record that the order was paid.

Our legal basis for processing

We process order data because it is necessary to perform the contract with you: accepting, preparing and delivering your order (Art. 6(1)(b) GDPR). We process invoice data under a legal obligation arising from accounting and tax law (Art. 6(1)(c)). Browser notifications and email news are sent only with your explicit consent (Art. 6(1)(a)), which you can withdraw at any time following the steps below.

Where the data is stored and who can access it

The site's database is located in the European Union, where we use Supabase with a data center in Frankfurt, Germany. Only the bistro's staff can access order data.

To run the site we use the following service providers, each of which receives only the data needed for its specific job:

• Supabase (EU, Frankfurt): the database and server infrastructure where orders are stored;
• Stripe: card payment processing. You enter card details directly with Stripe; we receive only a payment confirmation;
• Cloudflare: site hosting and aggregate, cookie-free traffic statistics (see the “Statistics” section below);
• Telegram: so the kitchen can react immediately, every new order is sent as a staff notification into a closed Telegram chat accessible only to the bistro's staff. The notification contains the order details (name, phone, address and contents);
• your browser's notification service (Google, Apple or Mozilla), only if you have explicitly allowed notifications. Messages are encrypted: the service carries them to your device but cannot read their content.

We do not sell, rent or share your personal data with third parties for advertising or any other purpose.

How long we keep the data

Personal data on completed orders (name, phone, address, location, notes and invoice details) is deleted automatically 6 months after the order. Until then it is used solely to fulfil and track the order.

After the automatic deletion only anonymous information remains (ordered products, amounts and ratings), which can no longer be linked to you and serves only for statistics.

Issued invoices are kept by our accountants for the periods required by Bulgarian law. This is an obligation independent of this site.

Your rights

Under the GDPR you have the right, at any time, to:

• ask what data of yours we store and receive a copy of it (right of access);
• request correction of inaccurate data;
• request deletion of your data (the “right to be forgotten”);
• request restriction of processing or object to it;
• receive your data in a structured, machine-readable format (portability);
• withdraw a given consent (for example for notifications or email news) without affecting orders you have already placed.

How to exercise your rights: step by step

1. Call the phone number on the “Contacts” page and tell us what you want: access, correction or deletion.
2. Tell us the phone number you ordered with, which is how we find your data. If you kept the order tracking link, it helps too.
3. We fulfil the request free of charge and reply as fast as we can, within one month at the latest, as the law requires.

If you believe we process your data unlawfully, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg. We would appreciate you contacting us first. We can almost always resolve the issue right away.

Data in your browser, no tracking cookies

This site sets no tracking or advertising cookies of its own and does not follow visitors across sites. The only true cookie comes from the infrastructure of our database provider (Supabase, behind Cloudflare): the strictly necessary __cf_bm security cookie for bot detection, valid for about 30 minutes. It contains no personal data, builds no profile and legally requires no consent. Separately, your browser's storage (localStorage) keeps only functional data that makes ordering convenient (scanning tools sometimes list these entries as "cookies" with no expiry):

• the contents of your cart;
• the history of orders placed from this device, with their tracking links;
• the products you marked as favourites;
• the name, phone, address and instructions from your last order, to prefill the next one;
• the invoice details from your last order, if you requested an invoice;
• your language choice, light/dark theme and minor preferences (for example a turned-off video background).

This data stays on your device only and is sent neither to us nor to third parties. Here is how to delete it:

Deleting the history from the site itself

1. Open “My orders” from the site menu.
2. Press the “Clear history” button and confirm.

This button deletes the completed orders from the device; an active order stays visible until it finishes, so you don't lose access to its tracking. The saved prefill details (name, phone, address) are removed by fully clearing the site's data in your browser: steps below.

Full deletion in Chrome (phone or computer)

1. Open the site and tap the icon to the left of the address (a padlock or sliders).
2. Choose “Site settings” (on a phone) or “Site data” (on a computer).
3. Tap “Delete data” and confirm.

Full deletion in Safari (iPhone/iPad)

1. Open your device's Settings and find Safari.
2. Choose “Advanced” → “Website Data”.
3. Find the site in the list, swipe the row left and tap “Delete”.

Browser notifications

We send notifications (your order status and occasional bistro news) only if you have explicitly allowed them via a button on the site. When you allow them, your browser creates an anonymous technical delivery address which we store. It contains no name, phone or other personal information and serves solely to deliver the notifications themselves. When you place an order from a device with notifications enabled, that address is linked to the specific order so you can receive its status ("accepted", "cooking", "on its way", "delivered" or "declined"), as well as a message if we stop taking orders for the day. We also store the language you chose on the site so notifications arrive in it. When you order from a device with notifications enabled, we also pair the phone number from the order with that address, so notifications about future orders placed with the same number reach all of your notification-enabled devices (for example both your phone and your laptop). This pairing is removed automatically when you disable notifications on that device, and you can end it at any time by turning notifications off in your browser settings.

How to stop notifications at any time:

• Chrome (phone and computer): tap the icon to the left of the site address → “Notifications” (or “Permissions”) → turn off.
• iPhone/iPad: open Settings → Notifications, find the site or Safari in the list and turn off “Allow Notifications”.
• Android (from the phone settings): Settings → Notifications → Chrome → find the site and turn it off.

Once you turn notifications off, the stored technical address becomes invalid and is deleted automatically from our system on the next delivery attempt. To unsubscribe from email news, write to the email on the Contact page, and we delete your address immediately.

Traffic statistics

We measure the site's traffic with Cloudflare Web Analytics, a cookie-free technology that places nothing on your device, builds no profiles and tracks no individual visitors. We see only aggregate numbers: visit counts, country and device type.

Changes to this policy

If we change how we process data (a new provider, a new kind of data, a different retention period), we will update this page and the date at its top. A substantial change will be announced visibly on the site.