Privacy policy

Controller

Hani Cafechi Oy (business ID 3560962-5), Liisankatu 3, 00170 Helsinki, Finland. Contact: hani.chi2022@gmail.com, +358 40 362 6211.

What we collect and why

• Table bookings: name, e-mail, phone, party size, time and requests (e.g. allergies) — to manage and confirm your booking (contract, GDPR art. 6(1)(b)).
• Gift cards: buyer name and e-mail, recipient name and (optional) e-mail, message, amount and usage history — to deliver and redeem the card (contract) and for bookkeeping (legal obligation, 6(1)(c)).
• Catering: contact details, event details, dietary needs and invoicing details — for the quote, delivery and invoice (contract, legal obligation).
• Visitor statistics: page views, page speed and clicks without cookies, IP addresses or identifiers — they cannot be linked to you (legitimate interest, 6(1)(f)). Your browser’s “Do Not Track” setting is respected.

How long we keep data

• Table bookings are deleted automatically 12 months after the booking date.
• Catering requests that did not lead to an order are deleted after 12 months.
• Gift cards, payments and completed catering orders are kept for 6 years after the end of the financial year, as required by the Finnish Accounting Act.
• The catering form draft is saved only in your own browser (localStorage), never sent to us until you submit it.

Processors and transfers

We use trusted providers: Netlify (website and data storage), Google (Gmail for sending e-mails, Google Fonts), and for payments PayPal and/or Stripe — your card details never reach us. Some providers are based in the USA; transfers rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

Your rights

You can request access to your data, correction, deletion or restriction, and you can object to processing. Requests: hani.chi2022@gmail.com — we reply within one month. You may also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).

Cookies

This website uses no tracking or advertising cookies, so no cookie banner is needed. The staff login uses session storage on the staff device only.