Privacy Policy

1. Introduction

Bertrand OÜ ("we", "us", "our") operates the sakuraresto.ee website and related services. We are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR) and Estonian data protection laws. This Privacy Policy explains what data we collect, why we collect it, and how you can exercise your rights.

2. Data Controller

The data controller responsible for your personal data is:

Bertrand OÜ
Paavli tn 7a, 10412 Tallinn, Estonia
Email: info@sakuraresto.ee

3. Information We Collect

3.1 Online Ordering

When you place an order through our website, we collect:

Full name
Phone number
Order details (items, quantities, prices, chosen pickup time)
Delivery address, including the map coordinates of the address you pick, when you choose delivery
Order notes or special instructions
Selected restaurant location
Preferred language

3.2 Table Reservations

When you make a reservation, we collect:

Full name
Email address
Phone number
Number of guests
Preferred date, time, and restaurant location
Special requests or notes

3.3 Banquet Reservations

For banquet bookings, we additionally collect your event type, expected guest count, and any special arrangements requested.

3.4 Technical Data

When you browse our website, we automatically collect:

IP address
Browser type and version
Device information
Pages visited and time spent
Referring URL

4. How We Use Your Data

We process your personal data for the following purposes:

Order fulfillment — to prepare your order, coordinate pickup times, and contact you if needed (legal basis: contract performance)
Delivery — when you choose delivery, to pass your name, phone number and delivery address to the courier company so a rider can bring the order to your door and you can follow it on their tracking page (legal basis: contract performance)
Reservation management — to confirm, modify, or cancel your table or banquet reservation and send confirmation emails (legal basis: contract performance)
Communication — to send order status updates and reservation confirmations via email (legal basis: contract performance)
Service improvement — to analyze how our website is used and improve the user experience (legal basis: legitimate interest)
Legal compliance — to meet tax, accounting, and other regulatory requirements (legal basis: legal obligation)

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Third-Party Services

We use the following third-party services to operate our website and process your data on our behalf under data processing agreements in accordance with GDPR:

Supabase

Database

Secure, EU-hosted database for storing orders, reservations, and restaurant settings.

Resend

Email delivery service used for sending reservation confirmations and order notifications.

Vercel

Hosting

Website hosting, content delivery, and serverless functions for our web application.

Google Maps

Maps

Embedded maps on our contact page to help you find our restaurant locations and view directions.

Mapbox

Maps & address search

Interactive map on the checkout page showing where your order is collected from, and address autocomplete: what you type into the delivery address field is sent to Mapbox from your browser to return matching addresses and their coordinates.

Wolt

Delivery

Courier service that carries delivery orders. Receives your name, phone number and delivery address so the rider can reach you, and hosts the tracking page you open from the order confirmation.

Montonio

Payments

Payment provider for card and bank-link payments. Card details are entered on their side and never reach us.

Bird

SMS verification

Sends the one-time code that confirms your phone number when you place an order. Receives your phone number from our server, and the code you type in so it can check it.

Cloudflare Turnstile

Bot protection

Checks that a reservation or an order is made by a person rather than an automated script. Runs in your browser on the reservation form and on the phone check before an order, and reads browser and device signals to do so; when you submit, our server sends Cloudflare the result of that check together with your IP address to confirm it.

Sentry

Error monitoring

Tells us when a page or our server fails. Receives technical error data: the error message, where in our code it happened, the page address without its query string, your browser and device type, and a short trail of the technical events just before it. We do not attach your IP address, cookies, what you type into forms, or user identifiers to it. Like any web service, Sentry does receive the IP address of the connection, and may derive an approximate location (country and city) from it.

6. Cookies

Our website uses essential cookies required for the site to function properly, such as maintaining your session and language preference. We do not use advertising or tracking cookies. You can manage cookie preferences through your browser settings, though disabling essential cookies may affect website functionality.

7. Data Retention

Order data — retained for the duration required by Estonian tax and accounting regulations (generally 7 years)
Reservation data — retained for up to 12 months after the reservation date, then anonymized or deleted
Technical logs — retained for up to 90 days

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS), secure database access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

9. Your Rights

Under GDPR, you have the right to:

Access — request a copy of the personal data we hold about you
Rectification — request correction of inaccurate or incomplete data
Erasure — request deletion of your data ("right to be forgotten")
Restriction — request that we limit the processing of your data
Portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interest

To exercise any of these rights, contact us at info@sakuraresto.ee. We will respond within 30 days.

10. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon):

Website: aki.ee
Email: info@aki.ee

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this page periodically.

Last updated: October 2026