Kepe-cafe
Privacy policy
How Kepe-cafe processes personal data under the General Data Protection Regulation (GDPR).
Data controller
Kepe Cafe, company code [Juridinio asmens kodas / Company code], Sibeliusgången 28, 164 77 Kista. Email: info@smile.com; phone: +370 46 398908.
Replace every bracketed placeholder with verified company details before collecting customer data.
Data we process
- Orders: selected products, quantities, prices, payment status and order timestamps.
- Collection: name, phone number and selected collection time where needed to fulfil an order.
- Customer account: email, account details and optionally name, phone number and date of birth.
- Requests and allergy notes: information a customer chooses to provide to help prepare an order safely. Do not request diagnoses or excessive health information.
- Marketing preferences: separate, optional consent for promotional email or SMS.
- Security logs: technical authentication, action and error records needed to protect the service.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Accepting, preparing and handing over orders; customer support | Contract, GDPR Article 6(1)(b). |
| Accounting and statutory records | Legal obligation, GDPR Article 6(1)(c). |
| Service security, fraud prevention and incident investigation | Legitimate interests, GDPR Article 6(1)(f), subject to a balancing assessment. |
| Promotional messages | Prior, freely given consent where required by applicable law. |
| Special-category data voluntarily supplied by a customer | Only where an appropriate GDPR Article 9 condition applies; collection and access must be restricted. |
Retention
[Approved retention periods by data category]
Processors, data locations and transfers
Service providers: [Processor name, service, role and contact]
Data locations: [Database, application hosting, email and backup locations]
Transfers outside the EEA: [EEA-only confirmation or applicable transfer mechanism and safeguards]
Recipients
- Database and authentication providers acting under data-processing agreements.
- Payment service providers, only as needed to process and reconcile payments.
- Email, hosting and content-delivery providers supporting order notifications, authentication libraries and website delivery.
- Public authorities where disclosure is legally required.
Your rights
- Request access to your personal data and a copy.
- Request correction or, where applicable, erasure.
- Request restriction or object to processing based on legitimate interests.
- Receive data you provided in a structured, commonly used format where portability applies.
- Withdraw consent at any time; withdrawal does not affect prior lawful processing.
- Complain to the Lithuanian State Data Protection Inspectorate: vdai.lrv.lt.
Privacy contact
Contact us at info@smile.com. Before launch, verify whether a data protection officer is required and publish any additional information needed about international data transfers.
Last updated: 2026-10-21.