Privacy policy
What we collect when you visit this site or order from us, why we need it, who we share it with, and the choices you have.
Last updated: 16 October 2026
1. Who we are
This website is run by the business below, which is the data controller for the personal data described in this policy. We follow the EU General Data Protection Regulation (GDPR) and Cyprus Law 125(I)/2018 on the protection of personal data.
Company registration no. HE 382515
Registered office: Charalambou Mouskou 8, 8010 Paphos, Cyprus
Restaurant: B16 Kennedy Avenue, Nicosia 1076, Cyprus
Phone: 70 001018
Email: info@sushiexpresscy.com
2. What we collect
When you place an order
- Your name, phone number and email address.
- Your billing address and, for delivery orders, your delivery address.
- Whether you chose pickup or delivery, the time you asked for, the items and add-ons you ordered, and any notes you left (for example allergy information or delivery instructions).
- The payment method you chose and the payment status. Card payments are handled by our payment provider; we never see or store your full card number.
If you create an account
Your login details, saved addresses and order history.
When you contact us
What you tell us by phone, email or message, and our replies.
When you browse the site
Technical data sent by your browser, such as your IP address, browser and device type, the pages you request and the time of the request. Our security system uses this to block attacks, and our server keeps it in short-lived logs.
If you tell us about an allergy or dietary need in an order note, that may reveal information about your health. We use it only to prepare your order safely, and it is shared only with the staff who prepare your food and, when needed, the courier delivering it.
3. Why we use it
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Taking, preparing and delivering your order, and contacting you about it (for example if an item is unavailable or the courier cannot find you) | Performing our contract with you |
| Taking payment and issuing receipts | Performing our contract with you |
| Keeping accounting and tax records | Legal obligation |
| Handling complaints, refunds and cancellations | Performing our contract; legitimate interest in resolving disputes |
| Keeping the site secure and preventing fraud and abuse | Legitimate interest in protecting our customers and our business |
| Running and improving the site, for example understanding which pages are used | Legitimate interest in a working website |
| Using allergy or dietary information you give us | Your explicit consent, given when you include it in your order (GDPR Art. 9(2)(a)) |
We do not sell your data, we do not send marketing messages unless you have agreed to receive them, and we do not make decisions about you by automated means alone.
5. Transfers outside the EU
Some of the providers above are based in, or use servers in, the United States. When personal data leaves the European Economic Area, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for more detail about these safeguards.
7. How long we keep it
- Orders, invoices and payment records: for as long as Cypriot tax and accounting law requires us to keep them.
- Your account: until you ask us to close it. Order records we must keep by law are kept for the legal period.
- Allergy and delivery notes: only as long as the order record they belong to.
- Messages and complaints: up to 2 years after the matter is closed.
- Security and server logs: usually no more than 90 days.
8. Your rights
Under the GDPR you can ask us to:
- give you a copy of the personal data we hold about you;
- correct data that is wrong or incomplete;
- delete your data, unless the law requires us to keep it;
- restrict how we use your data;
- send your data to you or to another company in a machine-readable format;
- stop using your data where we rely on legitimate interest.
Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.
To use any of these rights, contact us using the details below. We will reply within one month. We may ask you to confirm your identity first.
If you are unhappy with how we handle your data, you can complain to the Commissioner for Personal Data Protection in Cyprus at dataprotection.gov.cy or commissioner@dataprotection.gov.cy. We would appreciate the chance to sort it out with you first.
9. Security
The site is served over an encrypted connection (HTTPS) and protected by a firewall. Access to order data is limited to the staff who need it, and admin accounts are password protected. No system is completely secure, but if a breach puts your data at risk we will tell you and the Commissioner as the law requires.
10. Children
Online ordering is meant for adults. We do not knowingly collect data from children under 14 without the consent of a parent or guardian. If you think a child has given us their data, contact us and we will delete it.
11. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows when it was last changed. If we make an important change, we will make it clear on the site.
12. Contact us
For any question about this policy or your data:
B16 Kennedy Avenue, Nicosia 1076, Cyprus
Phone: 70 001018
Email: info@sushiexpresscy.com