Back to the home page

Privacy Policy

Last updated: 8 November 2026

We want you to be able to browse our menu, find us, book a table and order from your table easily. This policy explains how we handle personal data connected with visits to this website, table bookings, table orders and enquiries you send us.

Who is responsible for your data?

The data controller is Caffe Bar Brazil d.o.o., Croatian tax identification number (OIB) 43970966158, Masarykov put 3/B, 20000 Dubrovnik, Croatia.

For privacy questions and requests concerning your rights, write to this address and mark your letter “Personal data protection”. For information about submitting a request, call +385 98 947 2267.

What data do we process, and why?

Website visits. When you open a page, your browser transmits technical information needed for the network connection, including your IP address and request details. Processing this information allows the website to load and helps protect the service. The legal basis is our legitimate interest in operating and securing the website, while respecting your rights. We do not keep our own visit logs and we do not use analytics or marketing tracking.

Table bookings. When you send a booking request, we process your full name, email address, mobile number, date and time of arrival, number of people, the selected match, your note and the page language, so that we can confirm the booking, call you if needed and send a reminder the day before by message from the café's phone (e.g. WhatsApp). The legal basis is taking steps at your request before entering into a contract. To protect the form against misuse, we also store a hash of your IP address, from which the address itself cannot be read; the legal basis is our legitimate interest in keeping the service secure. All booking data is deleted 30 days after the booking date.

Table orders. An order sent using the QR code contains the table number, the drinks selected, the total, the language, the time it was sent and a note if you add one. We do not ask for your name or phone number to order. We process this data to prepare and serve your order (performance of a contract) and keep it for up to 180 days to review our business and handle any complaints. Please do not enter personal data in the note. When you call a waiter or ask for the bill, we record only the table number and the time.

Enquiries by phone and WhatsApp. When you contact us, we process the information you choose to share, such as your name, telephone number and enquiry, to the extent needed to respond. If your enquiry concerns arranging a service, the legal basis is taking steps at your request before entering into a contract or performing that contract; for other enquiries, our legitimate interest is responding to the person who contacted us. Messages sent via WhatsApp are transmitted by WhatsApp (Meta) under its own terms and privacy policy. Please do not send sensitive information that is unnecessary for your enquiry.

Complaints and legal duties. We process information needed to handle written complaints and binding requests from competent authorities to meet our legal obligations. Where necessary to establish, exercise or defend legal claims, we may also retain relevant information on the basis of our legitimate interest in protecting our rights.

You do not need to provide your name or telephone number to browse the menu. We cannot accept an online booking without a name and mobile number; you can call us instead.

Who can access the data?

Our staff access booking and order data through a protected admin panel, only as needed to serve customers and manage bookings. The website, its functions and the database are hosted by Cloudflare, Inc. as our processor, to the extent needed to host, deliver and secure the website. We disclose data to competent authorities when legally required. We do not sell personal data.

Where data is processed and transfers outside the EEA

The database containing bookings and orders is located in Cloudflare’s infrastructure in Western Europe. Requests made when you visit the website are handled by the Cloudflare data centre nearest to you. Cloudflare, Inc. is based in the United States, so access to or transfer of data to the United States cannot be ruled out. For such transfers, Cloudflare relies on its certification under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023. The list of certified organisations and further details are available at dataprivacyframework.gov, and Cloudflare’s data protection information at cloudflare.com/trust-hub/gdpr.

How long do we keep it?

• Table bookings: up to 30 days after the booking date, then deleted.
• Table orders: up to 180 days after they are sent, then deleted.
• Waiter and bill requests: 7 days.
• IP address hash when staff log in to the admin panel: 15 minutes, to limit login attempts.
• Enquiries by phone and WhatsApp: as long as needed to respond and complete the arrangements.

We keep data longer only where required by law or for a specific legal claim, such as an unresolved complaint.

Cookies and external websites

Our Cookie Policy describes the technologies actually used on this website. We do not use any technologies that require consent.

Links to Google Maps, Facebook, WhatsApp, WELO, Corvia Stay and NADIGRA take you to separate services. When you open these links, you leave our website for another provider’s site or app; that provider’s privacy policy applies to your subsequent use of its service.

Your rights

Depending on the circumstances and applicable legal requirements, you may request access, correction, deletion, restriction of processing and data portability. You may object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

Please use the contact details above to submit a request. If necessary, we will ask only for information reasonably needed to verify your identity. We respond within the time limits set by the GDPR.

If you believe your data is being processed unlawfully, you may contact the Croatian Personal Data Protection Agency: azop.hr/kontakt. You may also complain to the competent supervisory authority in another Member State as provided by the GDPR.

Automated decisions and updates

We do not use this website to make decisions based solely on automated processing that produce legal or similarly significant effects for you. Bookings and orders are confirmed by our staff. We update this policy when our processing practices or relevant obligations change.