Privacy Policy for the Sushi Guru App

1. Data Controller

The controller of personal data is EPS Project OÜ (registry code 14142206), address: Kärberi 18, Tallinn, Estonia.

Contact email address: info@sushiguru.ee.

For account deletion enquiries: delete@deapp.online.

2. Data We Process

Depending on how the app is used, we may process the following data:

• profile data: name, telephone number, email address, date of birth, if provided by the user, and user ID;
• delivery data: saved addresses, the selected order fulfilment method, and order comments;
• order data: order contents, amount, currency, time, restaurant, status, and order history;
• technical data: device type, app and operating system version, IP address, app identifiers, error logs, diagnostic information, push notification delivery data, and other information required for the secure and stable operation of the app.

Information indicating whether a user consented to or declined the transmission of Meta analytics events is not transmitted to EPS Project OÜ and is not stored in EPS Project OÜ systems. The user's choice is applied directly within the app to enable or disable data transmission to Meta tools.

3. Purposes and Legal Bases for Processing

• creating and maintaining an account and receiving, processing, preparing, and delivering orders – performance of a contract and taking steps at the user's request prior to entering into a contract;
• customer service and handling enquiries, refunds, and complaints – performance of a contract and legitimate interests;
• accounting and tax records – compliance with legal obligations;
• ensuring security, preventing misuse, and preventing the repeated use of one-time offers – legitimate interests;
• sending service notifications related to orders – performance of a contract;
• ensuring the stable operation of the app and identifying and resolving technical errors and failures – legitimate interests;
• sending promotional push notifications – the user's consent, where such consent is required;
• transmitting Meta analytics events – the user's voluntary consent.

Where processing is based on consent, the user may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

4. Meta Analytics

Only with the user's voluntary consent may the app transmit the following events and information to Meta Platforms Ireland Limited:

• the fact that the app was installed or launched for the first time;
• the fact that an order was placed;
• the total order amount;
• the order currency;
• technical information automatically added by Meta tools, such as information about the device, app, and operating system.

We do not transmit to Meta the contents of an order, product names, the user's name, telephone number, email address, delivery address, order comments, or internal user ID.

Transmission of the listed events and data to Meta is disabled until the user's consent has been obtained.

Information indicating whether a user consented to or declined data transmission to Meta is not transmitted to EPS Project OÜ and is not stored in EPS Project OÜ systems.

The user may change their choice at any time in the “Privacy & Ads” section of the app. Once data transmission is disabled, no new events are sent to Meta. Declining or subsequently disabling data transmission does not affect the operation of the app or the ability to place orders.

Meta processes the data it receives in accordance with its privacy policy: Meta Privacy Policy .

5. Error Diagnostics Using Sentry

We use Sentry to ensure the stable operation of the app, identify technical errors, and analyse failures.

When an error occurs, technical and diagnostic information may be transmitted to Sentry, such as the device type, app and operating system version, time of the error, technical characteristics of the failure, and actions performed by the app immediately before the error occurred.

Sentry is used solely to ensure the stability and security of the app and to provide technical support. Information obtained through Sentry is not used for advertising or to create a marketing profile of the user.

We take measures to ensure that error reports do not contain the user's name, telephone number, email address, delivery address, order contents, or order comments.

Further information about Sentry's processing of data is available here: Sentry Privacy Policy .

6. Recipients of Data

We disclose personal data only to the extent required to provide the relevant service to the following categories of recipients:

• courier and logistics partners;
• providers of hosting, technical support, cloud infrastructure, push notifications, and security solutions;
• Sentry – to identify and resolve technical errors and failures in the app;
• accountants, auditors, and professional advisers;
• Meta Platforms Ireland Limited – only with the user's voluntary consent;
• public authorities and other parties where disclosure is required by law.

Some service providers may process data outside the European Economic Area. In such cases, safeguards provided for under the GDPR are applied, such as an adequacy decision of the European Commission or standard contractual clauses.

7. Data Retention Periods

• active account data is retained for as long as the account is used or the data is required to provide services;
• after a verified request has been received, the account and related data that are not required to be retained by law are deleted within 30 days;
• source accounting documents and the information they contain are retained for seven years from the end of the relevant financial year, unless the law requires a different retention period;
• data required to resolve a dispute or defend legal claims may be retained until the relevant limitation period or proceedings have ended;
• technical and diagnostic information is retained only for as long as necessary to identify and resolve errors and to ensure the security and stable operation of the app;
• after account deletion, an irreversible technical identifier derived from a normalised telephone number using a server-side secret key, together with a record of the use of a one-time promotion, may be retained for one calendar year from the date the account is deleted to prevent fraud and repeated use of introductory offers. The original telephone number is not stored in this record. This information is not used to contact the user or for marketing purposes.

8. Deletion of the Account and Personal Data

The user can delete their account directly in the app. The “Delete Account” button is located at the very bottom of the user's profile page.

If the user does not have access to the app, a request may be sent to: delete@deapp.online.

The email must include:

• the name of the app – Sushi Guru;
• the telephone number associated with the account;
• the email address added to the profile or the user ID in the format #12345;
• a statement requesting deletion of the account and related personal data.

The user ID can be found in the app profile. Where necessary, we may request additional information to confirm ownership of the account and protect it against unauthorised deletion.

The request will be processed within 30 days after it is received and the required verification has been completed. Account deletion is irreversible.

Data that EPS Project OÜ is legally required to retain will not be deleted before the applicable retention period expires, but its further use will be restricted to the relevant lawful purpose.

9. User Rights

Where provided for under the GDPR, the user has the right to:

• obtain information about processing and a copy of their personal data;
• correct inaccurate data and complete incomplete data;
• request erasure of data or restriction of its processing;
• object to processing based on legitimate interests and opt out of direct marketing at any time;
• receive the data they have provided in a structured, commonly used, and machine-readable format and transmit it to another controller, where applicable;
• withdraw previously given consent;
• lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or seek a judicial remedy.

To exercise your rights, contact us at info@sushiguru.ee. We will respond without undue delay and no later than 30 days after receiving the request.

Where necessary, this period may be extended in the circumstances permitted by the GDPR. The user will be informed of any such extension.

10. Requirement to Provide Data

Data marked as mandatory during registration or when placing an order is required to create an account, communicate with the user, and fulfil the order. Without this data, certain app functions or the ability to place an order may be unavailable.

Consent to the transmission of Meta analytics events is not mandatory. Declining such transmission does not affect the ability to use the app or place orders.

11. Data Security

We apply appropriate organisational and technical measures to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure, and unauthorised access.

Access is granted only to those persons and service providers who require it to perform the relevant tasks.

12. Changes to this Privacy Policy

We may update this Privacy Policy when legislation, the services used, or the ways in which data is processed change. The current version of the Privacy Policy is published in the app.

Users will be notified of material changes by an appropriate means.