Privacy policy

PRIVACY POLICY

This website Privacy Policy regulates how its owner UAB „Neragauta Azija“ (hereinafter - the Company, We), processes the personal data of its customers and/or visitors (hereinafter - Users, You) and other persons and ensures the security of personal data.

WHO ARE WE?

The Guacamole restaurant chain belongs to UAB „Neragauta Azija“, provider of catering services, legal entity code 304416508, registered office address: Upės st. 9-1, LT-09308 Vilnius, tel. +370 615 42162. The owner of https://www.guacamole.lt and the controller of the personal data processed there is UAB " Neragauta Azija ". You can use the discounts provided by the Noriu card at the Guacamole restaurant chain. The owner of the website https://www.noriukortele.lt and the controller of personal data processed therein is UAB "Amber Food". UAB "Amber Food" acts as a data processor when providing Noriu card data administration and marketing services to UAB "Neragauta Azija".

We care about your privacy and the security of your personal data, and we are fully committed to processing the data of our Users and other persons only in accordance with the established principles and requirements for the processing of personal data. This Privacy Policy applies in conjunction with the Terms of Sales and the Cookie Policy published on our Website. If you have any questions about personal data processing or would like to obtain more information on personal data processing, please contact us at administracija@amberfood.eu.

WHEN DO WE PROCESS YOUR PERSONAL DATA?

We only collect and process your personal data when it is necessary to achieve our legitimate purposes and when we have a legal basis to do so. The Company processes personal data:

• When you have given your consent to the processing of your personal data for a specified purpose or purposes;
• When it is necessary to perform the contract or transaction concluded with you or to take action at your request before concluding the contract or transaction;
• When required to do so by law;
• When the processing of personal data is necessary to achieve the legitimate interests of the Company.

WHAT PERSONAL DATA DO WE PROCESS?

• When you purchase goods at our e-shop, we do not process your personal data. The personal data necessary for the execution of the order is processed by the Waitless.lt platform provider True Concept, UAB as another data controller in accordance with its Terms and Conditions and Privacy Policy. For the delivery of the ordered goods, True Concept has chosen Wolt Enterprises Oy, which acts as a data subprocessor. In the event that there is a need to clarify your order after receiving it from Waitless.lt, we process:
  • Name and surname (if indicated in the order)
  • Telephone number, email address and delivery address for ordered goods

Purpose of data processing is the execution of the order that the User has placed at our e-shop, including the delivery of goods

Legal basis of data processing is the execution of the purchase and sale agreement / transaction between the User and „True Concept“ (Waitless)

Duration of data processing – until the ordered goods are forwarded to the Wolt courier.

• When you purchase goods or pay for services at our service locations and request an invoice, we process:
  • Name, surname
  • Telephone number
  • Email address
  • Street address
  • Payment details (bank, payment card or account number)

Purpose of data processing is the sales of goods and / or services (invoicing)

Legal basis of data processing is the execution of the purchase and sale agreement / transaction between the User and the Company

Duration of data processing is 10 years after the conclusion of the contract/transaction, data confirming the fact of the conclusion of the contract/transaction and information related to the conclusion of the contract/transaction and documents confirming financial transactions are processed.

• When you register NORIU card that you have acquired, UAB “Amber Food”, the data processor processes on our behalf:
  • Name, surname
  • Telephone number
  • Email address
  • City/region and country of residence
  • Street address (optional)
  • Date of birth
  • NORIU card No.

Purposes of data processing:

• registering the NORIU card so that its holder can use the privileges of the loyalty program
• informing NORIU cardholders about offers and promotions provided to participants of NORIU card loyalty program
• identifying NORIU card registered holders, in order to grant them applicable discounts, to block the card when it is reported lost or damaged, or in order to issue a new NORIU card after the expiry of the previously held NORIU card.

Legal basis of data processing is the consent you express by registering the card online and checking the relevant fields, having previously familiarized yourself with NORIU card Privacy Policy and the NORIU card Terms of Use.

Duration of data processing: the registered NORIU card is valid for 2 (two) years; after its validity expires, cardholder data is stored for 3 months.

• When you register your existing NORIU card or virtual NORIU card on the Greet platform, UAB "Greet menu" as the joint data controller processes:
  • NORIU card number.

Purpose of data processing is identification of the registered holder of the NORIU card in order to grant them applicable discounts.

Legal basis for data processing is the consent you express by registering your card on the platform and checking the relevant fields, after having familiarized yourself with the relevant Privacy Policy and Terms and Conditions.

Duration of data processing - during the validity of your user account on the Greet platform.

• When you subscribe to our newsletters and promotional messages sent by e-mail when acquiring a NORIU card, UAB "Amber Food" as a separate data controller and as a data processor engaged by us processes on our behalf:
  • Email address

Purpose of data processing is marketing communication

Legal basis for data processing is the User's consent, given when filling out the NORIU cardholder form

Duration of data processing is no longer than 3 years, or until you withdraw your consent.

IMPORTANT: You can unsubscribe from newsletters and promotional messages at any time by clicking the unsubscribe link provided in the newsletter or message.

• When you provide feedback about our goods and services on our Website, we process:
  • Name, surname
  • Telephone number
  • Email address
  • Feedback text, which may contain other information related to your person that you have provided

The purpose of data processing is to improve the quality of services and goods

The legal basis for data processing is the User's consent, granted by deed of voluntary data submission

Data processing term is 6 months as of providing feedback.

• When you apply for job vacancies in any of our restaurants, we process:
  • Name, surname
  • Email address and other contact data specified by you
  • Data proving your education and work experience, as well as other data and information that you provide in your resume (CV), which you submit when filling out the form in the Career section of the Website

The purpose of data processing is employee recruitment to vacant positions (examining the suitability of candidates for specific positions)

The legal basis for data processing is your consent, which you express by filling out the form and sending your resume (CV) in order to get a job in the Company.

Data processing term - no longer than 6 months.

• When you visit the premises of our restaurants and/or the territory where video surveillance is carried out, we process: 
  • Your image captured by video surveillance cameras;
  • Other features of a physiological nature (e.g. gestures/gait characteristics) 

The purpose of data processing is the protection of individuals and the Company's property, prevention of criminal acts, clarification of the circumstances of incidents.

The legal basis for data processing is the Company's legitimate interests in ensuring the security of the territory and premises, as well as the security of persons (the Company's employees and visitors) and property.

The term of data processing is 2 weeks from the creation of records

Processing of personal data on the Website using cookies

When you visit the Website, we process your IP address, network and location data when you provide it. This data is collected with your consent, using cookies and other similar technologies. More information about the cookies used on the Website is available in our  Cookie Policy.

SOCIAL NETWORKS

When you visit the Company’s accounts on social networks (hereinafter referred to as the Social Networks) and provide information there (including messages, use of the “Like” and “Follow” buttons, and other communications) or which is received when you visit Social Networks (including information received through cookies used by the social network operators), it is controlled by the operator of the relevant social network, based on the privacy policy of the relevant social network. Therefore, you should read the privacy policies of the respective social networks.

When you use social networks, communicate with the Company via a Social network, visit the Company’s account on a Social network or follow the Company’s posts on it, the Company receives information about you. The scope of the data received depends on the account settings selected by Us, agreements with social networks regarding the ordering of additional services, and cookies set by social networks. The Company, as the administrator of social network accounts, selects certain settings depending on its target audience, and operational and promotional goals. However, Social networks may have restricted the Company’s ability to change certain essential settings, so We may not be able to influence what information the social network operator will collect about You while You visit the Company’s account on the social network. Even if You only view Our messages, the social network operator may receive some of Your personal data, such as information on the device You are using, Your IP address, etc.

Processing of personal data of minors

If you are a minor between 14 and 18 years of age, and you would like to use this Website or our goods and services at our service locations in such a way that you would have to provide your personal data to us, you can do so only with the consent of your parents or guardians, unless as per the law you have the right to independently dispose of your income. In any case, if you are a minor between 14 and 18 years old, we will process your personal data only when you confirm that you have the consent of your parents or guardians (you will indicate this on the Website).

TO WHOM WE MAY TRANSFER YOUR PERSONAL DATA?

For the processing of your personal data, we may involve third parties - service providers (data processors): companies providing financial and accounting services, companies providing data center services or web hosting services, companies providing information technology infrastructure services, companies creating, providing, maintaining and developing software, as well as other service providers to whom your personal data is disclosed only to the extent necessary for the provision of their services.

The data processors that we contract may only process your personal data in accordance with the clear instructions provided by us and may not use them for other purposes or transfer them to other persons. In each specific case, only the necessary personal data are provided to the processor, i.e., only such personal data that are necessary for the specific purpose of the processing or the provision of the service. To ensure the security of your personal data, we only use data processors who are committed to and can comply with appropriate data security requirements and confidentiality obligations.

WHERE DO WE PROCESS YOUR PERSONAL INFORMATION?

We only process your personal data in the European Union / European Economic Area (EU / EEA). We do not currently transfer your personal data to third countries. If there is a need to transfer your personal data to third countries, we will inform you before the transfer takes place and we will ensure the legality and security of the transfer (application of the necessary transfer mechanisms and security measures).

WHAT RIGHTS DO YOU HAVE?

As a data subject, you have all the rights set out in the General Data Protection Regulation, which you can exercise by visiting the Company or applying by e-mail administracija@amberfood.eu:

• know about the processing of your personal data:  to receive information about whether we process your personal data and, if such personal data is processed, the right to access your personal data;
• apply for a correction of your personal data if you find that your personal data we process is inaccurate;
• apply with a request to suspend the processing of your personal data, except for storage, in case the access to your personal data reveals that the data is incorrect, incomplete or inaccurate or is processed unlawfully;
• apply with a request to delete your personal data ("right to be forgotten"), except when your data must be stored based on the legal obligations applicable to the Company or the determination, execution and defense of legal requirements;
• object to the processing of your personal data when such data is processed or is intended to be processed on the basis of a legitimate interest pursued by the Company;
• where technically possible, obtain a copy of personal data relating to you which you have provided to the Company, which is processed by automated means and the processing of which is based on your consent or a contract, in a commonly used, computer-readable format and transfer to another data controller (right to data portability);
• to revoke your consent to the processing of your personal data at any time by submitting a notice to the Company by either clicking on the e-mail link at the end of the letter (in the case of direct marketing) or by sending your request to the Company by e-mail.

You can exercise your rights yourself or through agents. In order to exercise your rights, you must come to the Company's Administration Office (Upės g. 9-1, LT-09308 Vilnius) in person and submit your application there, or you can submit your application by email  administracija@amberfood.eu. When executing your request, we have the right and obligation to verify your identity, which will always be carried out in the simplest and most convenient way for you. By submitting your request, you can verify your identity in one of the following ways:

• if the request is submitted upon arriving directly at the Company, you must present your identity document to our employee;
• if the request is submitted by mail or through an authorized person, you must submit a notarized copy of your identity document along with the request;
• if the request is submitted by electronic means, it must be electronically signed or submitted by e-mail from your e-mail address which is known to us.

In case of reasonable doubts regarding the identity of the natural person who submitted the request, the Company has the right to request additional information necessary to confirm your identity (for example, by asking a question about what goods or services you have recently purchased, etc.).

The request must be clear, provide your name and surname, contain the information what rights you wish to exercise and to what extent, and how you would like to receive a response. If you submit your request electronically, the above listed information must also be provided electronically, unless you request the response in a different format.

We will make every effort to process your requests and provide you with the information as soon as possible, but no later than in 30 calendar days from the date of receipt of your request. If due to certain circumstances, such as the complexity of the submitted request (e.g., if it is necessary to seek the assistance of data processors) or due to the excessive number of requests processed by the Company, the Company may not process the request in time, therefore the processing period may be extended by a maximum of two additional months after informing you in advance.

Requests are processed and the information and data are provided free of charge, but we reserve the right, in certain cases, to either waive your rights (where the request is unreasonable or disproportionate or repetitive), or impose fees set by the Head of the Company for provision of information and data to cover administrative costs related to the fulfillment of the request in accordance with the requirements of legal acts and (in cases of identified obvious abuse of the data subject's rights, and unreasonably repeated requests for information, data, copies, documents, etc.).

If you believe that the actions or failure to act by the Company violate your rights or legal requirements, you have the right to file a complaint with the supervisory authority - the State Data Protection Inspectorate.

VALIDITY OF PRIVACY POLICY

This Privacy Policy is approved and effective as of 11 February, 2025. We reserve the right to review and update this Privacy Policy on a regular basis or as necessary. We will notify you of any updates on our Website.