Privacy Policy

Effective as of June 11, 2026.

This privacy policy explains what personal data we collect when you use the Sushi Fresh Bar website (sushifresh.rs) and the Sushi Fresh Bar mobile app, how we use it, who we share it with, and what rights you have. By using our services you accept the practices described in this document.

1. Data Controller

The controller of your personal data is Order Wave doo, Novi Sad, Republic of Serbia ("Sushi Fresh Bar", "we"). For any privacy-related questions, contact us at info@sushifresh.rs.

2. Data We Collect

Depending on how you use the service, we collect the following data:

  • Account data: full name, email address and phone number. If you sign in with your Google account, we receive your name and email address from Google.
  • Guest orders (without an account): name, phone number, email address and delivery address.
  • Delivery address: street and number, apartment, floor, intercom, courier notes and the geographic coordinates of the address (used to determine the delivery zone and fee).
  • Phone number verification: phone number and the time of successful SMS verification.
  • Payment data: card details are entered directly with our certified payment processor (AllSecure); your card number never reaches our servers and we never store it. We only keep a saved-card token (last four digits and card type) and transaction details (amount, time, status).
  • Push notifications: a device token (Firebase Cloud Messaging) if you allow notifications; you can turn them off in your device settings at any time.
  • Order history: ordered items, amounts, time and status of orders.

3. How We Use Your Data

  • receiving, processing and delivering your orders
  • notifying you about order status (push notifications, SMS)
  • managing and maintaining your account
  • preventing abuse and fraud
  • fulfilling legal obligations (fiscal and accounting regulations)

4. Legal Basis for Processing

  • performance of a contract: processing and delivering the order you placed
  • legal obligation: retaining transaction records as required by law
  • consent: push notifications; you can withdraw consent at any time
  • legitimate interest: system security and abuse prevention

5. Who We Share Data With

We never sell your data. We share it only with service providers who process it on our behalf and under our instructions:

  • AllSecure: card payment processing
  • Amazon Web Services (Cognito, Frankfurt region, EU): authentication and account sign-in
  • Google Firebase: push notification delivery
  • Google Cloud: infrastructure hosting
  • Mapbox: map display and delivery address lookup
  • courier services: name, address and phone number, solely to fulfil the delivery

Some providers (AWS, Google, Mapbox) may process data on servers outside the Republic of Serbia, with appropriate safeguards in place as required by law.

6. Data Security

We apply technical and organizational safeguards: all communication is encrypted (TLS/HTTPS), data is encrypted at rest, passwords are stored exclusively in hashed form and never as plain text, and access to data is restricted to authorized personnel.

7. How Long We Keep Data

Account data is kept while your account is active. Order and transaction data is retained for the periods required by accounting and tax regulations. Notification device tokens are deleted when you sign out or withdraw consent.

8. Your Rights

Under the applicable data protection law you have the right to: access your data, rectification, erasure, restriction of processing, objection and data portability.

You can request deletion of your account and data by emailing info@sushifresh.rs from the email address linked to your account. We fulfil requests within 30 days, we delete all data except what we are legally required to retain (e.g. issued invoice records).

If you believe your data is being processed unlawfully, you have the right to lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs).

9. Children

Our services are not intended for persons under 15 years of age and we do not knowingly collect their data. If we learn that we have collected a child's data, we will delete it without delay.

10. Changes to This Policy

We may update this privacy policy from time to time. The current version is always published on this page, with its effective date. We will notify you of significant changes via the app or email.

11. Contact

For any questions about this policy or the processing of your data, write to us at info@sushifresh.rs.