Privacy Policy

Last updated: October 26, 2026

This policy explains what personal data we process when you use the website onebite.bg and the mobile apps OneBite (for customers) and OneBite Business (for restaurants and couriers), why we process it, who we share it with and what rights you have. We have written it in plain language; if anything is unclear, email us at support@onebite.bg.

Who processes your data

The controller of your personal data is HAWK MINDS LTD OOD, Company ID (ЕИК) 205119042, VAT ID BG205119042, registered office: ул. „Пушкин“ № 19А, гр. Велинград 4600, обл. Пазарджик, България ("OneBite", "we"). Contact for personal-data questions: support@onebite.bg.

OneBite is a platform that connects customers with local restaurants. For the data needed to prepare and deliver a specific order, the restaurant you order from is an independent controller: it receives the data about your order and uses it only for that order.

What data we collect

• Account — name, email, phone, password (stored only as an irreversible hash), language and your choices about notifications and offers. If you sign in with Google or Apple, we receive your name and email from them (Apple can give a private relay address instead of your real email) and keep the provider's identifier for your profile.
• Orders — name, phone, email (optional), delivery address, the entrance point you place on the map yourself, building type, entrance, floor, apartment and instructions for the courier, notes, the order's contents and value, payment method, statuses and the time of each step. You can also order as a guest, without an account.
• Saved addresses and favourite restaurants — if you add them. A saved address holds the same as the address in an order (text, entrance point, instructions) and the identifier of the place you picked at Google.
• Reviews — the ratings and comment you leave for a completed order. Other customers see the rating, the comment and only your first name.
• Ad measurement on the website (only with consent) — if you press "Accept" in the cookie banner, the Meta pixel in your browser reports which restaurants you view, what you add to the basket, and that you reached checkout, together with your IP address, browser data and Meta's cookies _fbp and _fbc. Our server also sends the same events straight to Meta (so they are not lost if the browser blocks the pixel); they contain only your browser's technical data — no name, phone, email or address. The placed order (with its value) is reported by our server only — not by your browser, because the address of the order page contains a secret code. With it goes: your name, phone, email (if you gave one) and town — only as pseudonymised (cryptographically hashed with SHA-256) data, which is not sent in clear but allows Meta to match it with a user profile — only with your consent — and to tell whether you saw our ad; also the dishes (by internal number), quantity, price and the order number — but not the exact address, your notes or any password. We also keep where you came from (utm_source, utm_medium and utm_campaign from the ad's address) and note on the order that you consented, and the campaign — so we can see which ad leads to orders. This applies to the website only, not to the apps.
• Visit statistics (only with consent) — if you press "Accept" (or turn on "Statistics" in "Settings"), Google Analytics reports which pages of the website are viewed, from what device and browser, from roughly which town and where you came from (the ad's address or a website), together with the cookies _ga and _ga_JW4MN2Z41N. The address of the page with your order is sent without the secret code in it. We send no name, phone, email, address or order contents. We do not switch on Google's advertising features (ad personalisation, Google Signals).
• Location — the address or point you choose for delivery. If you tap "Use my location" (in the app, or on the website once you allow it in your phone or browser), your current position is taken (precise location, one-off) and used to find your address and the restaurants that deliver to you. Your position goes to Google only to get the address for it and better suggestions. We do not track your location in the background.
• Address search and map — the text you type in the address field goes through our server to Google for suggestions and to find the place; we do not keep it, except the address you choose. When you reach the step where you place the pin on your entrance, your browser connects directly to Google to show the map: Google receives your IP address, browser data and the area of the map shown. The pin you place is kept with us; only if you choose a spot directly on the map are its coordinates sent to Google, to get an address for it.
• "Notify me" list — if we do not deliver to your place yet and you leave your email (on the website) or sign up from the app: the email or a random installation identifier, the town or village you asked for, an approximate position (rounded to about 1 km, never your exact address) and the time of your consent. We use them to write to you when we start delivering there, and to see where there is interest.
• Device and notifications — a random installation identifier, platform (iOS or Android), app version, language and a notification token if you allow notifications.
• Technical data — IP address, device and browser type and request times, for security, abuse prevention and correct operation.
• Crash reports — if the app crashes, a technical report (device model and system version, app version, the error) goes to our error-tracking provider. It contains no orders, names, phones or addresses.
• Messages to us — our emails and conversations when you ask us about an order or your account.
• Restaurants, staff and couriers (OneBite Business and the restaurant console) — name, email, phone, role and location; for couriers, the assigned deliveries and the "picked up", "delivered" or "failed" marks, together with the customer data needed to deliver; for paired tablets, the device name and last use.

The mobile apps

The apps may ask for the following permissions. Each one is your choice and you can withdraw it at any time in your phone's settings:

• Location (only while the app is open) — when you tap "Use my location". The address for the coordinates is worked out by the Apple or Google map services on the device itself or — in newer versions of the app — by our server through Google.
• Notifications — for your order status (accepted, on its way, delivered) in OneBite and for new orders, reviews and deliveries in OneBite Business. We ask at a sensible moment, not at first launch.
• Camera and photos — only in OneBite Business, to upload a photo of a dish.

On your phone the app keeps: an installation identifier, a sign-in token (in the system's protected storage — iOS Keychain and Android Keystore), the selected address and language, the basket, and the orders you placed as a guest (so you can follow them without an account).

The apps show no ads, do not track users across apps and websites, do not use an advertising identifier and do not sell data. That is why they do not ask for tracking permission. Ad measurement with Meta is on the website only (see below). We do not use Face ID, fingerprint or the microphone.

Why we use the data and on what basis

• To accept, pass to the restaurant and track your order and to keep your account — performance of a contract (Art. 6(1)(b) of Regulation (EU) 2016/679, GDPR).
• For order-status notifications by email, SMS and push — performance of a contract; push notifications work only if you have allowed them on your phone.
• For your precise location — consent (Art. 6(1)(a) GDPR), which you give in the system dialog and can withdraw at any time.
• For address suggestions and the map where you place the pin on your entrance — performance of a contract: without them we cannot deliver to the exact place. Your position goes to Google only if you tap "Use my location" — with your consent.
• For the "Notify me" list — consent (Art. 6(1)(a) GDPR), which you give by ticking the box next to the email; you can withdraw it at any time. We also use the approximate position to see where there is interest in expanding — legitimate interest (Art. 6(1)(f) GDPR).
• For offers and promotions from OneBite and restaurants — only if you ticked the box (consent). You can untick it at any time in Account → Settings.
• For measuring our ads on Facebook and Instagram (the Meta pixel on the website, our server passing the events on) and for recording the campaign you came from — so we can see which ad leads to orders — only consent (Art. 6(1)(a) GDPR), which you give with the "Accept" button in the cookie banner and can withdraw at any time from "Cookie settings" at the bottom of the page. If you do not consent, the website and orders work exactly the same.
• For visit statistics (Google Analytics) — only consent (Art. 6(1)(a) GDPR), which you give with "Accept" or by ticking "Statistics" in "Settings" and can withdraw at any time. If you do not consent, the website and orders work exactly the same.
• For recording your choice in the banner (to prove consent) — legal obligation / legitimate interest (Art. 6(1)(c) and (f) and Art. 7(1) GDPR).
• For accounting, tax and other legal obligations — legal obligation (Art. 6(1)(c) GDPR).
• For security, preventing fraud and fake orders, crash reports, support, review moderation, improving the service and defending legal claims — legitimate interest (Art. 6(1)(f) GDPR).

Who we share data with

• The restaurant you order from, and its staff and couriers — only the data about your order (name, phone, address, notes, the order's contents).
• Providers who work for us (processors) — listed in the table below, under contract and only to provide the service.
• Google Ireland Limited (Google Analytics) — only if you accepted "Statistics": the visit data described in "What data we collect". We do not switch on Google's advertising features.
• Meta Platforms Ireland Limited (Facebook and Instagram) — only if you pressed "Accept": the ad-measurement data described in "What data we collect". Meta also processes it under its own privacy policy (facebook.com/privacy/policy).
• Authorities — when the law requires it or to defend legal claims.
• If the business is restructured or transferred, the data passes to the successor under the same protection.

We do not sell personal data and — apart from the ad measurement with Meta, when you have consented — we do not pass it to third parties for advertising. Notifications to your phone travel through Expo, Apple and Google and contain the restaurant's name, the order's status and the estimated time — not your address or phone.

When the Meta Pixel and the Conversions API are used, "HAWK MINDS LTD OOD" and Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) act as joint controllers within the meaning of Art. 26 GDPR for collecting data about your actions on the website and passing it to Meta. The essence of the arrangement between joint controllers (Meta Controller Addendum): we provide the legal basis (consent) and the Art. 13 and 14 GDPR information on the website; Meta is responsible for the security of its services and for fulfilling rights under Art. 15–20 GDPR for the data it keeps after the transfer. For more on how Meta processes data and how to exercise your rights against Meta: facebook.com/privacy/policy.

Transfers outside the EU/EEA

Our main infrastructure is in the EU (Frankfurt, Germany). Some providers — for example Expo, Apple, Google, Cloudflare and Meta — may process limited data outside the EEA, mostly in the USA. In those cases we rely on a European Commission adequacy decision (e.g. the EU–US Data Privacy Framework) or on the EU standard contractual clauses. You can ask for a copy of the safeguards at support@onebite.bg.

Data collected through the Meta Pixel and the Conversions API is passed to Meta Platforms Ireland Limited (Ireland). Where it is passed on to Meta Platforms, Inc. in the USA, the transfer relies on the European Commission's adequacy decision (the EU–US Data Privacy Framework), under which the US company is certified, and on the standard contractual clauses adopted by the Commission (Art. 46(2)(c) GDPR).

How long we keep data

• Order and invoice data — 60 months (accounting requirements), after which it is deleted or anonymised. The order keeps a note that you consented to marketing (as proof); the campaign (utm_*), if any, is deleted from the order after 6 months.
• Visit statistics (Google Analytics) — up to 2 months (a setting in Google Analytics); they contain no name, phone or address.
• A record of your choice in the cookie banner (when, which version of the text, what you chose; the IP address only as a hash) — 24 months, so we can prove there was consent.
• Account — while you use it; an inactive account — up to 24 months after the last activity, after which it is deleted or anonymised.
• When you delete your account, your name, email, phone, saved addresses, favourites, notification tokens and sign-in links are deleted immediately, together with the "Notify me" entries left with your account email or from your devices. Past orders remain as an accounting record without your name, phone and address; reviews remain with no link to you.
• "Notify me" list (email or installation, approximate position, consent) — 12 months after the consent (signing up again renews it), after which the entry is deleted; sooner when you ask or delete your account.
• In a courier's history the customer's details are visible for at most 24 hours after the delivery is closed.
• Sign-in tokens in the apps expire by themselves (customer — 180 days, staff — 60 days) and are destroyed on sign-out.
• Crash reports are kept according to our provider's settings (usually up to 90 days); technical logs only as long as needed for security.

Your rights and how to use them

You have the right to access your data, to rectification, erasure, restriction of processing, portability and objection, and the right to withdraw consent without affecting the processing done before withdrawal.

• Delete your account: in the app (Account → Delete account) or on the Delete account page.
• Offers: Account → Settings. Notifications and location: your phone's settings.
• "Notify me" list: write to support@onebite.bg from the email you signed up with and we will delete the entry.
• For anything else email support@onebite.bg. We reply within one month at the latest.

You have the right to lodge a complaint with the supervisory authority — the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg, kzld@cpdp.bg.

For the processing we carry out together with Meta (the pixel and the Conversions API) you can exercise your rights against either of us. If you write to us at support@onebite.bg, we will delete your data in our systems (cookies, records, the marketing flag), forward your request to Meta through the channels provided for controllers within 7 calendar days, and tell you what we did, with a link to Meta's ad-preferences settings.

Automated decisions

We do not take decisions with legal or similarly significant effects on you solely by automated processing. The order of restaurants is set by published criteria (see Ranking) and is not based on a profile of you. An account is restricted for abuse only after a human review.

Security

The connection to the website and apps is encrypted (HTTPS/TLS), passwords are stored as irreversible hashes, sign-in tokens in the phone's protected storage, and access for staff and restaurants is limited by role and by location: everyone sees only the data of their own orders. If a breach creates a risk for you, we will notify the CPDP within 72 hours and you where required.

Children

The service is intended for people over 18. We do not knowingly collect data from anyone under 14. If you believe a child has given us data, email support@onebite.bg and we will delete it.

Cookies and local storage

We use necessary cookies — the website does not work without them — and, only if you consent, cookies for visit statistics (Google Analytics) and for measuring ads (Meta). We use no cookies for other companies' ads:

• Session and protection — keeps you signed in, your basket and protection against forged requests; expires after 2 h of inactivity.
• "Remember me" — only if you leave the box ticked at sign-in: keeps you signed in on this device for up to 5 years or until you sign out.
• onebite_address — the remembered delivery address, so you don't re-enter it (up to 5 years; cleared with "Forget…" or when you change the address).
• onebite_contact — the remembered name and phone for your next order (up to 5 years; cleared when you sign out or with "Forget…" at checkout).
• Google map — only at the step where you place the pin on your entrance: your browser loads the map from Google, which receives your IP address and browser data and may store its own technical data in your browser that the map needs to work. We do not use it for ads or analytics.
• Tablet pairing — only on the restaurant's tablet: recognises the paired device.
• Console settings — sound, text size and board view (in the restaurant's browser).
• onebite_consent — remembers your choice in the cookie banner ("Accept" or "Reject"); up to 180 days.
• onebite_campaign — only if you pressed "Accept": where you came from (utm_source, utm_medium, utm_campaign from the ad's address, at most 100 characters each), so we know which ad leads to orders; 30 days. If you press "Reject" or withdraw your consent, we delete it.
• _fbp and _fbc (Meta) — only if you pressed "Accept": an identifier of your browser and of the ad you came from, so Meta can link the order to the ad. Set by the Meta pixel; up to 90 days. If you press "Reject" or withdraw your consent, the pixel is not loaded and we delete them.
• _ga and _ga_JW4MN2Z41N (Google Analytics) — only if you accepted "Statistics": an identifier of your browser and session, so we can count visits; up to 13 months. If you press "Reject" or withdraw your consent, Google Analytics is not loaded and we delete them.

Visit statistics with Google Analytics and ad measurement with Meta apply to the website only — not to the apps. Until you consent, nothing is loaded from Google or Meta and no data is sent to them. You can change your choice at any time from "Cookie settings" at the bottom of the page. The data Meta has already received stays with it under its policy; you can ask Meta to delete it through your Facebook/Instagram account settings.

In line with Art. 5(3) of Directive 2002/58/EC (and the Bulgarian law that implements it), statistics and marketing cookies are placed on your device only after your explicit prior consent.

Changes to this policy

If we make a material change, we will tell you in the app or on the website at least 15 days before it takes effect. You can always find the current version on this page; the date of the last edit is at the top.

The latest material change is the addition of visit statistics with Google Analytics and of ad measurement with Meta (the sections "What data we collect", "Why we use the data", "Who we share data with" and "Cookies and local storage"). It takes effect on the date of the last edit of this page. Because both tools are switched on only with your explicit consent in the banner, nothing is loaded from Google or Meta for anyone who has not consented.