Privacy Policy

Bulaccino Cafe ("we," "us," "our," or the "Company") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website bulaccinocafe.com (the "Website"), use our services, or interact with us in any way.

This Privacy Policy is designed to comply with the laws and regulations of the Republic of Fiji, including the principles of fair information practices. We encourage you to read this policy carefully to understand our practices regarding your personal data.

By accessing or using our Website and services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our Website or services.

We collect information in several ways when you interact with our Website and services:

2.1 Information You Provide Directly (a) Account Registration: Name, email address, phone number, password, and date of birth (optional, for birthday rewards). (b) Orders: Delivery/pickup details, payment information, order history, and special dietary requirements or preferences. (c) Communications: Information you provide when contacting us, including through our contact form, email, phone, or social media. (d) Loyalty Program: Information related to your participation in our rewards program. (e) Marketing: Email address and communication preferences when you subscribe to our newsletter or promotional communications.

2.2 Information Collected Automatically (a) Device Information: IP address, browser type and version, operating system, device identifiers, and screen resolution. (b) Usage Data: Pages visited, time spent on pages, click patterns, scroll depth, and navigation paths. (c) Location Data: General geographic location based on IP address (we do not collect precise GPS location without explicit consent). (d) Cookies and Similar Technologies: Information collected through cookies, web beacons, and similar technologies as described in our Cookie Policy.

2.3 Information from Third Parties (a) Payment Processors: Transaction confirmation and fraud prevention data. (b) Social Media: If you interact with us through social media platforms, we may receive information in accordance with your privacy settings on those platforms. (c) Analytics Providers: Aggregated and anonymized analytics data.

We use the information we collect for the following purposes:

3.1 Service Delivery (a) To process and fulfill your orders; (b) To manage your account and provide customer support; (c) To administer our loyalty rewards program; (d) To communicate with you about your orders, account, or inquiries.

3.2 Improvement and Personalization (a) To improve our Website, products, and services; (b) To personalize your experience and provide tailored recommendations; (c) To conduct research and analytics to understand how our Website is used; (d) To develop new products, services, and features.

3.3 Marketing and Communications (a) To send promotional communications, newsletters, and offers (with your consent); (b) To inform you about new products, services, or events; (c) To conduct surveys and collect feedback.

3.4 Legal and Security (a) To comply with legal obligations and regulatory requirements; (b) To protect against fraud, unauthorized transactions, and other liability; (c) To enforce our Terms of Use and other agreements; (d) To protect the rights, property, or safety of Bulaccino Cafe, our customers, or others.

We process your personal information based on the following legal grounds:

4.1 Contractual Necessity: Processing necessary to perform a contract with you or to take steps at your request prior to entering into a contract (e.g., processing orders, managing your account).

4.2 Legitimate Interests: Processing necessary for our legitimate business interests, provided these interests do not override your fundamental rights and freedoms (e.g., improving our services, preventing fraud, direct marketing to existing customers).

4.3 Consent: Where you have given clear consent for us to process your personal information for a specific purpose (e.g., marketing communications, non-essential cookies).

4.4 Legal Obligation: Processing necessary to comply with a legal obligation to which we are subject (e.g., tax reporting, responding to lawful requests from public authorities).

You have the right to withdraw your consent at any time where we rely on consent as the legal basis for processing. This will not affect the lawfulness of processing based on consent before its withdrawal.

We may share your personal information in the following circumstances:

5.1 Service Providers: We may share your information with third-party service providers who perform services on our behalf, including: (a) Payment processors (for transaction processing); (b) Email service providers (for marketing and transactional emails); (c) SMS providers (for order notifications); (d) Cloud hosting providers (for data storage); (e) Analytics providers (for website analytics).

These service providers are contractually obligated to protect your information and may only use it for the purposes specified by us.

5.2 Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, government agencies).

5.3 Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction.

5.4 Protection of Rights: We may disclose information to protect and defend our rights or property, or the safety of our customers or others.

5.5 With Your Consent: We may share your information for other purposes with your explicit consent.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

6.1 Retention Periods (a) Account Information: Retained for the duration of your account and for a period of seven (7) years after account closure for legal and regulatory compliance. (b) Order History: Retained for seven (7) years for tax and accounting purposes. (c) Marketing Data: Retained until you withdraw consent or unsubscribe, plus a suppression period to honor your preferences. (d) Analytics Data: Aggregated analytics data may be retained indefinitely; individual-level data is retained for up to twenty-four (24) months. (e) Communication Records: Retained for three (3) years from the date of communication.

6.2 Deletion: When personal information is no longer required, we will securely delete or anonymize it in accordance with our data retention policies and applicable law.

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

7.1 Technical Safeguards (a) Encryption of data in transit using SSL/TLS protocols; (b) Encryption of sensitive data at rest; (c) Secure password hashing algorithms; (d) Regular security assessments and vulnerability testing; (e) Firewalls and intrusion detection systems.

7.2 Organizational Safeguards (a) Access controls limiting employee access to personal information on a need-to-know basis; (b) Employee training on data protection and security practices; (c) Confidentiality agreements with employees and contractors; (d) Incident response procedures for data breaches.

7.3 Limitations: While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

7.4 Breach Notification: In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant authorities as required by applicable law.

Subject to applicable law, you have the following rights regarding your personal information:

8.1 Right of Access: You have the right to request a copy of the personal information we hold about you and information about how we process it.

8.2 Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal information.

8.3 Right to Erasure: You have the right to request deletion of your personal information in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.

8.4 Right to Restrict Processing: You have the right to request that we restrict the processing of your personal information in certain circumstances.

8.5 Right to Data Portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit it to another controller.

8.6 Right to Object: You have the right to object to the processing of your personal information for direct marketing purposes or where we process your information based on legitimate interests.

8.7 Right to Withdraw Consent: Where we rely on your consent to process personal information, you have the right to withdraw that consent at any time.

To exercise any of these rights, please contact us using the contact details provided in Section 12. We will respond to your request within thirty (30) days.

Your personal information may be transferred to and processed in countries other than Fiji. These countries may have data protection laws that are different from the laws of Fiji.

9.1 Safeguards: When we transfer your personal information internationally, we take appropriate safeguards to ensure that your information receives an adequate level of protection, including: (a) Transferring to countries that have been deemed to provide adequate protection; (b) Using contractual clauses that require the recipient to protect your information; (c) Implementing technical and organizational security measures.

9.2 Consent: By using our Website and services, you consent to the transfer of your information to countries outside of Fiji as described in this Privacy Policy.

Our Website and services are not directed to children under the age of thirteen (13). We do not knowingly collect personal information from children under 13.

If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will take steps to delete that information promptly.

If you believe we may have collected information from a child under 13, please contact us immediately at administrator@bulaccinocafe.com.

For users between 13 and 18 years of age, we recommend that a parent or guardian supervise their use of our Website and services.

Our Website may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to such third-party services.

We are not responsible for the content, privacy policies, or practices of third-party websites or services. We encourage you to review the privacy policies of any third-party sites you visit.

The inclusion of a link to a third-party website does not imply endorsement of the linked site by Bulaccino Cafe.

If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices, please contact us:

Data Protection Officer Bulaccino Cafe Nadi, Fiji

Email: administrator@bulaccinocafe.com WhatsApp: +679 675 0102

For general inquiries: administrator@bulaccinocafe.com For privacy-related matters: administrator@bulaccinocafe.com

We will investigate and respond to all complaints within thirty (30) days.

If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

When we make material changes to this Privacy Policy, we will: (a) Update the "Last Updated" date at the top of this page; (b) Post a prominent notice on our Website; (c) Where required by law or where we have your email address, send you an email notification.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

Your continued use of our Website and services after any changes to this Privacy Policy constitutes your acceptance of those changes.