Privacy policy

1. Who we are

Bun de Casa is the controller of the personal data described below. You can write to us with any question about your data using the contact details at the end of this page.

2. What we collect and why

We only collect the data you send us through the forms and what is strictly needed for the site to work:

• Shop orders: your last name, first name, email address, phone number, the product, the quantity, the date you want it for and your comment. We use them to prepare the order, contact you to confirm it and email you about its progress. The legal basis is entering into and performing a contract with you.
• Allergies (optional, on orders): if you tell us about allergies, that is information about your health. By filling in the field you give us your explicit consent to use it, only to avoid those ingredients in your order. You can leave the field empty.
• Order tracking: the order number together with the email address or phone used for the order, so we can show you the order's page. That page has a unique, hard-to-guess address that only you receive.
• Event sign-ups: your name, email address, phone, number of guests and your message, to keep your place and let you know if anything changes. The legal basis is your sign-up, which is a contract with us.
• Newsletter: your email address, the site language and the date you subscribed, to send you news. The legal basis is your consent, which you can withdraw at any time.
• Visit statistics: only if you press "Accept" on the cookie banner (details below).

We do not sell your data, do not use it for advertising and do not make automated decisions about you.

3. Cookies and statistics

The site sets only necessary cookies:

• NEXT_LOCALE remembers the language you chose, for one year.
• cookie_consent remembers your answer to the cookie banner: for 6 months if you accept, until you close the browser if you decline.

We measure visits with Umami, a privacy-friendly analytics tool. Umami sets no cookies, does not follow you across other websites and does not keep your IP address: visits are counted anonymously so we can see which pages are read and on what kind of device. The script loads only after you press "Accept", and you can withdraw your consent at any time from the "Cookie settings" link in the page footer.

Some recipes include YouTube videos, shown in youtube-nocookie.com mode. When you open such a page, the player loads from YouTube (Google), which receives your IP address and browser information under its own privacy policy.

4. Who we share data with

Your data only reaches those who help us run the site, and they use it only on our behalf:

• Smart Tech Innovation (smartinnovation.md), our technical partner, which runs the server hosting the site, its database and the Umami statistics.
• Resend, the service we send order emails through. Resend receives your email address and the message only to deliver it.

We give your data to no one else, except where the law requires it, for example at the request of an authority.

5. Transfers outside the Republic of Moldova

Resend is a company based in the United States, so data sent through this service may reach that country. The transfer relies on the provider's data processing agreement and standard contractual clauses, as safeguards provided for by law.

6. How long we keep data

• Orders: 3 years after completion, for possible complaints and for our accounting records, then we delete or anonymise them.
• Allergies: only while the order is being prepared; we delete them once the order is completed.
• Event sign-ups: 6 months after the event.
• Newsletter subscription: until you unsubscribe.
• Umami statistics: they contain nothing that identifies you and are kept only as aggregate figures.

7. Your rights

Under Law No. 195/2024 you have the right to:

• know what data we hold about you and receive a copy of it;
• have wrong or incomplete data corrected;
• have your data deleted or its processing restricted;
• receive your data in a format that is easy to pass on to someone else (portability);
• object to processing based on our legitimate interest;
• withdraw your consent at any time (for the newsletter, allergies or statistics), without affecting what was done before.

Write to us at the email address below. We reply within one month at the latest. To make sure your data reaches the right person, we may ask for your order number or reply to the email address used for the order.

If you believe we are breaching your rights, you can complain to the National Centre for Personal Data Protection (datepersonale.md). We would be glad if you wrote to us first, so we can sort it out together.

8. Children

The site is not meant for children under 14. If you are under 14, please ask a parent to place the order or sign up for you.

9. Keeping data safe

The site uses only encrypted connections (HTTPS), the admin panel is password-protected and every order-tracking page has a unique address. If an incident ever puts your data at risk, we notify the National Centre for Personal Data Protection within 72 hours and, if the risk to you is high, we tell you as well.

10. Changes to this policy

If we change how we use data, we update this page and the date above. For important changes we also let you know by email, if we have your address.