Privacy policy
Last updated: 20.10.2026
In short
- We collect only what is needed to run your account, your orders and bookings, and a business's page.
- The business you order from or book with sees your name, phone, email and the details of your order or booking, so it can serve you.
- We do not sell your data, we show no ads and we use no tracking or advertising cookies.
- You can delete your account yourself at any time from your profile.
1. Who we are
Sandanski.town is a local marketplace for the town of Sandanski, Bulgaria. Customers use it to find local businesses, order food, book tables, services and rooms, and reserve end-of-day bags. Businesses use it to run their public page, menu, orders and bookings.
The data controller for the personal data described here is:
- Sandanski.town
- Contact: Contact us form
Each business on the site is responsible for how it uses the order and booking details it receives from you, for example for delivery, invoices or its own records.
2. What data we collect
Customers
- Account: first and last name, email address, phone number, password (stored only as a secure hash, never in plain text), preferred language, account type and the date you signed up. If you sign in with Google, we receive your name and email address from Google; we do not receive your Google password.
- Orders: what you ordered, the vendor, delivery or pickup, delivery address, name, phone and email for the order, your notes, delivery cost, total and status.
- Bookings: table, service or room booked, date and time, number of guests, check-in and check-out dates, an optional address for services done at your place, your notes, and name, phone and email for the booking.
- End-of-day bag reservations: the bag, quantity, price, pickup code, and name, phone and email.
- Reviews and votes: your star rating, comment and the date. Reviews are public and show your first name and the initial of your last name (for example "Maria P."). We also store which reviews you voted on.
- Loyalty stamp cards: the stamps you collected at a business and the code of your personal stamp card.
- Cart: the products in your cart, linked to your account or to a random id in a cookie if you are not signed in.
Businesses (vendors)
- Owner account: the same account data as for customers.
- Business details: business name, company name and company ID (EIK), address and map location, contact phone and email, category, description, logo, photos, working hours, menus, services, rooms, prices and the other content you publish. Most of this is shown publicly on your page.
- Application and status: when you applied, when you were approved or why you were rejected, and your onboarding progress.
- Packages and billing: the packages you use, their status and dates, and your Stripe customer and subscription ids. Card details are entered on Stripe's own page and are never stored by us.
- Staff accounts: the accounts you add as staff for table orders, and the tables they are assigned to.
- Promotional emails: the campaigns you send and the number of recipients.
Everyone, including visitors
- Contact form: name, email, optional phone, your message, the date and the IP address it was sent from.
- Table QR orders: when you order at a table with a QR code, we store the products ordered and the staff calls for that table. We do not ask for your name.
- Phone verification: the phone number and a hashed copy of the code we text you. The code expires after a few minutes.
- Technical data: when something breaks, we log the error, the page address, the time and, if you were signed in, your account id. Your IP address is used for a short time in memory to limit repeated attempts (for example password guessing) and is not saved for that purpose.
- Usage counters: we count how many times a product or service is viewed or ordered. These are totals only and are not linked to you.
3. Why we use your data and on what legal basis
Under the EU General Data Protection Regulation (GDPR) we need a legal basis for every use of personal data. These are ours:
| Purpose | Legal basis |
|---|---|
| Creating and running your account, signing you in, verifying your email and phone | Contract (Art. 6(1)(b)) |
| Placing orders, bookings and bag reservations, and passing them to the business | Contract (Art. 6(1)(b)) |
| Emails and texts about your orders and bookings: confirmations, status changes and reminders | Contract (Art. 6(1)(b)) |
| Showing a business's public page, menu and reviews | Contract with the business (Art. 6(1)(b)); for reviews, our legitimate interest in useful, honest reviews (Art. 6(1)(f)) |
| Approving businesses and checking company details | Contract (Art. 6(1)(b)) and legitimate interest in keeping fake businesses off the site (Art. 6(1)(f)) |
| Billing businesses for paid packages | Contract (Art. 6(1)(b)) and legal obligation for accounting records (Art. 6(1)(c)) |
| Promotional emails a business sends to its own customers | The business's legitimate interest in informing earlier customers about similar offers (Art. 6(1)(f)); you can unsubscribe in every email |
| Security checks, rate limits, error logs and preventing abuse (including the one-time free gift for businesses) | Legitimate interest in a safe, working site (Art. 6(1)(f)) |
| Answering contact form messages | Legitimate interest in replying to you (Art. 6(1)(f)) |
| Keeping records we must keep by law, and answering requests from authorities | Legal obligation (Art. 6(1)(c)) |
We do not use your data for automated decisions with legal effects, and we do not build advertising profiles.
5. Emails and texts
We send emails and texts that are needed for your account, orders and bookings, for example a confirmation, a status change or a reminder the day before a booking. You cannot turn these off while the account is active, because the service does not work without them.
A business can send promotional emails only to customers who ordered from it or booked with it. Every promotional email has an unsubscribe link; after you click it, that business can no longer email you promotions through our site.
7. How long we keep data
- Customer accounts: until you delete your account. You can do this yourself in your profile by typing CONFIRM; the deletion happens straight away and needs no approval from us. Your name, email, phone, password and Google sign in are erased and the account can no longer sign in. We send a last confirmation email to your old address. While an order is being prepared or delivered, you can delete the account only after it is finished.
- Orders, bookings and reservations after deletion: orders not yet accepted, upcoming bookings and reserved bags are cancelled. Past ones, and your contact form messages, keep only the amounts, dates and what was ordered or booked, so the business's records stay correct; your name, phone, email and address in them are replaced with "Deleted user".
- Reviews after deletion: they stay on the site, shown as written by "Customer", without your name.
- Business accounts: until the business deletes its account. Deletion is possible when there are no open orders, upcoming bookings or reserved bags. The owner's personal data and the staff accounts are erased, paid packages end and their Stripe subscriptions are cancelled. The business record (business name, company name and ID, address, contact details and past orders and bookings) is kept, marked as deleted and hidden from the site, for accounting and to prevent abuse. The owner email is kept only as a one-way hash, so it cannot be used to register again for 3 months and the one-time "stay with us" gift cannot be claimed twice. Answers to the optional leaving survey are kept to improve the site.
- Billing records: as long as Bulgarian accounting law requires (currently 10 years for accounting documents).
- Contact form messages: up to 2 years.
- Error logs and sent email records: up to 12 months.
- Phone verification codes: they expire after a few minutes and are kept hashed for a short time to stop abuse.
8. Your rights
Under the GDPR you have the right to:
- see the personal data we hold about you and get a copy of it;
- correct data that is wrong (most of it you can change yourself in your profile);
- delete your data (delete your account in your profile, or write to us);
- restrict or object to how we use your data, including any use based on legitimate interest;
- receive the data you gave us in a machine-readable format (data portability);
- unsubscribe from promotional emails at any time.
To use any of these rights, write to us through the Contact us form. We reply within one month. We may ask you to confirm that the account is yours before we act.
If you think we handle your data unlawfully, you can complain to the Bulgarian data protection authority, the Commission for Personal Data Protection (КЗЛД): 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg.
9. How we protect your data
The site works only over an encrypted connection (HTTPS). Passwords and verification codes are stored only as hashes. Sign in, sign up, orders and bookings are protected by a security check and by limits on repeated attempts. Only the business concerned and the site administrators can see order and booking details, and only when it is needed for their work.
10. Children
The site is not meant for children under 14. We do not knowingly create accounts for them. If you believe a child has given us personal data, please contact us and we will delete it.
11. Changes to this policy
When we change this policy, we update the date at the top of this page. If the change is important, we will also let you know by email or with a notice on the site.