Privacy Policy

S.A.M. BAO Pau Ltd. ("Bao·Pau", "we", "us" or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect information about you when you visit our website, dine with us, place an order, or participate in our promotions and campaigns (including the Lolli-pau Challenge).

This policy is issued in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Cyprus Law Providing for the Protection of Natural Persons with regard to the Processing of Personal Data (Law 125(I)/2018).

1. Data Controller

The data controller responsible for your personal data is:

• S.A.M. BAO Pau Ltd.
• Registered in the Republic of Cyprus
• Email: info@baopau.com

2. What Information We Collect

We may collect and process the following categories of personal data:

Information you provide to us

• Contact details: name, email address, telephone number.
• Reservation and order information: booking details, dietary preferences, delivery address, order history.
• Payment information: processed securely through our payment providers; we do not store full card details.
• Campaign and promotion entries: social media handle, content you submit or tag us in (e.g. TikTok / Instagram videos for the Lolli-pau Challenge), and any information needed to contact a winner and deliver a prize.
• Correspondence: messages you send us through email, contact forms or social media.

Information collected automatically

• Technical data: IP address, browser type, device information, operating system.
• Usage data: pages visited, time spent on the site, referring URLs.
• Cookies and similar technologies: see Section 7 below.

3. How We Use Your Information

We use your personal data for the following purposes:

• To take and manage reservations and orders.
• To provide our food and drink services and respond to enquiries.
• To administer competitions, giveaways and campaigns, including verifying eligibility and contacting winners.
• To send marketing communications where you have consented, and to inform you about menu updates, offers and events.
• To improve our website, menu and customer experience.
• To comply with legal, tax, accounting and regulatory obligations.
• To protect our legal rights and prevent fraud or misuse.

4. Legal Basis for Processing

We process your personal data on one or more of the following legal bases:

• Contract: where processing is necessary to take a reservation, fulfil an order or deliver a prize.
• Consent: where you have opted in, for example to receive marketing emails or to enter a promotion.
• Legitimate interests: to operate and promote our restaurant, improve our services, and keep our website secure, provided these interests are not overridden by your rights.
• Legal obligation: where we are required to process data to comply with Cyprus or EU law.

5. Sharing Your Information

We do not sell your personal data. We may share it with:

• Service providers who support our operations (e.g. booking platforms, payment processors, email providers, delivery partners, website hosting).
• Social media platforms (e.g. Meta / Facebook, Instagram, TikTok) when you interact with us on those platforms or take part in a campaign run through them. Your use of those platforms is also subject to their own privacy policies.
• Professional advisers such as accountants, auditors and lawyers, where necessary.
• Public authorities where required by law or to protect our legal rights.

Where data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place in accordance with GDPR.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. For example, reservation records are typically kept for a limited period after your visit, while invoices and accounting records are retained for the period required by Cyprus tax law (generally six years).

7. Cookies

Our website may use cookies and similar technologies to make the site work, remember your preferences, and analyse how the site is used. You can control or disable cookies through your browser settings. Disabling cookies may affect the functionality of the site.

8. Your Rights

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten"), subject to legal exceptions.
• Restrict or object to the processing of your data.
• Request the transfer of your data to another controller (data portability).
• Withdraw your consent at any time, where processing is based on consent.

To exercise any of these rights, please contact us at info@baopau.com. We will respond within the timeframes required by law.

If you believe we have not handled your personal data in accordance with the law, you have the right to lodge a complaint with the Cyprus supervisory authority:

• Office of the Commissioner for Personal Data Protection
• Website: www.dataprotection.gov.cy

9. Security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure. However, no transmission over the internet can be guaranteed to be completely secure.

10. Children

Our website and promotions are not directed at children under 16. We do not knowingly collect personal data from children under 16 without parental or guardian consent. If you believe a child has provided us with personal data, please contact us so we can remove it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page with an updated "last updated" date.

12. Contact Us

For any questions about this Privacy Policy or how we handle your personal data, please contact:

• S.A.M. BAO Pau Ltd.
• Email: info@baopau.com