Privacy Policy

Last updated: 05.11.2026

1. Who processes your data

The controller of personal data on toucan.cafe is BLACKBREAD LTD (Cafe Toucan).

• Reg. No.: HE 352187
• VAT: CY10352187S
• Address: Agias Zonis 5, 3027 Limassol, Cyprus
• E-mail for data requests: toucan.limassol@gmail.com

About the site: Cafe Toucan websites: QR menu (menu.toucan.cafe), review page (www.toucan.cafe/feedback), guest feedback form, Toucan Home Kitchen page with a request form, meal order forms (www.toucan.cafe and izishift.cc/forms/).

2. What data we process and why

• Server logs: IP address, date and time, requested page, browser (user agent).
  Security, protection against attacks and bots, troubleshooting.
  Legal basis: legitimate interests — Art. 6(1)(f) GDPR
• Guest feedback (feedback form): rating of service and food, comment text, optionally your contact (phone, e-mail or name), page language, browser details (user agent), IP address and time of sending.
  To improve our service, handle complaints and, if you wish, contact you. A comment is forwarded to the manager straight away.
  Legal basis: legitimate interests — Art. 6(1)(f) GDPR; contact details — your consent, Art. 6(1)(a)
• Requests and orders from forms (Toucan Home Kitchen, meal orders): name, contact (phone or Telegram), what you would like to order / chosen dishes, IP address and time of sending.
  To contact you, accept and fulfil the order.
  Legal basis: steps prior to a contract and performance of a contract — Art. 6(1)(b) GDPR
• Form protection against bots: IP address and the ALTCHA check solution (computed in your browser; the service is self-hosted, no third parties).
  To prevent spam and automated form submissions.
  Legal basis: legitimate interests — Art. 6(1)(f) GDPR
• Cookies / localStorage. Cookie Policy

3. Who receives the data

We do not sell personal data or share it for advertising. Data is received only by providers the site cannot run without:

• Hetzner Online GmbH (Germany) — hosting; servers in the EU (Germany, Finland).
• Telegram — internal notifications to our staff about new enquiries/messages (only the enquiry text is sent). Telegram is located outside the EEA.
• Google Fonts (Google Ireland Ltd) — page fonts are loaded from Google servers, so Google receives your IP address and browser details. Google Fonts sets no cookies.
• Google Maps / Google Reviews (Google Ireland Ltd) — only if you follow the “Leave a review on Google” link or open the map yourself; Google then processes data under its own policy. The map on the Toucan Home Kitchen page is loaded from Google servers only after you click “Show map” (or “Accept all” in the cookie banner).

4. How long we keep data

• Server logs — 14 days, then deleted automatically
• Feedback — up to 24 months
• Requests and orders — up to 24 months after the last contact; accounting records — 6 years under Cyprus law
• Per-IP submission counter — in server memory for up to 1 hour

5. Your rights

Under the GDPR you may: obtain a copy of your data; have it corrected; request erasure; restrict processing; object to processing based on legitimate interests; receive your data in a machine-readable format; and withdraw consent at any time (without affecting processing before withdrawal). Write to toucan.limassol@gmail.com — we reply within one month. You may also lodge a complaint with the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy) or with the supervisory authority of your country.

6. Security

The site is served over HTTPS only. Servers are located in the EU and accessed only by authorised staff using keys. Form data is never published and is not used for automated decision-making.

7. Children

The site is not intended for children under 16 and we do not knowingly collect their data.

8. Changes

We may update this policy; the current version is always on this page, with the date at the top.