Privacy policy
Who processes the data
The controller is the We Smoke Fish smokehouse in Chisinau. The same contacts answer requests about personal data.
What we collect
We collect only what it takes to bring the order to your door and to keep the records the law demands.
Phone number
- Confirming the order, the sign-in code by text message, the courier call before delivery and, for pickup, our call if anything about the order changes.
- Performance of a contract
- Until the account is deleted
Email address
- Signing in to the account and the written confirmation of the order.
- Performance of a contract
- Until the account is deleted
First and last name
- The courier or the shop assistant has to know whom the order goes to, and the payment document carries the same name.
- Performance of a contract
- Until the account is deleted
Date of birth
- Age check on orders containing beer: selling alcohol to minors is prohibited.
- Legal obligation
- Until the account is deleted
Delivery address
- The delivery itself and the fee per sector. A replaced address is deleted.
- Performance of a contract
- Until the account is deleted
Orders and payments
- Your order history, quality claims and bookkeeping.
- Legal obligation
- 5 years, as bookkeeping law requires
Technical request data
- The network address and request headers land in the server log: without them an attack cannot be stopped and a failure cannot be reconstructed.
- Legitimate interest
- 30 days
Browser errors
- The page, the build version and the error text. Nothing leaves the browser until you accept the analytics category.
- Consent
- 90 days
Email address for the newsletter
- Only if you subscribed from the site footer: news and offers from the smokehouse. To unsubscribe, write to the contacts below.
- Consent
- Until you unsubscribe
Photo of the parcel at handover
- Proof of delivery: the courier photographs the parcel at the door. Only the operator in the panel and the courier in the app can see it, when a claim is looked into.
- Legitimate interest
- Until the account is deleted
The courier's note at handover
- Whom and how the parcel was handed to, for instance “left with the neighbour at 12”, so that a claim can be answered.
- Legitimate interest
- Until the account is deleted
Where we get it
Almost all of it you tell us yourself: in the order form, at registration and in your account. The rest follows from the browser asking for a page — the network address and request headers, plus browser errors if you allow them. At handover, the photo of the parcel and the note come from the courier.
Who receives the data
We sell data to no one and hand none of it to advertising networks. It reaches only those without whom the order cannot be delivered.
- The courier
- Name, phone number and address, for the order being carried and no other.
- The hosting provider
- The servers the site and the database run on. Its access is technical and it does not use the data for its own ends.
- The text message provider
- The phone number, so that the sign-in code and the order notice arrive.
- The Expo notification service
- The phone's notification identifier — only if you use the app and allowed notifications. The notification text carries no address, phone number or amount.
- The Google maps service
- The address text you type and the coordinates of the point on the map, so that we can suggest the full address. The request leaves from our server, without your IP address.
- The language model provider
- Only in the operator panel assistant: the name, delivery address and amount of the order the operator asks about; the phone number leaves masked. The request does not carry the smokehouse's name.
- Public authorities
- Only upon a written request and only within the limits of the law.
The data is kept on servers inside the European Union. Outside it, it reaches only three recipients in the United States — the Google maps service, the Expo notification service and the language model provider — in the scope described above and under the safeguards the regulation requires for transfers to third countries. Should a new recipient appear, we publish a new edition of this policy and ask again for consent to the optional categories.
How long we keep it
Deleting the account does not delete the orders: bookkeeping law requires five years of them. Instead we strip them of identity — the name becomes anonymous, phone and email are emptied, delivery addresses are deleted.
Your rights
They come from Regulation (EU) 2016/679 and from Law no. 133/2011 of the Republic of Moldova.
- Access: what data we hold about you and what we do with it.
- Rectification: fixing a misspelled name or an old number.
- Erasure: the account goes, and the orders stay only as long as the law demands, stripped of identity.
- Restriction: pausing the processing while we look into an objection.
- Portability: a file with everything tied to your account.
- Objection: stopping the processing we run on our legitimate interest.
- Withdrawing consent to analytics and marketing, in one click, from the footer of any page; unsubscribing from the newsletter — by writing to the contacts below.
- A complaint to the supervisory authority if our answer does not satisfy you.
Write to us or call. We answer within 30 days at the latest, and if a request needs a longer check we say so in advance. Quote the phone number the order was placed with — otherwise we cannot verify who is asking.
You can also delete your account yourself — in the account settings on the website and in the app.
The supervisory authority in the Republic of Moldova is the National Centre for Personal Data Protection. If you live in the European Union you may also turn to the authority of your own country.
Deleting your account
You delete your WeSmokeFish account yourself, without contacting us:
- In the app: Profile → Settings → Delete account, then confirm.
- On the website: Account → Settings → Delete account.
- Or write or call us using the contacts below from the account’s phone number — we delete the account within 30 days.
Your name, phone number, email address, date of birth, delivery addresses, loyalty points and devices registered for notifications are deleted immediately. Orders are kept for five years as bookkeeping law requires, but stripped of identity: the name becomes anonymous, phone and email are emptied. Backups are overwritten within 30 days.
How we keep it safe
The connection is encrypted, passwords are stored as a fingerprint and are unreadable even to us, and staff access to the operator panel is limited by role. Phone numbers, email addresses and authorisation headers are scrubbed from the logs automatically.
Age
This site is not meant for children. Orders containing beer are handed over to adults only, and the courier may ask for identification.
Changes to this policy
Every edition carries a date. When something of substance changes — a new purpose, a new recipient, a new retention period — the date changes and consent to the optional categories is asked for again. A consent once given holds for six months.
Contact
For any request about personal data, write or call using the contacts below.
Contact
We Smoke FishȘoseaua Balcani 7B, MD-2049 Chișinău
+373 61 222 212 · wesmokefishmd@gmail.com