Privacy policy

This Privacy Policy summarizes the key points regarding the protection of your personal data and how we process it. If you would like more information about specific processes, you can contact us using the details provided below.

Who are we?
“Delivery BG” Ltd. provides food and beverage delivery services from the menus of restaurant chains operating under the “Brunch Box,” “Wok to Walk,” (hereinafter collectively referred to in this Privacy Policy as the “Restaurants”).
As an established home food delivery provider we are committed to protecting the privacy of everyone in our community. This means we will protect the personal information of all visitors who access our websites or services through any mobile application, platform, or device.

“Delivery BG” Ltd. is a company registered in the Commercial Register at the Registry Agency with UIC 207874602, with its registered office and address of management at: Sofia, “Ovcha Kupel“, 12 , 692 Street , phone: 02/ 434 33 33, email:brunchboxbg@gmail.com. The company is a data controller pursuant to the provisions of the Personal Data Protection Act.

How to contact us?
Correspondence address: Sofia, “Ovcha Kupel“, 12 , 692 Street , phone: 02/ 434 33 33, email: brunchboxbg@gmail.com

Data protection and information security are an integral part of our corporate culture and policy.

What information can I find in this Privacy Policy?
This Privacy Policy will provide you with comprehensive information, in clear and accessible language, about what actions are taken with the personal data you provide to “Delivery BG” Ltd. (hereinafter referred to as “Brunch Box”), including:

What personal data do we collect about you? Are you required to provide your personal data? Can you use our services without providing personal data?
What is the purpose of collecting this data?
For how long do we store the provided personal data?
With whom do we share your personal data?
Do we use automated decision-making or artificial intelligence?
How do we inform you of changes to our Privacy Policy?
What types of cookies do we use to enhance your experience on our website?
What are your rights regarding the personal data you provide?
With this Privacy Policy, “Delivery BG” Ltd. declares that it applies all technical and organizational measures for the protection of personal data of individuals, as prescribed by applicable national and European legislation.

What is personal data?
Personal data is any information through which an individual can be identified – directly or indirectly.
This includes, for example: name, personal identification number (EGN), foreigner’s personal number (LNC), or another unique identifier;
Contact details – email address, phone number, physical address;
Online identifiers – username, IP address, etc.
Some data may not identify you directly (e.g., a phone number), but when combined with other information – such as a name or username – your identity could be established.
Direct identification occurs when a unique identifier such as an EGN or LNC is provided.

What personal data does Brunch Box collect about you and for what purposes?

To provide you with effective access to our services, Brunch Box collects information and personal data about you. Below are the types of personal data we collect and the purposes for which we process this data:

Information voluntarily provided during registration:
The information you fill out when registering and creating a profile at
https://www.brunchbox.bg/
includes: first and last name, mobile phone number, email address, and a password of your choice.
Brunch Box collects this information in order to:

Create your profile so you can place orders in accordance with our Terms;
Identify you when you log into your account;
Contact you to fulfill the services we offer; and
Notify you of changes or updates to our Terms and Privacy Policy.
Information required to place an order:
The minimum information necessary to place an order via our call center includes: first and last name, mobile phone number, city, delivery address, and the items you wish to order.
Please note that all calls are recorded, and therefore, voice data of the participants, including yours, is processed and stored.

When you place an order through our website brunchbox.bg, the data collected includes: first and last name, mobile phone number, email address, city, delivery address, and ordered items. In this case, the order itself is not recorded, but we may still process voice data if our delivery staff needs to contact you for locating the address or clarifying order details (this call will also be recorded).

Transaction data when placing an order from a restaurant, for the following purposes:

To process your order and issue an invoice/charge you (please note that Brunch Box never stores your credit/debit card information in our systems);
To communicate your order to the restaurant;
To send you updates on the status of your order;
To respond to your inquiries and resolve potential issues related to your orders;
To conduct analysis and research to improve our Services; and
To protect you and our Services by attempting to detect and prevent fraud or actions that violate our Terms or policies related to Brunch Box Services.
This information includes the date and time of payment, card issuer, corresponding bank, transaction reference number, amount paid, name and surname of the payer, and name of the merchant.
Order history and feedback information:
We use your order history information to:
Send you personalized marketing and promotional messages related to our delivery services, including the foods, beverages, and hospitality services offered by the Restaurants, which may be of interest to you.

We use the feedback you provide in order to:

Respond to your questions or inquiries;
Publish your reviews of our services, only with your explicit consent;
Conduct analysis and research to improve and develop our services.
You provide this information after logging into your user profile on the website brunchbox.bg. Within your profile, you can update preferences and manage consents for marketing and other purposes.

Information about Your Activities and Use of Our Services

We collect data on your activity and behavior when using our services in order to:

Provide you with a better experience when using our services;
Grant you access to the history and details of past orders;
Offer you other services at your request.
This information relates to your personal preferences and user behavior on the Brunch Box Website.
Information from Cookies and Similar Technologies

We use cookies and similar technologies to:

Measure and analyze the usage and effectiveness of our services;
Personalize and optimize advertising targeting for our services on other websites and platforms; and
Provide location-based services, if you choose to share your geolocation.
This data is collected based on your selection of which cookies are enabled.
Information Received from Other Sources – Third Parties

Analytical reports derived from analysis and research of our marketing activities to measure the effectiveness of our campaigns;
A better understanding of your preferences so that we can tailor our marketing campaigns and Services to your interests.
Types and Categories of Personal Data We Process

We process the following types of commonly used personal data:

Name, surname, telephone number, email address, date of birth, place of residence, delivery address – provided through various forms on our website for initial registration, subscription to newsletters/marketing communications, or inquiry submissions;
Transaction status when paying by bank card (successful/unsuccessful);
Information about your orders;
Technical data automatically sent to us when using our services via our website – IP address, device information;
Cookie data – to identify your browser or device.
Sensitive Personal Data

We do not proactively collect sensitive personal data, such as information related to your health. However, our platform contains free-text fields where you may voluntarily provide preferences related to food – such as allergies or dietary restrictions. Please note that the data you choose to share in these fields may reveal details classified under current legislation as "special categories of personal data" (sensitive data).
If such data becomes available to us, we will not use it for marketing or targeted advertising purposes.
Additionally, some platform features may request access to your precise location (geolocation) via your device or browser settings. Such access will only occur with your explicit consent.
Processing of sensitive data that you voluntarily provide is based on your explicit consent, which you may withdraw at any time by contacting us using the contact details provided at the beginning of this policy.

What Does “Processing of Personal Data” Mean?

Processing personal data includes the collection, storage, destruction, transfer, correction, updating, deletion, and all other actions performed on your personal data.

Why Does Brunch Box Process Your Personal Data (Legal Basis)?

The legal basis for collecting and using your personal data depends on the specific context in which it is collected.

The primary reason for collecting and processing your personal data is to perform our contract with you (i.e., to ensure the delivery of your order to the address and quantity you specified).
We may also process your data based on our legitimate business interests – but only when these do not override your own interests or fundamental rights and freedoms.
In some cases, we may have a legal obligation to collect data (e.g., to comply with laws governing the food service industry), or we may process it to protect your vital interests or those of another individual.

If we request your personal data to comply with legal requirements or to enter into a contract, we will inform you of this at the appropriate time, and clarify whether the provision of your data is mandatory, as well as the possible consequences of not providing it.
If we rely on legitimate interests (ours or those of a third party), we will inform you about them at the relevant time.

If you have any questions or need more information regarding the legal basis for our processing of your data, please contact us using the details listed under "How to Contact Us" above.

Consent-Based Data Processing

Brunch Box also collects and processes personal data based on your explicit, clear, freely given, and unambiguous consent.

For example, with your consent, Brunch Box may use the data you provide for marketing purposes – to send you the latest promotions and other marketing or advertising communications, news, updates, promo codes, and special offers related to our delivery services, including food, drinks, and hospitality services offered at the Restaurants.
Please note that your agreement with this Privacy Policy does not constitute consent for marketing purposes.
To enable such use of your data, you must give separate explicit consent by checking a specially designated box on our website, application, or through another appropriate method.

You may withdraw your consent at any time by emailing brunchboxbg@gmail.com or by submitting a written request to our correspondence address: Sofia, “Ovcha Kupel, 12 “692” Street.

Withdrawal of consent may apply to one or more purposes. For example, if you withdraw your consent to receive marketing messages, your contact information will still be used for maintaining your user profile and processing your orders, based on contractual grounds.

If you request deletion of data necessary for maintaining your user account, your profile will be deleted. To use our services again, you will need to provide your data anew.

How Do We Receive and Process Your Data?

To deliver products and services, Brunch Box processes the personal data you provide regarding your physical and economic identity through:

Forms you complete on our website;
Visits to the website
https://www.brunchbox.bg/
;
Updating your data via a form (in paper or digital format);
Use of online identifiers, such as IP addresses, cookie data, operating system, and browser type;
Newsletter subscriptions via email.
Email / Newsletter

When subscribing to our email newsletter, you will be asked to provide your email address. To manage newsletter distribution, we maintain a log of your IP address, emails you open, and links you click – allowing us to recommend content and special third-party offers more accurately.
We will never sell or disclose your personal data, including email, to third parties. However, if you participate in a prize draw, your email may be shared with the respective provider for activation and support purposes.
We will never ask for your credit card details for newsletter or advertising purposes. If you receive such a request, it is most likely a scam, and you are advised not to open or respond to it.

Artificial Intelligence (AI)

To stay up to date with modern trends, we may implement technologies based on artificial intelligence (AI).

Any use of AI tools/features will fully comply with applicable data protection laws, including the General Data Protection Regulation (GDPR).
We apply appropriate technical and organizational measures to protect your information and ensure transparency.
You have the right to object to profiling by AI tools or to exercise any other data protection rights at any time, in accordance with this Privacy Policy and applicable law.

Call Center

When placing an order via our call center, we collect the following data: your name, phone number, delivery address, and your voice (voice alone may not suffice to identify you).
All calls are recorded and retained by Brunch Box for up to 6 months for order fulfillment and to ensure accurate and timely service.

If you do not wish to be recorded, please do not initiate or accept calls. However, this may prevent us from processing your order.

Data Retention Period

Brunch Box will retain your personal data only as long as necessary to fulfill the purposes described in this Privacy Policy.
The retention period depends on the legal basis for processing:

If data is processed for contractual obligations – up to 5 years after the contract is no longer in force;
If data is processed for legitimate interest – until the interest ceases to exist;
If data is processed to comply with legal obligations – for the period defined by the applicable legislation.
After the relevant period, and if no legal basis remains, your data will be deleted from our systems.

User Profile and Data Retention

When you provide your personal data for the purpose of creating a user profile on our website, or elsewhere, we consider that you have an interest in us retaining this data until you choose to delete or deactivate your account.
We may also retain certain elements of your personal information for a period after your profile has been deleted or deactivated for legitimate business operations such as record-keeping and compliance with our legal obligations. In all such cases, data will be retained in accordance with applicable legislation.

If you have given your consent for your data to be used for receiving marketing or promotional messages, we will process this data for that purpose until you withdraw your consent. To ensure that your consent remains valid and freely given, we will remind you every 5 years and ask for active reconfirmation if you wish to renew it.

Who May Receive Your Personal Data?

Brunch Box does not share your personal data for purposes other than fulfilling contractual rights and obligations with third parties, and does not sell its databases.

Brunch Box uses software solutions and service providers to support its services. We may share limited personal data with these partners strictly for the purpose of performing contractual obligations – for example, address data may be entered into platforms used to generate and optimize delivery routes.

Brunch Box may share your personal data with the following recipients (in each case, appropriate safeguards and contractual protections will be in place to protect your data):

Partner companies managing the Restaurants where your orders are fulfilled;
Companies within the Brunch Box corporate group;
Third-party service providers who support our services (e.g. marketing or promotional partners in the food, beverage, and entertainment sectors based on your preferences, if there is a valid legal basis and your rights are not overridden; courier services; web hosting providers);
Any law enforcement, regulatory authority, government agency, court, or other third party when such disclosure is required by applicable laws or regulations;
New owners or reorganized entities in the event of a restructuring, sale, acquisition, or joint venture affecting our business;
Any other party, provided you have given your explicit consent.
Under no circumstances will we sell, distribute, or otherwise share your personal information without your explicit permission.
Other Cases Where We May Share Your Personal Data

Your personal data may also be shared with third parties in the following situations:

At your request, as the data subject (i.e., you submit a request to us);
At the request of competent authorities in accordance with the laws of the Republic of Bulgaria and the European Union.
In all such cases, recipients of your personal data will be required to provide an adequate level of data protection, including foreign entities located within the EU and EEA. For companies located outside the EU and EEA, appropriate safeguards will be ensured in accordance with EU legislation.

Use of Cookies

General Information
Cookies are small text files stored on your device when you visit our website. For more information, please refer to our Cookie Policy.

What Are Your Rights Regarding Your Personal Data?

If you are a registered Brunch Box user, you can access your account at any time to review and update your personal information. You may also contact us to request the updating or deletion of your data, or to request a restriction on its processing.

You also have the right to unsubscribe from marketing messages we send you at any time by using the unsubscribe link in any communication or by emailing us at brunchboxbg@gmail.com.

In accordance with Bulgarian and European legislation, including the General Data Protection Regulation (EU) 2016/679, you have the following rights:

Right of access to the personal data we hold about you and to request a copy of it;
Right to rectification of inaccurate or outdated data by emailing brunchboxbg@gmail.com;
Right to restriction of processing under the conditions specified by law or regulation;
Right to erasure ("right to be forgotten"), if applicable legal grounds exist;
Right to object to the processing of your data, particularly for direct marketing – including using the unsubscribe link in our marketing emails;
Right to withdraw consent at any time regarding the processing of your data for marketing or other purposes, by emailing us at brunchboxbg@gmail.com;
Right not to be subject to automated decision-making, including profiling, that significantly affects you;
Right to object to data sharing with third parties, which you can do from your user account by unchecking the relevant option;
Right to data portability, to receive your personal data in a structured, commonly used, and machine-readable format;
Right to file a complaint with us or the supervisory authority – the Commission for Personal Data Protection – if you believe your rights under GDPR have been violated.
You may exercise these rights at any time during the data processing lifecycle.

Are You Required to Provide Your Personal Data?

We require certain personal data in order to provide our products and services. Some data is also processed in compliance with legal obligations.
If you refuse to provide the necessary personal data, Brunch Box may be unable to deliver the products or services you request – for example, we will not be able to complete a food delivery order.

Changes to the Privacy Policy

We may update this Privacy Policy from time to time in response to legal, technical, or business developments.
We encourage you to review this page periodically to stay informed of the latest version of our Privacy Policy. The date of the most recent update is listed below.
If we make significant changes – such as introducing new data processing purposes or requiring renewed consent – we will notify you by email using the contact address you provided.

These Privacy Policies are adopted by Delivery BG Ltd. and have been in effect since May 05, 2021.