Legal information

Privacy policy

Personal data processing via www.oyabun.eu

Last updated: 7 July 2026

The operator of personal data

The operator of personal data is OIABU S.R.L., a Romanian company based in Bucharest, registered at the Trade Registry Office under no. J2026016311006, having CUI 54222979 (hereinafter referred to as "Operator", "we" or "Restaurant").

Contact details:

Pursuant to Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data ("GDPR"), the Operator establishes this Policy regarding the processing of personal data collected through the website.

Purpose of this Policy

This Policy aims to inform website visitors and people who use the services available through it regarding:

  • categories of personal data processed;
  • the purposes for which these data are processed;
  • the legal grounds of the processing;
  • storage period;
  • recipients or categories of recipients of personal data;
  • the period for which the personal data will be stored or the criteria used to establish this period;
  • the rights of data subjects;
  • the manner of exercising these rights.

The protection of personal data is a priority for us and we make every effort to ensure that their processing complies with the requirements of the GDPR and applicable national legislation.

To the extent that the data is necessary for the provision of the requested services (for example, making a reservation), failure to provide them may lead to the impossibility of processing your request.

If certain information in this Policy is unclear or you consider that additional explanations are needed regarding how we process your personal data, you can contact us using the contact details indicated above.

What is personal data

Personal data is any information relating to an identified or identifiable natural person.

A person is considered identifiable if he can be identified, directly or indirectly, by reference to an identifying element such as his name, email address, telephone number, online identifiers, IP address or other elements specific to his identity.

All the definitions provided in art 4 of the Regulation are applied accordingly in this Policy.

To whom this Policy applies

This Policy applies to all people who use the website and the services made available through it, including:

  • website visitors;
  • to people making online reservations;
  • to people who send requests through the contact form;
  • to people who communicate with the Restaurant by e-mail or telephone;

The website is not intended for persons under the age of 18 and we do not knowingly collect personal data belonging to minors.

Data processed, purposes of processing, legal basis and storage period

Making and managing online bookings

Processed data

If you use the booking form available on the Website, we can process the following categories of personal data:

  • name and surname;
  • email address;
  • telephone number;
  • the date and time of the reservation;
  • the number of people;
  • any special requests entered by you in the dedicated field (for example, dining preferences, birthdays or other remarks).

Please do not enter in the comment field personal data that is not necessary for making the reservation, in particular health data or other special categories of data, unless it is strictly necessary for the provision of the requested service and you decide to communicate it to us.

Purpose of processing

The data is processed for:

  • registration and administration of the reservation;
  • booking confirmation;
  • contacting you in case of schedule or availability changes;
  • handling requests regarding the modification or cancellation of the reservation;
  • organization of the restaurant's activity.

The legal basis

The processing is necessary for carrying out the pre-contractual steps requested by the data subject and, as the case may be, for the execution of the contract concluded between you and the Operator, in accordance with art. 6 para. (1) lit. b) GDPR.

Storage period

Data related to reservations are kept for the period necessary to manage the reservation and thereafter for a maximum period of 3 years, in order to defend the rights of the Operator or to fulfill legal obligations.

Communication with users

Processed data

If you contact us via the contact form, email or phone, we may process:

  • name;
  • email address;
  • telephone number;
  • the content of the request;
  • any other information you choose to provide to us.

Purpose of processing

The data is processed for:

  • request identification;
  • communication of the answer;
  • providing the requested information;
  • handling complaints, suggestions or notifications.

The legal basis

Art. 6 para. (1) lit. b) GDPR, when the request concerns the conclusion or execution of a contract, art. 6 para. (1) lit. f) GDPR, representing the legitimate interest of the Operator to respond to requests received or art. 6 para. (1) lit. c) GDPR - fulfillment of legal obligations.

Storage period

Correspondence is kept, as a rule, for 3 years from the resolution of the request, except in cases where the law requires a different period.

Exercising the rights provided by the GDPR

Processed data

If you make a request regarding the exercise of the rights conferred by the GDPR, we can process:

  • name and surname;
  • contact details;
  • the information necessary to identify you;
  • the content of the request;
  • the supporting documents and the answers sent.

Purpose of processing

Management and resolution of requests regarding the exercise of the rights of data subjects.

The legal basis

Art. 6 para. (1) lit. c) GDPR - fulfillment of legal obligations.

Storage period

The documentation related to these requests is kept for 3 years after the final resolution of the request.

Improving services

We may use information regarding the way the Website is used, user feedback or other aggregated data to:

  • improving the services offered;
  • optimizing the functionality of the Website;
  • service quality assessment;
  • user experience development.

For this purpose, where possible, we use aggregated or anonymized data.

The legal basis

Art. 6 para. (1) lit. f) GDPR - the legitimate interest of the Operator.

Storage period

The data are kept only for the period necessary to fulfill these purposes.

Commercial communications (Newsletter)

Processed data

If you agree to receive commercial communications, we may process the following data:

  • name (if provided);
  • email address;
  • phone number (if you opt for communications via SMS or other similar channels).

Purpose of processing

The data are used for the transmission of commercial communications regarding:

  • events organized by the Restaurant;
  • special menus;
  • offers and promotions;
  • new products and services;
  • other information regarding the activity of the Restaurant.

We do not use automated decision-making processes or profiling for the purpose of sending commercial communications, except where they will be expressly presented.

The legal basis

Art. 6 para. (1) lit. a) GDPR - consent of the data subject.

Withdrawal of consent

Consent can be withdrawn at any time, without cost and without affecting the legality of the processing carried out prior to its withdrawal.

Consent can be withdrawn:

  • by accessing the "Unsubscribe" link in each newsletter;
  • by sending a request to the email address indicated in this Policy.

Storage period

The data is processed until the consent is withdrawn or until the end of the marketing campaigns for which it was collected, but no longer than 2 years.

Data collected through the use of the Website

When accessing the Website, certain information is collected automatically through the browser used and similar technologies (eg cookies).

This information may include:

  • IP address;
  • browser type and version;
  • operating system;
  • date and time of access;
  • pages visited;
  • the duration of the visit;
  • online identifiers generated by cookies;
  • other technical information necessary for the operation of the Website.

Operation of the Website

We process this data for:

  • the correct display of the Website;
  • ensuring the operation of the reservation service;
  • maintaining the user session;
  • prevention of technical errors;
  • improving the performance of the Website.

The legal basis

Art. 6 para. (1) lit. f) GDPR - the legitimate interest of the Operator to ensure the proper functioning and security of the Website.

For cookies that require consent, the legal basis is art. 6 para. (1) lit. a) GDPR.

Storage period

The data are kept for the duration necessary to fulfill the purposes for which they were collected, and in the case of cookies according to the periods indicated in the Cookie Policy.

Website Security

To prevent unauthorized access, detect fraud attempts and ensure the security of IT systems, we may process:

  • IP address;
  • information regarding the device used;
  • access logs (logs);
  • information on technical errors.

The legal basis

Art. 6 para. (1) lit. f) GDPR - the legitimate interest of the Operator to protect the Website and the IT infrastructure.

Storage period

Technical logs are usually kept for a period of up to 30 days, except when it is necessary to keep them to investigate security incidents or to fulfill legal obligations.

Cookies

The website uses cookies and similar technologies to:

  • the correct functioning of the Website;
  • remembering user preferences;
  • analyzing traffic and how to use the Website;
  • improving user experience;
  • providing the reservation service.

Full information on the types of cookies used, their purposes, storage duration and how to manage preferences is available in the Policy on the use of cookies, available on the Website.

Recipients of personal data

As a rule, we do not sell or rent your personal data to third parties.

However, in order to carry out our business and provide the requested services, we may transmit certain personal data to the following categories of recipients, only to the extent necessary:

  • Website hosting service providers;
  • providers of the online booking platform;
  • providers of IT maintenance and development services;
  • providers of electronic communication transmission services (e-mail, SMS, newsletter);
  • providers of IT security and analysis services;
  • legal, tax, auditors or other professional consultants, to the extent that access to the data is necessary for the provision of their services;
  • to public authorities and institutions, when the transmission of data is required by law;
  • courts or other competent authorities, in order to establish, exercise or defend a legal right.

In the situation where we use suppliers who process personal data on our behalf, they will act exclusively on the basis of our instructions and on the basis of contracts concluded in accordance with art. 28 of the GDPR.

The operator ensures that the authorized persons provide sufficient guarantees for the implementation of appropriate technical and organizational measures, so that the processing complies with the requirements of the GDPR and ensures the protection of the rights of the data subjects.

Data storage period

Personal data are kept only for the period necessary to fulfill the purposes for which they were collected, in compliance with the applicable legal obligations.

When determining the storage period, we mainly consider:

  • the nature and purpose of the processing;
  • the need to provide the requested services;
  • legal obligations regarding document archiving;
  • applicable statutes of limitations;
  • the need to defend the rights and legitimate interests of the Operator.

Storage periods specific to each processing operation are indicated in this Policy.

At the end of the retention periods, the data will be deleted, anonymized or securely destroyed, except where applicable law requires their retention for a longer period.

Data security

The operator implements appropriate technical and organizational measures to protect personal data against:

  • unauthorized access;
  • unauthorized disclosure;
  • accidental or illegal modification;
  • accidental destruction or loss;
  • unauthorized use.

For this purpose, we apply measures such as:

  • limiting access to data exclusively to authorized persons;
  • user authentication and access control to IT systems;
  • the use of secure connections and encryption measures where appropriate;
  • backups and restoration procedures;
  • IT infrastructure monitoring and cyber security measures implementation;
  • regular staff training on the protection of personal data;
  • entering into confidentiality and data processing agreements with relevant collaborators and suppliers.

Although we make all reasonable efforts to protect data, no computer system and no method of transmitting information over the Internet can guarantee absolute security.

Transfer of data outside the European Economic Area

In principle, personal data are processed and stored on the territory of the European Union or the European Economic Area.

In the event that, for the provision of certain services, it will be necessary to transfer data to recipients located outside the European Economic Area, this will only take place in compliance with the provisions of Chapter V of the GDPR and only if an adequate level of data protection is ensured.

Depending on the situation, the transfer will be made based on:

  • an adequacy decision adopted by the European Commission;
  • standard contractual clauses approved by the European Commission;
  • the binding corporate rules (Binding Corporate Rules), if they are applicable;
  • or any other transfer mechanism permitted by the GDPR.

Upon request, data subjects may obtain additional information on the safeguards applicable to international data transfers.

The rights of data subjects

Under the terms of the GDPR, you have the following rights regarding your personal data:

The right to information

You have the right to receive clear, transparent and easy-to-understand information about how we process your personal data. This Policy is intended to provide you with this information.

Right of access

You have the right to obtain confirmation that we are processing your personal data and, if so, to request access to it, as well as information regarding:

  • the purposes of the processing;
  • categories of processed data;
  • data recipients;
  • storage period;
  • the rights you benefit from.

The right to rectification

You have the right to request the correction of inaccurate data or the completion of incomplete data.

The right to data deletion

You have the right to request the deletion of your data in the situations provided for by the GDPR, including when:

  • the data are no longer necessary for the purposes for which they were collected;
  • you withdraw your consent and there is no other legal basis for the processing;
  • you object to the processing and there are no overriding legitimate grounds;
  • the data were processed illegally;
  • deletion is necessary to comply with a legal obligation.

This right is not absolute and can be limited in the situations provided by law.

The right to restriction of processing

You have the right to request the restriction of data processing in the cases provided for by the GDPR, including when:

  • dispute the accuracy of data;
  • you consider the processing to be unlawful;
  • the data are necessary for establishing, exercising or defending a right in court;
  • you have objected to the processing, until it is resolved.

The right to data portability

To the extent that the processing is based on consent or the execution of a contract and is carried out by automated means, you have the right to receive the data in a structured, commonly used and machine-readable format or to request its transmission to another operator, when this is technically feasible.

The right to opposition

You have the right to object, for reasons related to your particular situation, to processing based on the legitimate interest of the Operator.

You can also object at any time to the processing of your data for direct marketing purposes.

Right to withdraw consent

In situations where the processing is based on consent, it can be withdrawn at any time. The withdrawal of consent does not affect the legality of the processing carried out before its withdrawal.

The right not to be subject to a decision based solely on automated processing

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects on you or similarly affects you to a significant extent, except as provided by law.

As of the date of this Policy, the Website does not use such mechanisms.

Exercise of rights

To exercise any of the rights provided above, you can contact us using the following data:

Postal address: Strada Scarlătescu, No. 53, Bucharest, District 1

In order to protect personal data, we may request additional information to verify the identity of the applicant before processing the application.

We will respond to requests without undue delay and, in any case, within a maximum of one month from their receipt, with the possibility of extending the deadline under the conditions provided by the GDPR.

The right to file a complaint

If you consider that the processing of your personal data violates the applicable legal provisions, you have the right to file a complaint with the competent authority in the field of personal data protection or address the competent courts.

In Romania, the competent authority is:

The National Supervisory Authority for the Processing of Personal Data (ANSPDCP)

B-dul G-ral Gheorghe Magheru no. 28-30, Sector 1, Bucharest

Modification of the Policy

This Policy can be periodically updated to reflect legislative changes, changes in the Operator's activity or the implementation of new functionalities of the Website.

The updated version will be published on the Website, together with the date of the last revision.

We recommend that you periodically consult this Policy to be informed about how your personal data is processed.