Privacy Policy

1. Data Controller

Restoran Tri OÜ (registry code 11683114), which runs Restaurant Moon
Telliskivi 60/4, 10412 Tallinn, Estonia
Email: moon@restoranmoon.ee
Phone: +372 6 314 575

2. Data We Collect

• Reservation data: name, email, phone number, date and time, number of guests, special requests (incl. allergy and diet info).
• Contact form data: name, email, subject, message content.
• Group booking inquiry data: name, email, phone, event date, number of guests, event type, use of the room, catering preference, budget indication, entertainment wishes, message.
• Newsletter data: email address.
• Gift card purchases: the buyer's email, the recipient's name and email, the gift message, and for a company invoice the company name, registry code and VAT number. Card details are entered on Stripe's payment page and never reach us.
• Cookies and analytics: device and browser details, pages viewed, clicks and scrolling, approximate location (Google Analytics 4, Google Tag Manager, Microsoft Clarity). Google Analytics does not store your IP address.
• Job application data: CV, cover letter, contact details.

3. Purposes of Processing

• Table reservation and management (via DinnerBooking).
• Selling and delivering gift cards, and issuing company invoices.
• Protecting our forms from automated abuse.
• Customer service and responding to inquiries.
• Newsletter (consent-based only).
• Website usage statistics and UX improvement.
• Marketing and advertising (consent-based only).
• Recruitment.

4. Legal Basis

• Consent – newsletter, analytics cookies, marketing cookies.
• Contract performance – reservation management, group event organisation, gift card sales.
• Legitimate interest – protecting forms from bots, making sure inquiries are delivered.
• Legal obligation – accounting and tax obligations (gift card sales and invoices).

5. Data Sharing

We share your data only with the following partners:

• DinnerBooking – reservation management.
• Smaily (AS Sendsmaily) – email delivery, in two separate roles. Newsletter: your address is passed to Smaily's mailing-list service only if you tick the newsletter consent box, and every newsletter carries an unsubscribe link. Inquiry forms: when you send a contact or group booking inquiry, its contents are delivered to our own staff mailbox through Smaily's transactional email service. That is delivery only — sending an inquiry does not add you to any mailing list, and inquiry data is never used for marketing.
• Google – Tag Manager; analytics (Google Analytics 4) with analytics consent; advertising measurement and remarketing (Google Ads, which is linked to our Google Analytics) with marketing consent. Embedded content: the map on the contact page (Google Maps) and the videos on the careers page (YouTube, privacy-enhanced mode) load from Google when you open those pages, so Google receives your IP address and browser details.
• Meta (Facebook) – a video embedded in one news article loads from Facebook when you open that article, so Meta receives your IP address and browser details and may set its own cookies. We do not use the Meta Pixel.
• Microsoft – Clarity, which records how pages are used (clicks, scrolling, mouse movement) so we can improve the site, with analytics consent. Text in the gift card purchase flow and gift card numbers are masked from these recordings.
• Stripe – gift card payments.
• CompuCash – our point-of-sale system, which issues the gift card and, for companies, the invoice.
• Supabase – the website's database and server functions (gift card orders, the temporary inquiry copy below).
• Cloudflare – Turnstile, which checks that a form is sent by a person and not a bot.

Some of these providers are based outside the European Economic Area. Such transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

We do not sell or rent your personal data to third parties.

6. Cookies

We use cookies according to your consent. Exceptions: the embedded Google map on the contact page and the Facebook video in one news article load with the page and may set their providers’ own cookies. You can manage cookie preferences via our cookie notice. Categories:

• Necessary – essential site functions, including remembering your cookie choice and completing a gift card purchase (always active).
• Analytics cookies – usage statistics (Google Analytics, Microsoft Clarity).
• Marketing cookies – advertising measurement and remarketing (Google Ads).

We use Google Consent Mode. Without your consent, Google tags set no cookies and send only signals without identifiers, which Google uses for aggregate statistics.

7. Data Retention

• Reservation data: up to 2 years after last visit.
• Newsletter data: until unsubscribed.
• Analytics data: 14 months (our Google Analytics setting).
• Gift card orders and invoices: for as long as the Accounting Act requires.
• Job application data: up to 6 months after the end of the recruitment process.
• Inquiry form data (contact, group booking): held in the staff mailbox it was delivered to, and reviewed at least annually.
• A temporary copy, so your inquiry is not lost: when you press send, we store what you wrote on our own server before handing it to the email provider. This is so that if the delivery fails, we can send it again ourselves instead of asking you to type it a second time. If delivery succeeds, that copy is deleted within 24 hours. If delivery fails or its outcome is unclear, it is kept while we retry and investigate, and never longer than 7 days. Deletion is automatic and runs every minute. Only our servers can read this copy.
• Inquiry delivery records: to make sure one inquiry is never delivered twice, we keep a technical record of each submission after the copy above is deleted. It contains which form was used, the language, which topic you selected, timestamps, delivery outcome and retry counts, plus a one-way keyed hash of the content — not your name, address, phone number or message, which cannot be reconstructed from it. We keep these longer, to measure whether our forms are technically reliable.

8. Your Rights

Under GDPR you have the right to:

• View your personal data.
• Request correction or deletion.
• Restrict processing.
• Object to processing.
• Request data portability.
• Withdraw consent (this does not affect data processed on the basis of consent given before the withdrawal).

For inquiries: moon@restoranmoon.ee

9. Data Protection Authority

If you believe your rights have been violated, you have the right to file a complaint:
Estonian Data Protection Inspectorate
Tatari 39, 10134 Tallinn
www.aki.ee

10. Changes

We reserve the right to update this privacy policy from time to time. Significant changes will be communicated on our website.