Legal information
Privacy policy
At Lucca Gelato we process your personal data in line with the laws of the Republic of North Macedonia, in particular the Law on Personal Data Protection (Закон за заштита на личните податоци, Official Gazette 42/2020, amended 294/2021 and 101/2025). This notice explains what data we process, why and for how long, and what your rights are.
Data controller
The data controller is Lucca Gelato. Address: Boris Kidric, 1230 Gostivar, North Macedonia. Contact: the business address and contact page.
You can reach us directly at these addresses with any request about your personal data.
Where your data is stored
All data created on this website, in the QR menu and in the till system is stored on the business's own server (Lucca Gelato).
The website and till software run on the AdiyoPOS platform. AdiyoPOS (Esfamos Software) provides only the software and technical support; customer data of Lucca Gelato is not stored on AdiyoPOS servers. To keep the software up to date and healthy, only technical status information (software version, error logs, business name and menu list) is sent to AdiyoPOS, and it contains no customer personal data.
If there is a problem with the system, the AdiyoPOS support team can access it only with time-limited permission granted by Lucca Gelato, and only as far as needed to fix the problem. In that case AdiyoPOS acts as a processor on behalf of and on the instructions of Lucca Gelato.
What data we process and why
- When you visit the site: IP address, browser and device information, the page requested. Purpose: keeping the site secure and working and preventing abuse. Legal basis: legitimate interest.
- Site statistics: without cookies, aggregate counts that do not identify you (page visited, referring site, device type, language). If you consent, a random visitor ID to recognise you on your next visit. Legal basis: legitimate interest for aggregate counts, your consent for cookies.
- Table ordering via the QR menu: table, order contents, your note and name if you give them, a temporary cookie that recognises the device the order came from. Purpose: taking, preparing and settling your order. Legal basis: performance of a contract.
- Reservations: name, phone, email, party size, date and time, note and the IP address of the request. Purpose: creating the booking, contacting you and preventing fake requests. Legal basis: pre-contractual steps and legitimate interest.
- Loyalty programme: phone, name, points and purchase history. Campaign messages are sent only if you give separate consent. Legal basis: performance of a contract; consent for campaign messages.
- Online payments: amount and payment status. Your card details are processed directly by the payment institution and never reach us. Legal basis: performance of a contract and legal obligation.
- Ratings and feedback: the score and comment you give. Purpose: improving our service. Legal basis: legitimate interest.
- Contact by phone, WhatsApp or email: what you write to us. Purpose: answering your request. Legal basis: legitimate interest or contract.
- Sales and accounting records: receipt and invoice details. Legal basis: legal obligation under tax and accounting law.
How long we keep data
- QR table device cookie: up to 6 hours.
- Reservations and online payment records: 13 months from creation.
- Ratings: 12 months.
- Site statistics: detailed records 13 months, then aggregate counts only.
- Loyalty membership: while the membership lasts; deleted immediately on your request.
- Receipts, invoices and accounting records: for as long as North Macedonian tax and accounting law requires.
- Security logs: until no longer needed for security, at most 90 days.
Who receives data
We do not sell your data or share it with others for marketing. It may be passed to the following parties only where needed to provide the service:
- Our email service provider (reservation verification and notification emails).
- The payment institution (if you choose to pay online).
- AdiyoPOS (Esfamos Software), only during technical support and as a processor.
- Google (maps, fonts; Google Analytics with your consent) and Meta (Meta Pixel with your consent). These services may process data in the European Union or the United States; transfers are made with the safeguards required by the applicable law.
- Public authorities empowered by law, when there is a lawful request.
Your rights
Under the Law on Personal Data Protection (Закон за заштита на личните податоци, Official Gazette 42/2020, amended 294/2021 and 101/2025) you have the right to:
- find out whether your data is processed and request a copy,
- have inaccurate or incomplete data corrected,
- have your data erased,
- restrict processing,
- receive your data in a commonly used format (portability),
- object to processing based on legitimate interest and to direct marketing,
- withdraw your consent at any time (this does not affect the lawfulness of earlier processing),
- not be subject to decisions based solely on automated processing.
Send your request via the business address and contact page; we reply within one month. If you are not satisfied with our reply, you can lodge a complaint with the Personal Data Protection Agency (Агенција за заштита на личните податоци), Bulevar Goce Delčev 18, 1000 Skopje, www.azlp.mk.
Children
Where consent is required, we process personal data of children under 14 only with the consent of a parent or legal guardian.
Security
The site runs over an encrypted connection (HTTPS). Staff access is protected with personal accounts, permission levels and two-step verification; passwords are stored encrypted and backups are taken regularly. If a breach affects your personal data, we notify the Agency within 72 hours and, where required, you as well.
Changes
We may update this policy when the law or our services change. Last updated: 26 October 2026.