Privacy Policy

Effective: October 4, 2026

This policy explains what personal information Bite of Balkan collects, why, where it is kept, who helps us handle it, and the choices you have. We follow British Columbia's Personal Information Protection Act (PIPA). We do not sell personal information, and we do not use it for advertising.

Who we are

Bite of Balkan is a restaurant in Burnaby, British Columbia, operated by Bite of Balkan Kitchen Ltd., Example Street, Burnaby, BC V5H 2E2, Canada.

Our privacy contact is responsible for how we handle personal information. You can reach them at privacy@example.invalid.

What this policy covers

• The website biteofbalkan.ca.
• Messages you send us by email.
• Our own business accounts on Google, Facebook, Instagram and Clover, when we connect them to the tools we use to run the restaurant. The sections below explain exactly what each connection reads and keeps.

Website visitors

You can use the website without telling us who you are. There are no accounts or payments on it. The one form is the catering enquiry form, described below.

Cookies

We use Google Analytics to understand how people find and use the site: which pages are visited, roughly where visitors are (city level), and what device and browser they use. It uses cookies (named _ga and _ga_ followed by an identifier) that remember a browser between visits.

These cookies are set only if you choose "Allow analytics" in the banner shown on your first visit. If you choose "Decline", or make no choice, Google Analytics runs without cookies and without identifying your browser. You can change your choice at any time with Cookie settings at the bottom of every page.

Google Analytics does not log or store IP addresses. Analytics data is kept for 14 months and then deleted by Google. More about how Google handles it: How Google uses information from sites that use its services.

Website hosting

Like every website, ours is served by a hosting provider whose servers briefly record technical details of each request (such as the IP address and the page asked for) to deliver the page and protect against abuse. We do not use these records to identify anyone.

Catering enquiries

If you send us a catering enquiry, we use what you enter (your name, email address, phone number if you give one, the date of your event, the number of guests, the package you chose and your message) only to answer your enquiry. We email you an acknowledgement, and the owner and managers are told about it by email.

We keep an enquiry for 24 months. After that, your name, email address, phone number and message are removed, and only the event date, the number of guests and how the enquiry turned out remain, so we can count enquiries.

News and offers. The form has a box, unticked, that reads "Yes, email me Bite of Balkan news and offers. I can unsubscribe at any time." Only if you tick it do we keep a record of your consent: the box's words, when you ticked it, and the page it was on. We email news and offers only to people who ticked it, and you can unsubscribe at any time, from any such email or by writing to privacy@example.invalid.

Spam protection (Cloudflare Turnstile)

The catering form is protected by Cloudflare Turnstile, which checks that a person, not a program, is sending it. To do that, Cloudflare looks at technical details of your browser and connection (such as the IP address) when the form loads and when you send it. It is not used for advertising or to follow you across websites. More in Cloudflare's privacy policy.

Messages you send us

If you email us, we use your name, email address and message only to reply and to deal with what you asked. We keep them as long as needed for that, and delete them on request unless the law requires us to keep them.

Our connected business accounts

We connect the restaurant's own accounts to the tools we use to run it. These connections act for the restaurant only: they are not offered to the public, and nobody signs in to them except our staff.

Google Business Profile

This section applies when the restaurant connects its Google Business Profile to our tools.

What we access. Through Google's Business Profile service, for our own listing only:

• the profile itself: name, address, phone number, hours, special and holiday hours, description and categories;
• our posts, and the photos and videos on the listing;
• the reviews customers leave on the listing, including the reviewer's public name and profile photo as Google shows them, and our replies;
• performance figures Google provides about the listing, such as views, searches, calls and direction requests, as totals.

Why. To keep our hours, closures and details correct on Google, to publish updates, to read and reply to reviews, and to see how the listing is doing.

How it is kept. The access Google grants us is stored encrypted. Copies of profile details, posts, reviews and figures are kept in our database (see Service providers below) so our team can work with them. We do not share this information with anyone, sell it, or use it for advertising.

How long. For as long as the listing is connected. When it is disconnected, our access is destroyed at once, and the stored copies are deleted within 30 days.

Turning it off. The listing's owner can remove our access at any time from their Google Account (how to remove an app's access), or ask us to disconnect it.

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Facebook and Instagram (Meta)

This section applies when the restaurant connects its Facebook Page and Instagram account to our tools.

What we access. For the restaurant's own Facebook Page and Instagram account only:

• the access Meta grants us to the Page and the Instagram account (access tokens);
• the identifiers of the posts we publish;
• comments on our posts, including the commenter's public name as Meta shows it;
• insights Meta provides about our Page and posts, such as reach and engagement, as totals.

Why. To publish the restaurant's posts and promotions to Facebook and Instagram, to see and reply to comments on them, and to measure how they perform.

How it is kept. Access tokens are stored encrypted. Post identifiers, comments and insights are kept in our database (see Service providers below). We do not share this information with anyone, sell it, or use it for advertising.

How long. For as long as the Page and account are connected. When they are disconnected, our access is destroyed at once, and post identifiers, comments and insights are deleted within 30 days.

Deleting it. Step-by-step instructions, including how a Page admin removes our access on Facebook and Instagram, are on our Data Deletion page.

Clover

What we access. From the restaurant's own Clover point-of-sale account:

• menu items, prices and availability, read only: we never change anything in Clover;
• in a later version, order totals (amounts and times) to understand sales. This will be added to this policy before it starts.

What we do not access. No customer data: no names, contact details, payment cards or customer histories are requested or stored.

How it is kept. The access Clover grants us is stored encrypted in the database of the service that connects to Clover. Disconnecting Clover destroys it at once.

Service providers

These companies process information on our behalf, only to provide their service to us and under their own privacy and security commitments.

Where information is stored

Some of our service providers store information in the United States, where it may be accessible to authorities under the laws of that country. We choose providers that protect it, and we keep only what we need.

How long we keep information

• Website analytics: 14 months, then deleted by Google.
• Emails: as long as needed to deal with them, then deleted.
• Catering enquiries: 24 months, then your name, email address, phone number and message are removed. A record of consent to news and offers is kept while you're subscribed.
• Google, Facebook, Instagram and Clover access: until disconnected, then destroyed at once.
• Copies of profile details, posts, comments, reviews and figures: until disconnected, then deleted within 30 days.

How we protect information

Access to our accounts and tools is limited to the people who need it. Connection access (tokens) is encrypted, information travels over encrypted connections, and every change in our tools is recorded.

Your rights

Under PIPA you can ask to see the personal information we hold about you, ask us to correct it, and withdraw your consent to our using it. Write to privacy@example.invalid; we will respond within 30 days. To have information deleted, see our Data Deletion page.

If you are not satisfied with our answer, you can contact the Office of the Information and Privacy Commissioner for British Columbia.

Children

The website is not directed at children, and we do not knowingly collect personal information from anyone under 13.

Changes to this policy

If we change this policy, we will update it here and change the effective date at the top. If a change affects information we already hold, we will say so before it applies.

Contact

Privacy questions and requests: privacy@example.invalid

Bite of Balkan Kitchen Ltd., Example Street, Burnaby, BC V5H 2E2, Canada