Privacy Policy

Enso Izakaya is the data controller for the personal data described in this policy.

Address: Jernbanegade 26 st tv, 3480 Fredensborg, Danmark
CVR: 45996565
Email: info@enso-izakaya.dk
Phone: +45 53691888

We collect the information you provide when you create an account, sign in, place an order, make a reservation, update your profile, or contact us. This can include your name, email address, phone number, account details, reservation details, order details, delivery or invoice details, company name, Danish CVR number, company address, notes you add to an order or reservation, and customer support messages.

If you use Google sign-in, we receive basic profile information from Google, such as your name, email address, profile image, and Google account identifier where provided by Google. We use this to create or access your restaurant account.

We also process technical information needed to run and secure the website, such as session information, device/browser information, timestamps, security logs, and payment or checkout references.

We use personal data to:

• create and manage your account;
• process orders, reservations, payments, refunds, and receipts;
• send order, reservation, verification, and password reset emails;
• provide customer support and respond to requests;
• maintain security, prevent fraud, and protect our systems;
• meet accounting, tax, food safety, and legal obligations;
• improve restaurant operations and website reliability.

When SMS is enabled, Enso / Square Circle ApS uses your Danish phone number for account verification, SMS sign-in and order messages. GatewayAPI (ONLINECITY.IO) and relevant telecom operators process the number and message to provide delivery. These are service messages, not marketing. Account security relies on our legitimate interest in protecting accounts; order messages support performance of your order. Codes expire after five minutes. Local challenge data is removed after 24 hours; SMS status and pseudonymised abuse/budget records after 90 days. Your verified number is retained with your account. Contact us to request access, correction or deletion, or to object to processing based on legitimate interests. See also Rights and International transfers.

For SMS sign-in, we use the verified phone number to create a customer account if needed, after you accept the terms and successfully verify the code. We record the sign-in and associate orders placed during it with that sign-in, so a later sign-in using the same phone number does not reveal those orders or previous account information. SMS alone cannot reset an existing account password. You may optionally verify an email for orders you can currently access; this creates access to those specific orders without changing an existing account email or revealing other orders. For an account created by the current SMS sign-in, optional verified account email setup can also link that account and its current orders, or merge it into an independently verified existing customer email account after explicit confirmation. The retained account uses the currently SMS-verified phone; superseded phone bindings and sessions are revoked, and the duplicate account is disabled with an audit record.

We process data where it is necessary to perform a contract with you, for example to handle orders, reservations, accounts, and payments. We process some data to comply with legal obligations, including bookkeeping, tax, and regulatory duties. We also process data based on legitimate interests, such as keeping the website secure, helping customers, improving operations, and preventing misuse. Where we ask for consent, you can withdraw it at any time.

We only share personal data when needed to provide the service, run the business, or comply with law. Recipients can include hosting and database providers, email delivery providers, payment providers, delivery or pickup service providers where relevant, accounting or professional advisers, authorities where legally required, and Google when you choose Google sign-in.

We send your street, postcode and city to Google Maps to check the address and calculate your delivery price.

We do not sell your personal data.

We use Cloudflare Turnstile to protect SMS sign-in and password recovery from automated abuse. Technical browser and device signals are processed for this security check. See the Cloudflare Turnstile Privacy Addendum.

Some service providers may process data outside Denmark or the European Economic Area. Where this happens, we use appropriate safeguards required by data protection law, such as EU adequacy decisions, EU Standard Contractual Clauses, or equivalent protective measures.

We keep personal data only for as long as needed for the purposes described above, unless a longer period is required by law, accounting rules, tax rules, dispute handling, fraud prevention, or legal claims.

• Account and profile data is generally kept while your account is active. If you ask us to delete your account, we delete or anonymize account profile data unless we must keep specific information for legal reasons.
• We keep order and reservation contact details, notes, and operational history in identifiable form for up to 6 months so we can provide customer support, handle changes, investigate disputes, and run the restaurant.
• To help staff enter repeat telephone orders, we keep a separate contact directory containing your name, Danish phone number and last order date. This relies on our legitimate interest in convenient customer service and is not used for marketing or customer profiling. Staff can find a suggested name by entering the complete phone number. Each name/number entry expires six calendar months after the last new order; another order restarts that period, but a lookup does not. Expired entries stop appearing immediately and are deleted in the next daily cleanup, subject to recovery after service outages. You can contact us to request removal or object to this use. This directory is separate from login accounts and legally required financial records.
• Payment, invoice, receipt, fiscal, tax, and bookkeeping records may be kept for the period required by Danish accounting and tax law. These records may include limited references such as order numbers, dates, totals, VAT, payment or refund references, and fiscal receipt references.
• Security logs, session records, and technical diagnostics are kept for a limited period unless they are needed to investigate misuse, fraud, security incidents, or legal claims.
• After the operational retention period, we delete or anonymize identifiable operational data, or keep only the minimum references needed for accounting, fiscal, audit, or legal purposes.

Under EU data protection law, you may have the right to request access to your personal data, correction of inaccurate data, deletion of data, restriction of processing, objection to processing, data portability, and withdrawal of consent where processing is based on consent.

To exercise your rights, contact us at info@enso-izakaya.dk. You also have the right to complain to the Danish Data Protection Agency, Datatilsynet.

We use essential cookies and similar technologies to keep you signed in, protect checkout sessions, remember cart or account state, and operate the website. If you accept analytics cookies, we load Google Analytics and Meta Pixel for page measurement. We also send purchase events when an order is successfully placed. The Google Analytics purchase event includes the order identifier, order amount, DKK currency, and ordered item names or codes. The Meta Pixel purchase event includes the order identifier, order amount, DKK currency, item IDs, item quantities, and item prices, but not item names. Neither purchase event includes your name, email, phone number, address, or order notes. Analytics stays off by default, and you can change your choice from Cookie settings in the footer. With analytics consent, we also keep campaign labels and ad identifiers in this browser for up to 7 days. When you place an order, we save that source with the order amount to measure campaign results. Revoking consent clears the browser record; it does not change an existing order record.

We may update this policy when our services, suppliers, or legal obligations change. The latest version will always be available on this page.