Privacy Policy

Last Updated: December 31, 2025

1. Introduction

Welcome to Amba ("we," "our," or "us"). We are committed to protecting your privacy and ensuring transparency about how we collect, use, and share your personal information. This Privacy Policy explains our practices regarding data collection, processing, and your rights under applicable data protection laws, including the General Data Protection Regulation (GDPR).

By using our platform, mobile application, or services, you agree to the collection and use of information in accordance with this policy.

2. Data Controller Information

Company Name: MB "Bravado"
Registration Code: 307511865
VAT Number: LT100019353612
Registered Address: Draugystės g. 17-1, LT-51229 Kaunas, Lithuania
Contact Email: CONTACT_EMAIL_PLACEHOLDER
Phone: CONTACT_PHONE_PLACEHOLDER

3. Information We Collect

3.1 Information You Provide Directly

When you create an account, place orders, or interact with our services, we collect:

  • Account Information: Name, email address, phone number, profile photo
  • Delivery Information: Delivery addresses, contact preferences, special delivery instructions
  • Payment Information: Payment method details (processed securely through third-party payment processors)
  • Order History: Details of your orders, preferences, and transaction history
  • Communication Data: Messages sent through our platform, customer support interactions

3.2 Information from Social Authentication

When you sign in using social authentication providers (Facebook, Google, Apple):

  • Profile Information: Name, email address, profile picture (if available)
  • Provider ID: Unique identifier from the authentication provider
  • Public Profile Data: Information you've made publicly available on the social platform

We only access information you've explicitly authorized through the authentication provider's consent screen. You can revoke this access at any time through your account settings or the provider's platform.

3.3 Automatically Collected Information

  • Device Information: Device type, operating system, unique device identifiers
  • Usage Data: Pages visited, features used, time spent on platform, click patterns
  • Location Data: Approximate location based on IP address or precise location (with your consent) for delivery services
  • Technical Data: IP address, browser type, language preferences, access times
  • Cookies and Tracking Technologies: See our Cookie Policy section below

3.4 Information from Third Parties

  • Restaurant Partners: Order details, delivery status, customer feedback
  • Payment Processors: Transaction confirmations, payment status
  • Delivery Partners: Delivery status, estimated arrival times
  • Analytics Providers: Aggregated usage statistics and performance metrics

4. How We Use Your Information

We use collected information for the following purposes:

4.1 Service Delivery

  • Process and fulfill your orders
  • Facilitate communication between you, restaurants, and delivery partners
  • Manage your account and preferences
  • Provide customer support and respond to inquiries
  • Send order confirmations, updates, and delivery notifications

4.2 Authentication and Account Management

  • Create and maintain your account
  • Verify your identity through social authentication providers
  • Secure your account and prevent fraudulent activity
  • Enable password recovery and account recovery processes

4.3 Communication

  • Send transactional messages (order confirmations, delivery updates)
  • Respond to customer support requests
  • Send marketing communications (with your consent, which you can withdraw at any time)
  • Notify you about service updates, policy changes, or important information

4.4 Service Improvement

  • Analyze usage patterns to improve our platform
  • Develop new features and services
  • Personalize your experience
  • Conduct research and analytics

4.5 Legal Compliance

  • Comply with applicable laws and regulations
  • Respond to legal requests and court orders
  • Protect our rights and prevent fraud
  • Enforce our Terms of Service

5. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

  • Contract Performance: To fulfill our contractual obligations (processing orders, delivering services)
  • Consent: For marketing communications and non-essential cookies (you can withdraw consent anytime)
  • Legitimate Interests: For fraud prevention, security, service improvement, and analytics
  • Legal Obligation: To comply with applicable laws and regulations

6. Data Sharing and Disclosure

We do not sell your personal information. We share data only in the following circumstances:

6.1 Service Providers

We share information with trusted third-party service providers who assist in:

  • Payment processing
  • Delivery services
  • Cloud hosting and infrastructure
  • Analytics and performance monitoring
  • Customer support tools
  • Email and SMS delivery services

These providers are contractually obligated to protect your data and use it only for specified purposes.

6.2 Restaurant and Delivery Partners

We share necessary order information with:

  • Restaurants to fulfill your orders
  • Delivery partners to complete deliveries
  • Only the minimum information required for service delivery

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

6.4 Legal Requirements

We may disclose information when required by law, court order, or government regulation, or to:

  • Protect our rights and property
  • Prevent fraud or security threats
  • Ensure user safety
  • Comply with legal processes

7. Data Retention

We retain your personal information only for as long as necessary to:

  • Provide our services
  • Fulfill legal obligations
  • Resolve disputes
  • Enforce agreements

Account data is retained while your account is active. After account deletion, we retain certain information as required by law (e.g., transaction records for tax purposes) for up to 7 years. Marketing consent data is retained until you withdraw consent.

8. Your Rights (GDPR)

Under GDPR and applicable data protection laws, you have the following rights:

8.1 Access

Request a copy of the personal data we hold about you.

8.2 Rectification

Request correction of inaccurate or incomplete data.

8.3 Erasure ("Right to be Forgotten")

Request deletion of your personal data, subject to legal retention requirements.

8.4 Restriction of Processing

Request limitation of how we process your data in certain circumstances.

8.5 Data Portability

Receive your data in a structured, commonly used format.

8.6 Objection

Object to processing based on legitimate interests or for direct marketing purposes.

8.7 Withdraw Consent

Withdraw consent for data processing where consent is the legal basis.

8.8 Lodge a Complaint

File a complaint with your local data protection authority.

To exercise these rights, contact us at CONTACT_EMAIL_PLACEHOLDER or through your account settings.

9. Social Authentication Data

When you use social authentication (Facebook, Google, Apple):

  • We access only information you authorize through the provider's consent screen
  • We store provider ID, name, email, and profile picture (if available)
  • You can disconnect social accounts at any time through account settings
  • Disconnecting does not delete your account; you can use email/password authentication instead
  • We comply with each provider's data use policies

10. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe we have collected information from a minor, please contact us immediately.

11. International Data Transfers

Your data may be processed and stored outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

  • Standard Contractual Clauses approved by the European Commission
  • Adequacy decisions by the European Commission
  • Other legally recognized transfer mechanisms

12. Security Measures

We implement technical and organizational measures to protect your data:

  • Encryption of data in transit (HTTPS/TLS)
  • Secure storage and access controls
  • Regular security assessments
  • Employee training on data protection
  • Incident response procedures

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

13. Cookies and Tracking Technologies

We use cookies and similar technologies to:

  • Maintain your session
  • Remember your preferences
  • Analyze usage patterns
  • Provide personalized content

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may affect platform functionality.

14. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by:

  • Posting the updated policy on our platform
  • Sending email notifications (for significant changes)
  • Displaying prominent notices on our platform

Continued use of our services after changes constitutes acceptance of the updated policy.

15. Contact Us

For questions, concerns, or to exercise your data protection rights:

Email: CONTACT_EMAIL_PLACEHOLDER
Phone: CONTACT_PHONE_PLACEHOLDER
Address: Draugystės g. 17-1, LT-51229 Kaunas, Lithuania

For data protection inquiries, you can also contact our Data Protection Officer at the above address.

This Privacy Policy is effective as of December 31, 2025.