Privacy Policy

1. Who is responsible

M.D.O.S. RESTAURANT LTD (“M.D.O.S.”, “we”, “our”, “us”) is a company established in the Republic of Cyprus, with its address at Flat 1, Protaras, Paralimni, 522 Kavo Gkreko, Strovolos, Nicosia 2003, Cyprus. We decide why and how the personal data described in this policy is processed, which makes us its controller under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Cyprus Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data.

For anything in this policy, write to support [at] mdos-r.com.

2. Where this policy applies

This policy covers:

• our website at mdos-r.com (the “website”);
• mobile applications that M.D.O.S. publishes on the Apple App Store (the “apps”);
• emails and other messages you send us.

An app may add details of its own — in its App Store listing (“App Privacy”) or inside the app. Those details are part of this policy for that app. Where an app comes with its own privacy policy, that policy governs the app, and this one covers everything else.

3. What we collect

3.1 When you visit the website

The website is informational. It sets no cookies and runs no analytics, advertising or tracking code. Like any web server, ours writes a log entry for each request: your IP address, the date and time, the address requested, the referring page and your browser’s user-agent string. We use these logs only to deliver the website, investigate errors and protect it against abuse.

3.2 When you write to us

Your email address, your name and signature if you include them, the content of your message and any attachments, and the technical headers that every email carries.

3.3 When you use our apps

What an app processes depends on its features. Across our apps, this can include:

• Device and app details — device model, operating system and version, app version, language and region settings.
• Identifiers — a random identifier the app creates for an installation or an account. The advertising identifier (IDFA) is read only if you allow tracking in Apple’s App Tracking Transparency prompt.
• Purchase records — the item or subscription you bought, its status and renewal dates, and transaction identifiers. Apple takes the payment; we never see your card number.
• Diagnostics — crash reports, performance measurements and error events that help us find and fix problems.
• Account details — where an app offers an account, the email address or sign-in identifier you use and your settings.
• Support details — whatever you choose to send us from inside an app.

We do not ask for sensitive data — such as health, biometric or political information — unless a particular feature needs it and you decide to provide it. In that case the app explains why and asks for your explicit consent first.

3.4 Business relationships

If you are, or represent, a client, partner or supplier, we keep work contact details (name, role, email, phone) together with the correspondence, agreements and invoices needed to run that relationship.

4. Purposes and legal bases

Where we rely on legitimate interests, we have weighed them against your rights and you may object (section 8). Where we rely on consent, you can withdraw it at any time; earlier processing stays lawful. We do not take decisions about you by automated means alone that have legal or similarly significant effects.

5. Who receives data

We do not sell or rent personal data. We disclose it only as far as necessary, to:

• Infrastructure providers — Hetzner Online GmbH (Germany) hosts this website on servers in Finland, Cloudflare, Inc. provides DNS and content delivery, and Google provides our email (Google Workspace). App back-ends may use other hosting providers bound by data-processing agreements.
• Apple, which distributes the apps and processes payments as an independent controller under its own privacy policy.
• Analytics, crash-reporting or attribution providers built into a particular app, as listed in that app’s App Store privacy information.
• Professional advisers — accountants, auditors and lawyers — under duties of confidentiality.
• Courts, regulators and law enforcement where the law requires it, or where needed to protect rights and safety.
• A successor business in a merger, acquisition or asset sale, which must keep protecting your data as described here.

Our service providers process personal data only on our documented instructions and under written agreements.

6. Transfers outside the EEA

Some of the providers above process data outside the European Economic Area. Such transfers rely on an adequacy decision of the European Commission — for example the EU–U.S. Data Privacy Framework for certified US companies — or on the Commission’s Standard Contractual Clauses, with supplementary measures where needed. You can ask us for a copy of the relevant safeguards.

7. How long we keep it

8. Your rights

Under the GDPR you can ask us to:

• give you access to your personal data and a copy of it;
• correct data that is wrong or complete data that is missing;
• erase your data in the cases the law provides;
• restrict how we process it;
• hand over data you gave us in a structured, machine-readable format, or send it to another controller;
• stop processing based on legitimate interests — and you can object to direct marketing at any time;
• stop processing based on your consent, by withdrawing it.

Email support [at] mdos-r.com. We may need to confirm your identity first. We answer within one month; complex or numerous requests can extend this by up to two further months, and we will tell you if that happens.

Apple holds its own records of App Store purchases, so some requests — refunds, or the full purchase history — must go to Apple directly.

You may also complain to a supervisory authority: in Cyprus, the Commissioner for Personal Data Protection (dataprotection.gov.cy), or the authority in the EU country where you live or work. We would welcome the chance to put things right first.

9. Children

The website and our apps are not intended for children under 16, and we do not knowingly collect their personal data. An app made for younger users would say so in its App Store listing and explain any parental consent it needs. If you believe a child has given us personal data, contact us and we will delete it.

10. Security

We protect personal data with technical and organisational measures that fit the risk: encrypted connections (HTTPS), key-only administrative access to our servers, and access limited to the people who need it. No system is perfectly secure. If a breach affects your data, we will notify you and the supervisory authority where the law requires.

11. Cookies and similar tools

This website sets no cookies. Our content-delivery provider may place a strictly necessary security cookie when it has to tell people apart from automated traffic. Inside our apps, software development kits may store identifiers on your device for the purposes in section 3.3; where consent is required, the app asks before they are used.

12. Updates to this policy

When we change this policy, we will publish the new version here with a new effective date. Significant changes will also be announced in the affected apps, or by email where we have your address.

13. Contact