Privacy Policy

1. Who we are

Donatello (Donatello Pizza & Pasta) is a pizza and pasta restaurant in Sri Thanu, Koh Phangan, Thailand. We are responsible for the personal data you give us when you order on this website. Contact us on WhatsApp: +66 96 025 7364.

2. What we collect

Only what we need to take and deliver your order:

• Your name and phone number.
• Your order: items, add-ons, notes, total, delivery or pickup, and — if you tell us — the cash amount you'll pay with so the driver brings change.
• For delivery: your address, delivery area and, only if you choose to share it, your device location (GPS) so the driver can find you.
• Technical: the date and time of your order. On your own device we save only your language choice (English/Hebrew).

We don't use advertising or analytics trackers, and we don't sell your data.

3. How we use it

• To prepare and deliver your order, and to contact you about it (WhatsApp or phone).
• To send you updates about your order on WhatsApp (for example “received”, “on the way”), to the number you gave us.
• To record the sale in our point-of-sale and accounting.
• To prevent fake orders and misuse.

Legal basis (Thailand PDPA): performing your order (contract) and our legitimate interests in running the business, plus legal obligations for accounting records.

4. Who we share it with

Only with service providers that help us run the restaurant, and only what each one needs:

• Supabase — secure database where orders are stored.
• Vercel — hosts this website.
• Meta (WhatsApp Business Platform) — sends your order to our staff and order updates to you.
• Loyverse — our point-of-sale; receives the items and amounts of the sale, not your name or phone number.
• Google Maps — only a link to the location you chose to share, for our driver.

We never sell or rent your personal data. We may disclose data if the law requires it.

5. How long we keep it

We keep order records for as long as we need them for accounting and legal obligations (Thai tax rules generally require up to 5 years). You can ask us to delete your personal details sooner — see “Delete your data” below — unless the law requires us to keep them.

6. Your rights

Under Thailand's Personal Data Protection Act (PDPA) you can ask to access, correct or delete your personal data, object to or restrict its use, and withdraw consent. Message us on WhatsApp and we'll reply within 30 days. You can also complain to Thailand's Personal Data Protection Committee.

7. Delete your data

Send a WhatsApp message to +66 96 025 7364 saying “Delete my data”, from the number you ordered with (or tell us that number and an order number). We delete your name, phone number, address, location and notes from our records within 30 days and confirm on WhatsApp. We may keep the anonymous sale amount for accounting.

8. Security

The website uses encrypted connections (HTTPS). Only our staff can see orders, behind a staff PIN, and our service keys are kept on the server — never in your browser.

9. Changes

If we change this policy we'll update this page and the date above.