Last updated: 06.11.2026

1. Who is responsible for your data

The controller of your personal data is O-SUSHI GROUP OÜ (registry code 12456018) ("we", "us"). This policy applies to the website osushi.ee, its ordering system, our loyalty programme and our mobile app, if we have one.

For questions and requests, write to us at osushitallinn@gmail.com.

The website, ordering system and app are run for us by our technology partner ServUp, which processes data only on our instructions as a processor.

2. What data we collect

Contact and account: name, phone number, email address. To sign you in we send a one-time code by SMS or email.
Order: items, amount, comments, order time, table number, payment method and payment status.
Delivery: address, apartment, floor, door code and a note for the courier.
Loyalty programme: bonus balance, purchase history, rewards received and friend referrals; optionally your birthday and gender.
Payment: we never see or store your card details — they are handled by the payment provider. We only receive the amount and payment status.
Feedback: your order rating and comment, if you leave them.
Technical data: IP address, browser and device, language, in the app a push notification identifier; security and error logs.
Cookies and browser storage — see our cookie policy.

3. Why we use your data and on what legal basis

Taking, preparing and delivering your order, and order status messages by SMS, email or push — performance of a contract (GDPR Art. 6(1)(b)).
Your account and the loyalty programme (bonuses, rewards, customer card in Apple or Google Wallet) — performance of a contract (6(1)(b)).
Accounting and tax records — legal obligation (6(1)(c)).
Security, fraud prevention, reliable service and customer support — our legitimate interest (6(1)(f)).
Offers and news by email, SMS or push — your consent (6(1)(a)); for our customers, about similar products, also our legitimate interest. You can unsubscribe from any message.
Birthday and gender — for a birthday treat and more relevant offers, based on consent (6(1)(a)). Providing them is optional.
Traffic analytics and ad measurement (e.g. Google Analytics, Google Ads, Meta Pixel) — consent given in the cookie banner (6(1)(a)).

We do not make automated decisions about you that have legal or similarly significant effects. Loyalty bonuses and tiers are calculated automatically according to the programme rules.

4. Who we share data with

We share only what each purpose requires. We do not sell personal data.

Our staff and our till system (e.g. Poster, CompuCash), which receives the order.
Couriers — our own or a delivery partner (e.g. Wolt Drive): name, phone, address and note.
Payment providers (e.g. Montonio, Stripe) and banks.
Messaging services: SMS provider, email providers, push notification service (Google Firebase).
Technology partners: ServUp (platform), server and cloud hosting providers, Google Maps (address search).
Analytics and advertising — only with your consent: Google and Meta. If you have agreed to marketing, we may send Meta your hashed (encrypted) email or phone number with a purchase to measure ad results.
Our accountant, auditor and legal advisers; public authorities where the law requires it.

If you order through the Bolt Food or Wolt app, their privacy policy applies; we receive only what is needed to fulfil the order.

5. Data outside the European Economic Area

Some providers (e.g. Google, Meta, Stripe) may process data outside the European Economic Area, mainly in the USA. Such transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. How long we keep data

Account and loyalty data — until the account is deleted or you ask us to delete it.
Orders and accounting records — 7 years (Accounting Act).
Marketing consent — until you withdraw it.
Technical logs — as long as needed for security and fixing errors.
Cookies — see the cookie policy.

When the period ends, the data is deleted or anonymised.

7. Your rights

to know what data we process about you and get a copy;
to have inaccurate data corrected;
to have your data erased, except what we must keep by law;
to restrict processing;
to object to processing based on legitimate interest and to direct marketing;
to receive your data in a machine-readable format (portability);
to withdraw consent at any time — this does not affect processing before the withdrawal.

Send your request to osushitallinn@gmail.com. We reply within one month and may ask you to confirm your identity. You can also unsubscribe from offers via the link at the end of an email or in the app settings.

If you believe we are violating your rights, you can contact the Estonian Data Protection Inspectorate (www.aki.ee) or a court.

8. Do you have to provide data

We need your name and phone number to fulfil an order, and your address for delivery — without them we cannot accept the order. Birthday, gender and marketing consent are optional.

9. Children

The service is not intended for children under 13, and we do not knowingly collect their data.

10. Security

The connection to the website is encrypted (HTTPS), only staff and partners who need the data for their work can access it, and we have data processing agreements with our partners.

11. Changes

We may update this policy. The current version and its date are always on this page.