Privacy policy

This translation is provided for information purposes only. In the event of a dispute, the Lithuanian text shall prevail: Lithuanian version.

This privacy policy explains how your personal data is collected, used and stored when you use the Rollka food ordering website (the Website). Data is processed in accordance with the EU General Data Protection Regulation (GDPR) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.

1. Who processes your data

The data controller is the company that sells the food and fulfils the orders, on whose behalf this Website operates:

The data processor is the company that maintains the technical ordering system and the servers and processes data only on the instructions of the Data controller:

2. What data we collect

To fulfil the order, we collect only the necessary data:

• first name and last name: only when you fill in the return form (we do not ask for them when ordering);
• phone number: we send SMS messages about the order only to Lithuanian (+370) and Latvian (+371) numbers. We receive your contact details already at the contact step (before payment), so that we can get in touch if the order was not completed, and to confirm the phone number with an SMS code when you select "Pay on pickup";
• email address: when you provide it when ordering (to send the order confirmation; requested only for non-Lithuanian and non-Latvian numbers), when you provide it in the “I want to return” form, or when you leave it so that we can let you know when the branch accepts orders again;
• order contents (selected dishes, pickup place and time, notes);
• the fact of payment (amount and status; the payment is processed by an external payment service provider);
• IP address and the time of acceptance of the terms, for website security (protection against abuse) and as proof of the order.

The Website does not collect or see payment data (bank login or card details): payment is made through the payment initiation service of „Swedbank", AB, in your online banking.

3. Why and on what legal basis

• To accept and fulfil the order (to prepare the dishes, hand over the order, inform you by SMS or email, contact you about an unfinished order): on the basis of entering into and performing the contract (GDPR Article 6(1)(b));
• For accounting and tax obligations (order content, amount, date, payment details) and to handle return requests: on the basis of a legal obligation (GDPR Art. 6(1)(c));
• For the security of the Website (IP address, protection against abuse) and to resolve disputes: on the basis of legitimate interests (GDPR Article 6(1)(f)).

4. How long we keep data

• Contact details (phone number, email address), the IP address and order notes are kept for no longer than 7 (seven) days and are then automatically deleted or anonymised.
• Accounting data on the order without contact details (order number, items, amount, date, branch) is kept in the seller's point-of-sale system for 10 years (Law on Financial Accounting).
• If a complaint has been made or a dispute has arisen about an order, the related data is kept until the dispute ends (GDPR Article 17(3)(e)).
• Return requests and correspondence about complaints are kept in the seller's email for as long as needed to handle the complaint and any dispute, but no longer than 1 year from the last correspondence.

5. Who we share data with

We share data only to the extent necessary to fulfil the order:

• MB „Profinetas", the data processor that maintains the ordering system (ProfiPOS) and the servers, and the server hosting provider it uses, UAB „Interneto vizija" (Lithuania);
• „Swedbank", AB (Lithuania), the payment initiation service provider: the order amount and number in order to make the payment. Swedbank and your bank process payment data as independent data controllers under their own privacy rules;
• The SMS service providers GatewayAPI (OnlineCity.io ApS, Denmark) and UAB „Tele2" (Lithuania): the phone number and message text for notifications about the order;
• public authorities: only in the cases laid down by law.

We do not sell data or use it for marketing.

6. Where data is stored

Core data (orders, contacts) is stored on MB „Profinetas" internal servers in Lithuania; the Website and its temporary data are hosted on a UAB „Interneto vizija" (Lithuania) server. The service providers we use process data within the European Union.

The Website's fonts are stored on our own server, so when you visit the Website your data (e.g. IP address) is not passed to third parties such as Google. There are no advertising or third-party analytics tools on the Website. To measure traffic (legitimate interest, GDPR Article 6(1)(f)) we count statistics without cookies: the country from the IP address (the address itself is not stored), the selected language, the pages visited, the device type, where you came from (e.g. Google, Facebook) and the hour of the day. So that a visitor is counted once per day, an untraceable token of the IP address and browser with a random key that changes daily is kept until the end of the day; the next day the token and the key are deleted. Only aggregated totals are kept. You have the right to object by email to info@metina.lt.

7. Cookies and browser storage

The Website uses only strictly necessary entries, without which it would not work:

• rk_kalba (cookie, 1 year): the selected website language;
• rk_csrf (cookie, until the browser is closed): protection of the return form;
• rollka_sutikimas (browser storage): a flag showing that you have read the notice on cookies and data processing;
• rollka_krep, rollka_krep_ts (browser storage, 20 min.): basket contents;
• rollka_rez (browser storage, a few minutes): the pickup time reserved during payment;
• rollka_juodrastis (browser session storage, until the window is closed): the number of the unfinished order.

On your first visit a notice on cookies and data processing is shown. You can view it again here.

8. Your rights

You have the right to: access your data; request its rectification or erasure; restrict or object to its processing; obtain a copy of the data. To exercise these rights, write to info@metina.lt. We will reply within 1 month at the latest.

If you believe that your data is being processed unlawfully, you have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt).

9. Responsibility for the food

UAB „Metina" is responsible for the food sold (its quality, ingredients, allergens, preparation and pickup). Allergen information is given next to the dishes on the menu.

10. Contacts

For questions about orders and personal data: tel. +370 662 58494, email info@metina.lt. Location contacts: Contacts.