MLYN is a family kitchen. We collect the least we can get away with to cook and deliver your order. This page says, in plain language, what that is, where it goes, and how to have it deleted.
Last updated:
Who we are
MLYN (Sabor Artesanal) is a family kitchen near Lisbon, Portugal, cooking Eastern European food to order. We are the controller of the data described on this page.
For anything to do with privacy, or to exercise your rights: WhatsApp +351 926 369 792 or ivan@mlyn.pt.
What we collect
There are two different situations: placing an order, and simply visiting the site.
When you place an order
Your name and phone number: required, so we can confirm the order.
Your email: optional, only so we can write to you about this order (the confirmation, the deposit received, and a note when it leaves for delivery).
Delivery address: only if you choose delivery rather than pickup.
Exact location: only if you paste a Google Maps link into the form. It is optional; we keep it with the order so Mykola reaches the right door and so the delivery distance is measured rather than guessed.
The delivery day you picked, the items ordered, the total, and any note you write.
The language you were browsing in, so we reply in the same one.
When you only visit
Server logs from our host (Vercel): IP address, browser type, pages requested. Any website generates these automatically.
Aggregated visit statistics (Umami), with no cookies and nothing that identifies you individually.
Meta Pixel events: viewing a page, viewing the menu, opening the order builder. These use cookies and are tied to your Meta account if you have one.
Why, and on what legal basis
We never sell your data. We never use it for anything not on this list.
To cook and deliver your order and talk to you about it: performance of a contract (GDPR Art. 6(1)(b)).
To meet tax and accounting obligations: legal obligation (Art. 6(1)(c)).
To understand what works on the site and show our ads to people likely to want them: legitimate interest (Art. 6(1)(f)), and consent where the law requires it.
Who else sees it
Only the services we need to run the site:
Telegram: where your order is sent, so the kitchen gets it straight away.
Cloudflare: sends the emails about your order, if you left an address.
Vercel: hosts the site and keeps the server logs.
Umami: aggregated visit statistics.
Meta Platforms Ireland (Facebook, Instagram, WhatsApp): the Pixel, our ads, and the conversation itself if you message us on WhatsApp.
If you have ordered from us before, your phone number may be sent to Meta in hashed form, so we can show you ads and find people similar to you. We never send it in plain text, and you can object at any time (see “Your rights”).
Google Fonts: serves the site’s typefaces, which means your IP reaches Google.
Some of these process data outside the European Union, under the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.
The reviews on the site
On the home page we show real customer messages, and next to each one the original screenshot, so you can see we didn’t write them ourselves.
Google and Facebook reviews appear as they are: they are already public, posted by the person under their own name.
WhatsApp and Instagram messages are private, so the screenshot is cropped: the message stays, and the chat header, profile photo, phone number and contact name go. The person is shown only as “Customer”, or by a first name if they made it public themselves.
We never publish addresses, order totals, or any conversation about payment.
If you recognise a message of yours and would rather it weren’t here, write to us on WhatsApp (+351 926 369 792) or at ivan@mlyn.pt and we’ll take it down. We won’t ask why.
Cookies and the Meta Pixel
The site sets no cookies of its own. Visit statistics are collected without cookies.
The Meta Pixel does use cookies, and records which pages you look at here so we can measure our ads and build audiences for them. You can switch it off in your browser by blocking third-party cookies, or in your Meta account’s ad settings.
How long we keep it
Order data: as long as it takes to fulfil the order, then for the period Portuguese tax law requires.
WhatsApp messages: as long as the conversation is useful for looking after you.
Ad audiences built from the Pixel: between 30 and 90 days, after which people drop out automatically.
Server logs: our host’s short retention period.
Your rights
Over your data, you have the right to:
Know what we hold and get a copy of it.
Correct anything that is wrong.
Have it deleted.
Object to us using it for advertising.
Withdraw consent at any time.
Complain to the CNPD (cnpd.pt), Portugal’s data protection authority.
Message us on WhatsApp at +351 926 369 792 or write to ivan@mlyn.pt and we will answer within 30 days.
Deleting your data
Want everything we hold about you gone? Message us on WhatsApp at +351 926 369 792, or email ivan@mlyn.pt with the subject “Delete my data”, telling us the name and phone number you used to order.
We delete everything within 30 days and confirm in writing once it is done. The only things kept back are the records Portuguese tax law obliges us to retain. Those are used for nothing else.
If you found us through Facebook or Instagram and want that link removed too, you can do it in your Meta account settings, under “Activity off Meta technologies”.
Children
The site is not intended for anyone under 16, and we do not knowingly collect their data.
Changes to this policy
If we change anything, we change the date at the top of this page. If the change is significant, we will say so on the site.
Leave the cooking to us.
Place your order right here on the site and we’ll handle the rest.