Privacy Policy

1. Who we are

Bell Kitchen, trading as Cookaki, is a family-run restaurant located at Petméza 5, Koukáki, Athens 11742, Greece. We are the data controller for personal data collected through this website.

• Formal corporate name: LITTLE NOE L.P.
• Registered identifiers: Γ.Ε.Μ.Η. (General Commercial Registry): 191138001000 · Α.Φ.Μ. (VAT / Tax ID): 803166019 · Δ.Ο.Υ. (Tax Office): ΚΕΦΟΔΕ Αττικής

You can contact us at info@littlenoe.com, by phone on +30 21 0921 9818, or by WhatsApp on +30 698 237 3505.

2. What we collect and why

We collect personal data only when you give it to us through one of our forms. We never collect data passively beyond essential website operation.

Reservation form

• What: your name, phone number, date and time of booking, party size, optionally your email address and notes (allergies, occasion, seating preferences).
• Why: to process your booking request, to send you an automated confirmation email where you provide an address, and to contact you to confirm or adjust your reservation.
• Lawful basis (standard data — GDPR Article 6(1)(b)): performance of a contract — handling your specific reservation request.
• Lawful basis (health / allergy data — GDPR Article 9(2)(a)): explicit consent. By voluntarily electing to fill out any allergy, health, or dietary requests in the optional text fields, you explicitly consent to our processing of this data solely to ensure your physical safety during your meal.
• Retention: until 12 months after the booking date, then safely deleted.

Events & catering inquiry form

• What: your name, contact details, event type, preferred date, guest count, venue choice, and any notes you provide (allergies, dietary needs, occasion).
• Why: to scope your event, send you a customized quotation, and coordinate logistics.
• Lawful basis (standard data): performance of a contract and taking pre-contractual measures.
• Lawful basis (health / allergy data — GDPR Article 9(2)(a)): explicit consent. By voluntarily specifying dietary or medical allergy requirements within your inquiry notes, you explicitly consent to our processing of this health data to customize a safe menu proposal.
• Retention: 24 months for accepted bookings (for operational reference); 6 months for declined or unanswered inquiries.

Contact form

• What: your name, email or phone, and message content.
• Why: to answer your question.
• Lawful basis: legitimate interest in responding to customer enquiries.
• Retention: 12 months from last contact.

Pantry / product orders via WhatsApp

• What: your WhatsApp profile name and number, plus transaction details written in the conversation (typically: the product you want, delivery address if shipping).
• Why: to fulfil your retail order.
• Lawful basis: performance of a contract.
• Retention: up to 10 years for invoice-related correspondence and fiscal transactions in strict compliance with the Greek Code of Tax Procedure; other chat content for as long as is reasonably needed for customer support.

3. How your data reaches us

This website uses two separate routes, depending on what you send us. Table reservations made through the booking form are transmitted directly to a Google Apps Script service operated by us and recorded in a Google Sheet held in our Google account; if you provide an email address, that same service sends you an automated confirmation message. All other forms (contact, events and catering, pantry orders) are composed into a WhatsApp message that opens in your browser, which you send by tapping Send in WhatsApp; it reaches our WhatsApp business number over WhatsApp's end-to-end encrypted transport. In neither case is your data stored on this website's own server.

Important to note: the form data appears briefly in your browser's URL bar before WhatsApp opens. On shared or public devices, this means anyone with momentary screen access could see what you submitted. We recommend using your personal device for reservations.

4. Who we share your data with

We do not sell your personal data to anyone. We share it only with the service providers we need to operate:

• WhatsApp (Meta Platforms Ireland Ltd, EU): contact, events and pantry enquiries reach us as WhatsApp messages. Meta processes the data under its own privacy policy.
• Google Workspace & Google Apps Script (Google Ireland Limited): table reservations are processed by a Google Apps Script service and stored in a Google Sheet within our Google account, including any allergy or dietary information you choose to add. Where you supply an email address, Google's mail service sends your confirmation message on our behalf. Google acts as our processor for this data and does not use it for its own advertising purposes.
• Our online ordering platform (noe.bfwqr.com): if you order online, it processes your order details. We receive only what's needed to prepare and hand off your food.
• Google (Maps, Fonts): our pages load Google Fonts and embed Google Maps. Google may receive your IP address and basic browser information.
• Google Analytics (Google Ireland Ltd): only if you consent, we use Google Analytics 4 to understand how visitors use the site. It sets cookies and sends usage data (e.g. pages viewed, approximate location, device and browser type) to Google. We operate it through Google Consent Mode v2, so no analytics or advertising data is collected until you opt in via our cookie banner. See section 5 below. When you complete a booking, we also send the booking's date, time, party size, site language and a random reference number to Google Analytics, so that we can measure how many reservations the website generates. Your name, phone number and email address are never sent to Google Analytics.
• Google Ads (Google Ireland Ltd): only if you consent to Marketing, we use Google Ads conversion measurement and remarketing to understand which advertisements lead to a booking or an order, and to show our advertisements to people who have already visited the site. Nothing is collected while marketing consent is off.
• Our hosting provider: processes basic web server logs (IP address, request time, page requested) for security and analytics. These logs are retained no longer than 30 days.

5. Cookies and similar technologies

When you first visit, a cookie banner asks for your choice before any non-essential cookie is set. Nothing in the Preferences, Analytics, or Marketing categories runs until you opt in, and you can change or withdraw your choice at any time using the cookie button at the bottom-left of every page (or by clicking Cookie settings). We use four categories:

• Strictly necessary (always on): required for the site to work — security, page navigation, and remembering your cookie choice itself. These do not track you and need no consent.
• Preferences (consent required): remember choices such as a dismissed menu to give you a smoother experience.
• Analytics (consent required): Google Analytics 4 cookies that help us see, in aggregate, how the site is used so we can improve it. Set only after you accept.
• Marketing (consent required): cookies used to measure campaigns and show more relevant content across Google services. Off unless you accept; while off, ad identifiers are redacted. This covers Google Ads conversion measurement and remarketing.

We manage Google cookies through Google Consent Mode v2: before you decide, Google's tags load in a restricted state that stores no analytics or advertising data. Your choice is remembered for 12 months, after which we ask again. Third-party embedded content (Google Maps) may set its own cookies when you interact with the map; please consult Google's privacy policy.

6. Your rights under GDPR

You have the right to:

• Access the personal data we hold about you.
• Rectify incorrect or incomplete data.
• Erase your data ("right to be forgotten"), subject to legal retention requirements.
• Restrict our processing of your data.
• Object to processing based on legitimate interest.
• Data portability — receive your data in a structured format.
• Withdraw consent at any time, where consent is the lawful basis.
• Lodge a complaint with the Hellenic Data Protection Authority (HDPA) — www.dpa.gr.

To exercise any of these rights, email us at info@littlenoe.com. We respond within 30 days.

7. International transfers

Most of our data processing happens within the European Union. Some service providers may transfer data to the United States: Google (including Google Analytics, Google Workspace and Google Apps Script) is certified under the EU–US Data Privacy Framework, the adequacy decision adopted by the European Commission, and also relies on Standard Contractual Clauses. WhatsApp / Meta processes data in the EU. These transfers happen only to the extent you have consented (for analytics and marketing) or where necessary to provide the service you requested.

8. Children

Our website is intended for adults. In strict accordance with Article 21 of Greek Law 4624/2019, the threshold age for direct minor consent to Information Society Services within Greece is set at 15 years of age. We do not knowingly collect personal data from children under 15. If you believe a minor under 15 has provided us with data, please contact us immediately at info@littlenoe.com and we will purge it from our systems.

9. Security

We take reasonable technical and organisational measures to protect your data, including HTTPS encryption in transit, restricted access to the WhatsApp account that receives form submissions, and not retaining data longer than necessary. No system is perfectly secure; if a breach occurs, we will notify affected users and the Hellenic Data Protection Authority within 72 hours where required.

10. Changes to this policy

We may update this policy as our practices evolve or as required by law. The "Last updated" date at the top of the page shows when the current version took effect. Material changes will be highlighted on the homepage.

11. Contact

Questions about this policy or your data:
Email: info@littlenoe.com
WhatsApp: +30 698 237 3505
Post: Bell Kitchen / Cookaki, Petméza 5, Koukáki, Athens 11742, Greece