Privacy Policy

1. Who is responsible for your data

The data controller is BULKA, Encosta do Pilar 3A, Varandas do Pilar, Madeira. For any privacy question or request, contact us at +351 965 763 982.

2. What we collect and why

Breakfast delivery orders. When you order through a property's QR code we collect your name, phone number, the property you're staying at, the items you ordered, your delivery date and time window, and the payment reference. We use this to prepare and deliver your order and to contact you about it. Legal basis: performance of a contract (GDPR Art. 6(1)(b)), and our legal obligation to keep accounting records (Art. 6(1)(c)).

Payments. Payments are processed by IfthenPay. Card details are entered on IfthenPay's secure page and never reach us. For MB WAY, the phone number you enter is sent to IfthenPay to request the payment. We only receive confirmation that the payment succeeded and its reference.

Catering inquiries. When you send the catering form we collect your name, phone or email, the date you need, and what you write. We use it only to answer your request. Legal basis: steps taken at your request before a contract (Art. 6(1)(b)).

Embedded content. Our contact page can show a Google Map, and our homepage can play TikTok and Instagram videos. These only load after you agree (map) or press play (videos). Once loaded, Google, TikTok or Instagram receive your IP address and may set their own cookies under their own privacy policies. Legal basis: your consent (Art. 6(1)(a)).

Security. To protect the site against abuse (for example password guessing, spam, or repeated payment requests sent to someone's phone), we keep a scrambled, one-way code derived from your IP address and, for MB WAY, your phone number, together with a count of recent attempts. It can't be turned back into the original and is deleted within 24 hours. Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f)).

We don't use analytics or advertising trackers, we don't sell your data, and we don't make automated decisions about you.

3. Who we share it with

Only with the service providers we need to run the website and your order, each bound by a data processing agreement:

• IfthenPay (Portugal) — payment processing.
• Vercel Inc. — website hosting.
• Neon Inc. — database hosting.
• Telegram — our team receives each new paid order and catering request as a Telegram message, so it can be prepared and answered. These messages are deleted automatically after one month.

Some of these providers process data outside the European Union (Vercel and Neon in the United States; Telegram on servers outside the EU). Where they do, transfers are covered by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses, or are necessary to fulfil your order.

4. How long we keep it

• Your name and phone number on a paid order: 90 days after delivery, so we can help if something was wrong with it. After that they're removed automatically.
• The rest of a paid order (items, amounts, dates, payment reference, no longer linked to you): as long as Portuguese tax and accounting law requires (generally 10 years).
• Orders that were never paid: deleted automatically 90 days after they were placed.
• Catering inquiries: up to 12 months after our last contact, unless they lead to an order.

5. Cookies

This website only uses the cookies it needs to work:

• bulka_consent — remembers your cookie choice (6 months).
• Payment session cookies set by IfthenPay's payment page while you pay.

Third-party cookies from Google Maps, TikTok or Instagram are only set if you accept them or press play on a video. You can change your choice at any time with "Cookie settings" at the bottom of every page.

6. Your rights

You can ask us to access, correct, delete, or export your data, to restrict or object to how we use it, and to withdraw consent at any time. Contact us at +351 965 763 982 — we'll answer within one month. If you think we've handled your data wrongly, you can complain to the Portuguese data protection authority, the CNPD (www.cnpd.pt).

7. Changes

If we change this policy we'll update the date at the top of this page. For complaints about our service you can also use the Livro de Reclamações.