Your details

Privacy notice

What we keep when you book a table, why, and your rights. Last updated 27 October 2026.

1. Who we are

Kalua – Tapas Lounge Bar is operated by NAKPOL LTD, Avanti Village Plaza, Poseidonos 11–15, 8042 Geroskipou, Paphos, Cyprus (VAT no. 10171742Z). We are the “controller” of your personal data for table reservations.
For anything about your data, contact us at info@kalualoungebar.com or +357 99 131544.

Booking details: your name, mobile number, email (if you give it), date and time, number of adults, children and babies, high chairs, preferred area, what you’re coming for (food, drinks, shisha) and any notes you add.
How we confirm: whether you chose WhatsApp or SMS, and the messages we exchange with you.
Your visits: when you arrived and left, your table, previous visits, and short notes our team adds to help look after you (for example seating preferences).
What you had: the bill total, tip and the items ordered, recorded by our team after your visit.
Things you choose to tell us in My Kalua: allergies and dietary needs, special occasion requests, “running late” updates, reviews, and links to social media posts you share with us.
Gifts we give you and when they are used.
We show our team the country of your phone number’s dialling code (for example a flag) to help us welcome you. We don’t collect your location.

To take, confirm, change and manage your booking and serve you on the day — to carry out your booking (contract).
To remember your visits and preferences, send you a thank-you after your visit, ask for a review, and give you gifts — our legitimate interest in looking after our guests. You can tell us to stop at any time.
Allergy and dietary information can be health information. We only keep it because you choose to give it to us for your visit (your explicit consent), and you can remove it at any time.
Showing your social media post: only with your consent, which you can withdraw.
Keeping bill and accounting records — our legal obligations under Cyprus tax law.
Keeping our systems secure and preventing misuse (for example limits on repeated requests) — our legitimate interest.
We don’t sell your data, don’t use it for advertising and don’t make automated decisions about you.

Our team, only as needed for their role. Staff accounts are personal and access is limited by position.
Service providers who run the system for us, under data-processing agreements: Vercel (website hosting) and Neon (database), with servers in Frankfurt, Germany (EU).
Meta / WhatsApp, when we message you on WhatsApp and for alerts to our own WhatsApp Business number about new bookings and changes. SMS messages go through your and our mobile networks.
Some providers are part of groups based outside the EU (for example in the USA). Where data may be accessed from outside the EU, they protect it with the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.
Authorities, if the law requires it.

Booking and visit history (including our notes and what you had): up to 3 years after your last visit, then deleted or anonymised.
Allergy and dietary details: until 30 days after the visit they were given for, or sooner if you remove them.
Requests that were declined or cancelled: up to 12 months.
Reviews: up to 3 years. Shared social media links: until you ask us to remove them or we stop showing them.
Accounting records: for as long as Cyprus tax law requires.

You can ask us for a copy of your data, to correct it, delete it, restrict or object to how we use it, or to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.
To use your rights, email info@kalualoungebar.com. We will reply within one month.
You can also complain to the Commissioner for Personal Data Protection in Cyprus: www.dataprotection.gov.cy · commissioner@dataprotection.gov.cy · +357 22 818456. We’d appreciate the chance to help first.

We only use what is needed for the website to work: a secure cookie that keeps you signed in to My Kalua, and your browser’s storage for things like your language and a booking you’ve started. We don’t use advertising or tracking cookies.

Your data is sent over encrypted connections, stored in the EU, and only available to signed-in staff. My Kalua links are long, private codes, and you can ask us to replace yours at any time.

Bookings are made by adults. We only hold a child’s details as part of an adult’s booking (for example the number of children or a high chair).

We may update this notice; the latest version is always on this page with the date it was updated.