Privacy policy — Bistero

This policy explains how we handle the personal data of visitors to and customers of the Bistero website. The seller is Astriza LLC, a company incorporated in the state of Wyoming, USA, which processes data on servers in the United States.

Because we knowingly offer goods to customers in the European Union, we apply the General Data Protection Regulation (GDPR) to that processing, alongside the rules that apply in the United States. Where the two differ, we apply the stricter standard.

1. Data controller

2. What data we collect

Category	Data	When
Order details	First name, last name, address, city, postcode, country	When you buy
Contact details	Email address, phone number	When you buy or contact us
Payment data	Transaction status, amount, processor reference (we never receive the card number)	When you pay
Message content	Messages you send us	When you contact us
Technical data	IP address, browser type, pages visited	When you visit the site
Marketing consent	Email address, date and content of the consent	If you sign up for updates
Review	The name you entered, the rating, the text, a photo (if you attach one) and the IP address it was sent from	If you send a review

3. Purposes and legal bases

Purpose	Legal basis	Retention period
Fulfilling the order and delivery	Performance of a contract	Duration of the contract + guarantee period
Taking payment and issuing invoices	Legal obligation (tax rules)	Up to 11 years
Customer support and complaints	Performance of a contract / legitimate interest	3 years from the last contact
Preventing misuse and fraud	Legitimate interest	2 years
Sending news and offers	Consent	Until consent is withdrawn
Publishing a review with a name and photo	Consent	Until consent is withdrawn; unpublished reviews are deleted after 6 months
Measuring visits (analytics)	Consent (cookies)	Up to 14 months

4. Who we share data with

We share data only as far as it is necessary to fulfil an order, namely with:

payment processors — Stripe (processing card, Google Pay and Apple Pay payments and preventing fraud) and, if the customer chooses that method, PayPal (processing PayPal payments, preventing fraud and resolving disputes). The processors receive your name, email address, delivery address, the amount and the order description — never more than that. They process those data as independent controllers, in line with their own privacy policies,
delivery companies — name, address and phone number, so the parcel can be delivered,
our hosting and email providers — technical processing,
our accountants — to meet tax obligations,
public authorities — only where the law requires it.

We do not sell, rent or trade personal data for advertising purposes. Data processing agreements are in place with all of our processors.

4a. Customer reviews

If you send a review, we process the name you entered, the rating, the text, any photo you attached and the IP address it was sent from (to prevent misuse of the form). Reviews are not published automatically — we read each one first and check that it comes from a person who actually bought the product. We publish the name and the photo exactly as you sent them; your email address, IP address and other data are never published.

The legal basis for publication is your consent, which you can withdraw at any time by writing to contact@bistero.com; once withdrawn, we remove the review without delay. We do not publish made-up reviews, we do not write them ourselves, and we do not delete a review for being negative.

5. Transfers to the United States

Astriza LLC is based in the United States, so data belonging to customers in the European Union is transferred to and processed in the United States. We make those transfers on the basis of:

the European Commission's standard contractual clauses, concluded with our processors, together with a transfer impact assessment; and
performance of the contract — without transferring your address we could not deliver your order.

Please note that United States law allows public authorities access to data in certain cases, to an extent that differs from European Union standards. That is precisely why we keep the data we hold about you to the necessary minimum — card details, for example, never reach us at all.

Data protection contact. Please send any question or request about personal data to contact@bistero.com. We reply within 30 days, in the language you write to us in.

6. Your rights

Access — request a copy of the data we hold about you.
Rectification — correct inaccurate or incomplete data.
Erasure — request deletion of data we are not required by law to keep.
Restriction of processing — where the accuracy or lawfulness of processing is disputed.
Portability — receive your data in a structured, commonly used format.
Objection — to processing based on legitimate interest.
Withdrawal of consent — at any time, without affecting processing carried out beforehand.
Automated decision-making — we do not take decisions based solely on automated processing that would have legal effects for you.
Complaint to a supervisory authority — the data protection authority in your EU country of residence; in Croatia this is AZOP, Selska cesta 136, 10000 Zagreb.

Send your request to contact@bistero.com. We reply within 30 days. To protect your data we may ask you to confirm your identity.

7. Data security

The site runs over an encrypted HTTPS connection.
Only authorised staff have access to order data.
We do not store card details in any form.
We update our software regularly and keep backups.

8. Children

This site is intended for adults. We do not knowingly collect data from children under 16. If you believe we have received such data, please tell us and we will delete it immediately.

9. Cookies

The use of cookies is described in our separate cookie policy.

10. Changes to this policy

We may update this policy. We announce significant changes on the website and, for customers who have consented to updates, by email as well.

Last updated: 1 January 2026.