Privacy policy

1. Who is responsible

The controller is D.M MASH SUSHI RESTAURANT LTD, HE 413990, VAT 10413990V, Agias Phaneromenis 9, Mesogi, 8280 Paphos, Cyprus. Privacy contact: mashalis007@gmail.com or +357 96596003.

2. Data we use

Account and contact details, preferred language, optional profile photo, saved addresses and delivery coordinates; orders, dish options, comments, discounts, tips, payments, invoices, loyalty points, cash wallet and gift cards. We also use session information, security logs, IP address and, if you enable notifications, an installation identifier and push token. Please do not put unnecessary sensitive information in comments.

3. Purposes and legal grounds

We process necessary data to fulfil your order contract and provide account, payment and delivery functions (GDPR Article 6(1)(b)). Required tax and accounting records are processed to meet legal obligations (6(1)(c)). Fraud prevention, security and resolving disputes rely on our legitimate interests, balanced against your rights (6(1)(f)). Where consent is required, including optional analytics or advertising cookies, we request it separately and you may withdraw it (6(1)(a)).

4. Sign-in and existing accounts

You may use a password, a one-time code by SMS/email or available Apple/Google sign-in. We receive the information you authorise from that provider, not its password. One-time codes expire and have attempt limits. When moving from a previous ordering service, account details, addresses, order history and balances may be transferred for continuity, without transferring the old password. Access requires identity verification.

5. Location and delivery tracking

The customer app asks for location permission when you select your current position for delivery. You can type an address or place a pin without granting that permission. We do not continuously track customer location in the background. For an active delivery you may see the courier location and estimated arrival; estimates are not guarantees. Embedded maps and tracking pages communicate with their respective providers.

6. Notifications and messages

With push permission you can receive available order updates, including acceptance, estimated time, courier on the way or nearby, and completion. You can disable push from your account or device settings. SMS/email may be needed for OTP, order communication or a link to pay an outstanding balance. These operational messages do not sign you up for advertising.

7. Payments and service providers

Card details are entered in the payment provider environment. Our system keeps transaction results, amounts and references, not the full card number or CVV. Depending on the feature, necessary data is shared with hosting providers, JCC/Stripe, Twilio for SMS, email services, Expo/Apple/Google for push and sign-in, OpenStreetMap map services and delivery partners such as Wolt Drive. Couriers receive necessary order, address and contact details. Payment/delivery providers may also act as controllers for their own services.

8. International transfers and retention

Some providers may process data outside the EEA. Where required, an appropriate lawful transfer mechanism applies, such as an adequacy decision or standard contractual clauses; you may request further information. Account data is kept as needed to provide the service; transaction records are retained for applicable tax/accounting obligations and legal claims. Temporary sign-in data expires; local storage depends on its purpose and your deletion choices. There is no single retention period for all categories.

9. Deleting your account

Use Account → Delete account with secure verification, or contact our email. Processing starts after 24 hours and may first require completion of outstanding orders, payments or settlement of a cash-wallet refund. Account personal details, addresses, favourites, cart and profile photo are removed; legally required invoice/transaction records are retained. Unused loyalty points end when deletion completes. Save any active gift cards before completion.

10. Your rights

You may request access, correction, erasure, restriction, portability or object where applicable. Withdrawing consent does not affect earlier lawful processing. We respond under GDPR time limits, normally within one month; identity verification may be required. You may complain to the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy). We do not make solely automated decisions producing legal or similarly significant effects.

11. Updates

The date and version are displayed on this page. The app loads the current text from our server. Material changes are communicated where required; changing this policy alone does not enable a new use that requires consent.

Google reviews

This website may display public Google reviews of KOJO SUSHI, including reviewer names, images and available attribution links. Reviews and ratings are provided by Google. Reviewer images load from Google services when reviews are displayed; Google then receives technical connection details such as your IP address. New reviews are submitted only on Google using the customer’s Google account. These features are also subject to the following Google terms and privacy policy.

Google Maps / Google Earth Additional Terms of Service
Google Privacy Policy