Privacy policy
This policy explains what data about you we receive when you use the website momonga.uz — when you view the menu, order at your table, pay online, — why we need it, who we share it with, how long we keep it and how you can exercise control over it.
1. Who is responsible for your data
ООО «IMPASTO» (“we”, “the venue”) is responsible for processing your personal data as the owner and operator of personal data within the meaning of the Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547.
- TIN (STIR): 311 678 510; VAT payer registration code: 326010266722
- Registered address: г. Ташкент, Мирабадский район, OYBEK MFY, ул. Амира Темура, 22
- Venue address: ул. Амира Темура, 22/5
- Data enquiries: momonga@momonga.uz, telephone +998 92 045 04 05
Technical operator of the website. The website momonga.uz runs on the POSse platform. POSse processes your data only on our instructions and for our purposes — as a processor, under a data processing agreement. POSse itself makes no decisions about your data and does not use it for its own purposes, except to protect the platform against abuse. How POSse stores and protects data and which subcontractors it engages is set out in its policy: getposse.app/privacy.
2. What data we receive and why
We receive only what is needed for a specific action on the website. Below, situation by situation. The “legal basis” is the legal reason on which the law permits us to process the data.
2.1 You simply view the menu
- What: a random device identifier and a tab identifier, created in your browser’s storage; the events “opened the menu”, “opened a dish”, “added to basket”, “added to favourites”; the language selected. Your IP address and browser details are not stored with these events.
- Why: to see which dishes and menu sections are viewed most often, and to show the “favourites” counter.
- Legal basis: our legitimate interest in improving the menu without advertising trackers. The identifier is not linked to your name, but it is a pseudonymous, not an anonymous, identifier: you can delete it by clearing the website’s data in your browser (section 7).
2.2 Email asking for a review
If you provided an email address when booking or ordering for pickup, two days after your visit we may send you one email asking you to rate us on Google. The legal basis is our legitimate interest in learning your opinion. If you do not want such emails, write to us and we will make a note of it.
2.3 You order or pay at your table
- What: table number, items and total of the order, number of guests, comment. “Your order” is stored in the browser for the duration of your visit so that you can see it after reloading the page.
- Why: to send the order to the kitchen and to issue and settle the bill.
- Legal basis: performance of a contract with you.
2.4 You pay online
Payment takes place on the secure page of the payment service Multicard. You enter your card number, expiry date and security code on the payment service’s page — they do not reach us, and we do not store them.
- What we receive: the amount, currency, payment status, its reference at the payment service, a link to the receipt and a technical payment notification in the form in which the payment service sends it — it may contain a masked card number (for example, 4444 •••• 1234) and the payer’s name.
- What the payment service receives from us: the amount, order number, description and items of the order. We do not pass your name or telephone number to it.
- Why: to process and confirm the payment and to make refunds.
- Legal basis: performance of a contract with you; keeping records of payments — compliance with our legal obligation under accounting and tax law.
2.5 Our guest database and emails from us
Your bookings and pickup orders form a guest record with us: name, telephone number, email address, language, history of bookings and orders. We use it to recognise regular guests and to send you emails about our venue: a new menu, events, promotions — only about our own services similar to those you have already ordered. We do not ask for separate consent: the law allows us to write to our own guests provided they can opt out at any time, free of charge. The legal basis is our legitimate interest.
Every email contains an “Unsubscribe” link — it works in a single click, without signing in or confirmations. If an email is not delivered or you mark it as spam, we automatically stop writing to you. Emails are sent on our behalf through the POSse platform’s email service.
2.6 You write to us or call us
- What: your contact details and the content of your enquiry.
- Why: to reply to you, to consider a complaint, to fulfil your data request.
- Legal basis: our legitimate interest in replying; for complaints and data requests — compliance with a legal obligation.
2.7 Analytics and advertising — only with your consent
We use Meta Pixel (Meta Platforms) and Google Analytics 4 (Google) — to understand where our guests come from and to show our advertising to people who are interested in it. These services are loaded only after you have clicked “Accept all” in the cookie banner. If you clicked “Reject all”, they do not run at all.
After consent, these companies receive your IP address, browser details and their own cookies directly. In addition, the website’s server sends Meta events (view, add to basket, purchase, booking) with your IP address, browser details, Meta cookies and an irreversible fingerprint (hash) of the device identifier, and for purchases and bookings also hashes of your email address, telephone number and name, which Meta uses to match the event to its users. Your email address, telephone number and name themselves are not sent to Meta.
- Legal basis: your consent. For this data, Meta and Google are independent controllers under their own rules: Meta, Google.
2.8 What we do not do
- We do not receive or store full bank card details.
- We do not ask for identity documents, passwords or your geolocation.
- We do not sell your data or pass it to others for advertising.
- We do not make decisions about you that have legal effects automatically, without human involvement.
3. Who we share data with
- Our staff — only those who need it to accept and fulfil a booking or order.
- POSse — the technical operator of the website, as a processor (section 1), and its subcontractors for hosting, database and sending emails. Their list and countries are in the POSse policy.
- The payment service Multicard — to process payment (section 2.4).
- Our till system iiko — so that the order reaches the kitchen and our accounts: the items of the order and name, telephone number, and comment.
- The Telegram messenger — notifications of new bookings and orders are sent to our staff’s work chat and contain your name, telephone number, email address and comment.
- Meta and Google — only with your consent (section 2.7).
- Google — when the map on the home page loads (section 7).
- Public authorities — only where the law requires it, and to the extent the law requires.
4. Where data is stored and transfers to other countries
Data is stored in the United Kingdom, where the database and application of the POSse platform run, and the data of guests in our country is also stored in a local database within its territory.
The law requires personal data of citizens of the Republic of Uzbekistan to be processed using technical means physically located within the territory of Uzbekistan and registered in the state register; your data is stored in accordance with this requirement (see above). Transfer outside Uzbekistan is permitted to states that ensure adequate protection, and to other states with your consent.
5. How long we keep data
| Data | Period |
|---|---|
| Bookings, orders, guest record | Until you ask us to delete them, or until our venue stops operating on the platform — but no longer than necessary for the purposes in section 2 |
| Payment and settlement records | For the periods set by the accounting and tax legislation of the Republic of Uzbekistan (at least 5 years) |
| Menu viewing events and “favourites” | Until you delete them in your browser (identifier) or until the venue stops operating on the platform (events) |
| Record that you unsubscribed from emails | Indefinitely — so that we do not write to you again |
| Your choice in the cookie banner | Until you clear the website’s data in your browser |
At your request we delete the data or anonymise it (name, telephone number and email address are erased; order totals remain for accounting purposes). Information that the law obliges us to keep (payments, receipts) remains until the end of the statutory period but is not used for anything else.
6. How we protect data
The website works only over a secure connection (HTTPS). The data of different venues on the platform is isolated from each other. Access to guest data in the venue’s panel is available only to those of our staff to whom we have granted it, and to POSse technical support. The keys to our connections to the payment service and the till are stored in encrypted form. No protection is absolute; if a data breach occurs that creates a risk to you, we will notify you and the competent authority within the time limits set by law.
7. Cookies and browser storage
The website stores small records in your browser. Some of them are necessary for the website to work — they are set without asking. The rest are set only after you consent.
Necessary (no consent required):
| Record | Purpose | Period |
|---|---|---|
| Choice in the cookie banner | to remember your answer so as not to ask again | until you clear the website’s data |
| Basket | to remember what you have selected | until the tab is closed |
| “Your order” and the last payment at the table | to show your order after the page is reloaded | until the tab is closed |
| Device and tab identifier | menu statistics and “favourites” (section 2.1) | device — until you clear the website’s data; tab — until it is closed |
Only with consent (“Accept all”):
| Service | What it sets | Period |
|---|---|---|
| Meta Pixel | cookies _fbp, _fbc | up to 90 days |
| Google Analytics 4 | cookies _ga, _ga_* | up to 2 years |
Map. A Google map is embedded on the home page. When it loads, Google receives your IP address and browser details and may set its own cookies — under the rules of Google. If you do not want this, do not scroll the home page down to the map, or go straight to the menu.
How to change your choice. At present this is done by clearing the data of the website momonga.uz in your browser settings: the banner will then appear again. Cookies already set by Meta or Google can be deleted in the same place.
8. Your rights
You have the right to:
- find out whether we hold your data and obtain a copy of it;
- have inaccurate data corrected;
- request that your data be erased or its processing restricted;
- object to processing based on our legitimate interest — including opting out of emails at any time;
- withdraw your consent — this does not affect the lawfulness of processing before withdrawal;
- receive the data you have given us in a machine-readable format in order to transfer it to someone else;
- lodge a complaint with the competent authority (section 9).
How to exercise them. Write to momonga@momonga.uz or call +998 92 045 04 05. State what you would like and the contact detail you gave when booking or ordering — we will use it to find your data. To avoid disclosing someone else’s data, we may ask you to confirm that the contact detail is yours (for example, by replying from the same address). We will reply within the time limits set by Law No. ZRU-547. Our reply is free of charge.
9. Complaints
If you believe we are infringing your rights, please write to us first — we will try to resolve the matter quickly. You also have the right to contact the personal data protection authority: the competent state authority for personal data of the Republic of Uzbekistan.
10. Children
The website is not intended for children under 16 making bookings and orders on their own, without their parents’ involvement. We do not verify age; if you learn that a child has given us their data, write to us and we will delete it. Alcoholic drinks are sold only to adults (terms of ordering, section on alcohol).
11. Changes to this policy
We update this policy when the way the website works or the law changes. The new version is published on this page with a new date at the top. We will send previous versions on request.
12. For guests in Uzbekistan
You give consent to the processing of your personal data in electronic form — by the act of placing a booking or order after reading this policy. You can withdraw it by writing to us, except where processing is necessary to perform a contract already concluded or is required by law.