Privacy policy

1. Who we are

This policy explains how CMD Trading AB (registration number 559544-5502), trading as Uma's Momo, handles personal data. Our address is Linnégatan 44, Gothenburg, Sweden.

We are the data controller for all the personal data described in this policy. That means we decide how and why it is used.

This policy covers our website at umasmomo.com, our table booking system at boka.umasmomo.com, the forms on our website, and food orders you place with us through Happy Order. It applies inside the booking pages in the same way as on the rest of the website.

If we start collecting personal data in a new way, we will update this policy before we do.

To contact us about your personal data, email info@umasmomo.com or write to us at the address above.

2. Visiting our website

You can browse our website and booking pages without telling us who you are.

When you visit, our hosting provider processes technical information, such as your IP address and the type of browser you use. It needs this to show you the pages and to protect them from misuse. We do not use it to find out who you are.

We do not use cookies or similar technologies for advertising or tracking, and we do not use cookies for analytics. The only cookies our website and booking pages may use are those strictly necessary for them to work, for example to keep a page secure. These do not need your consent.

To understand how our website is used and how quickly its pages load, we use Cloudflare Web Analytics. It does not set cookies, does not store anything on your device and does not identify you. For each page view, it records the page you viewed, the website that sent you to it, your type of device, browser and operating system, the country you are in and how quickly the page loaded. We see this information only as totals.

If we ever want to use any other kind, we will ask for your consent first and update this policy.

3. Booking a table

You can book online, by telephone or in person. However you book, we collect:

• your name
• your email address
• your telephone number
• any notes you choose to add, for example about allergies or special requests
• the details of your booking: the date, time, group size, whether you sit inside or outside, and the language you book in
• whether you arrived for your booking
• if a minimum spend applies to your booking, a record that you accepted it.

4. Allergy and health information

The notes field is optional. If you tell us about an allergy or another health matter, that is health data. The law treats health data as a special category of personal data and protects it more strictly.

We use health information only to prepare your visit safely. We rely on your explicit consent to hold it.

When you add a note online, we ask you to tick a box agreeing that we may use any health information in it. If you book by telephone, in giving our staff such information we consider that we have your agreement and record it.

Your notes are seen only by our restaurant staff and never appear on any guest-facing page. We repeat them only in your own confirmation email, so that you can check them.

You can withdraw your consent at any time by contacting us. We will then delete the health information from your booking. If you would rather not give us this information at booking, you can tell our staff when you arrive.

5. Applying for a job

When we advertise a vacancy, you can apply through our website. We collect your name, email address, contact address and CV, and anything else you choose to include in your application.

We use your application only to consider you for the job you applied for and, if you ask us to, for future vacancies.

When you apply, you can tick a box asking us to keep your application on file for future vacancies. Section 12 explains how long we keep your application in each case.

Please do not include information about your health, ethnic origin, religion or beliefs, sexual orientation, political opinions or trade union membership unless you want us to know it. If you do include it, we do not use it to decide on your application. We use it only if you ask us to, for example to arrange an interview that suits a health need, and we delete it with the rest of your application.

6. Business enquiries

If you are interested in running an Uma's Momo restaurant, or in working with us in another way as we grow, you can send us an enquiry through our website.

We collect your name and business contact details, and anything else your enquiry contains. This may include financial information, such as the funds you have available to invest. We treat financial information as confidential.

We use your enquiry only to reply to you and to consider whether we can work together. When you send it, you confirm by ticking a box that you accept our terms and have read this policy.

7. Ordering food for collection

To order food for collection, you use Happy Order's ordering platform, which our website links to. When you order, you buy from us. Happy Order handles your order and payment on our behalf.

We receive your name, mobile number and order. We use them to prepare your order, hand it over and deal with any complaint. We do not receive your card details.

Happy Order's own privacy policy covers your Happy Order account, your payment and your use of its app.

8. Why we use your data and our legal basis

We use your booking data to take and manage your booking. This includes sending you a confirmation, a reminder the day before and, where applicable, an email if your booking is changed or cancelled. Our legal basis is that the processing is necessary to perform our agreement with you.

We keep your details after your visit, for the time set out in section 12, so that our staff can trace a booking later, for example if you leave something behind. Our legal basis is our legitimate interest in being able to do this.

We hold health information on the basis of your explicit consent, as set out in section 4.

We use your job application to take steps you have asked for before we may employ you. That is our legal basis. If you ask us to keep your application for future vacancies, our legal basis for keeping it is your consent, which you can withdraw at any time.

We use your franchise or business enquiry to take steps you have asked for before we may enter into an agreement with you, and in our legitimate interest in growing our business. Those are our legal bases.

We use your food order to perform our sale to you. That is our legal basis. We keep records of the sale because accounting law requires us to.

We process technical information about visits to our website in our legitimate interest in running a secure website.

We count visits to our website, as described in section 2, in our legitimate interest in understanding how our website is used and improving it.

We do not send you marketing. If we ever plan to, we will update this policy first. We do not sell your data. We do not make automated decisions about you.

9. Links to other websites

Our website links to other websites that we do not run. When you follow one of those links, you leave our website. This policy and our terms do not cover what happens on those websites.

10. Who we share your data with

We use service providers to run our website, booking system, ordering and till system, and email. Each acts as our processor. That means it may use your data only on our instructions and only to provide its service to us. They include:

• Cloudflare, which runs our booking system, delivers our website and provides our website statistics
• Supabase, which hosts the database that holds our booking records
• Resend, which sends our booking emails
• Google, which provides our email
• Happy Order AB, which provides our ordering and till system.
• Mammoth Enterprises Ltd (trading as AI Mammoth), which builds and supports our booking system

We do not share your data with anyone else unless the law requires us to.

11. Where your data is stored

Our booking records are held in Stockholm, Sweden. Nightly backup copies of them are kept in Cloudflare's storage in the EU. Our booking emails are sent through Ireland.

Mammoth Enterprises Ltd may access booking records from the United Kingdom to support the booking system. The European Commission has decided that the United Kingdom protects personal data to an adequate standard.

Some of our service providers are based outside the EU, for example in the United States, and may access data from there, for example to give support. When they do, they use safeguards approved under EU law, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

12. How long we keep your data

If you book a table, we keep your name, email address, telephone number and booking notes for 24 months after your most recent booking. Every night, our booking system removes these details for any guest whose most recent booking is older than that.

If you book again, the time starts again from your new booking. While you have a booking coming up, we never remove your details.

Once your details are removed, we keep a record of the booking itself: the date, time, group size, whether you sat inside or outside, the language you booked in and whether you arrived. It no longer identifies you, and we keep it indefinitely for our own statistics.

You can ask us to delete your details sooner, at any time. We will then remove them in the same way, without waiting for the time to pass. Backup copies are kept for 30 days, so removed details also disappear from the backups within that time.

If you apply for a job and are not offered it, we keep your application for 6 months after our decision, in case we need to show how the decision was made, and then delete it.

If you asked us to keep your application on file for future vacancies, we keep it for one year from the day we receive it instead, or for the period above if that ends later. You can ask us to delete it sooner. If you are offered a job, your application becomes part of your staff records.

If you send us a franchise or business enquiry, we keep it for no longer than two years from the day we receive it, and then delete it. If we go on to make an agreement with you, the information becomes part of the records of that agreement.

We keep records of food orders for as long as accounting law requires.

Our hosting provider keeps technical information about visits only for as long as it needs to run and protect the website.

Cloudflare keeps the full information behind our website statistics for 7 days. After that, it keeps a reduced sample, which we can see for 6 months.

We may keep information for longer if the law requires us to.

13. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct data that is wrong
• ask us to delete your data
• ask us to restrict how we use your data
• object to our use of your data where we rely on our legitimate interest
• receive the data you gave us in a format you can take elsewhere
• withdraw your consent where we rely on it.

To use any of these rights, contact us using the details in section 1. We will reply within one month.

14. Complaints

If you are unhappy with how we handle your data, please contact us first so that we can try to put it right.

You also have the right to complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY) (the Swedish Authority for Privacy Protection), at imy.se. If you live or work in another EU country, you can also complain to the data protection authority there.

15. Changes to this policy

We may update this policy. The date at the top shows when it last changed.