Privacy Policy

We may revise this policy from time to time to reflect updates to our practices, operational requirements, or legal and regulatory obligations. Changes take effect once published on this page, and the “last updated” date above will change.

Information you give us

• Contact information — your name, delivery address, phone number and email address.
• Order details — what you ordered, where it goes, delivery notes, allergy notes, and payment confirmation.
• Account information — your login credentials and the information used to keep your account secure.
• Customer support information — anything you share when you contact us or submit an enquiry through our forms.

Some features need specific information to work. You can choose not to provide it, but that may limit what you can use.

Your profile photo

A profile photo is optional. If you upload one, we store the image and show it in your account; you can replace or remove it at any time from your profile, and removing it deletes the stored file.

If you signed in with Apple or Google and that account has a picture, we show it as your photo until you set your own. That image is not copied to us — it is loaded from Apple or Google each time it is displayed, which means they can see that it was requested. You can turn that off with a single tick in your profile, and we will show your initials instead; uploading your own photo also replaces it. Because the image stays with them, it changes when you change it there, and we cannot keep a copy after you switch it off.

Information collected automatically

We gather technical information about how you use our services through cookies and similar technologies — device type, browser, network details, IP address and interaction data. See our Cookie Policy for the categories we use and how to control them.

Information collected in our cafe

If you ask to collect Pechka rewards on an order placed at the counter, our team will ask for your phone number so the order can be attached to a rewards account. If you do not already have an account, this creates a provisional one holding only your phone number and any name you give. You are free to decline, and the order proceeds normally without rewards. Scanning a QR code at a table does not collect your phone number.

Information from third parties

We receive information from vendors who collect it on our behalf, including our payment processor.

You can also order Pechka food through a delivery marketplace — we are on Deliveroo, Talabat, Careem, Keeta, Instashop and Noon. When you do, your relationship is with that platform and their privacy policy, not ours, governs what they collect from you and what they do with it.

They pass us what we need to fulfil the order, and exactly what that includes varies from one platform to another — always the order itself along with a name or order reference, and in some cases your phone number and delivery address. We use whatever we receive only to prepare and hand over that order.

Those orders reach our kitchens through Deliverect, the integration service that connects every marketplace to our kitchen system so an order arrives in one place rather than on six separate tablets. Whatever a platform sends us passes through Deliverect on the way. They act on our instructions and use it for nothing else.

• To provide our services — accepting and preparing orders, coordinating delivery, taking payment, sending order updates, and managing your account.
• To operate the rewards programme — calculating sushki, applying credit, and maintaining your balance.
• To send marketing communications, only where you have opted in, as described in our Marketing Policy. You can opt out at any time.
• To prevent fraud — detecting, investigating and preventing fraudulent or unauthorised activity, and verifying transactions.
• To respond to you and improve — answering support requests and analysing usage patterns to make the service better.
• To meet our legal, tax and regulatory obligations.

We do not sell your personal information. We share it with the service providers below, who process it on our instructions and only for the purposes we set.

Not every order goes to the same delivery partner. Some are delivered by our own team, and for the rest we book a rider when the order is ready, based on where you are and who is available. Whichever it is, they receive your details only for the order they are delivering.

Careem and Noon each appear twice on this page, because each of them plays two separate roles for us, and which one applies depends entirely on where you placed your order.

• Ordering here, on our own site. We take your order, and we book the rider — that may be Careem, Noon or Porter, or our own team. They get your name, phone number and address purely to complete that delivery. Everything else on this page about how we handle your data applies.
• Ordering on a marketplace — Deliveroo, Talabat, Careem, Keeta, Instashop or Noon. The order is placed with that platform, reaches our kitchen through Deliverect, and their rider collects it. We never book a courier for those orders, and we only ever see the details the platform chooses to pass on. Their privacy policy governs the rest.

We may also disclose information:

• To professional advisers, such as our accountants and lawyers.
• Where required by law, or to establish, exercise or defend legal claims, and to protect our rights, property and the safety of our people and customers.
• In connection with a merger, acquisition or sale of assets, in which case your information may transfer to the acquiring party.

Our database, sign-in and file storage are hosted in India (Mumbai), and the servers that run this website and process your order sit in the same region — so placing an order and storing the result happen in one place rather than across several. We chose it because it is the closest region our hosting providers offer to Dubai, which is also what makes the site quick for you. Our scheduled background jobs run in the European Union.

Beyond that, the specialist services we rely on — card payments, SMS and WhatsApp, email, and maps — operate internationally, so some of your information reaches countries outside the United Arab Emirates, including the United States. Pages and images are served from whichever of our host’s locations is nearest you, which is why the site loads quickly wherever you open it. Our delivery partners are UAE businesses, and the details we pass them to bring you an order stay in the UAE.

UAE data protection law permits personal data to be transferred abroad where the recipient is bound by a contract requiring protections equivalent to those under UAE law, and where the transfer is necessary to perform a contract with you — such as preparing and delivering the order you placed. We rely on both.

Every provider named above that processes your data outside the UAE is engaged under a written agreement that:

• incorporates the European Commission’s Standard Contractual Clauses, the transfer safeguard most widely recognised internationally;
• restricts them to processing your data only on our documented instructions;
• requires appropriate technical and organisational security measures, independently audited and evidenced on request;
• obliges them to impose equivalent commitments on any sub-processor they engage, and keeps them liable for it; and
• requires them to delete your data when our agreement with them ends.

The riders we book for an order placed here are a different case, because they work in the UAE and no transfer abroad arises. Careem is engaged under a signed contract. Porter we book by phone, without one — so what limits what they see is the booking itself: your name, phone number, delivery address and any directions you added, for the single delivery in front of them, and nothing else. No payment details, no order history, no access to any system of ours.

For those orders — the ones you place with us — the delivery remains our responsibility until the food reaches you, so if it goes wrong your claim is with us and not with the rider. An order placed on a marketplace is the other way round: their rider delivers it, and that delivery is theirs to answer for. Either way, see our Refunds & Returns page.

We keep personal information for as long as we need it for the purpose it was collected, and for as long as the law requires. In practice:

• Account and order records are kept while your account is open, and afterwards for as long as we are required to retain financial records.
• Kitchen and delivery system event logs are deleted after 60 days.
• Order dispatch photographs are deleted after 90 days.
• Operational alert records and in-cafe order mirrors in our own systems are deleted after 48 hours.
• Sushki expire six months after they are earned.

We take reasonable technical and organisational measures to protect your personal information. In practice that means:

• Everything travels over an encrypted connection, and our database is encrypted where it is stored.
• Your order and account records are not readable from the public internet. Our website reaches them only through the server, which checks who you are on every request — the database refuses to return another customer’s data even if it is asked directly.
• Staff see only what their role requires, and only for the branches they work at. Actions taken in our admin tools are logged.
• Card details never reach us. They are entered on our payment provider’s own secure page, and we receive only the result.
• Where we store something we do not need in full — such as the phone number behind a one-time code — we keep only a one-way scrambled version of it.
• Malicious and automated traffic is filtered before it reaches the site, and our forms check that a person is filling them in. Both look at your IP address to do so, and neither is used to identify you.

No method of transmission or storage is completely secure, so please avoid sending sensitive information such as card numbers or identity documents by email or chat.

Depending on your location and applicable law, you may have the right to:

• Request access to the information we hold about you.
• Request that we correct information that is inaccurate or incomplete.
• Request that we delete your information, subject to our legal and operational obligations.
• Request a copy of your information in a portable format, where technically feasible.
• Ask us to restrict how we process your information, in certain circumstances.
• Withdraw your consent where our processing relies on it.

Your marketing preferences can be changed at any time in your account settings. Everything else — including account closure, access requests and data copies — is handled by our team rather than automatically: email contact@pechka.ae and we will respond within 30 days.

Even after opting out of marketing, you will still receive messages about orders you place, such as confirmations and delivery updates. These are service messages, not marketing.

Our services are not directed at children, and we do not knowingly collect personal information from anyone under the applicable age of consent. If you are a parent or guardian and believe a child has given us personal information, contact us and we will delete it.

Our site links to third-party websites and services we do not control, including delivery marketplaces and social media. We are not responsible for their privacy practices, and we encourage you to read their policies before sharing personal information with them.

If you have a question or concern about how we handle your personal information, contact us and we will look into it.

• Email: contact@pechka.ae
• Phone: +971 4 575 9431

You may also have the right to raise a complaint with the data protection authority in your country of residence.