https://www.table9.md/privacy-policy

Last updated: 20 August 2026

1. Personal data controller

The controller is RAHAF SRL, IDNO 1017600018378, registered office at 22 Decebal Blvd., MD-2038, Chisinau, Republic of Moldova, operator of the Table 9 brand and www.table9.md.

For questions and rights requests: restaurant@table9.md, phone 069 474 436, or the contact form on www.table9.md. RAHAF SRL is the responsible entity;

2. Scope

This Policy explains how Table 9 collects, uses, stores, shares and protects data about people who use the website, create an account, order food, make reservations, submit the contact form, use the Table 9 discount card, receive promotional SMS messages or visit areas covered by video surveillance.

Processing is carried out under the laws of the Republic of Moldova, including Law No. 195/2024 on Personal Data Protection, together with applicable rules on information-society services, consumer protection and commercial communications.

3. Processing principles

Table 9 seeks to process data lawfully, fairly and transparently; collect it for specified and legitimate purposes; limit it to what is necessary; keep it accurate; retain it only as long as necessary; and protect it with appropriate technical and organisational measures.

4. Personal data we collect

• User account: first name, last name, e-mail, phone number and password managed by Wix; the address may be added later and is optional.

• Online order: e-mail, first name, last name, phone number, ordered items and, for delivery, the delivery address.

• Reservation: first name and phone number as required personal details, together with date, time, number of guests and other selected/provided booking details.

• Contact form: name and phone number as required fields, together with any optional information voluntarily submitted.

• Payment: amount, status and transaction identifiers. Table 9 does not store full card details; these are processed by Paynet.

• Table 9 discount card: first name, last name, phone number and, where given, the status of separate consent for promotional SMS; data is stored in Poster POS.

• SMS marketing: phone number, evidence of consent or another applicable lawful basis, and opt-out/objection information as needed to honour the request.

• Technical data: IP address, browser and device type, operating system, technical identifiers, security logs, website activity and cookie-generated data.

• Video surveillance: CCTV images from both Table 9 locations. Audio is not recorded.

• Allergy/intolerance information only where voluntarily provided by the customer for an order or service.

5. Sources of data

Data is obtained directly from customers through the website, account, orders, reservations, contact form, phone, restaurant interactions and discount card. For orders placed through Glovo, Table 9 receives the information required to fulfil the order from the platform. Technical data is collected through Wix and enabled analytics/advertising services according to the user’s cookie choices.

6. Purposes and legal bases

Creating and managing the user account: Performance of the requested service/contract and legitimate interest in account administration and security.

Orders, delivery, pickup and order communications: Performance of a contract and pre-contract steps requested by the customer.

Reservations: Performance of the requested service/pre-contract steps and legitimate interest in operational organisation.

Contact form and enquiries: Steps taken at the person’s request and legitimate interest in customer relations.

Payments, accounting and tax records: Performance of a contract and legal obligations.

Table 9 discount card: Performance of the loyalty programme requested by the customer and legitimate interest in programme administration.

Promotional SMS: Separate consent where required; otherwise only to the extent applicable law expressly permits use of existing-customer contact details, with a simple and free right to object.

Wix Analytics, Google Analytics: Consent for non-essential cookies where required.

Google Ads, Meta/Facebook Pixel: Consent for marketing/advertising cookies and technologies.

Website security and fraud prevention: Legitimate interest and, where applicable, legal security obligations.

CCTV: personal safety, theft prevention and protection of property: Legitimate interests of RAHAF SRL and persons on the premises, subject to proportionality.

Establishing, exercising or defending legal claims: Legitimate interest and legal obligations, where applicable.

7. Required and optional data

Required fields are necessary for the relevant service. Without them we may be unable to process an order, confirm a reservation, create an account or respond to an enquiry. The address in the account profile is optional. Consent to promotional SMS and non-essential cookies is separate and is not a condition for placing an order or making a reservation.

8. Recipients and service providers

Table 9 does not sell personal data. To the extent necessary, data may be accessed by or disclosed to:

• Wix — website hosting and operation, accounts, forms, orders, reservations and Wix Analytics. Website customer data is stored in Wix infrastructure; internal access is limited to the authorised restaurant administrator.

• Paynet — online payment processing; Table 9 does not store full card details.

• Google — Google Analytics and Google Ads, according to cookie consent.

• Meta — Meta/Facebook Pixel, according to cookie consent.

• ROCK SOFT S.R.L. / sms.md — technical delivery of promotional SMS where there is an applicable lawful basis.

• Poster POS — administration of the Table 9 discount card and associated programme data.

• Glovo — a third-party platform for orders placed through Glovo; Glovo determines its own purposes and rules for data processed within its platform.

• Hikvision — infrastructure used to access CCTV stored locally on DVR/NVR.

• Imou — cloud storage for part of the CCTV recordings.

• Public authorities, courts and professional advisers where disclosure is required by law or necessary to protect rights.

9. International transfers

Some technology providers, including Wix, Google, Meta and Imou, may process data or permit access to it outside the Republic of Moldova. Where an international transfer occurs, RAHAF SRL applies, as required, the conditions and safeguards provided by Law No. 195/2024. Further information may be requested at restaurant@table9.md.

10. Retention periods

User account: Until a deletion request or a maximum of 5 years of inactivity, whichever occurs first, except where data must be retained by law.

Orders and reservations by customers without an account: 3 years from the last order or reservation, then deletion/anonymisation, subject to mandatory retention.

Order/reservation history linked to an account: For the life of the account, but not beyond 5 years of inactivity, subject to legal retention and legal-claims needs.

Contact form: 12 months after the enquiry is resolved unless a lawful reason requires longer retention.

SMS marketing: Until withdrawal/objection or a maximum of 24 months after the last relevant interaction, whichever is earlier. A minimal suppression record may be retained to respect the opt-out.

Discount-card data in Poster POS: Maximum 5 years after the card was last used, then deletion/anonymisation unless legal obligations apply.

CCTV — Hikvision local / Imou cloud: 14 days, except footage needed for incident investigation, legal claims or a lawful authority request.

Accounting/tax documents: For the periods required by applicable accounting, tax and archival law.

Cookies and online identifiers: According to the technical lifetime of the cookie and the user’s preferences; consent can be withdrawn at any time.

11. Data security

RAHAF SRL applies reasonable technical and organisational security measures. Access to Wix customer data is limited to the authorised restaurant administrator, while internal access to CCTV footage is limited to the director. Account passwords are managed by Wix and are not visible to Table 9 in readable form.

12. Your rights

Subject to Law No. 195/2024, individuals may have rights to information and access; rectification; erasure; restriction of processing; data portability; objection, including a free objection at any time to direct marketing; withdrawal of consent; protection from solely automated decisions with legal or similarly significant effects; and the right to lodge a complaint with the CNPDCP and seek judicial remedies.

Requests may be sent to restaurant@table9.md or through the website contact form. RAHAF SRL may request reasonable information to verify identity. Requests are handled without undue delay and generally within one month, with extensions only where permitted by law.

13. Account and data deletion

Customers may request deletion of their account and/or personal data through the contact form at www.table9.md or by e-mail at restaurant@table9.md. Deletion does not apply to information that must be retained by law or is necessary to establish, exercise or defend legal claims.

14. Promotional SMS

Table 9 sends promotional SMS only where an applicable lawful basis exists. Where online consent is used, it must be separate and optional; an order or reservation can be completed without consenting to marketing. For the discount card, separate consent for promotional SMS is recorded in Poster POS.

You may opt out free of charge at any time through the contact form on www.table9.md or by e-mail to restaurant@table9.md. After the opt-out is processed, the number will no longer be used for promotional messages. The technical SMS provider is ROCK SOFT S.R.L. / sms.md.

15. Cookies and similar technologies

The website uses cookies and similar technologies. The consent banner separates essential, functional, analytics and marketing categories. Strictly necessary cookies are used for website operation and security; non-essential cookies are enabled according to the user’s choice and the applicable legal basis.

Essential: Website operation, security and core functionality.

Functional: Remembering selected preferences and optional functions.

Analytics: Wix Analytics and Google Analytics for measuring website use, where accepted.

Marketing: Google Ads and Meta/Facebook Pixel for measuring and personalising advertising, where accepted.

Users can accept or reject optional cookies and later change their choices through the “Cookie Settings” mechanism available on the website. Withdrawal does not affect the lawfulness of processing before withdrawal.

16. Video surveillance (CCTV)

Both Table 9 locations, 22 Decebal Blvd. and 34/1 Drumul Viilor St., are covered by video surveillance for personal safety, theft prevention and protection of property. Visible CCTV notices are displayed at the entrances.

The cameras record images only, without audio. Hikvision recordings are stored locally on DVR/NVR and the system is also used for remote access. Part of the system uses Imou for cloud storage. The standard retention period is 14 days. Internal access is limited to the director, except for necessary authorised technical access and lawful requests from public authorities.

17. Children's data

The website is not specifically directed at collecting data from children. Table 9 does not intentionally ask children to create profiles or provide unnecessary information. Where an adult provides limited information about a child for a reservation or event, it is used only to the extent necessary to provide the service.

18. Automated decision-making

Table 9 does not currently use solely automated processes to make decisions that have legal or similarly significant effects on customers. If this changes, the Policy will be updated as required by law.

19. Changes to this Policy

This Policy may be updated to reflect legal, technical or operational changes. The current version and the last-updated date will be published on the website. Where a new consent is required, it will be obtained before the relevant consent-based processing begins.

20. Contact and supervisory authority

For personal-data questions or requests: RAHAF SRL, 22 Decebal Blvd., MD-2038, Chisinau, Republic of Moldova; restaurant@table9.md; phone 069 474 436; or the contact form on www.table9.md.

Individuals have the right to lodge a complaint with the National Centre for Personal Data Protection (CNPDCP): MD-2004, 48 Serghei Lazo St., Chisinau, Republic of Moldova; phone (022) 820 801; e-mail centru@datepersonale.md.