Privacy policy

Last updated: 29 October 2026

1. Who is responsible for your data

The controller is Fresh Korner 2024, trading as FAST FRUIT. Registered address: Pero Nakov 118. This policy covers fastfruit.mk, website accounts and the digital Rewards programme.

For privacy enquiries and rights requests: fastfruitmk@gmail.com.

2. Information we process

• Account: name, surname, email address, account identifier, registration and confirmation dates, accepted terms and privacy-notice versions and acceptance time, and information needed for secure sign-in. Supabase processes passwords and stores cryptographic hashes, rather than readable passwords.
• Rewards, if you join: membership identifier and QR code, eligible products and quantities, selected redemption extras, receipt references, dates, stamps, earned rewards and redemptions. Authorised staff enter or verify these records.
• Usage and security: IP address, browser and device information, requested pages, request time, errors, sessions, and security and administrative records. Hosting and authentication services process technical data when you visit, including without an account.
• Communications: your email address and information you choose to share when contacting us. Account emails involve processing the recipient address, message content and delivery information.

We obtain information from you, from staff verifying your purchases, and automatically through use of the website. This website does not collect payment-card details or process online payments.

For rewards, we store the selected product, extras and selection and collection times. Your choice stays saved until collection. These records provide the Rewards service and help us understand reward preferences through aggregate product reports.

3. Purposes and legal bases

• Creating and maintaining accounts, email confirmation, password resets and Rewards operation: to provide the service you request and perform the programme agreement.
• Protecting accounts, preventing abuse and duplicate receipts, resolving errors and handling support requests: our legitimate interest in operating the service securely and correctly.
• Responding to legal requirements and retaining necessary records: compliance with applicable legal obligations, where required.
• Loading the embedded Google Maps map: your choice and consent through the Load map button. You can use the page without loading the map.

An account requires a name, surname, email address and password. Your name identifies your Rewards card and purchase and reward history in the administrator view. A digital Rewards card requires an account and eligible-purchase records. Creating an account does not subscribe you to marketing emails, and we do not sell your personal data.

4. Who receives your information

Authorised staff have access according to their role and the need to handle accounts, purchases, rewards or support. We use these services:

• Cloudflare — website hosting, delivery and traffic protection.
• Supabase — accounts, authentication, the Rewards database and content storage.
• Resend — delivery of account messages, including email confirmation and password resets, and delivery records.
• Google — emails sent to our Gmail contact address; Google Maps loads only when you choose it, as explained below.

We may also disclose information where legally required or necessary to handle a legal claim. Other customers do not receive access to your account.

5. Processing outside North Macedonia

Our service providers use international infrastructure and subprocessors. Processing can involve the EU/EEA, the United States and other locations described in their terms. Resend states that email and log data is stored in the United States; selecting Ireland as the sending region does not restrict storage to Ireland.

Their data-processing terms describe safeguards, subprocessors and applicable international-transfer mechanisms, including standard contractual clauses where applicable. The documents are available below; you can also contact us for further information or a copy of relevant safeguards.

Supabase DPA · Cloudflare DPA · Resend DPA

6. Cookies and the embedded map

• ff_lang — remembers your language preference for up to one year. You can delete it in your browser.
• sb-* — authentication and link-verification cookies. They are needed for sign-in and secure account use. They may have a lifetime of up to 400 days, while session validity also depends on tokens and security settings. Signing out removes sign-in cookies.

Cloudflare may also use necessary security cookies when its protection features are triggered. We do not use advertising pixels or marketing cookies on this website. You can block or delete cookies through browser settings; blocking sign-in cookies may prevent account use.

On the staff page, the camera is used only when selected to read a membership QR code. Images are processed locally and are not uploaded. The membership code and a unique purchase reference are submitted. An unconfirmed scan is kept in that tab's sessionStorage for safe retries and removed after confirmation or when the tab closes.

Google Maps connects to Google only after you select Load map. Google may then receive your IP address and browser information and use its own cookies. The map choice is not remembered: reloading or leaving the page stops loading it unless you choose it again. Use your browser settings to manage Google cookies already placed. Google privacy policy.

7. How long we retain data

We keep account data while the account is open and needed to provide the service. If you join Rewards, we retain the history needed to display and honour your stamps and unused rewards, which have no expiry. Longer retention is limited to what is necessary for a legal obligation, a specific dispute or a justified security investigation.

Support correspondence is kept while resolving the request and as needed to document it or handle a dispute. Technical logs and backups also follow provider retention limits and rotation cycles. Resend states a 30-day retention period for email and log data on the current plan. Deleted information may remain in restricted backups until routine rotation.

8. Your rights and account deletion

Subject to applicable law, you may request access and a copy, correction, deletion, restriction or data portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Email fastfruitmk@gmail.com from your account address and explain your request. We may ask for reasonable identity verification to protect your information. We respond without undue delay within applicable legal time limits. Requests are assessed individually; if some records must be retained, we will explain the reason and the applicable period or criteria.

Use the same email contact to request account closure and deletion. Before closing the account, we will explain how this affects membership and unused rewards. The menu remains available without an account.

You can also lodge a data-protection complaint with the Personal Data Protection Agency of North Macedonia (AZLP).

9. Security and automated processing

We use HTTPS, role- and session-based access controls and additional authentication for administration. No service can guarantee absolute security. Rewards automatically counts verified stamps and creates rewards under the published rules; staff verify purchases and redemptions. We do not use advertising profiling or solely automated decisions with legal or similarly significant effects.

10. External services and updates

When you open Wolt, Instagram or an external Google Maps link, their processing is also governed by their own policies. Wolt orders and payments are handled on Wolt. These services are not needed to browse our menu.

We update this policy when services or processing change and show the date above. We provide additional notice of material changes where applicable law requires it.