The data controller is FLO resto SIA, reg. No. 40203667313, operating FLŌ restorāns at 11. novembra krastmala 13, Rīga, LV-1050, Latvia.

For any privacy question, write to us at reservations@floresto.lv.

Reservations: your name, phone number, email, party size, date and time, and any notes or preferences you choose to share.

Allergies and dietary requirements, if you tell us about them. Information about your health is treated as a special category of personal data under Article 9 of the GDPR, and we only record it because you chose to give it to us so the kitchen can cook safely for you. You never have to, you can tell a member of staff on the night instead.

Deposits: if your booking takes a deposit, our payment provider handles your card. We never see or store your card number.

Contact: anything you include when you email or message us.

Website: less than you would expect. We run no analytics. The site sets one cookie, and only if you choose a language, so the next page opens in the language you chose.

To take and manage your booking, to contact you about it, and to remember your preferences for a better visit.

To run and secure this website, and to meet our legal and accounting obligations.

We rely on: performance of a contract (your reservation and any deposit), our legitimate interests (running the restaurant and improving service), and legal obligations where they apply.

For allergy and dietary information, which is health data, we rely on your explicit consent under Article 9(2)(a). You give it by choosing to write it in the booking form, and you can withdraw it at any time by asking us to remove it, that does not affect the booking itself.

Stripe Payments Europe, Ltd. takes deposits on our behalf. Stripe receives your email address and the amount, and handles your card details directly, they never reach us. Stripe acts as an independent controller for parts of that processing under its own terms.

Mailjet (Mailjet SAS, part of the Sinch group) sends the emails about your booking. Mailjet receives your name and email address and the text of the message, which contains your booking date, time, party size and table. Mailjet processes and stores this within the European Union.

If the restaurant switches text messages on, Sinch (Sinch Sweden AB) sends them, and receives your phone number and the text of the message. It does not do so today: no text message is sent and Sinch is given nothing.

Vercel Inc. hosts this website and runs the code behind it, and Supabase hosts the database your booking is written to. Neither is given anything beyond what running the site requires.

The concierge on this site can answer either from a fixed set of facts about the restaurant or with the help of a language model. In the second case, what you type into it is sent to Anthropic (Anthropic PBC) to compose the reply. Your name, your contact details and your booking are not sent with it, and what you type is not used to train a model. The concierge never makes a booking; it hands you to the form.

The contact page shows a map served by Google (Google Ireland Limited, for visitors in Europe). It is the only part of this site that comes from anybody else. When the map loads, Google receives your IP address and browser details and can set its own cookies. Google is not acting for us there, and what it does with that is covered by Google's own privacy policy.

Only the providers named above, under agreements that protect your data, and anyone the law obliges us to tell. We never sell your personal data.

Two of the companies above are established outside the European Economic Area: the one that hosts this website, and the one behind the concierge. Where your data reaches either of them it is transferred out of the EEA. Both transfers rely on the European Commission's standard contractual clauses, which each of those providers incorporates into the data processing terms that apply to us as its customer. Both publish those terms, and we will send you a copy if you ask.

A booking stays in the restaurant's book. It is our own record of who sat where and what was paid, so we do not delete bookings on a timetable and nothing sweeps them away in the background.

What we do instead, whenever you ask, is take you out of them. We remove your name, telephone number, email address and anything we have noted about you, and what is left is a booking that is not about an identifiable person. If you have no booking with us at all, not even a cancelled one, there is nothing holding the record and we delete it outright. Either way, within one month of your asking.

Allergy and dietary notes stay with the booking they were given for, and on your guest profile if we kept them there. Ask us and we take them off both, and you do not have to say why.

Records of payments and refunds are kept for as long as accounting and tax law requires.

Two things are deliberately kept longer, and both are about being able to answer for what was done rather than about you. If a member of our staff leaves and asks us to erase their details, we erase their name, email and login, but we keep their username permanently, so that a booking recorded as taken by them in 2026 can never later appear to name a different person. And our internal record of who did what, who took a booking, who cancelled one, who approved a refund, is never altered or deleted, because a record that can be edited is not a record.

You may ask us for a copy of what we hold, for a correction, for a restriction on what we do with it, for your data in a portable form, or to object to processing altogether. You may withdraw a consent, including the one covering your allergy note, at any time. Write to reservations@floresto.lv and we answer within one month.

Erasure is worth spelling out, because what we can do is not quite what the word promises. If you have no booking with us at all, not even a cancelled one, we delete your record and that is the end of it. If you have, the booking itself has to stay: it is the restaurant's own record of service and of money taken, and our accounts are made of it. So we erase you from it instead, name, telephone, email and notes, and what remains says that a table of four sat down at eight o'clock with nobody's name against it. We would rather tell you that plainly than promise you a deletion this restaurant cannot perform.

You also have the right to complain to Latvia's Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv).

We do not send marketing messages. The only messages you receive from us are about a booking you made: a confirmation, a reminder the day before your table, a confirmation when it is cancelled, and where a deposit is owed, a request to pay it. If that ever changes we will ask for your consent first, separately, and you will be able to refuse without it affecting your booking.

We run no analytics on this site. There is no tracking pixel, no advertising tag, and nothing that follows you anywhere else. That is not a box we left unticked, there is no such code in the site.

We set one cookie, and only when you pick a language, so that the next page opens in the language you chose. It does nothing else and it tells us nothing about you. Staff signing in to the restaurant's own booking panel get a session cookie as well; that one is never set for a guest.

While you are choosing a table, your browser remembers whether you were looking at the room in 2D or in 3D. That is kept in your browser for the length of the visit and is never sent to us.

The map on our contact page is served by Google, and it is the one piece of this site that comes from somebody else. When it loads, Google receives your IP address and browser details and can set its own cookies, under Google's privacy policy rather than this one.