Privacy Policy
Last updated: 7 August 2026
Data controller
Little Fish Poke, Corso Cristoforo Colombo 3, 20144 Milan, Italy. You can contact us at info@littlefishpoke.com or by telephone at +39 02 3956 5563.
Data we process
We may process account and contact details, telephone and email verification data, order and purchase history, pickup or delivery details, saved addresses, invoice details, customer support messages, loyalty activity, notification preferences, device identifiers and push tokens. Payment card details are processed directly by the selected payment provider; Little Fish Poke receives payment status and transaction references needed to manage the order.
Why we use data
We use personal data to create and secure accounts, receive and fulfil orders, process payments and refunds, provide customer support, issue invoices when requested, manage loyalty benefits, prevent abuse, send service notifications and, where consent is required, send marketing communications.
Legal bases
Processing is based on performance of a contract, compliance with legal obligations, our legitimate interests in operating and securing the service, and consent where applicable. Consent can be withdrawn at any time without affecting earlier lawful processing.
Service providers
We use specialised providers for hosting, authentication, notifications, email and SMS delivery, payments, meal vouchers, analytics and delivery services. They process only the data needed to provide their service and are bound by applicable data-protection obligations.
Retention
We keep data only for as long as necessary for the purposes described above and for the periods required by tax, accounting, fraud-prevention and dispute-resolution laws. Account data may be deleted or anonymised when it is no longer required, subject to mandatory retention duties.
Your rights
Under the GDPR you may request access, correction, deletion, restriction, portability or objection to processing. You may also withdraw consent and lodge a complaint with the Italian Data Protection Authority. Requests can be sent to info@littlefishpoke.com.
Children
The service is not intended for children who cannot lawfully consent to data processing under applicable law. A parent or guardian should contact us if a child has provided personal data without appropriate authorisation.
Changes
We may update this policy when our services or legal obligations change. The current version is always available at this address.