Bistro Nad Rzeka

سياسة الخصوصية

النسخة البولندية من سياسة الخصوصية هي النسخة المعتمدة.

This policy is based on the platform template, with the controller's details provided by the Venue. It explains what personal data we collect through this website and related services, why, and what your rights are (GDPR).

1. Data controller

The controller of your personal data is Hotel Demo — dane przykładowe, ul. Hotelowa 1, 00-001 Warszawa, tax ID (NIP) 1234563218, operating the venue Bistro Nad Rzeka (the “Venue”, “we”).
For personal data matters, email sprzedawca@example.com or call +48 000 000 000.

2. What data, why and on what legal basis

Orders: first name, phone number, optionally email address, order contents and notes, optionally a tax ID for the sales document, and for delivery also the delivery address — to accept, prepare and deliver the order, contact you about it and keep you informed of its status (Art. 6(1)(b) GDPR — contract).
Online payment: amount, email address, first name and transaction ID — to process the payment and any refund (Art. 6(1)(b) GDPR — contract).
Table reservation: name, phone number, email address, date, party size and notes — to accept and handle the reservation and send a confirmation (Art. 6(1)(b) GDPR — contract).
App account: phone number verified by SMS code, first name, optionally email address, and session data — to run your account and sign you in (Art. 6(1)(b) GDPR — contract) and to protect the account against unauthorised access (Art. 6(1)(f) GDPR — legitimate interest).
App notifications: a device notification ID — to inform you about your order status, based on your consent (Art. 6(1)(a) GDPR), which you can withdraw in the app or phone settings.
Contact and complaints: the data you provide in a message or complaint — to reply and handle the complaint (Art. 6(1)(b) and (c) GDPR).
Sales documents: data on receipts or invoices — to issue and keep them as required by tax law (Art. 6(1)(c) GDPR — legal obligation).
Claims: data related to an order or reservation — to establish, pursue or defend claims (Art. 6(1)(f) GDPR — legitimate interest).
Providing data is voluntary, but without the data marked as required we cannot accept an order or reservation.
We do not make decisions about you based solely on automated processing, including profiling.

3. Online payments

Online payments are handled by an external payment operator, to whose service you are redirected when paying. You enter card or bank login details directly with the operator — we do not see or store them. The operator processes data for the payment service as a separate controller, under its own privacy policy.

4. Who we share data with

The provider of the website, ordering, reservation and app software (the Pure Alpha platform) — as a processor acting on our behalf under a data processing agreement.
The software provider's subprocessors: Amazon Web Services (servers and databases in the Frankfurt data centre, sending emails and text messages) and Cloudflare (delivering and protecting the website).
Apple and Google notification services — for app notifications.
The online payment operator — for payments.
Our accounting office — for sales documents.
Public authorities — only where required by law.
Some providers (e.g. Cloudflare, Apple, Google) may process data outside the European Economic Area, including in the USA, under a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses. We will share information about these safeguards on request.

5. How long we keep data

Orders: 12 months from when the order was placed.
Delivery address: 30 days after the order is completed or cancelled.
Reservations: 24 months from the visit date; after that personal data is deleted and only anonymous statistics remain.
App account: until you delete the account or 24 months after your last sign-in; the notification ID — until you sign out, turn notifications off or delete the account.
Sales documents: 5 years from the end of the tax year, as required by tax law.
Complaints and claims: until the limitation period expires.

6. Your rights

You have the right to access your data and receive a copy, to rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
To exercise your rights, email sprzedawca@example.com. We will reply within one month.
You can also delete your app account yourself in the app.
You have the right to lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

7. Cookies and browser storage

The website uses essential browser storage (technical cookies or local storage), for example to remember your language, basket contents and the status of your order. We do not use advertising cookies. You can delete this data in your browser settings; the website will then forget your settings.
The website contains links to external services (e.g. maps, social media, app stores). Once you open them, those services' privacy policies apply.

8. Changes to this policy

We update this policy when our services or the law change. The current version is always available on this page.