Privacy policy

I. General Information

This Privacy Policy sets out the terms for the processing of personal data of the users of the wi-taj.pl website (hereinafter: the “Website”).

The controller of personal data is:
Klubokawiarnia sp. z o.o.,
NIP 7010333557,
pl. Konstytucji 4, 00-552 Warsaw
(hereinafter: the “Controller”).

The controller ensures the protection of users’ privacy in accordance with:

– Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter: “GDPR”),
– the Act of 10 May 2018 on the Protection of Personal Data,
– the Act of 18 July 2002 on the Provision of Electronic Services,
– the Act of 12 July 2024 – Electronic Communications Law (hereinafter: “PKE”).

Contact with the Controller in matters concerning personal data protection: biuro@wi-taj.pl.

II. Scope of Processed Personal Data

On the Website, personal data is collected through the following forms:

• Catering order form: – name and surname, – e-mail address, – phone number, – delivery address, – delivery date and time, – order details (selected dishes and their quantity).
• Contact form: – name and surname or company name, – e-mail address, – phone number, – message content.
• Newsletter subscription form: – e-mail address.

Providing personal data is voluntary, but necessary, respectively, to: place a catering order, send an inquiry via the contact form, or subscribe to the newsletter.

III. Purposes and legal bases of data processing

Personal data are processed for the following purposes:

a) Performance of catering orders – the processing of data provided in the order form is necessary to take steps prior to entering into a contract and for its performance (Article 6(1)(b) GDPR).

b) Handling contact form inquiries – the processing is necessary to take steps at the request of the data subject prior to entering into a contract, and in the case of inquiries not related to a contract – based on the legitimate interest of the Controller consisting in providing a response (Article 6(1)(b) and Article 6(1)(f) GDPR).

c) Sending of the newsletter – the processing of the e-mail address is based on the legitimate interest of the Controller (Article 6(1)(f) GDPR), in connection with the prior obtaining of consent for sending commercial information by electronic means in accordance with the Act on the Provision of Electronic Services and the consent required pursuant to the PKE.

d) Analytics and statistics – the processing of data regarding the use of the Website (including through cookies and similar technologies) is carried out on the basis of the user’s consent (Article 6(1)(a) GDPR) expressed via the cookie banner.

e) Marketing using remarketing and conversion tracking tools (Meta Pixel, Google Ads) – processing is based on the user’s consent (Article 6(1)(a) of the GDPR) expressed via the cookie banner. These tools make it possible to display personalized advertisements to users who have visited the Website, as well as to measure the effectiveness of advertising campaigns. The user can opt out of Google ad personalization at https://adssettings.google.com/ and Meta ad preferences at https://www.facebook.com/adpreferences at any time.

f) Compliance with legal obligations – the processing of data to the extent required by applicable laws, including tax and accounting provisions (Article 6(1)(c) GDPR).

g) Establishment, exercise or defense of claims – the processing is necessary for the purposes of the legitimate interests pursued by the Controller (Article 6(1)(f) GDPR).

IV. Data recipients

Personal data may be transferred to the following categories of recipients:

– Hosting service providers: LH.pl Sp. z o.o. with its registered office in Poznań, Pl. Wolności 6/4, 61-738 Poznań (https://www.lh.pl/) – to the extent necessary to ensure the technical operation of the Website.

– E-mail marketing service provider: MailerLite Limited with its registered office in Ireland (88 Harcourt Street, Dublin 2, D02 DK18) – to the extent of handling newsletter distribution. MailerLite processes data as a processor on the basis of a data processing agreement.

– Providers of analytical and marketing tools: Google LLC (USA) – with regard to Google Analytics 4, Google Tag Manager, and Google Ads (remarketing and conversion tracking); Meta Platforms Ireland Ltd. / Meta Platforms, Inc. (USA) – with regard to the Meta Pixel service. These tools are activated exclusively upon the user’s consent expressed via the cookie banner.

– Authorized state authorities – if such an obligation results from generally applicable provisions of law.

V. Transfer of data to third countries

In connection with the use of services provided by Google LLC and Meta Platforms, Inc., personal data may be transferred to the United States. The transfer is carried out on the basis of the European Commission implementing decision of July 10, 2023, establishing an adequate level of protection for personal data under the EU-US Data Privacy Framework (DPF). Both Google LLC and Meta Platforms, Inc. hold current certification under the DPF.

In connection with the use of the CookieYes Limited platform, user consent data may be transferred to the United Kingdom. Such transfer is based on the European Commission’s adequacy decision of 28 June 2021 determining an adequate level of protection of personal data in the United Kingdom.

The Controller monitors the legal status of the above adequacy decisions and, in the event of their change, will take appropriate steps to ensure the compliance of data transfers with applicable laws.

VI. Data retention period

Personal data are stored for the following periods:

– Catering order data: for the duration of order fulfillment, and subsequently for the period necessary to fulfill legal obligations (in particular tax and accounting obligations) and to establish, exercise, or defend against potential claims.

– Contact form data: for the duration of the correspondence, and for the period necessary to establish, exercise, or defend against claims.

– Newsletter subscriber data: until the withdrawal of consent to receive the newsletter (unsubscribing), which is possible at any time via the unsubscribe link included in each message or by contacting the Controller.

– Data processed based on consent (analytics and marketing cookies): until the withdrawal of consent.

VII. Rights of data subjects

Every data subject has the right to:

– access to their personal data (Article 15 GDPR),
– rectification of their data (Article 16 GDPR),
– erasure of data – the “right to be forgotten” (Article 17 GDPR),
– restriction of processing (Article 18 GDPR),
– data portability (Article 20 GDPR),
– object to processing based on the legitimate interest of the Controller, including processing for direct marketing purposes (Article 21 GDPR),
– withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal (Article 7(3) GDPR).

– Any requests regarding the above should be sent to the e-mail address: biuro@wi-taj.pl.

– The data subject also has the right to lodge a complaint with a supervisory authority – the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl/).

VIII. Automated decision-making and profiling

The Controller does not make decisions based solely on automated processing, including profiling, which would produce legal effects concerning the user or similarly significantly affect them.

IX. Cookies and tracking technologies

The website uses cookies and similar technologies. Detailed information regarding the cookies used, their types, purposes, providers, and validity periods can be found in a separate document – the Cookie Policy.

During the first visit to the Website, the user may consent to the use of individual categories of cookies (analytical, marketing) or refuse their use via the cookie banner operated by the CookieYes platform. Cookies necessary for the proper operation of the Website do not require consent.

Analytical scripts (Google Analytics 4) and marketing scripts (Meta Pixel, Google Ads) are activated exclusively upon the user’s consent. The Website uses Google Tag Manager in conjunction with the Google Consent Mode v2 mechanism to manage their loading.

Consent can be withdrawn or changed at any time:
– by using the cookie settings available on the Website (CookieYes banner),
– by changing the web browser settings,
– by contacting the Controller at the e-mail address: biuro@wi-taj.pl.

Failure to accept certain cookies may limit the functionality of the Website.

More information about Google Analytics: https://policies.google.com/privacy
Google ad personalization opt-out: https://adssettings.google.com/
Google Analytics opt-out: https://tools.google.com/dlpage/gaoptout

X. Data security

The Controller implements appropriate technical and organizational measures to ensure the protection of processed personal data, in particular protecting the data against disclosure to unauthorized persons, processing in violation of applicable laws, as well as modification, loss, damage, or destruction.

XI. Changes to the Privacy Policy

The Controller reserves the right to make changes to this Privacy Policy. The current version of the document is always available on the Website. In the event of significant changes, users will be notified in a prominent manner on the Website.