I. General Provisions

1. The Privacy Policy specifies how the personal data of Users necessary to provide services by electronic means through the website https://karczmaukarola.pl (hereinafter: the Website) are collected, processed and stored.

2. The Website collects only the personal data necessary to provide and develop the services offered on it.

3. Personal data collected through the Website are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: GDPR), and the Personal Data Protection Act of 10 May 2018.

II. Data Controller

III. Purpose of Collecting Personal Data

1. Personal data are used for the purpose of:

• performing the agreement concerning catering services,

• communicating with the User (contact form),

• sending the newsletter (after the User has consented to receive it),

• processing table reservations,

• organizing special events,

• promoting the Controller’s offer,

• marketing and remarketing,

• personalizing the Website for Users,

• analytical and statistical activities,

• debt collection,

• establishing and pursuing claims or defending against them.

2. Providing data is voluntary, but necessary to conclude an agreement or use other functionalities of the Website.

IV. Types of Personal Data Processed

V. Personal Data Processing Period

• where the legal basis for processing the data is the performance of an agreement – until the claims arising after its performance become time-barred,

• where the legal basis for processing the data is consent – until the consent is withdrawn, and after consent is withdrawn, until the claims become time-barred.

VI. Disclosure of Personal Data

1. Users’ personal data may be transferred to: entities affiliated with the Controller, its subcontractors, entities cooperating with the Controller, e.g. companies handling e-payments, companies providing courier/postal services, law firms, IT service providers, and accounting firms.

2. Users’ personal data may be transferred outside the European Economic Area (EEA) in connection with the Controller’s use of analytical and marketing tool providers, such as Google or Facebook.

VII. Users’ Rights

1. A Service User has the right to: access the content of their personal data, rectify, erase, restrict processing, transfer, object to processing, and withdraw consent at any time (which does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal).

2. A notification by a User of exercising any of the rights listed above should be sent to biuro@karczmaukarola.pl.

3. The Controller shall comply with or refuse the request without undue delay – no later than within one month of receiving it.

4. A User has the right to lodge a complaint with the President of the Personal Data Protection Office if they consider that the processing violates their rights and freedoms (GDPR).

VIII. Cookies

1. The Service collects information using cookies – session, persistent, and third-party cookies.

2. The collection of cookies supports the proper provision of services on the Service and serves statistical purposes.

3. The Service uses the following types of cookies:

• first-party cookies – necessary for the proper functioning of the website,

• analytical cookies (Google Analytics) – used to analyse traffic on the website,

• marketing cookies (e.g. Facebook Pixel) – used to personalise advertisements.

4. A User may specify the scope of cookies’ access to their device in their browser settings.

IX. Automated Decision-Making and Profiling

1. Users’ data may not be processed in an automated manner such that, as a result, any decisions could be made concerning them.

2. Users’ data may be profiled in order to tailor content and personalise the offer after they have given their consent. Profiling may include analysing activity on the website in order to display content tailored to the user’s interests.

X. Data Security

1. The Controller applies appropriate technical and organisational measures to ensure the protection of processed personal data.

2. The Service uses a secure data transmission protocol (SSL).

3. Access to personal data is granted exclusively to persons authorised by the Controller.

XI. Final provisions

1. The Controller has the right to introduce changes to the Privacy Policy, provided that Users’ rights will not be restricted.

2. Information about the introduced changes will appear in the form of a notice available on the Website.

3. Matters not regulated in this Privacy Policy shall be governed by the provisions of the GDPR and Polish law.