1. Personal Data and Data Administrator
The Administrator in relation to personal data is Restaumatic S.A. with its registered office in Zabrze (41-800) at ul. Wolności 345, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court in Gliwice, 10th Economic Division of the National Court Register under KRS no. 0001016935, NIP 6482765571, REGON 242895699, the amount of share capital and paid-in capital: PLN 149,400.00, administering the website at www.skubacz.pl and www.restaumatic.com and a dedicated IT System and mobile application under the name Restaurant Operating System - Restaumatic.
Contact regarding the processing of personal data: privacy@restaumatic.com or by correspondence to the administrator's registered address.
The personal data administrator has appointed the Data Protection Officer Mr. Tomasz Banasik, contact: privacy@restaumatic.com.
2. Purpose of data processing
The purpose of the processing of Personal Data is the performance of contracts linking the Data Controller to the users of the service and the application, the technical operation of the service and marketing activities.
3. Legal basis of data processing
Personal Data is processed on the following legal bases:
a) with regard to the performance of the contract Article 6(1)(b) and (f) of EU Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC (hereinafter: "RODO"), i.e. as part of the performance of the contract and as part of the Administrator's legitimate interest, which is to be able to inform you of any matters relating to the performance of the service;
b) for the purposes of marketing its own goods and services and those of its cooperating entities Article 6(1)(a) of EU Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, that is, in the context of contacting to present a commercial offer;
c) for the implementation of the legal requirements of Article 6(1)(c) of EU Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC, for example for the implementation of tax regulations;
d) with regard to the implementation of analytical and statistical purposes - the legal basis for the processing is the legitimate interest of the Administrator Article 6(1)(f) of the EU Regulation 2016/679 of 27 April 2016 on the protection of natural persons in relation to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, consisting in conducting analyses of user activity in the IT System, in order to improve the functionalities used and the operation of the web chat and other forms of automated communication with the customer through the website.
4. Data recipients
The following data recipients may have access to Personal Data:
a) service providers to whom the processing of Personal Data has been contractually entrusted for the purposes of performing the services provided to the Administrator, in particular - to the extent necessary for the proper performance of these services. In the case of the Customer who uses the electronic payment method, the Administrator also makes the collected Personal Data of the Customer available to the selected entity handling the aforementioned payments,
b) entities entitled to receive Personal Data under the law,
c) providers of legal and advisory services and those supporting the Administrator in the collection of outstanding claims (in particular law firms, tax law firms, debt collection agencies).
5. Data storage period
a) In the case of data processing for the purposes referred to in point 3(a) and (c), for the period during which the data subject may assert possible claims for non-performance or undue performance of the contract limited to the expiry of the period of limitation of actions provided for by the generally applicable legislation in force at the time the service was provided.
b) In the case of data processing for the purpose referred to in point 3(b), for as long as you have not withdrawn your consent.
6. Collected data
A. Customer Service
When contact is made with the customer service department, the personal data provided by the user is used to answer a question or deal with a complaint. The legal basis for processing this personal data is that it is necessary for the performance of the contract. The following personal data are processed for customer service purposes:
B. Marketing messages
Personal data is processed in order to address marketing messages and notifications. Such communications include news, discounts and updates on new restaurants (by email or using push notifications) and loyalty programmes. The legal basis for this processing of your personal data, as defined in the DPA, is that you have given your consent. You can change your preferences regarding the receipt of such messages and notifications at any time.
The following personal data are processed for marketing purposes:
C. Cookies
The Administrator informs that he uses cookies. Cookies are harmless to the Customer's computer or other device and its data. The Administrator also informs that it is possible to configure the web browser or the Mobile Application in such a way that it does not allow cookies to be stored on the Customer's computer or other device.
The information that is contained in the system logs in connection with the general rules for the execution of connections on the Internet is used by the hosting company operating the Information System only for technical and statistical purposes.
The Administrator uses so-called service cookies and similar technologies (local storage) primarily to provide the Customer with services provided electronically and to improve the quality of these services. Accordingly, the Administrator and other entities providing analytical and statistical services to the Administrator use cookies to store information or access information already stored in the Customer's telecommunications terminal equipment (computer, phone, tablet, etc.).
Cookies used for this purpose include:
D. Social Media
The Administrator processes personal data of Customers visiting the Administrator's profiles maintained on social media (Facebook, YouTube, Instagram, LinkedIn, Twitter). This data is processed exclusively in connection with the running of the profile, including for the purpose of informing Customers about the Administrator's activities and promoting various events, services and products. The legal basis for the Administrator's processing of personal data for this purpose is its legitimate interest (Article 6(1)(f) RODO), which is to promote its own brand. In this framework, personal data such as name and surname are collected.
7. Data collection principles
a) The provision of data is voluntary, but necessary for the use of the service.
b) The Controller may transfer personal data to a third country or an international organisation. Should the need arise to transfer personal data to a third country, the Controller will only cooperate on the basis of standard contractual clauses or the consent of the European Commission to such transfer.
c) Portal users are also direct customers of the cooperating restaurants, where they provide their personal data for the purpose of processing an order on the restaurateurs' dedicated websites. The cooperating restaurants have their own responsibilities and liabilities in relation to the processing of personal data. If you have questions about how a restaurant processes your personal data, please contact the restaurant directly where you placed your order.
8. Profiling
As part of the implementation of the service with you and in order to improve our platform, www.skubacz.pl and restaumatic.com, profiling is used. Order history is used in order to prepare a marketing campaign. The marketing campaign may consist of, at the decision of the cooperating restaurant, granting a discount for the first order, sending a message inviting you to make repeat orders, etc. The Data Controller does not use automated decision-making. Profiling is only carried out in relation to users who have consented to the processing of their data for marketing purposes.
**9. Rights in relation to the processing of Personal Data **
The data subject may exercise the following rights:
a) the right to request access to and rectification of your Personal Data,
b) the right to restrict the processing of its data in the situations and under the conditions indicated in Article 18 of the RODO or to have it deleted in accordance with Article 17 of the RODO ("right to be forgotten"),
c) the right to transfer Personal Data pursuant to Article 20 of the RODO,
d) the right to object at any time to the processing of his/her Personal Data on grounds relating to his/her particular situation, as referred to in Article 21(1) of the RODO,
e) the right to withdraw consent to data processing pursuant to Article 13(2)(c) of the RODO, insofar as the processing is based on consent,
f) the right to lodge a complaint with the supervisory authority dealing with the protection of personal data.
A person who has submitted a request or task concerning the processing of his/her Personal Data, in the exercise of his/her rights, may be asked by the Administrator to answer a number of questionś related to his/her Personal Data, which allow̨ the verification of his/her identity.