Privacy Policy

This Privacy Policy has been created with concern for the rights of persons visiting the www.podaniolami.pl website and using the services offered through it. It also fulfils the information obligation arising from Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L119 of 4.05.2016, p. 1) (hereinafter: the “GDPR”). We kindly inform you that the data obtained through the website are protected and secured against access by unauthorised persons in accordance with generally applicable laws, in particular the GDPR, the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws 2018, item 1000) and the Act of 18 July 2002 on the Provision of Services by Electronic Means (Journal of Laws 2018, item 650, as amended). The Privacy Policy is made available to all interested parties. The website is publicly accessible.
The website owner may collect personal data as well as other types of data. Depending on their nature, such data are collected automatically or as a result of actions taken by persons visiting the website.

I. General Information

1. The owner and operator of the website is Jacek Łodziński, conducting sole proprietorship under the name: Jacek Łodziński Restauracja “Pod Aniołami”, with its registered office in Kraków, address: ul. Grodzka 35, 31-001 Kraków, NIP: 6760112481, REGON number: 350857583 (hereinafter: the “Entrepreneur”). In accordance with the provisions of the GDPR, the Entrepreneur is also the Controller of the Personal Data of website users (hereinafter: the “Controller”).

2. As part of its activities, the Controller uses cookies in such a way that, by observing and analysing traffic on the website, it undertakes marketing activities; however, as part of the activities referred to in this point, the Controller does not process personal data within the meaning of the GDPR.

3. The website obtains information about website users and their behaviour in the following ways:
a. The website automatically collects information contained in cookies.
b. Through the voluntary provision of personal data by website users in forms made available on the website.
c. Through the automatic collection of www server logs by the hosting operator.

4. Cookies (so-called “cookies”) are IT data, in particular text files, which are stored on the website user’s end device and are intended for the use of the website’s pages. Cookies generally contain the name of the website from which they originate, the period for which they are stored on the end device and a unique number.

5. During visits to the website, user data concerning a given user’s visit to the website may be collected automatically, including, among others, the IP address, type of web browser, domain name, number of page views, addresses of websites from which the user entered the website, and time spent using the website. This data does not constitute personal data and does not allow the person using the website to be identified.

6. The website may contain links to other websites. The Controller is not responsible for the privacy practices applicable on such websites. At the same time, the Entrepreneur encourages website users to familiarise themselves with the privacy policy established for such websites. This Privacy Policy does not apply to other websites.

7. The entity placing cookies on the end device of a website user and gaining access to them is the website owner.

8. Cookies are used to create statistics that help understand how website users use the websites, which makes it possible to improve their structure and content.

9. The website uses, among others, so-called “necessary” cookies, which enable users to use the services available through the website.

10. The website uses, in particular, two basic types of cookies: “session” and “persistent” cookies. Session cookies are temporary files stored on the end device until the relevant user leaves the website or closes the web browser (e.g. Chrome, Mozilla, Opera). In the case of persistent cookies, they are stored on the user’s end device for the period specified in the parameters of the cookies or until they are deleted by the website user.

11. It should be noted that in most cases, software used for browsing websites allows cookies to be stored on the website user’s end device by default. Website users may change their cookie settings at any time of their choice. These settings may be changed using the options available in the web browser, for example, in a manner that prevents the automatic handling of cookies or requires the website user to be informed each time cookies are placed on their device. Detailed information about the possibilities and methods of handling cookies is available in the settings of the web browser.

12. Cookies placed on the end device of a given website user may also be used by advertisers and partners cooperating with the co-owner of the website.

II. Processing of Personal Data, Information about Forms

1. Personal data of website users may be processed by the Controller only in the situations specified in Article 6(1) of the GDPR, in particular where the website user has given consent by ticking the appropriate box in the reservation form provided on the website, for the purpose of taking the actions to which the form relates (Article 6(1)(a) GDPR).

1. As part of the website, personal data voluntarily provided by website users are processed. The Controller processes the personal data of website users only to the extent necessary for the purposes specified in point 1 above and for the period necessary to achieve those purposes, or until the website user withdraws consent. If a website user does not accept the contents of this Privacy Policy, this may in some cases result in the inability to achieve the purposes for which the provision of data is necessary.

2. The following personal data of a website user may be collected through the reservation form available on the website: first name, surname, email address, telephone number.

3. The personal data provided by the user may be transferred by the Controller to third parties cooperating with the Controller in connection with the fulfilment of the purposes specified in point 1.

4. Data provided in the form available on the website are processed for purposes resulting from the function of the particular form; furthermore, they may also be used by the Controller for archival and statistical purposes. Acceptance of this Privacy Policy takes place by ticking the appropriate box in the form, thereby confirming that the website user has read and accepted this Privacy Policy.

5. Data provided in forms may be transferred to entities technically performing certain services – in particular, this concerns the transfer of information about the holder of a registered domain to entities that are operators of the internet domain.

6. Personal data of website users are stored in a database in which technical and organisational measures have been implemented to ensure the protection of the processed data in accordance with the requirements set out in the relevant regulations.

7. In cases provided for by law, the Controller may disclose some of the personal data of website users to third parties for purposes related to the protection of the rights of third parties.

8. The Controller reserves the right to send all website users electronic messages containing notifications about important changes to the website and changes to this Privacy Policy. The Controller may send electronic messages of a commercial nature, in particular advertisements and other content constituting commercial information, provided that the website user has given consent to this. Advertisements and other commercial information may also be attached to messages sent to and from the system account.

a. Server Logs

In accordance with the practice adopted by most websites, the website operator stores HTTP requests directed to the website operator’s server (information about certain user behaviour on the website is subject to logging at the server level). The resources viewed are identified by URLs. Information stored in www server log files includes, among others:
a. the public IP address of the computer from which the request originated;
b. information about the website user’s web browser;
c. the time at which the website user began their visit to the website and the time at which the visit ended.

The above data are not associated with specific individuals browsing the pages available on the website. In order to ensure the highest possible quality of the website, the website operator occasionally analyses log files in order to determine which pages within the website are visited most frequently, which web browsers are used, and whether the structure of the pages contains errors, etc.
1. The logs collected by the operator are stored for a period of one year as supporting material used for the proper administration of the website. The information contained therein will not be disclosed to any entities other than the operator or entities personally, financially or contractually affiliated with the operator. Statistics assisting in the administration of the website may be generated on the basis of the information contained in these files. Summaries containing such statistics do not contain characteristics identifying persons visiting the website.

b. Rights of website users concerning their personal data.

In accordance with Articles 15–22 and Article 77 of the GDPR, every website user has the following rights:

1. Right of access to data (Article 15 GDPR)
The data subject has the right to obtain from the Controller confirmation as to whether personal data concerning them are being processed and, where that is the case, the right to access such data. Pursuant to Article 15, the Controller shall provide the data subject with a copy of the personal data undergoing processing.

2. Right to rectification of data (Article 16 GDPR)

The data subject has the right to request that the Controller rectify without undue delay personal data concerning them that are inaccurate.

3. Right to erasure of data (“right to be forgotten”) (Article 17 GDPR)

The data subject has the right to request that the Controller erase personal data concerning them without undue delay, and the Controller shall have the obligation to erase personal data without undue delay where one of the following circumstances applies:
a. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b. the data subject has withdrawn consent on which the processing is based;
c. the data subject objects pursuant to Article 21(1) to the processing and there are no overriding legitimate grounds for the processing.

1. Right to restriction of processing (Article 18 GDPR)

The data subject has the right to request that the Controller restrict processing in the following cases:
a. the accuracy of the processed personal data is contested;
b. the processing of personal data is unlawful and the data subject opposes the erasure of the personal data, requesting the restriction of their use instead;
c. the Controller no longer needs the personal data, but they are required by the data subject for the establishment, exercise or defence of legal claims;
d. the data subject has objected to processing on grounds relating to their particular situation – pending the verification of whether the legitimate grounds of the Entrepreneur override the grounds for the objection.

2. Right to data portability (Article 20 GDPR)

At the request of the website user, the Controller shall provide the data concerning that person in a structured, commonly used and machine-readable format or, where possible, transmit them to another entity.

3. Right to object (Article 21 GDPR)

If a website user submits an objection, justified by their particular situation, to the processing of their personal data, and the data are processed by the Controller on the basis of the legitimate interest of the Entrepreneur or a task entrusted to the Entrepreneur in the public interest, the Entrepreneur shall uphold the objection unless there are compelling legitimate grounds for the processing on the part of the Entrepreneur which override the interests, rights and freedoms of the person submitting the objection, or grounds for the establishment, exercise or defence of legal claims.

4. Right to lodge a complaint (Article 77 GDPR)

If a website user believes that their data are being processed by the Entrepreneur unlawfully, they have the right to lodge a complaint with the President of the Personal Data Protection Office or another supervisory authority.

c. Contact with the Controller

In order to exercise their rights, a website user may contact the Controller of personal data at any time.
Contact is possible at the Entrepreneur’s registered office in Kraków at ul. Grodzka 35, 31-001 Kraków, in writing by sending an appropriate request to the registered office address or by email at: biuro@podaniolami.pl.