1. Controller and scope
The controller of data related to the Restavox platform website and platform account is Krystian Thiede, a sole proprietor trading as Promo-Expo Krystian Thiede, ul. Świerkowa 17, 89-650 Czersk, Poland, Polish tax ID (NIP) 5552025383. Contact: [email protected]. Restaurant operators are separate controllers of data processed on their public sites and describe that processing in their own privacy notices.
2. Data, purposes and legal bases
- Account and service: identifiers, email address, organisation assignment, role and dashboard activity are processed to create and manage access to Restavox and perform the contract (Article 6(1)(b) GDPR), and to secure the service and protect claims (Article 6(1)(f) GDPR).
- Contact: information provided in correspondence is used to answer enquiries and handle the matter (Article 6(1)(f) GDPR, or Article 6(1)(b) where pre-contractual steps or performance of a contract apply).
- Security and operation: standard request data, including IP address, time, requested URL and browser information, may appear in short-lived infrastructure logs on the basis of the legitimate interest in operating and securing the service (Article 6(1)(f) GDPR).
- Platform analytics: when enabled, page views, traffic sources and permitted UTM parameters are measured to assess the platform website (Article 6(1)(f) GDPR in the mode without identifiers). Visitor and session identifiers and related data are used only after Analytics consent (Article 6(1)(a) GDPR). The raw IP address and full User-Agent are not stored in the analytics events dataset. Consent can be withdrawn at any time in cookie settings without affecting earlier lawful processing.
- Legal duties: data required by law, such as accounting records, are processed under Article 6(1)(c) GDPR.
3. Recipients and transfers
Data may be accessed by authorised persons and providers acting as needed: DigitalOcean (hosting, database and media), Silverhand Inc./Logto Cloud (authentication), and email providers used for correspondence. Transfers outside the EEA take place only under Chapter V GDPR, including an adequacy decision or appropriate standard contractual clauses. Information on relevant safeguards is available through the contact address above.
4. Retention and cookies
Account data are kept while the service is used and for the time needed for settlement or legal claims. Correspondence is kept as needed to handle the matter and protect claims. Technical logs are kept for the time needed for security and diagnostics. Raw analytics events are kept for up to 35 days; aggregate statistics without identifiers may be kept longer. Cookie-choice records may last up to 12 months; a consent-based visitor identifier up to 13 months, while a session expires after about 30 minutes of inactivity. The cookie policy explains these technologies and how to change a choice.
5. Rights
You have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent where consent is the legal basis. You may complain to the Polish President of the Personal Data Protection Office. Send requests to [email protected]. Providing account data is voluntary but necessary to use an account; sending correspondence is voluntary. We do not make decisions about you with legal or similarly significant effects solely by automated means.