Privacy policy
1. Controller
The controller of your personal data is Real King Kebab, ul. Głogowska 78, Poznań, tax ID (NIP): — (the "Controller"). For anything about your data write to kontakt@realkingkebab.pl or call +48 000 000 000.
2. What data, why and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Taking, preparing and delivering your order, contacting you about it | name, phone, e-mail, delivery address, order contents, notes | Art. 6(1)(b) — contract |
| Your customer account, saved addresses, order history, loyalty points | account and order data | Art. 6(1)(b) — contract |
| Online payments and refunds | amount, payment ID (we never see card details) | Art. 6(1)(b) — contract |
| Accounting and tax | order and sales document data | Art. 6(1)(c) — legal obligation |
| Order reviews | rating, comment, first name and initial (once published) | Art. 6(1)(f) — legitimate interest |
| Security, preventing abuse, legal claims | IP address, login data, logs | Art. 6(1)(f) — legitimate interest |
| Order status notifications (e-mail, SMS, push) | e-mail, phone, device token | Art. 6(1)(b) — contract |
Giving your data is voluntary, but we cannot take an order without the data needed to fulfil it. We do not make decisions based solely on automated processing, including profiling.
3. Recipients
We share data only as far as needed for your order: branch staff and riders (name, phone, delivery address); our hosting and e-mail providers; the online payment provider Stripe (when you pay online); the SMS gateway (SMSAPI) and Google Firebase push notifications (when used); and public authorities where the law requires it.
Maps are loaded from OpenStreetMap servers — your browser downloads map tiles from them (sharing your IP address). Address search goes through our server.
Stripe and Google may process data outside the European Economic Area, based on the European Commission's standard contractual clauses or an adequacy decision.
4. How long we keep data
- account data — until you delete the account;
- order data — for the period required by tax and accounting law (as a rule 5 years from the end of the year of the order) and until legal claims expire;
- logs and security data — up to a few months;
- rider location — only the rider's latest position during a shift (shown to the customer while the order is on its way).
After an account is deleted, its orders stay in the system without your contact details, only as far as the law requires.
5. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on legitimate interest. In your account you can download your data (JSON file) and delete the account. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).
6. Cookies and device storage
The Service uses only strictly necessary cookies: the session (login, checkout cart) and form protection (XSRF). Your browser's storage keeps the cart and small preferences, and the web app (PWA) stores site files to load faster and work offline. We use no advertising or analytics cookies. You can delete cookies in your browser settings — you will then be logged out and lose your cart.
7. Changes
We publish changes to this policy on this page. The terms of service are here.
