Privacy policy

1. Data controller

The controller of your personal data is MB GASTRO Michał Blicharz, pl. Bartosza Głowackiego 43, 39-400 Tarnobrzeg, NIP 8672148931, REGON 528065249 (“FUMO”, “we”).

Contact for data protection matters: kontakt@fumotarnobrzeg.pl, phone 661 562 680, postal address as above.

We have not appointed a Data Protection Officer — please contact us directly at the e-mail address above.

2. Purposes and legal bases

• Handling the contact form and e-mail correspondence (name, e-mail or phone, message) — Art. 6(1)(f) GDPR, our legitimate interest in answering your enquiry; where the message concerns a booking or an order — Art. 6(1)(b) GDPR.
• Table bookings taken by phone, message or — once launched — through an online booking system (name, phone number, date and time, number of guests, notes) — Art. 6(1)(b) GDPR.
• Handling dine-in and takeaway orders and settlements — Art. 6(1)(b) and Art. 6(1)(c) GDPR for tax and accounting obligations.
• Handling complaints and establishing, pursuing or defending claims — Art. 6(1)(c) and (f) GDPR.
• Running our social media profiles (Instagram, Facebook) and communicating there — Art. 6(1)(f) GDPR.
• Website statistics and improvements based on aggregated Google Search Console data — Art. 6(1)(f) GDPR.

3. Providing your data is voluntary

Providing data is always voluntary but necessary for the given purpose. Without a name and contact details we cannot reply to your message or confirm a booking. Data required by tax law (e.g. invoice details) is a statutory requirement.

4. Retention periods

• Correspondence and contact form messages — up to 12 months after the exchange ends.
• Booking data — up to 12 months after the booking date.
• Accounting and tax records — 5 years from the end of the year in which the tax obligation arose.
• Data needed to defend against claims — until the relevant limitation periods expire.

5. Recipients of data

• our hosting and website maintenance provider,
• our e-mail provider,
• Google Ireland Limited — embedded Google Maps and Google Search Console,
• Meta Platforms Ireland Limited — contact via our social media profiles,
• our accounting office and, where needed, a law firm,
• delivery platforms (e.g. Glovo) when you order through them under their own terms and privacy policy,
• public authorities, where required by law.

6. Transfers outside the EEA

Using Google and Meta services may involve transferring data outside the European Economic Area, including to the United States. Such transfers rely on the European Commission adequacy decision (EU–US Data Privacy Framework) or on Standard Contractual Clauses. You can request a copy of the safeguards by e-mail.

7. Your rights

• access to your data and a copy of it,
• rectification of inaccurate data,
• erasure of data,
• restriction of processing,
• data portability,
• objection to processing based on our legitimate interest,
• withdrawal of consent at any time, without affecting processing carried out beforehand,
• lodging a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

8. No profiling

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you.

9. Cookies

Our use of cookies and similar technologies is described in the Cookie policy.

10. Job applicants and staff

Applicant data is processed under the Polish Labour Code and Art. 6(1)(b) and (c) GDPR, and — for data provided voluntarily or for future recruitment — on the basis of consent (Art. 6(1)(a) GDPR). Recruitment documents are deleted no later than 6 months after the process ends unless you consent to longer storage.

Employee and contractor data is processed to perform the employment relationship and our obligations as an employer (Art. 6(1)(b) and (c) and Art. 9(2)(b) GDPR), for the retention periods required by law (10 or 50 years). HR records are kept in an internal, secured administration panel accessible only to authorised persons and are not connected to the public website.

11. Security and changes

We apply technical and organisational measures appropriate to the risk, including encrypted transmission (HTTPS), access control and written authorisations to process data.

We may update this policy, for example when new website features (such as online bookings) go live. The current version is always published on this page with its update date.