Privacy policy

1. Who is responsible for your data

The controller of your personal data is DAON POLSKA sp. z o.o., registered office ul. Zabrska 17, 40-083 Katowice, entered in the register of businesses of the National Court Register under KRS number 0001173486, NIP 6343055877, REGON 541760574. The company runs the DAON restaurant at Dworcowa 8, 40-012 Katowice.

For anything about your personal data, write to daonpolska@gmail.com or call +48 728 550 310.

2. What we collect

When you book a table on the website, you give us:

• the name the booking is under,
• a phone number,
• an email address, if you choose to give one — we send the confirmation and a reminder to it,
• notes, if you choose to add them — an allergy, an occasion, a high chair.

Along with these we store the date, time, number of guests, the table you chose and the language of the site.

If you book by phone or in person, the staff enter the same details into our reservation system.

Like any web server, ours logs the IP address, the time and the page requested, and details of the browser.

3. Why, and on what legal basis

• Taking and handling your reservation, including contacting you about it and emailing the confirmation, the reminder and any change or cancellation — Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract).
• Allergy or health information you write in the notes — Art. 9(2)(a) GDPR (your explicit consent, given by writing it). We use it only to prepare for your visit. You can withdraw consent at any time by writing to daonpolska@gmail.com.
• Keeping the website secure and preventing abuse, such as mass fake bookings — Art. 6(1)(f) GDPR (our legitimate interest).
• Aggregate visit statistics that tell us whether the site helps guests find the menu and book a table — Art. 6(1)(f) GDPR (our legitimate interest).

4. Who can see your data

The restaurant staff see reservations. We also use outside services that process data on our behalf:

• Supabase — the database where reservations are stored,
• Hetzner Online GmbH — the server the website runs on, which also holds your email address until your visit (data centre in Helsinki, Finland),
• Telegram — the messenger through which staff receive each reservation with the name, phone number and notes,
• Google — Gmail, which sends the confirmation and reminder emails if you give an email address.

The site's fonts are stored on our own server, so your browser does not contact anyone else's servers to load them.

Supabase, Telegram and Google may process data outside the European Economic Area. Any such transfer takes place with the safeguards required by Chapter V of the GDPR.

Links to Uber Eats, Instagram and Google Maps lead to outside services that handle data under their own terms.

5. How long we keep it

• Your name, phone number and notes are deleted automatically 30 days after the booking date — from the database and from the Telegram notifications sent to staff. What remains is the reservation without personal data: date, time, number of guests and table.
• Your email address is deleted the day after the booking date, or straight away if the reservation is cancelled.
• Database backups are kept for no longer than 30 days.
• Server logs are deleted after 14 days.
• Visit statistics are numbers only, with no personal data, and are kept for up to 400 days.

6. Your rights

You have the right to:

• access your data and receive a copy,
• have it corrected,
• have it deleted,
• restrict its processing,
• data portability,
• object to processing based on our legitimate interest,
• withdraw consent at any time, without affecting processing that took place before.

To use any of these rights, write to daonpolska@gmail.com.

You can also lodge a complaint with the Polish data protection authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.

7. Do you have to give us your data

No, but without a name and phone number we cannot take a booking through the website. An email address is optional. You can always book by phone: +48 728 550 310.

8. Cookies, statistics and browser storage

The website uses no cookies and no third-party advertising or analytics tools.

We count visits ourselves. When you open a page, your browser sends our server the page's name, the site language and the domain of the site you came from; we also count taps on the phone number, the map, Uber Eats and Instagram, and the start of a booking. To count how many people visited on a given day, the server makes a hash of the IP address and browser name together with a random value that it changes every day and keeps only in memory. Neither the IP address nor the hash is saved — only the totals are. If your browser sends a Global Privacy Control or Do Not Track signal, nothing is counted.

It keeps in your browser's storage the language you chose, whether you closed the announcement at the top of the page and, after you book, the booking's number, date, time and a code that lets you change or cancel it. The booking details disappear from the browser after the date of the visit; you can also remove them by clearing the site's data in your browser settings.

9. Automated decisions

We make no automated decisions about you and do not profile you.

10. Changes

If we change how we handle data, we will update this page.