How we process guests' personal data
B.1 Who processes your data
The controller is the restaurant Bistro Grémium, premises at Moyzesova 39A, 900 28 Ivanka pri Dunaji. The registered business name, registered office and company ID (IČO) are not published on this page.
Contact for questions about personal data: patrikgremium@gmail.com, +421 948 185 956.
We have not appointed a data protection officer (DPO), as Art. 37 GDPR does not require us to.
The processor is the operator of the Taverum service: Marko Karol Guldan – Taverum, Bratislava, phone +421 944 443 304. We will add the company number (IČO) as soon as it is entered in the trade register. Taverum hosts our website and sends the messages about bookings and orders for us. It processes data only on our instructions and under a contract pursuant to Art. 28 GDPR.
B.2 What data we process
- With a booking request: name, phone number, e-mail (if you give one), date and time, number of people, note, status of the request (received, confirmed, declined, another time) and the messages we sent you about it.
- For an order for pickup or delivery: name, phone number, e-mail (if you give one), note, the dishes ordered and their quantities, price, payment method, pickup date and time, and order status (received, confirmed, ready, picked up, declined, cancelled or expired). For delivery also the address, its location on the map and the delivery fee.
- When you sign up for an event: name, phone number, e-mail (if you give one), number of people and the event you sign up for.
- When you join the waiting list: name, phone number, e-mail (if you give one), number of people and note.
- In the guest list: from the bookings still stored, our staff see for each guest the name, phone number, number of visits, date of the last visit, bookings you did not turn up for, and notes on bookings. No new record is created: when the bookings are deleted (section B.5), the guest disappears from the list too.
- If you sign up for menu e-mails: phone number, e-mail and the date you signed up, or unsubscribed.
- For the loyalty card: phone number, the days you got a stamp (on a visit with a booking, with an order you picked up, or at the till), your rewards and when you used them. If another guest recommended us to you, or you recommended someone, also which two cards belong together. We do not store your name, e-mail or spending with the card. You get the card with your first stamp and open its page through a private link.
- If you join through the QR code on the table: your phone number, the day you joined, the table number (if the code carries one), today's stamp and the welcome gift for your next visit with its validity. Your e-mail and name only if you tick that you want to receive news. The page shows a card only to a number that is new here; if the number already has a card, we send the link to it only to the e-mail we have for it with consent.
- If you tell us where you heard about us when you join: your answer (for example Instagram or our website). It is optional; we keep it with your card and it is deleted together with it. In our overviews we count it only as a daily total, without your phone number. If you show the staff a code from an advert or a post, only the code, the day and the number of guests are recorded, not who you are.
- When you visit the website: technical data needed to show and protect the page: IP address, browser type, time and the address visited. When you send a form, an anti-bot check is also run.
- Where you came to the website from: with a booking, order, sign-up or a place on the waiting list we store only a general source, such as Instagram, Google, our e-mail or “direct”, and possibly the label of our post or campaign. We take it from the link you came through, and between the site's pages it travels in the link address, not in cookies. We do not store the full address of the page you came from, nor your IP address. We count website visits by source only in total.
- If you answer our question after your visit: your rating from 1 to 5, any text you write, and whether we may publish it on our website with your first name. We also store that you clicked the button for a Google review. The Google review itself you write at Google, not with us. You only get the question after a booking or an order.
- If you comment on our post on Facebook or Instagram: your name or user name, the text of the comment, its time, the post it is under, and our reply. This is information you published yourself under our post; we read it through Meta's interface so that we can reply to you.
Health data (such as allergies or diets): we do not ask you for them and ask you not to write them in the note. Please tell our staff directly. If you do put them in the note, we use them only to prepare for your visit and delete them together with the booking.
B.3 For what purpose and on what legal basis
| Purpose | Legal basis |
|---|---|
| Handle your booking request: confirm it, decline it or suggest another time, send a reminder, contact you if anything changes | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) |
| Prepare your order for pickup or deliver it, check whether we deliver to the address, confirm or decline it and let you know how it is going | Performance of the contract for buying food, or steps taken at your request before entering into it (Art. 6(1)(b) GDPR) |
| Confirm your place at an event and send you a confirmation and a reminder | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) |
| Contact you from the waiting list when a table frees up | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) |
| Keep a guest list, so that we recognise you on your next booking, know how often you have been with us, and can prepare for regular guests as well as for guests who repeatedly do not turn up | Legitimate interest in looking after guests well and planning tables (Art. 6(1)(f) GDPR) |
| Keep your loyalty card: stamps for visits and orders, rewards, a gift for a friend you recommended, the welcome gift when you join through the QR code on the table, and protection against misuse (one stamp a day, one welcome gift per new number, at most 5 stamps for friends a month) | Legitimate interest in rewarding regular guests (Art. 6(1)(f) GDPR). You can delete the card yourself at any time on its page. |
| Count how many new guests came through our website, posts and adverts (your optional answer when you join through the QR code on the table) | Legitimate interest in improving our services (Art. 6(1)(f) GDPR) |
| Send you an occasional e-mail about the menu and events, if you signed up for it yourself | Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time |
| Read your rating after a visit, evaluate it and reply to it | Legitimate interest in improving our services (Art. 6(1)(f) GDPR) |
| Replying to your comment under our post on Facebook or Instagram | Legitimate interest in answering our guests (Art. 6(1)(f) GDPR) |
| Publish your words from the rating with your first name on our website | Your consent (Art. 6(1)(a) GDPR), which you give by ticking the box and can withdraw at any time |
| Protect the form against spam and misuse (limits on the number of requests, anti-bot check) | Legitimate interest in the security of the service (Art. 6(1)(f) GDPR) |
| Find out which of our posts, campaigns and pages bring guests, in total numbers only (the general source of a booking or order) | Legitimate interest in measuring our promotion (Art. 6(1)(f) GDPR) |
| Show the website and protect it against attacks | Legitimate interest (Art. 6(1)(f) GDPR) |
Without a name and phone number we cannot accept a booking request, an order, an event sign-up or a place on the waiting list. If you would rather not give them, call us on +421 948 185 956.
Your data is not used for marketing without your consent and we do not sell it. Messages about your booking are service messages, not advertising. If you click “Send me news about the menu now and then” yourself, we occasionally send you an e-mail about the menu and events, and a short message when you get your first stamp or a reward on the loyalty card, at most one such message a week. You withdraw your consent with one click on the link in every such e-mail, or by telling us. We do not use the guest list for advertising and do not give it to anyone. You can object to it (section B.9) and we will delete your records from it. We make no automated decisions under Art. 22 GDPR: a person from our team always decides on your booking.
B.4 Who we share data with
- to our staff who handle bookings and orders, and to the courier who delivers the order (name, phone number, address),
- to our processor Taverum and its sub-processors:
- Cloudflare (website hosting and database; data stored in the EU),
- Resend (sending confirmation e-mails; Resend, Inc., USA),
- Twilio (sending SMS with a confirmation or reminder; it receives only the phone number and the text of the message; Twilio Inc., USA),
- Anthropic (an artificial intelligence tool that drafts replies to ratings and comments; it receives only the text, not your name or phone number; Anthropic PBC, USA),
- OpenStreetMap Foundation (the Nominatim service finds the location of the delivery address; it receives only the street and town, not your name or phone number),
- Current list: taverum.sk/subprocesori.
- to public authorities, only where the law requires it.
B.5 How long we keep data
- Data about bookings, orders and event sign-ups, including name, phone number, e-mail and note: 90 days after the date of your visit. For a pickup order, this is the pickup date. After that it is deleted automatically.
- Waiting list data: 90 days after you joined the list. After that it is deleted automatically.
- Rating after a visit: deleted together with the booking or order it belongs to. Words you allowed us to publish stay on the website until we take them down. Ask us and we will take them down.
- Guest list: it has no data of its own; it is built from the stored bookings and disappears with them.
- Sign-up for menu e-mails: until you unsubscribe. After that we keep only your phone number, e-mail and the date you unsubscribed, so that we do not write to you again and can show that we respected your decision.
- Loyalty card: as long as you use it. The stamps stay on it even after a booking or order is deleted, because the card counts visits for longer. If you go 12 months in a row without a stamp, the card deletes itself together with its rewards. You can delete it at any time on its own page (the “Delete card” button) or ask us to. A welcome gift you did not redeem is deleted 90 days after it expires.
- A comment on Facebook or Instagram: we delete its text, the name and our reply on our side 90 days after the comment. On Facebook and Instagram they stay until you or we delete them.
- Technical records of website visits: at most 30 days.
- Backups are overwritten within 35 days at the latest.
B.6 Transfers outside the EU
Údaje sú uložené v EÚ. Cloudflare, Resend, Twilio a Anthropic sú však spoločnosti so sídlom v USA a Cloudflare spracúva požiadavky v sieti, ktorá môže siahať aj mimo EÚ. Prenos je chránený rámcom ochrany údajov EÚ – USA (rozhodnutie Komisie (EÚ) 2023/1795) a štandardnými zmluvnými doložkami (rozhodnutie Komisie (EÚ) 2021/914) podľa čl. 45 a 46 GDPR. Kópiu záruk si môžete vyžiadať na patrikgremium@gmail.com.
B.7 Cookies
Our website uses no tracking or advertising cookies and has no third-party scripts. We count visits only in total, without identifying anyone. Where a visit came from (for example “Instagram”) is carried by the links between the site's pages, in the address (?zdroj=…); nothing is stored in your browser. When you send a form, the anti-bot check (Cloudflare Turnstile) may briefly use technically necessary data in your browser. No consent is needed for that (§ 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications).
B.8 Artificial intelligence
An artificial intelligence tool helps us with the text of the menu. A person from our team checks and approves every such text before it is published or sent. Data from the booking form is not sent to the AI tool. The tool may receive the text of your rating to draft a reply; it does not get your name or phone number. Replies drafted with the help of AI are marked as such. We send booking confirmations from fixed templates, not through AI. (Information in the spirit of Art. 50 of Regulation (EU) 2024/1689 on artificial intelligence.)
We reply to comments under our posts on Facebook and Instagram with the help of the same tool. It receives only the text of the comment and information about our restaurant, not your name. If we have switched it on, a thank-you and an answer to a question about opening hours, the daily menu, the address, booking or ordering may go out automatically, without a person checking it, and only from our own information. Everything else, for example a complaint or a question about allergies, is answered by a person from our team.
B.9 Your rights
You have the right:
- to access your data (Art. 15 GDPR),
- to rectification (Art. 16),
- to erasure (Art. 17),
- to restriction of processing (Art. 18),
- to portability (Art. 20),
- to object to processing based on legitimate interest (Art. 21), for example to the guest list or the loyalty card,
- at any time to withdraw your consent to the menu e-mails, without affecting what we sent before (Art. 7(3)).
Write to us at patrikgremium@gmail.com or speak to us in person at the restaurant. We will reply without undue delay, within 1 month at the latest (Art. 12(3) GDPR).
If you believe we handle your data unlawfully, you can file a complaint (a request to start proceedings) under § 100 of Slovak Act No. 18/2018 Coll. with the Office for Personal Data Protection of the Slovak Republic, Hraničná 4826/12, 820 07 Bratislava, dataprotection.gov.sk.
B.10 Changes
We update this information when the way we process data changes. The date of the last change is given at the start of part B.