Privacy policy
This policy explains what personal data na tacy processes when you place an order through this site, on what basis, and for how long.
Who the controller is
na tacy is a brand. The controller of your data is the business behind it: MS Małgorzata Szejka, ul. Lipowa 61, 44-102 Gliwice, Poland, tax identification number (NIP) 631 248 73 40, REGON 541908338. The site you are reading, and the system your order is stored in, are operated for us by BDS Experts Leszek Szejka — but the decision to collect your order details, and what they are used for, is ours. That is what makes us the controller and them our processor, even though the servers and the database are theirs. For anything concerning personal data, write to catering@na-tacy.pl or call 694 462 993.
What we collect when you order
To accept and fulfil an order we ask for your name, e-mail address and telephone number, the date and time you want the order for, and — when you choose delivery rather than collection in person — the delivery address. We also keep the contents of the order itself. All of it is used to prepare what you ordered, to hand it over or deliver it, and to contact you if something about the order needs settling. Providing this data is voluntary, but without it we cannot take the order.
Cookies, analytics, and what stays in your browser
This site sets at most two cookies of its own: one remembering the language of the site, and one remembering your answer to the cookie banner. Two further things are kept in your browser and are never sent to us on their own: your basket, which stays there until you place the order or clear it, and — if you arrived through a campaign link — the campaign tags from that link, which are cleared when you close the tab and are submitted with the order so that we know which campaign it came from. If — and only if — you accept on the banner, we additionally load Google Analytics 4, which sets its own cookies (_ga and _ga_ followed by the property id) and tells us which pages are read, for how long, and roughly where visitors arrived from. Google acts as our processor for those statistics; advertising features and cross-site tracking are not enabled. Nothing is requested from Google before you accept, and declining means no such request is ever made. You can change your mind at any time using the "Cookie settings" link in the footer, which brings the banner back. The same acceptance also lets us report confirmed orders to our advertising platforms, described in section 6.
Checking that you are not a bot
The order form is protected by Cloudflare Turnstile, which receives your IP address and basic details of the browser session in order to tell a person from an automated script. It runs only on the order form, and it is a security measure the form cannot work without — so it is not something the cookie banner can switch off. Cloudflare acts as our processor for this.
Legal basis
Order data is processed in order to perform the contract, or to take steps at your request before entering into it (GDPR Article 6(1)(b)). Protecting the order form against automated abuse rests on our legitimate interest in keeping the service usable (Article 6(1)(f)). Where you accepted the cookie banner, measuring our advertising rests on your consent (Article 6(1)(a)), which you may withdraw at any time using the "Cookie settings" link in the footer — withdrawing stops any future sharing, and does not affect what was already shared lawfully. We make no automated decisions about you and profile no one.
Who we entrust data to
Orders are held in FingerFood Manager, the system we run the business on, supplied by BDS Experts Leszek Szejka as our processor and hosted on Microsoft Azure in the Poland Central region, so the data stays within the European Union. Cloudflare processes the anti-bot check described above. E-mail about your order is sent through our own mail provider. If you consented to analytics, Google processes those statistics on our behalf; without that consent no data reaches them at all. If you consented on the cookie banner, we also report confirmed orders to the advertising platforms we run campaigns on, so we can tell which adverts led to real orders — what they receive is your e-mail address and phone number in a scrambled form they cannot read back, together with the order's value. Decline, and nothing about your order is sent to them. We sell your data to nobody, and pass it to nobody beyond those named here except where the law requires it.
How long we keep it
Order data is kept for 5 years from the end of the accounting year in which the order was placed — the period Polish tax law requires invoices and accounting records to be kept, and the reason we cannot delete an invoiced order sooner even on request. Correspondence about an enquiry that never becomes an order is kept for as long as handling the matter requires, and no longer than a year.
Your rights
You have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, and to receive it in a portable form. Write to catering@na-tacy.pl and we will deal with it. Where we have to keep something despite a deletion request — an invoice, for example — we will tell you why.
Complaints
If you believe we process your data unlawfully, you may complain to the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
Changes
The date of the last update is shown at the top of this page. Any change applies from the moment it is published here.
contact
Let’s talk
Opening hours
Mon–Fri 9:00–16:00
Sat 9:00–15:00
Address
ul. Lipowa 61
44-102 Gliwice
NIP 631 248 73 40