Privacy policy

The controller of your personal data is Harvest Koprowski spółka jawna, registered at Sukiennice 9a, 50-107 Wrocław, Poland, tax ID (NIP) 8971850314, operating the PIENO restaurant at Vespucciego 18d, 51-505 Wrocław.

Contact: email info@pieno.pizza, phone 695 100 645.

We have not appointed a Data Protection Officer. All data-protection matters should be addressed directly to the controller above.

Purpose: answering enquiries sent via the contact or events/catering form, handling table reservations, arranging events, catering or the mobile oven, preparing offers.

Legal basis: Art. 6(1)(b) GDPR (steps to enter into a contract) or Art. 6(1)(f) GDPR (legitimate interest of the controller — answering enquiries directed to the business).

Scope: name, email, phone number, message content and enquiry details (e.g. event type, date, number of guests, budget, location), plus technical data: IP, browser, entry page.

Retention: until the end of the correspondence or the reservation date + 12 months for potential complaints.

Purpose: measuring page views, traffic sources and campaign performance.

Legal basis: Art. 6(1)(a) GDPR (your consent in the cookie banner — “Analytics” category).

Scope: cookie IDs, anonymised IP, device, browser, click path.

Retention: per Google Analytics 4 settings (up to 14 months).

Purpose: showing personalised PIENO ads on Google Ads and Meta Ads to people who visited the site.

Legal basis: Art. 6(1)(a) GDPR (your consent in the cookie banner — “Marketing” category).

Scope: advertising cookie IDs, fact of visit, pages viewed.

Retention: up to 90 days for remarketing lists.

Purpose: checking whether a PIENO ad led to a form being sent (booking, contact, event) or to a booking being confirmed by our staff, and optimising campaigns for real bookings rather than clicks.

Legal basis: Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law — your consent in the cookie banner (“Marketing” category). Without it we pass no form data to Google or Meta and store no ad click IDs.

Scope (only with consent): SHA-256 hashes of your e-mail, phone number and first name (Google Enhanced Conversions, Meta Conversions API), ad click IDs (gclid, gbraid, wbraid, fbclid), Meta browser IDs (_fbp, _fbc), IP address and browser, party size and request number. A SHA-256 hash is not anonymisation — it is pseudonymised data that Google and Meta compare with their users' data solely to match conversions.

Campaign names (UTM parameters) are stored with analytics or marketing consent.

Retention: click IDs in your browser up to 90 days; for table requests — together with the booking (see above). You can withdraw consent at any time via “Manage cookies” in the footer — from then on we send nothing and delete the IDs stored in your browser.

We use the following trusted providers (processors) under data processing agreements: the site's hosting provider; Resend, Inc. — sending emails from the forms (US); Google Ireland Ltd. — Google Tag Manager, Google Analytics 4, Google Ads, Maps (Ireland / EEA, US); Meta Platforms Ireland Ltd. — Meta Pixel / Conversions API (Ireland / EEA, US); Supabase, Inc. — the database storing table requests and enquiries from the contact and event forms (EU / US); Telegram FZ-LLC — the messenger our staff use to confirm bookings and mark enquiries as handled; only the first name, phone, hour or date, number of guests and event type or subject are sent there — no message text and no full e-mail address (United Arab Emirates, outside the EEA); zjedz.my — the booking system reachable from our Google profile (Poland); Adjust GmbH — attribution of clicks on the Glovo app link (glovo.go.link deep link; Germany / EEA).

Some of these providers (Resend, Google, Meta) are based in or process data in the US. Transfers to the US are based on the Standard Contractual Clauses of the European Commission and the EU-US Data Privacy Framework (Commission Decision 2023/1795). Booking notifications also go to Telegram, whose operator is based outside the EEA — which is why we limit them to what is needed to confirm a table (no full e-mail address).

We do not sell or share your data with third parties for marketing purposes beyond those listed above.

Under data protection law you have the right to: access your data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17) — except data the law requires us to retain, restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and to withdraw consent at any time — without affecting processing done before withdrawal.

You also have the right to lodge a complaint with the Polish DPA (uodo.gov.pl).

To exercise any of these rights, write to info@pieno.pizza. We respond within 30 days.

Providing data is voluntary but necessary to handle your enquiry or reservation. We do not make solely automated decisions or profiling with legal effects.

The site pieno.pizza uses cookies in three categories: essential (always on), analytics (consent required) and marketing (consent required). We remember your choice for 12 months. You can change your consent at any time — click “Manage cookies” in the footer.

By default (before consent) we operate in Google Consent Mode v2 with all signals set to “denied” — no advertising IDs are stored, no user profile is built.

Every visit generates a technical log (IP, time, URL path, browser). Logs are retained for up to 30 days and are not linked to other personal data.

Some links take you to external services (zjedz.my, Glovo — via an Adjust attribution link, Google Maps, Instagram, Facebook). Once you leave our site we are not responsible for how those parties process your data — e.g. details you enter when booking on zjedz.my or ordering on Glovo are processed by their operators under their own privacy policies.

This privacy policy may be updated. Each version is dated at the top of this page. We notify about material changes via a banner on the site.