No products in the cart.

No products in the cart.

Personal Data Processing and Protection
Personal Data Processing and Protection

1. General

This Privacy Policy provides information on how your personal data are collected, stored and processed, the legal basis for their processing, and your rights in relation to their processing.

The Controller of your personal data (within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – hereinafter referred to as the GDPR) is Maison Charlotte spółka z ograniczoną odpowiedzialnością, with its registered office in Warsaw (00-549) at ul. Piękna 11B, lok. 2, KRS Registration No: 0000363133, NIP Tax ID: 7010251730, REGON Business ID: 142545525, hereinafter referred to as the “Controller” or “Charlotte”.

Users’ personal data are processed by the Controller in compliance with personal data protection legislation, including in the first instance the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”).

2. Legal Basis for Data Processing

We process your personal data only if:

  1. we have obtained your prior consent;
  2. this is necessary for the conclusion of a contract, taking steps prior to entering into a contract, or performance of a contract;
  3. the processing is necessary for compliance with our legal obligations;
  4. the processing is necessary for the Controller or a third party to pursue its legitimate interests which are not overridden by the interests or rights and freedoms of the data subject.

3. Categories of Personal Data Processing

Personal data are processed by us to the extent indicated in respect of:

  1. Customers – to the extent necessary for the acceptance and fulfilment of an order, i.e., full name, address of residence, email address, phone number;
  2. Applicants – to the extent necessary to carry out a recruitment process, i.e., full name, date of birth, address of residence, email address, phone number, education and professional qualifications, and previous employment history;
  3. Counterparties – to the extent necessary for the performance of the contract between the parties, i.e., full name, position, phone number and email address, and data necessary for the issue of a VAT invoice;
  4. Site Users – to the extent necessary for the provision of the Newsletter service or use of the contact form, i.e., full name and email address.

4. Consent to the Processing of Personal Data

Consent to the processing of personal data must be freely given, specific, informed and unambiguous. If we process your personal data based on your consent, you can withdraw your consent at any time as easily as you gave it.

5. Purposes of Personal Data Processing

We collect, store and process personal data for the purpose of providing services, marketing our services, making and receiving payments, collecting debt, and archiving, and for marketing and statistical purposes.

Your data will be processed to the extent necessary for us to comply with our obligations and for a period necessary to achieve the purposes for which they were collected, in compliance with our data storage policy and the applicable data protection legislation. The personal data processing period may each time be extended by the statute of limitations for claims, if the processing of the personal data will be necessary for the exercise or defence of such claims by the Controller.

We process Customers’ personal data in order to provide them with the service ordered – to accept and fulfil an order, as well as to handle complaints and produce accounting documents. We process the data entrusted to us for a period necessary to provide the service ordered.

Legal basis: point (b) of Article 6(1) of the GDPR.

We process personal data of Site Users and those using the contact form in order to handle the query made and to provide a response. We process the personal data entrusted to us for a period necessary to establish and manage the communication.

Legal basis: point (b) of Article 6(1) of the GDPR.

We process personal data of Newsletter service Recipients in order to provide them with news about the Controller – we inform them, among other things, about changes to our menu and events taking place at Charlotte or new restaurant openings. We process the personal data entrusted to us until you withdraw your consent.

Legal basis: point (a) of Article 6(1) of the GDPR.

We process Applicants’ personal data in order to conclude a contract with the data subject, to the extent necessary for the recruitment process. We process the personal data entrusted to us for the period necessary for the current recruitment process. Applicants’ personal data may be processed for the purpose of future recruitment processes only after obtaining the Applicant’s consent to such processing of their personal data.

Legal basis: point (b) of Article 6(1) of the GDPR.

We process Counterparties’ personal data in order to perform the civil law contracts concluded. We process the personal data entrusted to us until our cooperation is terminated. Legal basis: points (a) and (b) of Article 6(1) of the GDPR.
We may collect personal data from social media, such as Facebook, to the extent of data relating to your activity on such portals, e.g. your activity on the Controller’s profile. Data are transferred automatically, based on contracts or website terms and conditions.

6. Making Personal Data Available

We may transfer personal data to third parties in order to achieve the purposes listed in Article 5, insofar as this is necessary for such third parties to carry out the tasks commissioned by us, if we are required to do so by law, or if we have your consent to transfer such data to another entity. In this regard, your personal data may be transferred to:

  1. system hosting providers;
  2. Newsletter service providers;
  3. payment service providers;
  4. accounting service providers;
  5. document archiving service providers;
  6. legal, analytical and marketing service providers;
  7. postal or courier companies;
  8. banks, in order for them to process payments;
  9. authorities having the right to receive your data by law.

Your personal data will not be made available in any way to third parties, other than for the purposes indicated in this Privacy Policy, and in particular they will not be transferred to other entities for the purpose of sending third-party marketing material. Your personal data is not transferred outside the European Union.

7. Rights of Data Subjects

1. right to withdraw consent

At any time, you have the right to withdraw any consent to the processing of personal data without giving any reasons. Your request may relate to a specific purpose of processing, but may also relate to all the purposes of processing. The withdrawal of consent in respect of all the purposes of processing will result in your data not being processed by us. The withdrawal of consent will not affect the activities already completed. The withdrawal of consent does not have any adverse consequences, but it may prevent us from continuing to perform activities for you or prevent you from using our functionalities which we can lawfully provide only with your consent (Article 7(3) of the GDPR).

2. right to object to use of personal data

You have the right to object at any time to the processing of your personal data, either in their entirety or to the extent indicated, if we process them based on our legitimate interests. Unless we have another legal basis for processing your personal data, we will erase the data objected to (Article 21 of the GDPR).

3. right to erasure – “right to be forgotten”

You have the right to obtain the erasure of all or some of your personal data at any time. The request to erase the data will not affect the activities already completed. The erasure of the data will result in your data not being processed by us.

Despite a request to erase your personal data, due to an objection or withdrawal of consent, we may retain certain personal data where there are compelling legitimate grounds for processing the data or where this is necessary for the establishment, exercise or defence of potential claims related to the processing of your personal data. This applies in particular to personal data which we retain for the purpose of handling complaints and claims related to the processing of your personal data. The legal basis for our processing of your personal data for this purpose is our legitimate interest (point (f) of Article 6(1) of the GDPR).

4. right to restriction of processing of personal data

At any time, you have the right to obtain the restriction of processing of your personal data (Article 18 of the GDPR).

5. right of access to personal data

At any time, you may request us for confirmation as to whether or not we process your personal data and, if so, access them and obtain the following information: the purposes of the processing, the categories of the personal data being processed, the recipients or categories of recipients to whom the personal data have been or will be disclosed, the envisaged period for which the personal data will be stored or the criteria used to determine that period, the right to request rectification, erasure or restriction of processing of the personal data, the right to object to such processing, the right to lodge a complaint with a supervisory authority, the source of the personal data, the existence of automated decision-making, including profiling, and the safeguards used in relation to the transfer of such data outside the European Union. You also have the right to obtain a copy of your personal data (Article 15 of the GDPR).

6. right to rectification of personal data

You have the right to obtain from us the rectification of personal data if they are inaccurate or to have them completed if they are incomplete (Article 16 of the GDPR).

7. right to data portability

You have the right to obtain the personal data provided by you and to transmit them to another personal data controller of your choice. You have the right to have the personal data transmitted directly to another controller, where technically feasible (Article 20 of the GDPR).

8. right to lodge a complaint

You may submit queries and requests to us regarding the processing of your personal data and the exercise of your rights. We have the obligation to provide information on actions taken by us within one month of receipt of each request.

If you consider that your right to data protection has been infringed, you have the right to lodge a complaint with the President of the Personal Data Protection Office.

8. Contact with the Controller about Personal Data

You may contact us regarding all personal data protection matters by sending an email to rodo@bistrocharlotte.com.

The Site does not automatically collect any information except that contained in cookies. Cookies are IT data, in particular text files, which are stored on the Site User’s end device, and which are intended for the use of the Site. Cookies typically contain the name of the website they originate from, their storage time on the end device, and a unique number. Cookies are placed on the Site User’s end device and accessed by the Site operator and server administrator. Cookies may also be placed and used by advertisers and partners cooperating with the Site operator and server administrator, in particular Google Analytics for analytical and statistical purposes.

Cookies are used for:

  1. adapting the content of the Site to the User’s preferences and optimising the use of the Site, in particular such files allow the Site to recognise the User’s device and appropriately display the Site, in a way tailored to the User’s individual needs;
  2. generating statistics which make it easier to understand how Site Users use the pages, so as to improve the pages’ structure and content.

We do not use cookies to obtain any personally identifiable information about Users of our Site or to track their navigation.

In many cases, web browsing software (browser) allows the storage of cookies on the Site User’s end device by default. Site Users can change their cookie settings at any time. These settings can be changed, in particular, in such a way as to block the automatic use of cookies in the settings of the browser or alert the User each time cookies are placed on the Site User’s device. Details on the possibility and ways of using cookies are available in the settings of your software (browser).

Please be advised that restricting the use of cookies may affect some of the functionalities available on our Site.

10. Miscellaneous

This Privacy Policy takes effect on 1 January 2021. Any changes or additions to this Privacy Policy will be published on the Controller’s Site.

Witamy w Charlotte - Chleb i Wino.