Privacy Policy

1. Controller

The controller of the personal data described in this policy is LOKI SOFTWARE TECHNOLOGIES SP. Z O.O., ul. Jurajska 4, lok. U05, 02-699 Warszawa, PL, tax number (NIP) 7011288037, KRS 0001207843 ("we"). For anything about personal data, write to info@tavolify.com.

This policy covers the data of our customers and users of Tavolify (owners and staff of venues), visitors of our website and people who contact us.

Restaurant guests' data (for example orders, delivery addresses, phone numbers) is processed by us on behalf of the restaurant, which is its controller. The Data Processing Agreement governs that processing. For questions about that data, contact the restaurant.

2. What data we process, why and on what basis

Purpose	Data	Legal basis (GDPR)
Creating the account and providing the service	name, email, phone, venue and company details, sign-in data, usage data	Art. 6(1)(b) — performance of the contract
Invoicing and accounting	company details, tax number, address, payment history	Art. 6(1)(c) — legal obligation (tax and accounting law)
Account messages (for example email confirmation, end of trial, invoices)	email, name	Art. 6(1)(b) — performance of the contract
Support and answering messages	data given in the message	Art. 6(1)(b) or (f) — contract or our legitimate interest
Service security, preventing abuse, audit log	IP address, device identifiers, log of actions in the system	Art. 6(1)(f) — legitimate interest
Establishing and defending claims	data needed for that purpose	Art. 6(1)(f) — legitimate interest

Giving us the data is voluntary, but without it we cannot create the account or provide the service.

3. Who receives the data

Data may be received by providers that help us run the service and act on our instructions, in particular:

• server hosting — our own managed server (processing location: Turkey),
• email sending — from our own server,
• invoicing — Fakturownia (Poland), including delivery of invoices to the National e-Invoice System (KSeF),
• online payments for the subscription — Stripe, when you pay by card or BLIK,
• online payments for guests' orders — Tpay, under the restaurant's own agreement with that provider,
• address search — OpenStreetMap Nominatim, only when you use address search or delivery zones,
• artificial intelligence provider (Anthropic) — only when you use AI features, such as reading a menu from photos,
• our accountants and legal advisers.

We may also pass data to public authorities where the law requires it.

4. Transfers outside the EEA

Our servers are located in Turkey, and some providers may also process data outside the European Economic Area. Where required, we transfer data on the basis of the standard contractual clauses approved by the European Commission.

5. How long we keep data

• account data — for the duration of the contract, then for the limitation period of claims,
• invoices and accounting documents — for the period required by tax law (as a rule 5 years from the end of the year in which the tax payment was due),
• security log — for as long as needed to keep the service secure and to investigate abuse, and no longer than necessary,
• backups — daily, kept for 14 days,
• correspondence — until the matter is closed, then for the limitation period of claims.

6. Your rights

You have the right to access your data, rectify it, erase it, restrict processing, data portability, and to object to processing based on our legitimate interest. To use these rights, write to info@tavolify.com.

You may also lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

7. Cookies

See the Cookie Policy.

8. Changes

When we change this policy, we publish the new version on this page and inform customers by email if the change is significant.