Privacy policy
Effective from 27 September 2026.
This document explains what personal data we process in connection with the hashisha.pl website and running the restaurant, why we process it, how long we keep it and what rights you have. We follow Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Polish telecommunications law with regard to cookies.
1. Data controller
The controller of your personal data is the owner of Hashisha restaurant, ul. Zofii Urbanowskiej 4A, 62-500 Konin, Poland (“we” or the “Controller”).
For matters relating to personal data you can call us on +48 791 597 447, message us on Instagram or Facebook, or send a letter to the restaurant address.
2. What data we process and why
Using the website
When you visit the site, the server automatically records technical data: IP address, date and time of the visit, the address of the page viewed, browser type and operating system. We do this to keep the site working correctly and securely. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). Logs are kept for no longer than 30 days.
Bookings and phone contact
When you call to book a table or ask about an event, we note your first name, phone number, date, time and number of guests. We need this to take and handle the booking. Legal basis: steps taken at your request before entering into a contract, and performance of that contract (Art. 6(1)(b) GDPR). We delete the data after the booking has taken place, within 30 days at the latest.
Social media
We run profiles on Instagram and Facebook. If you message us or comment, we process the data visible in your profile and the content of the message in order to reply and run the profile. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Meta Platforms Ireland Ltd. is a joint controller of this data and processes it under its own privacy policy.
Cookies and analytics tools
Our rules for cookies are described in the cookie policy. We only enable analytics and marketing tools with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
Legal obligations
If we issue an invoice or handle a complaint, we process the data required by tax and consumer law (Art. 6(1)(c) GDPR) for the period those laws require, usually 5 years from the end of the tax year.
3. Recipients of data
Your data may only be received by parties that help us run the website and the restaurant:
- the hosting and server provider for the website,
- the company providing technical support for the website (Most Digital),
- our accounting office, for accounting documents,
- providers of analytics or marketing tools, if you consent to them,
- public authorities, where the law requires it.
We sign data processing agreements with parties that process data on our behalf.
4. Transfers outside the EEA
We do not transfer data outside the European Economic Area. The exception may be Google and Meta services, if you click a link to Google Maps or our social media profiles, or consent to tools from these companies. In that case the transfer is based on a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.
5. Your rights
In connection with the processing of your data you have the right to:
- access your data and receive a copy,
- have inaccurate data corrected,
- have your data erased (the “right to be forgotten”),
- restrict processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal,
- lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
To exercise these rights, contact us by phone, through social media or by post. We will reply within one month.
6. Whether providing data is required
Providing data is voluntary. Without a first name and phone number, however, we cannot take a booking.
7. Automated decisions
We do not make automated decisions or profile users without their consent.
8. External links
The site contains links to Google Maps, Instagram and Facebook. Once you click them, the privacy rules of those services apply.
9. Changes to this policy
We may update this policy, for example when the law changes or we start using new tools. The current version is always available on this page, with its effective date at the top.