Information on the processing of personal data by BAR BARBARA

Your personal data is processed by GWARNO Spółka z ograniczoną odpowiedzialnością, with its registered office in Warsaw (00-511) at ul. Nowogrodzka 10, Tax ID (NIP) 7011237778, National Court Register (KRS) 0001144911, which acts as the controller of personal data within the scope described below (the “Controller”).

The Controller processes your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, known as the General Data Protection Regulation (“GDPR”).

The information below is provided for information purposes only and requires no action on your part.

Purposes, scope and legal bases of processing

The Controller processes your personal data primarily in order to perform the agreement between you and the Controller, to provide services to you, or to take steps necessary to conclude an agreement or begin providing such services (pursuant to Article 6(1)(b) GDPR), including in order to make a table reservation, handle enquiries regarding events and venue hire, and respond to questions you send us.

In addition, the Controller may process your personal data on the basis of your consent, pursuant to Article 6(1)(a) GDPR — in particular with regard to the processing of your image and with regard to cookies and analytics tools referred to in the section “Cookies and analytics tools”.

The Controller may also process your data for purposes related to its legitimate interests other than the provision of services and performance of an agreement (pursuant to Article 6(1)(f) GDPR), namely in order to:

• ensure safety on and around the premises (CCTV),
• handle and confirm reservations,
• pursue or defend legal claims.

The Controller processes the personal data collected solely to the extent necessary to achieve the purposes listed here.

Providing your data is voluntary; however, failure to provide personal data may hinder or prevent the conclusion of an agreement or the provision of services to you by the Controller.

Consent once given may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal. Consent should be given each time on a separate form.

Reservations

Table reservations can be made through the mojstolik.pl system, by telephone or by e-mail. Where a reservation is made through the reservation system, your data is also processed by the provider of that system, on the terms set out in its own privacy policy.

Cookies and analytics tools

The barbarbara.pl website uses cookies — small text files stored on your device.

Necessary cookies are used for the proper functioning of the website and to remember your choices regarding consent. Their use does not require consent.

Analytics cookies are used by Google Analytics 4, provided by Google Ireland Limited. They serve solely for aggregate analysis of website traffic — how many people visit the site, where they come from and which content they view. They are not used to identify individual persons.

Analytics cookies are activated only after you have given your consent via the banner displayed on your first visit. Until consent is given, analytics tools do not store cookies.

You may change your decision at any time using the “Cookies” link in the website footer, and you may also manage cookies through your browser settings.

Recipients of personal data

In the ordinary course of business, the Controller may transfer your personal data to external recipients where this is necessary for business processes, for ensuring a high quality of service, and for fulfilling the Controller’s legal obligations.

This includes in particular the Controller’s partners and suppliers — providers of courier, postal, accounting, legal and IT services, including the provider of the reservation system, the website hosting provider and the provider of analytics tools.

Transfers outside the European Economic Area

In connection with the use of analytics tools and hosting services, your data may be transferred to entities established outside the European Economic Area, in particular to the United States.

Analytics services are provided to the Controller by Google Ireland Limited, established in Ireland. To the extent that data is onward transferred to Google LLC in the United States, such transfer takes place on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU-U.S. Data Privacy Framework. Google LLC appears on the list of entities certified under that programme.

Irrespective of the above, the Controller uses providers on terms incorporating the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR), which apply in particular should the above decision cease to be in force.

Data retention period

Your data is processed for the period necessary to fulfil the purposes described above, i.e. for the term of the agreement between you and the Controller or the provision of services to you, and after its expiry or the end of the provision of services — for the period required by law or necessary to pursue the Controller’s legitimate interests, including the limitation period for civil law claims.

Where the basis for processing personal data is consent, the data will be processed until consent is withdrawn or until the Controller’s legitimate interest no longer requires such processing.

Personal data recorded by CCTV is processed for a period of 2 weeks, after which it may continue to be processed only where it constitutes or may constitute evidence in proceedings based on legal provisions. In such a case, this period is extended until those proceedings have been finally concluded.

Data collected via cookies is processed for the period indicated in the settings of the individual files, and no longer than until consent is withdrawn.

Your rights

In connection with the protection of personal data, you have a number of rights under the GDPR. These include:

• the right to rectification of data, should the processed data prove to be incorrect;
• the right of access to your data, including the right to obtain a copy of it and information about the processing;
• the right to request erasure of personal data, in the cases set out in the GDPR;
• the right to request restriction of processing and to object to processing;
• the right to portability of the data you have provided to the Controller.

You also have the right to lodge a complaint with the competent supervisory authority (the President of the Personal Data Protection Office, Prezes Urzędu Ochrony Danych Osobowych) if you consider that the Controller’s processing of personal data infringes the law.

Should you have any questions or concerns regarding the processing of your personal data, you may contact the Controller:

• by post to the registered office address,
• by e-mail: rezerwacje@barbarbara.pl

This document is a translation provided for information purposes. In the event of any discrepancy, the Polish-language version available at barbarbara.pl/polityka-prywatnosci shall prevail.