Privacy policy

1Who is responsible for your data

Indus Tandoor at Świętego Tomasza 18 in Kraków is run by the company below, which is the controller of the personal data collected through this website.

For any question about your data, write to us at the email address above with "RODO" or "GDPR" in the subject line, or speak to the manager in the restaurant.

2What we collect

We only collect what we need in order to reply to you.

When you send a booking request

• your name and phone number, which we need to confirm the table;
• your email address, if you choose to give one;
• the date, the time and the number of guests;
• anything you write in the message field, for example an occasion or a dietary need;
• the fact that you ticked the consent box, and when.

When you email or call us

We keep the content of your message and the contact details you used, so we can answer.

Automatically, when you open the website

Our hosting provider records standard server information such as your IP address, the time of the visit, the page requested and your browser type. This is needed to deliver the site and to keep it secure.

We do not ask for and do not want any sensitive data, such as health information. Please don't include it in the message field; if you have an allergy, tell your server in the restaurant.

3Why we use it, and on what legal basis

Giving us your data is voluntary, but without a name and a phone number we cannot confirm a table. You can always book by calling us instead.

4How long we keep it

• Booking requests: up to 3 months after the date of the booking, so we can handle any questions about your visit.
• Emails and other correspondence: up to 12 months from our last exchange.
• Data needed for legal claims: until the claims expire, which in Poland is usually up to 3 years.
• Accounting documents: 5 years from the end of the tax year, as Polish law requires.
• Server logs: for the period set by our hosting provider, normally a few months.

5Who else can see it

We do not sell your data and we do not share it for anyone else's marketing. We do use trusted suppliers who process data on our behalf, under written agreements:

• our hosting provider, which stores the website and its email traffic;
• our email provider, Google (Gmail), through which booking requests reach the manager;
• the person or company that maintains the website for us;
• where we are legally required to do so, public authorities.

Transfers outside the European Economic Area

Google, our email provider, may process data outside the EEA, including in the United States. These transfers are covered by the European Commission's adequacy decision for the EU-US Data Privacy Framework and by standard contractual clauses. You can ask us for a copy of the safeguards used.

6Cookies and the map

We use Google Analytics 4 to count visits, and it starts only after you accept it in the cookie banner. Which cookies that sets, and how to change your answer, is described in our cookie policy.

The map in the Find us section is displayed with OpenStreetMap data served by CARTO. When the map loads, your IP address is sent to that provider so the map images can be delivered. The map does not load until you reach that part of the page.

7Your rights

Under the GDPR you may ask us to:

• give you access to the data we hold about you, and a copy of it;
• correct anything that is wrong or incomplete;
• erase your data, for example to cancel a booking request;
• restrict how we use it while a question is being resolved;
• transfer the data you gave us to another provider;
• object to processing based on our legitimate interest;
• withdraw your consent at any time, where we rely on consent. This does not affect what we did before you withdrew it.

Write to generalmanagerindus@gmail.com and we will answer within one month.

Complaints

If you think we handle your data incorrectly, you can complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

8Automated decisions, children and changes

We do not make automated decisions about you and we do not profile you.

This website is not aimed at children. We do not knowingly collect data from anyone under 16 years old. If a booking is made for a family, we only need the name of the adult making it.

If we change this policy, we will publish the new version here with a new date. Bookings already made are handled under the policy that applied at the time.