iTasty

Privacy Policy

Data controller

The data controller is Yaroslav Moskal conducting business under the name Yaroslav Moskal, ul. Szlak 77/222, 31-153 Krakow, Poland, NIP: 6793286602, e-mail: [email protected].

The controller has not appointed a Data Protection Officer. For personal data matters, you can contact us directly at: [email protected].

Roles and scope of responsibility

For this marketing website (itasty.pl, itasty.eu, i-tasty.com), iTasty acts as the data controller. For restaurant ordering services, roles may be split: a restaurant may act as controller for guest data, while iTasty may act as processor under separate contractual terms.

Data processing map

Data category Purpose Legal basis Typical retention
Contact form details Sales contact and response to inquiry Art. 6(1)(b) GDPR where the inquiry concerns pre-contractual steps, or Art. 6(1)(f) GDPR as the controller's legitimate interest in handling contact Until inquiry handling is completed, or longer where required by law
Technical and security data Security, abuse prevention, service integrity Art. 6(1)(f) GDPR For as long as needed to protect the service and defend legal claims
Statistics (Umami) Traffic measurement and website effectiveness without storing cookies, localStorage or sessionStorage Art. 6(1)(f) GDPR Until analytics purpose is fulfilled or a valid objection applies

Contact form

Details submitted through the contact form, such as name, venue name, e-mail address, phone number and message content, are used only to reply to the inquiry and contact you about an offer or cooperation. We do not use this data for behavioral advertising and we do not sell it to other entities.

Providing data in the form is voluntary, but providing the fields marked as required is necessary so that we can reply to your inquiry and contact you.

What data we may process

  • contact details provided through the form, including name, e-mail and phone number,
  • technical data related to website use, such as IP address, device type and browser,
  • aggregated statistical and analytical data collected through Umami Analytics, without contact form data,
  • data needed to operate anti-spam protections through Cloudflare Turnstile.

Purposes of processing

  • handling contact form submissions and replying to inquiries,
  • ensuring website security and limiting abuse,
  • measuring traffic and website effectiveness,
  • complying with legal obligations where required.

Legal basis

We process contact form data under Article 6(1)(b) GDPR where the inquiry concerns pre-contractual steps, or Article 6(1)(f) GDPR where we reply to the inquiry under our legitimate interest. Technical, security and aggregated analytics data is processed under Article 6(1)(f) GDPR, meaning our legitimate interest in protecting the website, preventing abuse and analyzing website effectiveness.

Data recipients

Data may be entrusted to entities supporting the operation of the site, including hosting and technical infrastructure providers, analytics tools, security services and contact form handling tools. We currently use self-hosted Umami Analytics and Cloudflare Turnstile.

We do not sell personal data and we do not use this website for behavioral advertising based on user profiling.

Retention period

We keep data for as long as necessary to handle contact, ensure security, pursue legitimate analytics purposes, and meet any legal retention obligations that may apply. Contact form data is deleted or anonymized when it is no longer needed to handle the inquiry, unless longer retention is required by law or necessary to defend legal claims.

Transfers outside the EEA

As a rule, personal data is processed within the European Economic Area. If a specific service requires transfer outside the EEA, we apply appropriate safeguards, including Standard Contractual Clauses (SCC), in line with Article 46 GDPR.

Your rights

  • right of access,
  • right to rectification,
  • right to erasure,
  • right to restriction of processing,
  • right to object,
  • right to data portability where applicable,
  • right to lodge a complaint with the competent supervisory authority.

Profiling and automated decisions

We do not make automated decisions about you, including decisions that produce legal effects or similarly significantly affect you. We do not use data from this website for advertising profiling.

Contact

For privacy and personal data matters, contact: [email protected]

Last updated: 2026-04-24

Change history

  • 2026-04-16 – clarified controller vs processor roles
  • 2026-04-16 – added processing map and cross-border transfer safeguards
  • 2026-04-24 – clarified contact form handling and cookieless analytics
  • 2026-04-24 – added information about voluntary data provision, no DPO and no automated decisions
Back to site