Who processes your data

The controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (the GDPR) is Na koláče patisserie, Námestie Andreja Hlinku 1, 831 06 Bratislava-Rača, Slovakia, company ID 53795041. You can reach us on 0948 128 000, by e-mail at daniela@nakolace.sk, or in person at the shop during opening hours, daily from 11:00 to 21:00.

We have not appointed a data protection officer under Article 37 of the GDPR, because we neither process personal data on a large scale nor carry out systematic monitoring. Any question about your data is handled directly by Daniela.

What we process and why

Orders. When you order a cake, pastries or a savoury platter, we need your name, telephone number, e-mail address and, for deliveries, the delivery address. Without these we cannot accept or deliver the order. The legal basis is performance of a contract under Article 6(1)(b) of the GDPR.

Invoices and accounting. If you ask for an invoice or order on behalf of a company, we process billing details including the company name, registered address, company ID and VAT number. The legal basis is compliance with a legal obligation under Article 6(1)(c), specifically the Slovak Accounting Act and the VAT Act.

Contact form. If you write to us through the form on this site, we process what you put into it – usually your name, e-mail, phone number and the text of your message. We do so on the basis of our legitimate interest in answering you, under Article 6(1)(f) of the GDPR.

Newsletter. If you subscribe, we process your e-mail address on the basis of your consent under Article 6(1)(a) of the GDPR. You may withdraw that consent at any time – with one click in the footer of any of our e-mails, or by writing to daniela@nakolace.sk. Withdrawal does not affect the lawfulness of processing carried out beforehand.

Allergens and health data. If you tell us that one of your guests has an allergy or coeliac disease, that is a special category of data under Article 9 of the GDPR. We note it only against that particular order, use it solely to prepare the food, delete it once the order is complete, and never pass it on.

How long we keep it

Order data is kept for three years after the order is fulfilled, matching the limitation period for possible complaints and claims. Accounting records, including invoices, are kept for ten years as required by the Accounting Act. Correspondence from the contact form is deleted within one year of the last exchange. Newsletter e-mail addresses are kept until you withdraw your consent.

Who we share it with

We do not sell your data and we do not pass it to third parties for marketing. We share it only with processors who keep our operation running: our web and e-mail hosting provider, the payment gateway used for online payments, the accountant who keeps our books, and the tool we use to send the newsletter. We have a data processing agreement under Article 28 of the GDPR with each of them. We do not transfer data outside the European Economic Area; should that ever change, it will happen only under the standard contractual clauses approved by the European Commission.

Cookies

Our website uses strictly necessary cookies, without which neither the basket nor the language switch would work. These are set on the basis of our legitimate interest and do not require your consent. We also use analytics cookies, which show us in anonymised form which pages people read and where they leave. Analytics cookies, and any marketing cookies, are set only after you consent in the cookie banner. You can change or withdraw that consent at any time via the cookie settings in the footer. You can also delete cookies in your browser – in that case the site may forget your language and the contents of your basket.

Your rights

As a data subject, the GDPR gives you the right:

• to access the data we hold about you and receive a copy of it (Article 15),
• to have inaccurate data corrected and incomplete data completed (Article 16),
• to erasure where the data is no longer needed or you have withdrawn consent (Article 17),
• to restriction of processing while we examine an objection (Article 18),
• to portability of your data to another controller in a machine-readable format (Article 20),
• to object to processing based on legitimate interest (Article 21),
• to withdraw consent at any time where processing is based on it (Article 7(3)).

Send your request to daniela@nakolace.sk or bring it to the shop in person. We will reply within one month; if the request is complex we may extend that by a further two months and will tell you so.

Complaints

If you believe we are handling your data unlawfully, please come to us first – it is almost always a misunderstanding we can resolve in a day. You also have the right to lodge a complaint with the supervisory authority: the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava.

Automated decision-making

We do not carry out automated decision-making or profiling. Every order is reviewed and confirmed by a person.

Changes to this notice

We may update this notice if the way we work changes, or if the law does. The current version is always on this page, with the date of the last change at the top.