Privacy policy

1. Data controller

The controller of your personal data is DESTAN MEAT FOOD spółka z ograniczoną odpowiedzialnością, ul. Ceramiczna 6, 05-850 Ołtarzew, KRS 0001011555, NIP 1182254272, REGON 524076687 (the “Controller”, “we”).

Contact for data protection matters: by post to ul. Ceramiczna 6, 05-850 Ołtarzew or by phone at +48 796 853 604.

The Controller has not appointed a data protection officer, as it is not required to do so (Art. 37 GDPR).

2. Where your data comes from

We process data you give us yourself — through the contact form, by phone or in correspondence — and technical data your browser automatically sends to the server when you open the website.

The website is aimed at businesses (restaurants, food service chains, wholesalers). If you write on behalf of a company, we process your data as that company's contact person.

3. Purposes, scope and legal bases

• Answering your enquiry and preparing an offer. Data: company or venue name, email address, phone, town, message. Basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in communicating with business customers and their representatives).
• Phone and email contact outside the form. The data you provide in the call or message. Basis: Art. 6(1)(f) GDPR.
• Concluding and performing a contract if we start working together. Basis: Art. 6(1)(b) GDPR and, for accounting and tax records, Art. 6(1)(c) GDPR.
• Website security and abuse prevention (e.g. spam, attacks). Technical data: IP address, browser type, time of visit, page visited. Basis: Art. 6(1)(f) GDPR.
• Establishing, pursuing or defending legal claims. Basis: Art. 6(1)(f) GDPR.

4. Do you have to provide data

Providing data is voluntary. Without an email address and a message, however, we cannot reply to an enquiry sent through the form. All other fields are optional.

5. How long we keep data

• Enquiries that did not lead to cooperation — up to 12 months after the last contact, then deleted.
• Contract-related data — for the duration of the contract and then until the limitation periods for claims expire.
• Accounting records — for 5 years from the end of the year in which the tax payment was due (required by tax law).
• Technical data in server logs — for the short period set by the hosting provider, usually up to several dozen days.
• If you successfully object, we stop processing data for purposes based on legitimate interest.

6. Who receives your data

We do not sell data. It may only be received by parties that help us run the website and the business, under data processing agreements:

• Cloudflare, Inc. — website hosting and attack protection.
• Resend (Plus Five Five, Inc.) — delivering contact form messages to our mailbox.
• our email and IT service providers,
• accountants, lawyers, courier and transport companies — where needed for cooperation,
• public authorities — only when required by law.

7. Transfers outside the EEA

Cloudflare and Resend are based in the USA, so data may be transferred outside the European Economic Area. This happens on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework) for certified companies, or on the basis of standard contractual clauses approved by the Commission (Art. 46 GDPR). You can obtain a copy of these safeguards by contacting us.

8. Your rights

You have the right to:

• access your data and receive a copy (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• portability of data processed under a contract (Art. 20 GDPR),
• object to processing based on legitimate interest (Art. 21 GDPR),
• lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, Poland (uodo.gov.pl), or with the supervisory authority in your EU country.

To exercise your rights, contact us as described in section 1. We will reply without undue delay, at the latest within one month.

9. Profiling

We do not make automated decisions and do not profile website visitors.

10. Cookies and browser storage

The website uses no analytics or advertising tools and sets no marketing cookies.

• Browser session storage (sessionStorage) — when you switch language, we store the click position for a few seconds to show the transition animation. The entry contains no personal data and is deleted right after use. It is strictly necessary for a feature you request, so no consent is required.
• Cloudflare may set technical security cookies (e.g. __cf_bm, cf_clearance) that tell humans and bots apart. They are necessary to protect the website.
• The Google map loads only after you click “Show map”. Google Ireland Limited may then set its own cookies and receive your IP address — see Google's privacy policy (policies.google.com/privacy). The “Get directions” button opens Google Maps in a new tab.

You can delete or block cookies at any time in your browser settings. Blocking technical cookies may make the website harder to use.

11. Security

The website works only over an encrypted HTTPS connection. The form is protected against spam and automated submissions. Only authorised people can access messages.

12. Changes to this policy

We update this policy when the way we process data or the law changes. The current version, with its effective date, is always available on this page.