Privacy policy

Draft for legal review · 24.09.2026

1. Controller

The controller is Braggers Sp. z o.o., ul. Grzybowska 87, 00-844 Warszawa, Poland, VAT PL5273039937 (“we”). Privacy contact: through the contact form or by post to the registered address.

2. What we process and why

• Restaurant guests (people booking a table): name, e-mail, phone, party size, date and time, remarks. Purpose: making, confirming and reminding of the reservation and handling changes and cancellations (art. 6(1)(b) GDPR). Marketing only with a separate consent (art. 6(1)(a)).
• Restaurant owners (account users): name, e-mail, phone, restaurant details, invoicing details, payment data (handled by the payment provider — we store no card numbers). Purpose: performing the contract, billing, tax duties (art. 6(1)(b) and (c)).
• Commercial contact with restaurants: name, address, publicly available contact details of the business (website, Google Maps), the reservation system in use. Purpose: presenting the Restrona offer to restaurants, based on our legitimate interest (art. 6(1)(f)). The first message asks for permission to send the offer; every message carries an unsubscribe link that we honour immediately.
• Technical data: IP address, browser, server logs — security and statistics (art. 6(1)(f)). Visit statistics (Google Analytics) run only after consent to analytics cookies.

3. Where restaurant data comes from

Restaurant contact details come from public sources: the business's own website and its Google Maps profile. We say so in the first message, as art. 14 GDPR requires.

4. Recipients

Service providers acting on our instructions: hosting in the EU, Amazon Web Services (e-mail delivery, EU region), Google (Reserve with Google — availability and reservations of restaurants that switched the service on), the payment provider (Revolut). Each is bound by a data-processing agreement or standard contractual clauses.

5. Retention

• Reservation data: 24 months after the reservation date, then anonymised.
• Account and billing data: the contract period plus the statutory tax retention (5 years).
• Commercial contacts without a reply: 12 months, then deleted; an opt-out is kept so that it is respected.

6. Your rights

Access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest (including marketing) and withdrawal of consent. We answer within 30 days. You may complain to the Polish supervisory authority (UODO, ul. Stawki 2, 00-193 Warszawa).

7. Automated decisions

We take no automated decisions with legal effect. Messages may be drafted with AI tools, but a person sends them and is responsible for them.

8. Cookies

See the cookie policy.