Privacy policy
ORZO • orzo.pl
Effective from 17 October 2026
This policy explains how we process the data of people who use orzo.pl, contact ORZO restaurants or use the online services available on the site: the event enquiry form, the newsletter and the voucher shop. Provisions about a given service apply only to services available on the site.
1. Controller and contact
The controller of the data of people who use the website, the voucher shop and the newsletter is Gastro Group Kwaśniewski i Wspólnicy Spółka Jawna, Pl. Konstytucji 5, 00-657 Warsaw, Poland, NIP (tax ID) 5252585480.
ORZO restaurants are also run by: ORZO KONESER Sp. z o.o. (NIP 7011098182), ORZO Kraków sp. z o.o. (NIP 7963021821), ORZO WROCŁAW Sp. z o.o. (NIP 7011098153) and ORZO POZNAŃ Sp. z o.o. (NIP 7011098041), all at Plac Konstytucji 5, 00-657 Warsaw. When you send an event enquiry for a specific restaurant, the company running that restaurant is also a controller of the data needed to prepare the offer and organise the event. Company details are on the Company documents and details page.
For anything about personal data, write to kontakt@orzo.pl or by post to Pl. Konstytucji 5, 00-657 Warsaw.
2. What data we receive
We receive data directly from you through forms, when you buy a voucher or in correspondence. Depending on the service: name, email, phone number, message content, the date, restaurant and number of guests for an event, order details, delivery address for a paper voucher and invoice details. Required fields are marked in the form. We never ask for a PESEL number or ID document details.
When you use the site, your IP address, connection time, device and browser information and technical events may be recorded. Information from cookies and similar technologies is described in the Cookie policy.
You book a table in the MojStolik.pl system, which the “Book” buttons lead to. Data entered there is processed by its operator under its own privacy policy; the restaurant receives from it the data needed to handle your booking.
Please do not enter sensitive data, such as medical diagnoses, in forms. Information on ingredients and allergens is in the menu. If a special request requires information about your health, we will explain the purpose, scope, retention period and legal basis separately before collecting it.
3. Purposes and legal bases
General contact: we answer questions under Art. 6(1)(f) GDPR. Our legitimate interest is handling correspondence and enquiries. When the question concerns entering into a contract at your request, for example an event offer, the basis is Art. 6(1)(b) GDPR.
Bookings, events and vouchers: we process data to take steps before entering into a contract and to conclude and perform it, including handling a booking, preparing an event, sending a voucher and processing payment (Art. 6(1)(b) GDPR).
Accounting and legal obligations: data required by tax and accounting law and to handle complaints is processed under Art. 6(1)(c) GDPR.
Security and claims: we prevent abuse, keep the site secure and establish, pursue or defend claims under Art. 6(1)(f) GDPR. These are our legitimate interests.
4. Newsletter and optional technologies
Newsletter: with your consent we process your email and chosen city to send news about the restaurants, menu and events (Art. 6(1)(a) GDPR). Sending commercial information by email requires prior consent under Art. 398 of the Polish Electronic Communications Law. Signing up is voluntary and is not a condition of booking, contact or purchase.
Analytics and advertising: if you consent, we use the tools listed in the Cookie policy. For personal data the basis is Art. 6(1)(a) GDPR, and storing and reading information on your device is governed by Art. 399 of the Polish Electronic Communications Law. Consent to cookies and to the newsletter are independent of each other.
5. How long we keep data
Correspondence not related to a contract: while we handle the matter, then 6 months after the correspondence ends.
Booking, event and voucher order data: until the service is performed and closed, then for 6 months. Accounting and tax documents are kept for the period required by law, as a rule until the tax liability becomes time-barred, taking any suspension or interruption into account.
Data needed for claims: until the limitation period ends and, in a dispute, for as long as needed to resolve it. This does not mean all operational data is kept for that long.
Newsletter: until you withdraw consent or the newsletter ends. We may keep a record of giving and withdrawing consent for 6 months to demonstrate compliance and defend against claims (Art. 6(1)(f) GDPR).
Technical logs: 30 days, unless a specific event needs a longer security review. Cookie data is kept for the periods given in the Cookie policy. After these periods we delete the data or anonymise it permanently.
6. Recipients
To the extent needed for a given purpose, data may be received by: Shopify (online shop, website hosting, newsletter sending), our email provider, the operator of the MojStolik.pl booking system, the payment operator shown when you buy a voucher, the courier or postal service delivering paper vouchers, IT support and our accounting office.
Providers act as processors on our documented instructions or as separate controllers, depending on their role. The payment operator, the MojStolik.pl operator and Shopify (for features it is responsible for itself, described in the Shopify privacy policy) describe their processing in their own policies. Data may also be disclosed to authorities where the law requires it.
7. Transfers outside the EEA
Shopify and some analytics providers may process data outside the European Economic Area, in particular in Canada and the United States. Data is transferred there on the basis of a European Commission adequacy decision (Canada, and in the US for organisations taking part in the EU-US Data Privacy Framework) or standard contractual clauses approved by the Commission. You can get a copy of the safeguards by writing to kontakt@orzo.pl.
8. Your rights
Under the GDPR you can request access to your data and a copy of it, rectification, erasure or restriction of processing. You can also use data portability where processing is automated and based on consent or a contract.
You can object to processing based on our legitimate interest on grounds relating to your particular situation. You can object to direct marketing at any time.
You can withdraw consent at any time. For the newsletter, use the unsubscribe link in the email or write to kontakt@orzo.pl. For cookies, choose “Cookie settings” in the site footer. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
Send your request to kontakt@orzo.pl or to the controller’s address. We reply without undue delay, as a rule within one month of receiving it. In cases provided for in the GDPR this may be extended by two further months; we will tell you about this and why within the first month. If we have reasonable doubts about your identity, we may ask for information needed to confirm it.
You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO). Information on how to do so is at uodo.gov.pl. The right to erasure does not always mean immediate deletion of data we must keep, for example under tax law.
9. Voluntary data and automated decisions
Providing data is voluntary, but data marked as required is needed to handle an enquiry, booking or purchase. Without it we cannot provide that service. Invoice data is required by law. Marketing consent and consent to optional cookies remain voluntary.
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
10. Security and updates
We use technical and organisational measures appropriate to the risk, including access control and encrypted connections. We update this policy when our processing or the law changes. The current version and effective date are published on the site. Changing the document does not replace new consent where it is required.