U WnukaEst. 1850
← Back to home

Privacy Policy

1. General information

  1. This policy applies to the website operating at the following URL: uwnuka.com
  2. The website operator and data controller is: Muzyk Ryszard Zakopane, ul. Kościeliska 8, 34-500 Zakopane, NIP 7361060317
  3. The operator’s email contact address is: restauracjauwnuka@gmail.com
  4. The operator is the controller of your personal data in relation to the data provided voluntarily on the website.
  5. The Website uses personal data for the following purposes:
    • Handling enquiries via the contact form and the group booking form
    • Collecting feedback about the restaurant
    • Providing the services you have ordered
    • Presenting offers or information
  6. The website collects information about users and their behaviour in the following ways:
    1. Through data voluntarily entered into forms, which is then entered into the Operator’s systems.
    2. By storing cookies on end-user devices.

2. Selected data protection methods used by the Operator

  1. The areas where personal data is entered are protected at the transmission layer (SSL certificate). This ensures that data entered on the website is encrypted on the user’s computer and can only be read on the destination server.
  2. Personal data stored in the database is encrypted at rest on the infrastructure provider’s side. Access to the data is protected by access keys held exclusively by the Operator.
  3. Administrative account passwords are stored in hashed form. The hashing function is one-way, which is the current standard for password storage.
  4. The Operator changes its administrative passwords periodically.
  5. To minimise the risk of unauthorised access to data, the Operator uses complex passwords containing lower-case and upper-case letters, numbers and special characters, and no shorter than 8 characters.
  6. An important element of data protection is the regular updating of all software used by the Operator to process personal data.
  7. To protect data, the Operator regularly makes backup copies.

3. Hosting and infrastructure

  1. The Website is hosted (and technically maintained) on the infrastructure of the provider: cloudflare.com (Cloudflare, Inc.).
  2. Data from forms and the content of the Website are stored in the provider’s database: supabase.com (Supabase, Inc.), on a data processing basis.
  3. To ensure technical reliability, the hosting provider maintains server-level logs. The following may be logged:
    • resources identified by a URL (addresses of requested resources, pages, files),
    • the time the request was received,
    • the time the response was sent,
    • the client’s hostname, identified via the HTTP protocol,
    • information about errors that occurred during the execution of the HTTP transaction,
    • the URL of the page previously visited by the user (referrer link), where the user accessed the Website via a link,
    • information about the user’s browser,
    • IP address information.

4. Your rights and further information on how your data is used

  1. In certain situations, the Controller is entitled to disclose your personal data to other recipients if this is necessary to fulfil the contract concluded with you or to comply with the Controller’s legal obligations. This applies to the following categories of recipients:
    • the hosting company and database provider, on a data processing basis,
    • companies providing marketing and analytics services to the Controller (Google, Meta).
  2. Your personal data is processed by the Controller for no longer than is necessary to carry out the related activities specified in separate regulations (e.g. regarding the keeping of accounts). With regard to marketing data, the data will not be processed for longer than 3 years.
  3. You have the right to request from the Controller:
    • access to your personal data,
    • rectification of such data,
    • deletion,
    • restriction of processing,
    • and data portability.
  4. You have the right to object to the processing of your personal data for the purposes of the Controller’s legitimate interests, including profiling; however, this right to object may not be exercised where there are compelling legitimate grounds for the processing, which override your interests, rights and freedoms, in particular the establishment, exercise or defence of legal claims.
  5. A complaint regarding the Controller’s actions may be lodged with the President of the Office for Personal Data Protection, ul. Stawki 2, 00-193 Warsaw.
  6. The provision of personal data is voluntary but necessary for the operation of the Website.
  7. Automated decision-making, including profiling, may be carried out in relation to you for the purpose of providing services under the concluded contract and for the purpose of the Controller conducting direct marketing.
  8. In connection with the use of Google and Meta services, data may be transferred to third countries within the meaning of data protection legislation, i.e. outside the European Union (in particular to the USA). Such transfers are carried out on the basis of the compliance mechanisms provided for in the GDPR, such as a decision by the European Commission confirming an adequate level of protection (the EU-US Data Privacy Framework) or standard contractual clauses.

5. Information in forms

  1. The website collects information provided voluntarily by the user, including personal data, where such data is provided.
  2. The website may record information about connection parameters (timestamps, IP address).
  3. Data provided in a form is processed for the purpose specified by the function of that particular form, e.g. to handle a group booking enquiry, contact the restaurant, or publish a review once it has been approved. In each case, the context and description of the form clearly state its purpose.
  4. The forms are protected against misuse by the Google reCAPTCHA mechanism (Google LLC). Use of reCAPTCHA is subject to Google’s privacy policy and terms of service.

6. Administrator Logs

  1. Information about users’ behaviour on the website may be logged. This data is used for the purpose of administering the website.

7. Key Marketing Techniques

  1. The operator carries out statistical analysis of website traffic using Google Analytics (Google LLC, based in the USA), implemented via Google Tag Manager. The operator does not transfer personal data to the provider of this service, but only anonymised information. The service relies on the use of cookies on the user’s device and is activated in accordance with the consents given (Google Consent Mode). With regard to information about the user’s preferences collected by the Google advertising network, the user may view and edit the information contained in cookies using the following tool: https://www.google.com/ads/preferences/
  2. The operator uses the Meta (Facebook) pixel. This technology enables Facebook (Meta Platforms, Inc., based in the USA) to recognise that a person registered with it is using the Website. In this case, it relies on data for which it is the data controller. The pixel is triggered only after the user has given their marketing consent via the consent banner.
  3. The operator uses the Meta Conversion API: once a form has been submitted to the Meta service, information about the event (e.g. a query being sent) is transmitted from the operator’s server, together with technical connection data (IP address, browser information) and contact details in an irreversibly hashed form (SHA-256). The aim is to measure the effectiveness of adverts; Meta does not receive contact details in plain text.
  4. The Operator uses remarketing techniques to tailor advertising messages to the user’s behaviour on the website, which may give the impression that the user’s personal data is being used to track them; however, in practice, no personal data is transferred from the Operator to advertising providers. The technical prerequisite for such activities is that cookies are enabled and marketing consent has been given.

8. Information on cookies

  1. The Website uses cookies.
  2. Cookies are IT data, specifically text files, which are stored on the Website User’s end device and are intended for use with the Website’s web pages. Cookies usually contain the name of the website from which they originate, the duration for which they are stored on the end device, and a unique number.
  3. The entity that places cookies on the Website User’s end device and accesses them is the Website operator.
  4. Cookies are used for the following purposes:
    1. to remember the user’s consent choices (cookie banners),
    2. to fulfil the purposes set out above in the section ‘Relevant marketing techniques’.
  5. The Website uses two main types of cookies: ‘session’ cookies and ‘persistent’ cookies. ‘Session’ cookies are temporary files which are stored on the User’s device until they leave the website or close the software (web browser). ‘Persistent’ cookies are stored on the User’s device for the period specified in the cookie settings or until they are deleted by the User.
  6. Web browsing software (a web browser) usually allows cookies to be stored on the User’s device by default. Users of the Website may change their settings in this regard. The web browser allows you to delete cookies. It is also possible to automatically block cookies. Detailed information on this subject can be found in the web browser’s help section or documentation.
  7. Restrictions on the use of cookies may affect certain features available on the Website’s web pages.
  8. Cookies placed on a Website User’s end device may also be used by entities cooperating with the Website operator; this applies in particular to the following companies: Google (Google LLC, based in the USA) and Meta (Meta Platforms, Inc., based in the USA).

9. Managing cookies, how do you give and withdraw consent in practice?

  1. On your first visit to the Website, a consent banner is displayed, allowing you to accept all cookies, select only essential ones, or customise the scope of your consent (analytics, marketing). Consent given can be changed or withdrawn at any time by clicking the ‘Cookie settings’ link in the footer of the Website.
  2. If you do not wish to receive cookies, you can also change your browser settings. Please note that disabling cookies that are essential for authentication, security and the maintenance of user preferences may hinder, and in extreme cases prevent, the use of the website.
  3. To manage your cookie settings, select the web browser you use from the list below and follow the instructions:

    Mobile devices:

Last updated: 23 July 2026

This translation is provided for information only; the Polish version of this document is legally binding.