Privacy Policy

Introduction

Best Restaurants Kraków is a curated concierge service. We help visitors discover dining in Kraków through editorial collections, search, and venue information. This policy explains how we process personal data when you use our website and related services.

For the purposes of the UK GDPR and EU GDPR, we act as the data controller for personal data processed through this site, unless stated otherwise below for specific processors (for example Google or OpenAI).

For disclosures on affiliate links and commercial relationships, see our Terms of Use.

Data we collect and why

We only collect data that is necessary to run the service, improve it, and—where required—only with your consent.

• Google Analytics 4 (GA4). If you accept cookies via our banner, we use GA4 to understand how the site is used. This may include aggregated usage data, events such as search intent (for example when you submit a search query, which can be logged as an analytics event), and device and technical information(such as browser type, general location derived from IP at a coarse level as configured in GA4, and similar diagnostics). GA4 is operated by Google; see "Third parties" below.
• Local storage (cookie consent). We store your choice about analytics cookies in your browser using local storage (not a HTTP cookie file for that flag). This remembers whether you have accepted or declined optional analytics so we do not load GA4 until you opt in. This is necessary to respect your consent.
• Operational and security data. Like most websites, our hosting and infrastructure may process technical logs (for example IP addresses, timestamps, and request metadata) for security, reliability, and abuse prevention, typically on the basis of legitimate interests.

Automated data refresh

Our data engine automatically audits restaurant metadata (including opening hours and related status signals) on a scheduled basis—currently twice daily—so that information such as "Open Now" reflects third-party sources as accurately as practicable. This processing concerns business and venue data, not direct identification of individual visitors, though API and server logs may incidentally include technical identifiers as described above.

Third parties

We rely on carefully selected providers. They process data only as needed to deliver their service and in line with their own privacy terms:

• Google — for Google Analytics 4 (when you consent) and for Google Maps(for example map tiles, geocoding, or place-related features where embedded or linked). Google's use of data is governed by Google's policies and your Google account settings where applicable.
• OpenAI — where we use AI-assisted tooling to help produce or refine vibe descriptionsor similar editorial content about venues, inputs and outputs may be processed by OpenAI in accordance with OpenAI's terms and privacy documentation. This is part of our content workflow, not real-time profiling of individual site visitors.

Lawful bases and retention

We process data on consent where required (for example non-essential analytics), and on legitimate interests or contract / legal obligation where appropriate for operating and securing the site. We retain personal data only for as long as needed for the purposes described, after which it is deleted or anonymised in line with our internal practices and provider settings.

Your rights (GDPR)

Depending on your location, you may have the following rights in relation to your personal data. To exercise them, contact us using the details below. We will respond within the timeframes required by law.

• Right of access — to obtain confirmation of processing and a copy of your personal data we hold.
• Right to rectification — to correct inaccurate data.
• Right to erasure("right to be forgotten") — to request deletion where applicable.
• Right to restrict processing — in certain circumstances.
• Right to data portability — where processing is based on consent or contract and technically feasible.
• Right to object — including to processing based on legitimate interests, where applicable.
• Right to withdraw consent — at any time, where processing is based on consent (for example you may clear site data or change cookie preferences; withdrawing consent does not affect the lawfulness of processing before withdrawal).
• Right to lodge a complaint with a supervisory authority in your country of residence or work.