Delivery daily 12:00–21:00 · order online or call 722 722 879
+48 722 722 879Cart

Privacy Policy

This is a translation for convenience. The Polish version is legally binding.

This Privacy Policy applies from 08.10.2026. It describes how we process personal data in accordance with the GDPR (EU Regulation 2016/679).

1. Data controller

The data controller is [uzupełnij w CRM], [uzupełnij w CRM], NIP (tax ID) [uzupełnij w CRM] (hereinafter: “we”). Contact regarding personal data: e-mail [uzupełnij w CRM], phone +48 722 722 879, or by post to our registered office address. We have not appointed a data protection officer.

2. What data we process

  • contact and address details: first name, phone number, delivery address, optionally e-mail;
  • order data: products ordered, amounts, payment method, order notes, order history;
  • Account and SUSHIPOINTS programme data: points balance and history, saved addresses, optionally date of birth;
  • technical data: IP address and server logs, and, with your consent, statistical data on your use of the Service (see the Cookie Policy); when you are logged in, we link this data to your Account;
  • records of consents given and withdrawn (content of the consent, date, method of giving it).

If you order via Uber Eats or Bolt Food, we receive the data needed to fulfil your order (first name, products ordered, notes and, if delivery is made by our restaurant, your address and contact phone number) from the platform operator. We do not use this data for marketing or for the SUSHIPOINTS programme. The platform operator is responsible for processing data on the platform itself, under its own privacy policy.

If you previously ordered from us through our former online ordering system, we have transferred your data from that account (first name, phone number, e-mail, order statistics, points balance and marketing consents) to the current system — the data controller has not changed.

3. Purposes and legal bases

- accepting and fulfilling your order, contacting you about it (including status SMS messages), maintaining your Account and the SUSHIPOINTS programme — Art. 6(1)(b) GDPR (contract);
- issuing sales documents, keeping accounts, handling complaints — Art. 6(1)(c) GDPR (legal obligation);
- establishing, pursuing and defending claims, Service security, aggregate sales statistics and tailoring offers based on order history — Art. 6(1)(f) GDPR (legitimate interest);
- sending marketing information by SMS or e-mail — Art. 6(1)(a) GDPR and Art. 398 of the Prawo komunikacji elektronicznej (Electronic Communications Law) (consent);
- an SMS reminder about an unfinished order (with a discount code) — only if you have consented to marketing SMS messages and to statistics; in that case we link your visit to your Account — Art. 6(1)(a) GDPR (consent);
- demonstrating that consents were given — Art. 6(1)(c) and (f) GDPR;
- visit statistics using an identifier stored in your browser — Art. 6(1)(a) GDPR and Art. 399 of the Prawo komunikacji elektronicznej (consent).
Providing your data is voluntary but necessary to place and fulfil an order.

4. Data recipients

Data may be received only by entities that help us run our business, under data processing agreements or as separate controllers: our server (hosting) provider, the online payment operator — PayPro S.A. (Przelewy24), ul. Pastelowa 8, 60-198 Poznań, KRS 0000347935 (for online payments), SMS and e-mail service providers, our couriers, our accounting firm and, where necessary, a law firm and competent authorities. We look up addresses on our own server using OpenStreetMap data — the address you enter is not shared with external map providers. If our couriers receive orders via the Telegram messenger, the data needed for delivery (first name, phone, address, notes and amount due) reaches the courier through that service.

5. Transfers outside the EEA

As a rule, we process data within the European Economic Area. The exception is passing a delivery order to a courier via the Telegram messenger (a provider outside the EEA) — this takes place only to the extent necessary to deliver the order (Art. 49(1)(b) GDPR). If transfers outside the EEA come to include other services, they will be made using the safeguards required by the GDPR, and we will inform you in this Policy.

6. How long we keep data

  • order data — for the period required by tax and accounting regulations (5 years from the end of the year in which the order was placed) and until claims become time-barred;
  • Account and saved addresses — until the Account is deleted; if you do not place an order for 3 years, identifying data is automatically anonymised;
  • marketing consents — until withdrawn, and the consent record — until claims become time-barred;
  • content of sent SMS messages and e-mails — up to 13 months;
  • visit statistics — up to 13 months;
  • technical server logs — briefly, solely for security and troubleshooting purposes (they are automatically overwritten).

7. Your rights

You have the right to access your data, rectify it, erase it, restrict processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). In the Account tab you can download your data, change your consents and delete your Account yourself. You also have the right to lodge a complaint with the Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office) (ul. Stawki 2, 00-193 Warszawa).

8. Profiling

Based on order history, we assign customers to groups (e.g. regular, new, not ordered for a long time) to tailor offers. We do not make decisions producing legal effects concerning you solely by automated means.

9. Cookies

The rules for using cookies and similar technologies are described in the Cookie Policy.

10. Changes to the Policy

We will inform you of significant changes to this Policy on the Service.