This policy explains which personal data we collect through the website and in connection with bookings, why we collect it, how long we keep it and what your rights are. We process data in accordance with the Personal Data Protection Act of the Republic of Serbia (Official Gazette of RS, No. 87/2018). This English version is provided for convenience; in case of any discrepancy, the Serbian version prevails.
Data controller
Nikola Kovačević PR Restoran Bistromat, Mutapova 9, Vračar, Belgrade, registration number 66551245, tax ID (PIB) 113066654. Contact for questions about personal data: [email protected].
What data we collect
Data you give us through the forms on the website (table bookings, seat bookings for Chef’s Table and events, inquiries about parties, catering and vouchers, the general contact form):
- first and last name,
- phone number and email address,
- date, time and number of people,
- any notes you enter, including information about allergies or diet,
- for vouchers: the recipient’s name and the dedication.
You provide information about allergies and diet voluntarily, and we use it only to prepare a safe meal.
Data collected automatically: the website uses no analytics tools or advertising cookies. The server hosting the website logs standard technical data (IP address, time of access, browser type) for security and to keep the site working. Read more about cookies in our Cookie policy.
Why we process data and on what basis
| Purpose | Legal basis |
|---|---|
| Booking a table, seat or date, and related communication | Steps taken at your request before entering into a contract, and performance of the contract |
| Replying to inquiries about parties, catering, classes or vouchers | Steps taken at your request |
| Information about allergies and diet | Your explicit consent, given by entering it in the notes |
| Invoicing and business records | Legal obligation |
| Security and proper functioning of the website | Legitimate interest |
We do not use your data to send marketing messages without your separate consent, and we never sell it to third parties.
Who else has access to the data
We share data only with service providers who help us run the business and process it on our behalf:
- Eventlin — the online table booking system,
- Behold — showing our latest Instagram posts on the home page (images load from their server, which therefore sees your IP address; it sets no cookies),
- Google (reCAPTCHA) — spam protection on the forms; it loads only when you open a form and may set cookies needed for that check (Google privacy policy),
- a hosting provider — hosting the website and processing form messages,
- an email provider — sending and receiving messages.
Some service providers may process data outside Serbia. In that case, the transfer takes place only with appropriate safeguards required by law.
How long we keep data
- data from bookings and inquiries: up to 12 months from the booking date or the last communication,
- data needed for invoices and accounting: as long as the law requires,
- server logs: up to 30 days.
After that, we delete the data or anonymise it permanently.
Your rights
At any time you have the right to:
- request access to the data we process about you,
- request correction or completion of inaccurate data,
- request deletion of your data,
- request restriction of processing or object to processing,
- request the transfer of your data to another controller,
- withdraw your consent (e.g. for allergy information), without affecting the lawfulness of processing before withdrawal.
Send your request to [email protected]. We will reply within 30 days at the latest.
If you believe your data is not being processed lawfully, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs).
Changes to this policy
We may update this policy from time to time. The date of the last change is shown at the top of the page.