Privacy Policy
Effective from 7 October 2026.
1. Controller
TURING trgovina in storitve d.o.o., Brnčičeva ulica 5, 1231 Ljubljana-Črnuče, Slovenija. Registration number: 2233711000. VAT ID: SI52070310.
Contact for questions and requests about personal data: info@kratkoasladko.si. We have not appointed a data protection officer, as the law does not require one for the scale of our processing.
2. What data we process, why and on what basis
| Data | Purpose | Legal basis (GDPR, Art. 6(1)) |
|---|---|---|
| Name, e-mail address | Performing the order: confirmation, notice that it is ready, cancellation and refund, invoice | Contract (b) |
| Phone number | Only to contact you about your order (e.g. a delay, a changed location, a sold-out menu) — never for marketing | Contract (b) |
| Order contents: dishes, quantities, prices, pickup day and slot, order number and status, discount | Preparing and handing over the order, accounting, business statistics | Contract (b); legal obligation (c) for accounting records |
| E-mail address, name and orders together | An overview of how often you order and how much you spend (internal only, at most the last 24 months) — to plan the offer and possible benefits for regular customers; nothing is sent elsewhere | Legitimate interest (f); you can object (section 5) |
| Order note (optional) | Taking your wishes into account | Contract (b) |
| Company details when ordering as a company: name, address, country, tax number, VAT status, purchase-order number | Invoicing the company | Contract (b); legal obligation (c) |
| Payment data: amount, payment and refund status, Stripe payment identifier | Payment, refund, reconciliation | Contract (b) |
| Newsletter e-mail address, dates of sign-up, confirmation and unsubscription; for a sign-up at checkout also the order, the words and version of the box you ticked, and when | Sending the weekly menu; proof of consent and unsubscription | Consent (a): on the newsletter form with a double opt-in (a link in an e-mail), at checkout by ticking the box — effective once the order is paid; proof of consent and unsubscription: legal obligation (c, GDPR Art. 7(1)) |
| Technical data: IP address, browser type, time of request | Running and securing the site: bot protection, rate limiting, error logging | Legitimate interest (f): a secure, working website |
| Visit statistics (Google Analytics) and session recordings to fix errors (Sentry) | Measuring visits, fixing errors | Only with consent (a), which you can withdraw at any time |
We never see or store your card details: you enter them directly with Stripe. We make no decisions based solely on automated processing.
The newsletter is for people aged 15 or over.
3. Who receives data
Data is processed by the service providers we use (processors), only as far as their service needs it:
| Recipient | What it does | Data | Where; transfer outside the EU |
|---|---|---|---|
| Supabase, Inc. | Database | Order and newsletter data | EU (Frankfurt); US company — standard contractual clauses |
| Vercel Inc. | Website hosting | Technical data; form data while processed | Servers in the EU (Frankfurt), global network; EU–US Data Privacy Framework (DPF) |
| Stripe Payments Europe, Ltd. | Card payments and refunds | E-mail address, amount, payment data | Ireland; the Stripe group also in the US — DPF. For some purposes (e.g. fraud prevention) Stripe is a controller in its own right |
| Resend (Plus Five Five, Inc.) | Sending e-mail: confirmations, notices, invoices, newsletter sign-up confirmation | Name, e-mail address, message content | Sent from the EU (Ireland); US company — standard contractual clauses |
| Intuit Inc. (Mailchimp) | Sending the weekly newsletter | E-mail addresses of confirmed subscribers | US — DPF |
| Functional Software, Inc. (Sentry) | Error logging; session recordings only with consent | Technical data — personal data is removed before sending | EU (Germany); US company — standard contractual clauses |
| Cloudflare, Inc. (Turnstile) | Bot protection for forms | IP address, browser data | Global network — DPF |
| Google Ireland Ltd. (Google Analytics) | Visit statistics — only with consent | Pseudonymous identifier, pages visited, purchases without personal data | EU and US — DPF |
| Metakocka d.o.o. | Issuing fiscally verified invoices | Invoice data | Slovenia |
The newsletter through Mailchimp. From time to time we export the e-mail addresses of confirmed subscribers who have not unsubscribed from our app (a CSV file, e-mail addresses only) and import them into Mailchimp, which sends the weekly menu. Every newsletter has an unsubscribe link; Mailchimp remembers the unsubscription and sends you no more newsletters, even if your address were imported again.
We also disclose data to public authorities where the law requires it (e.g. the Financial Administration).
4. How long we keep data
| Data | Period |
|---|---|
| Phone number, order note, cancellation reason | 30 days after the order was collected or cancelled, then deleted |
| Name and e-mail address on an order | 24 months after pickup or cancellation (complaints, card payment disputes, repeat-order overview), then anonymised; the order without personal data (amounts, dates, dishes) is kept for statistics and accounting |
| Invoices and credit notes, including company details on them | 10 years after the end of the year of issue (Slovenian VAT Act) |
| Newsletter: confirmed address | Until you unsubscribe |
| Newsletter: unconfirmed sign-up | 30 days after the last sign-up, then deleted |
| Newsletter: unsubscription (e-mail address and dates) | 2 years after unsubscribing, as proof, then deleted |
| Hosting and error logs | As set by the providers, at most 90 days |
| Google Analytics | 2 months |
| Database backups | Up to 7 days |
The periods for data in our database are applied by an automatic job once a day.
5. Your rights
You have the right:
- of access to your data and a copy (GDPR Art. 15),
- to rectification (Art. 16) and erasure (Art. 17), except for data we must keep by law (e.g. invoices),
- to restriction of processing (Art. 18),
- to portability of data you gave us under a contract or consent (Art. 20),
- to object to processing based on legitimate interest (Art. 21),
- to withdraw consent at any time — for the newsletter with the link in every message, for statistics with "Cookie settings" in the footer. Withdrawal does not affect processing before it.
Send your request to info@kratkoasladko.si. We answer without undue delay, within one month at the latest. To avoid disclosing your data to someone else, we may verify your identity, for example by asking you to confirm the request from the e-mail address you ordered with.
If you believe we process your data unlawfully, you can complain to the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.
7. Security
Data is stored in the EU and encrypted in transit; only staff with their own account can see orders. The kitchen screen shows no names, e-mail addresses or phone numbers. Personal data is removed from error reports automatically.
8. Changes
We may change this policy. The version published on this page, with its effective date at the top, applies. The terms of ordering are in the Terms and Conditions.