Privacy Policy
Archived version 2026-10-01 — in force from 28.09.2026 to 06.10.2026. All versions
This is a translation. In case of discrepancies, the Polish version prevails.
§ 1. Controller and scope of the Privacy Policy
1.1. This Privacy Policy describes how personal data are processed in connection with the Ranedo system and the ranedo.com service.
1.2. Ranedo is operated by Createin.pl Jarosław Kądzioła, a sole proprietorship registered in the Central Register and Information on Economic Activity (CEIDG), ul. Boczna 8, 46-080 Chróścice, Poland, tax ID (NIP) 7481531765, REGON 161499368 (“Ranedo”, “we”). Depending on the type of data, we act in one of two roles:
- controller — where we ourselves determine the purposes and means of processing: this applies to the data of our Clients (restaurants), the Users of their Accounts, Partners in the Partner Programme, persons who contact us and persons who report illegal content;
- processor — where we process the data of the restaurant’s Guests and staff on behalf of the restaurant, under the data processing agreement (DPA) contained in the Ranedo Terms of Service (§ 26–31).
1.3. You may contact us on data protection matters by e-mail at kontakt@ranedo.com, by phone at +48 577 682 359, or by post at: ul. Boczna 8, 46-080 Chróścice, Poland. We have not appointed a data protection officer.
1.4. The Policy applies from the date indicated in the header of the document. Previous versions are available at https://ranedo.com/pl/dokumenty/polityka-prywatnosci.
1.5. Capitalised terms (e.g. Client, User, Guest, Account, Panel, Restaurant Website, Agreement) have the meanings given to them in the Ranedo Terms of Service.
§ 2. Clients and Users — Account and Agreement
2.1. In connection with the Account, we process: first name and surname, e-mail address, telephone number, company details and invoicing details (including the tax ID (NIP)), the password in hashed form, two-factor authentication configuration data, information on the version and date of acceptance of the Terms of Service, the roles and permissions of Users, and the history of the Subscription and payments.
2.2. Purposes and legal bases:
- the conclusion and performance of the Agreement with a Client who is a natural person — Article 6(1)(b) of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”);
- contact with persons representing the Client, its employees and Users in connection with the Agreement — our legitimate interest in performing the Agreement (Article 6(1)(f) GDPR);
- issuing invoices and keeping accounting records — a legal obligation (Article 6(1)(c) GDPR);
- ensuring the security of Accounts and the System, preventing abuse, accountability, and the establishment, exercise and defence of legal claims — our legitimate interest (Article 6(1)(f) GDPR).
2.3. On registration we record the IP address from which the Account was created and, at each login, the IP address and browser information (login history). These are used to detect unauthorised access and abuse.
2.4. In the event log we record significant actions performed in the Panel and by our operators (who changed what and when) in order to ensure accountability and to be able to investigate incidents.
2.5. If the Account was created on the recommendation of a Partner in the Ranedo Partner Programme (a referral link or a referral code entered on registration), we process information on the assignment of the Client to the Partner and on paid subscription payments in order to calculate and settle the Partner’s commission and to enable the Partner to verify it. The legal basis is the legitimate interest of Ranedo and of the Partner (Article 6(1)(f) GDPR), consisting in running the Partner Programme and correctly settling the referral fee. The scope of information visible to the Partner is described in clause 13.4.
§ 3. Logging in with Google or Facebook
3.1. If you choose to log in with a Google or Facebook account, we receive from Google Ireland Ltd. or Meta Platforms Ireland Ltd. your first name, surname, e-mail address and the identifier of your account with that provider. We use them to create the Account and to log you in (Article 6(1)(b) or (f) GDPR).
3.2. In this respect, Google and Meta are separate controllers. The rules on which they process data are described in their privacy policies.
§ 4. Payments for the Subscription
4.1. Payments for the Subscription, Add-on Modules and SMS Packages are handled by Paynow (mBank S.A.). We provide it with the data needed to carry out the payment (the amount, description and payer’s e-mail address). We do not store payment card data — such data are entered directly with the payment operator.
4.2. The legal basis for processing is the performance of the Agreement (Article 6(1)(b) GDPR) and our legitimate interest in settling payments (Article 6(1)(f) GDPR) and, as regards accounting records, a legal obligation (Article 6(1)(c) GDPR).
§ 5. Contact forms and correspondence
5.1. Sending a message via the contact form on ranedo.com does not require acceptance of the Terms of Service or the giving of consent. We process your first name, e-mail address, telephone number (if you provide it) and the content of the message in order to answer your enquiry — on the basis of our legitimate interest in conducting correspondence (Article 6(1)(f) GDPR) and, if you enquire about our offer before concluding the Agreement, in order to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).
5.2. We store messages sent via contact forms for 24 months. The same applies to e-mail correspondence relating to support.
5.3. We operate the contact form on the Restaurant Website on behalf of the restaurant — the controller of those data is the restaurant (§ 7).
5.4. On the home page and the pricing page of ranedo.com there is a “Set it up for me” form, in which you may leave the name of your venue, your first name, e-mail address, telephone number and a link to your menu or a menu file, so that we can prepare the configuration of your Account free of charge at your request. The legal basis for processing is taking steps at your request prior to concluding the Agreement (Article 6(1)(b) GDPR). We store such requests for 24 months.
§ 6. Ranedo marketing information
6.1. We send commercial information about Ranedo by e-mail only to persons who have given separate, voluntary consent to receive it (Article 6(1)(a) GDPR in conjunction with the provisions of the Electronic Communications Law (Prawo komunikacji elektronicznej)). Not giving consent does not affect the conclusion or performance of the Agreement.
6.2. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal. We process data for this purpose until consent is withdrawn.
6.3. We store information on the giving and withdrawal of consent on the basis of our legitimate interest (Article 6(1)(f) GDPR) for the limitation period for claims, but no longer than 3 years from the withdrawal of consent.
§ 7. Ranedo as the processor of Guests’ data
7.1. If a Guest places an order, books a table, is a hotel guest, participates in a loyalty programme, subscribes to the restaurant’s newsletter, writes via the contact form of the Restaurant Website or otherwise uses the features made available by the restaurant in Ranedo, the controller of the Guest’s data is the restaurant.
7.2. Ranedo processes those data on behalf of the restaurant as a processor, in accordance with Article 28 GDPR and the data processing agreement contained in the Ranedo Terms of Service. We do not use Guests’ data for our own purposes.
7.3. Information on the purposes, legal bases and periods of processing of data by the restaurant is provided by the restaurant — in particular on the “Privacy” page (at /prywatnosc) of its Restaurant Website and next to the order form.
§ 8. Categories of Guests’ data processed on behalf of the restaurant
8.1. Depending on the features used by the restaurant, we process:
- first name, surname, telephone number, e-mail address, delivery address;
- the content and history of orders and comments on orders;
- information on allergies and intolerances provided voluntarily by the Guest (§ 9);
- reservation data;
- hotel stay data: first name, surname, telephone number, dates of stay, room number;
- data in the restaurant’s CRM (including customers recorded with a telephone number only) and staff notes;
- marketing consents to contact by e-mail and SMS, together with the date and source of their giving;
- restaurant newsletter subscription data (including double opt-in confirmations) and campaign recipient data;
- loyalty programme points and history;
- the content of messages sent via the contact form of the Restaurant Website;
- the contents of abandoned baskets;
- IP addresses recorded by security mechanisms and event log entries.
8.2. We also process, on behalf of the restaurant, the data of its employees and associates who use User Accounts (first name, surname, e-mail address, role, permissions, assignment to venues, history of actions in the Panel).
8.3. We ask restaurants not to enter data concerning health or any other special categories of personal data in CRM notes or other text fields.
§ 9. Information on allergies and intolerances
9.1. The order form on the Restaurant Website contains an optional field “Allergies and intolerances” with the following information: “Only enter what the kitchen needs to prepare your order safely. Restaurant staff and the kitchen will see it.”
9.2. Information provided in this field constitutes data concerning health (Article 9 GDPR). The controller of such data is the restaurant. The legal basis for processing is, as a rule, the Guest’s explicit consent, expressed by voluntarily providing the information (Article 9(2)(a) GDPR). Consent may be withdrawn by contacting the restaurant.
9.3. The information is saved in the order, is visible only to the restaurant’s service staff and kitchen, and is stored together with the order. We do not create a separate allergy profile in the CRM on its basis. The restaurant may export and anonymise it using the GDPR tool.
§ 10. Legal bases for processing Guests’ data
10.1. The legal basis for processing Guests’ data is determined by the restaurant as the controller. It may be, in particular: the performance of a contract with the Guest (Article 6(1)(b) GDPR), the restaurant’s legal obligations (Article 6(1)(c) GDPR), the restaurant’s legitimate interests (Article 6(1)(f) GDPR) and consent (Article 6(1)(a) and Article 9(2)(a) GDPR).
10.2. Ranedo does not replace the restaurant in assessing whether a legal basis exists in a specific case.
§ 11. Restaurant marketing
11.1. Ranedo provides restaurants with tools for newsletters (with a double opt-in mechanism), e-mail and SMS messages, a loyalty programme and abandoned basket reminders. The controller of the data used in such marketing is the restaurant; it is responsible for consents, the information obligation and the legal basis.
11.2. All SMS messages (campaigns, order and reservation confirmations, staff notifications) are sent from the Ranedo account via SMSAPI (LINK Mobility Poland sp. z o.o.), which is our sub-processor. The restaurant pays for them with an SMS Package purchased in Ranedo.
11.3. The restaurant ensures the possibility to withdraw consent, unsubscribe from the newsletter and object to marketing.
§ 12. Guest payments and tools on Restaurant Websites
12.1. Guests’ online payments are handled by operators with which the restaurant has concluded its own agreements: PayU S.A., PayPro S.A. (Przelewy24) or Krajowy Integrator Płatności S.A. (Tpay). The money goes directly to the restaurant’s account with the operator. Ranedo does not accept money due to the restaurant and does not store Guests’ payment card data. The operators process transaction data in accordance with the rules described in their own documents.
12.2. The restaurant may enable analytics and advertising tools on the Restaurant Website (Google Analytics, Google Tag Manager, Meta Pixel). They are loaded only after the Guest has given consent in the cookie banner of the Restaurant Website. The restaurant may also embed maps or videos from external providers on the website. Those providers are not sub-processors of Ranedo; their role is determined by the restaurant.
§ 13. Recipients of data where Ranedo is the controller
13.1. We disclose data only to the extent necessary for the given purpose:
| Recipient | Scope |
|---|---|
| Hostinger International Ltd. (Cyprus) | VPS server and database in a data centre in Vilnius (Lithuania) |
| OVH SAS (France) | |
| Paynow — mBank S.A. | payments for the Subscription, Add-on Modules and SMS Packages |
| Google Ireland Ltd.; Meta Platforms Ireland Ltd. | logging in with Google or Facebook — as separate controllers |
| LINK Mobility Poland sp. z o.o. (SMSAPI) | SMS messages, where they concern your Account |
| providers of accounting services | accounting documents and invoicing data |
| Partners in the Partner Programme | a narrow scope of information on the Client referred by the Partner (clause 13.4) |
| Cloudflare, Inc. | DNS services for Ranedo domains (without proxying traffic) |
13.2. We may also disclose data to public authorities where required by law.
13.3. The content generator uses OpenAI (§ 17).
13.4. Partners in the Partner Programme. A Partner on whose recommendation a Client created an Account sees in the Partner Panel only: the Client’s company name (if the Account name is an e-mail address, it is masked), the date of registration of the Account, the date of the first payment, the subscription status (active, inactive, ended) and — for each paid subscription payment — its date, net amount, and the commission rate and amount. The Partner does not receive Users’ data (e.g. e-mail addresses and telephone numbers), data of the restaurant’s Guests or any other content from the Account. The Partner Programme Terms oblige the Partner to use this information solely to verify commission and to keep it confidential. The information is available to the Partner for the duration of the Partner’s participation in the Partner Programme, and Ranedo stores commission settlement data for the period required by tax and accounting regulations and until the expiry of the limitation periods for claims. An objection to such processing (§ 22) may be submitted to kontakt@ranedo.com.
§ 14. Sub-processors of Guests’ data and restaurants’ providers
14.1. We process the data of the restaurant’s Guests and staff with the assistance of the following sub-processors:
| Entity | Registered office | Scope | Place of processing |
|---|---|---|---|
| Hostinger International Ltd. | Cyprus | VPS server and database | data centre in Vilnius (Lithuania), EEA |
| OVH SAS | France | e-mail: notifications and confirmations to Guests and restaurants | EEA |
| LINK Mobility Poland sp. z o.o. (SMSAPI) | Poland | SMS messages from SMS Packages purchased in Ranedo | EEA |
| Geoapify GmbH | Germany | geocoding of delivery addresses | EEA |
| OpenStreetMap Foundation (Nominatim service) | United Kingdom | fallback geocoding of the delivery address when Geoapify does not respond | United Kingdom — European Commission adequacy decision |
| OpenAI Ireland Ltd. | Ireland | content generator — no Guests’ data | USA — standard contractual clauses or the EU–US Data Privacy Framework |
| Browser Web Push services (Google, Apple, Mozilla) | — | notifications to staff devices; content end-to-end encrypted in accordance with the Web Push standard | depending on the browser, including outside the EEA |
14.2. Cloudflare, Inc. provides only DNS services for Ranedo domains, without proxying traffic, and does not process Guests’ data.
14.3. Providers used by the restaurant under its own agreements — PayU S.A., PayPro S.A. (Przelewy24), Krajowy Integrator Płatności S.A. (Tpay), analytics and advertising tools, and embedded maps and videos — are not sub-processors of Ranedo.
14.4. We inform restaurants of any intended addition or replacement of a sub-processor at least 14 days in advance by e-mail and by a notice in the Panel. The restaurant may object in accordance with the rules set out in the Ranedo Terms of Service.
§ 15. Transfers of data outside the European Economic Area
15.1. The Ranedo server and database are located in Lithuania, within the EEA.
15.2. Data may be transferred outside the EEA in the following cases:
- OpenAI — data entered into the content generator may be processed in the USA; the transfer is based on the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR) or the Commission’s decision on the EU–US Data Privacy Framework (Article 45 GDPR), where the recipient is covered by it;
- OpenStreetMap Foundation — in the case of fallback geocoding, the delivery address is transferred to the United Kingdom, which is covered by a Commission adequacy decision (Article 45 GDPR);
- browser Web Push services — encrypted notifications may pass through browser providers’ servers outside the EEA; the content is unreadable to them;
- logging in with Google or Facebook — the providers act as separate controllers and apply their own transfer mechanisms.
§ 16. Data retention periods
16.1. The retention periods are applied by a daily automated process in the System:
| Data | Retention period |
|---|---|
| Account data | until the Account is deleted at the Client’s request (deletion = anonymisation of Account and Guest data) and thereafter — to the extent necessary — until the expiry of the limitation period for claims |
| accounting documents (payments, invoices, Subscription history) | 5 years from the end of the calendar year in which the tax payment deadline expired |
| login history (IP address, browser) | 12 months |
| Account registration IP address | 12 months |
| data of an Account whose approval we have refused | anonymisation 30 days after the refusal (information on the refusal remains in the event log) |
| event log | 24 months |
| messages sent via contact forms (ranedo.com and Restaurant Websites) and “Set it up for me” requests | 24 months |
| reports of illegal content | 24 months from the decision |
| abandoned baskets | 30 days |
| order data and other Guest data during the Agreement | for the term of the Agreement; the restaurant may delete them earlier using the GDPR tool |
| Guest data after termination of the Agreement with the restaurant | anonymisation or deletion 30 days after the end of the Agreement (expiry or termination of the Subscription, including expiry of the Trial Period without payment, or deletion of the Account) |
| backups | overwritten after 90 days at the latest |
| Ranedo marketing consent | until consent is withdrawn; proof of consent — clause 6.3 |
| data of Partners in the Partner Programme | for the duration of participation in the Partner Programme and thereafter for the limitation period for claims and the retention period for accounting documents |
16.2. Data remaining solely in backups are not used for any purpose and may be restored only in order to recover the System after a failure.
16.3. We store data for longer only where this is necessary to investigate a security incident, to defend against a claim or to comply with a legal obligation.
§ 17. Artificial intelligence
17.1. The content generator of the Restaurant Website uses OpenAI models (currently gpt-4o-mini) provided by OpenAI Ireland Ltd. We transfer to OpenAI only information entered by the Client (e.g. a description of the venue, the menu), without Guests’ data.
17.2. AI-generated content is labelled as generated in the Panel, and the Client verifies it before publication. We provide information on the use of AI and label content to the extent required by Article 50 of Regulation (EU) 2024/1689 (Artificial Intelligence Act).
17.3. Users should not enter into the generator Guests’ personal data, special categories of data, passwords, payment data or confidential information.
§ 18. Reports of illegal content
18.1. If you report illegal content via the form at https://ranedo.com/pl/dsa, we process the data provided in the report: the URL, the explanation and — if you provide them — your first name, surname and e-mail address. The purpose is to handle the report, to inform you of the decision and to demonstrate compliance with the obligations arising from Regulation (EU) 2022/2065 (Digital Services Act) (Article 6(1)(c) GDPR).
18.2. The restaurant concerned by the decision receives the statement of reasons for it. We do not disclose your data to the restaurant unless this is necessary to handle a report concerning an infringement of your own rights.
18.3. We store reports for 24 months from the decision.
§ 19. Cookies
19.1. The rules for the use of cookies and browser storage in the Ranedo service are described in the Cookie Policy: https://ranedo.com/pl/polityka-cookies.
19.2. Without consent, we store only files necessary for the operation of the service. We store the Partner Programme cookie ranedo_ref only after consent has been given in the “Marketing” category. We activate analytics and advertising tools only after consent has been given in the banner.
19.3. The pages of the ranedo.com service and Restaurant Websites do not download fonts or style sheets from external servers.
19.4. On Restaurant Websites, the consent banner is displayed by the restaurant, which is responsible for the tools it has enabled (§ 12.2).
§ 20. Source of data and voluntary nature of providing data
20.1. We obtain the data of Clients and Users from the persons creating the Account, from the Client (e.g. when adding Users), from Google or Meta when logging in through those services, and from payment operators (payment status).
20.2. We obtain Guests’ data from Guests using the Restaurant Website or from the restaurant and its staff.
20.3. Providing data is voluntary, but certain data are necessary to create an Account, to conclude and perform the Agreement or to use a given feature. Providing data for marketing purposes is entirely voluntary.
§ 21. Your rights
21.1. Where Ranedo is the controller, you have the right, on the terms set out in the GDPR:
- of access to your data and to obtain a copy of them;
- to rectification of your data;
- to erasure of your data;
- to restriction of processing;
- to data portability, where processing is based on a contract or consent and is carried out by automated means;
- to object to processing based on legitimate interest (§ 22);
- to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
21.2. Please send requests to kontakt@ranedo.com. We respond without undue delay and in any event within one month.
§ 22. Right to object
22.1. Where we process data on the basis of legitimate interest (Article 6(1)(f) GDPR), you may at any time object on grounds relating to your particular situation. We will stop processing the data unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims.
22.2. An objection to processing for direct marketing purposes does not require justification.
§ 23. Rights of the restaurant’s Guests
23.1. Requests concerning data processed by Ranedo on behalf of the restaurant should be addressed to the restaurant, which is their controller. The restaurant may search for a Guest’s data by e-mail address or telephone number, export them and anonymise them using the GDPR tool in the Panel.
23.2. If we receive such a request directly, we will promptly forward it to the restaurant and assist it in fulfilling the request. We do not delete or alter data entrusted by the restaurant contrary to its instructions, unless required by law.
§ 24. Complaint to the supervisory authority
24.1. If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland.
§ 25. Automated decision-making
25.1. We do not make decisions concerning Clients or Guests based solely on automated processing which would produce legal effects concerning them or similarly significantly affect them. Decisions on reports of illegal content are made by a human.
25.2. Customer segmentation in the CRM is carried out according to the restaurant’s settings; the restaurant is responsible for the compliance of its activities with the GDPR.
§ 26. Security
26.1. We apply technical and organisational measures appropriate to the risk, in particular: encryption of connections (TLS), password hashing, two-factor authentication (mandatory for our operators, available to Clients), encryption of payment gateway keys and other secrets in the database, roles and permissions, an event log, encrypted backups, and limits on login attempts and other operations.
26.2. We periodically review our safeguards and adapt them to the risk and to technical developments.
§ 27. Personal data breaches
27.1. In the event of a breach of data for which we are the controller, we assess the risk and fulfil the obligations under Articles 33 and 34 GDPR.
27.2. If a breach concerns data entrusted by the restaurant, we notify the restaurant without undue delay, and in any event within 48 hours of becoming aware of the breach, and provide the information needed for it to fulfil its obligations.
§ 28. Changes to the Privacy Policy and contact
28.1. We update the Policy in the event of changes in the law, Ranedo features, the scope of processing, providers or sub-processors. We inform Clients of material changes by e-mail or by a notice in the Panel.
28.2. The addition or replacement of a sub-processor of Guests’ data is additionally carried out in accordance with the procedure set out in the data processing agreement contained in the Ranedo Terms of Service.
28.3. Questions concerning the Policy and the processing of data: e-mail kontakt@ranedo.com, telephone +48 577 682 359, address: ul. Boczna 8, 46-080 Chróścice, Poland.