GDPR - your data is safe

What is the GDPR?

The GDPR (General Data Protection Regulation, Regulation (EU) 2016/679, in Polish: RODO) is an EU law protecting the personal data of EU citizens. It has applied since 25 May 2018.

Below we describe how we protect data and how we act as the processor of the data of your customers and employees.

BakePilot as a data processor

When you use BakePilot to manage your pastry shop, you enter the data of your customers (names, phone numbers, addresses, orders). Within the meaning of the GDPR:

• You (the Organization) are the controller of your customers' data
• BakePilot is the processor of that data

This means that we process your customers' data solely for the purpose of providing the BakePilot service, in accordance with your instructions.

Data Processing Agreement (DPA)

In accordance with Article 28 GDPR, we conclude a Data Processing Agreement with every Organization using BakePilot. Its full text is Annex No. 1 to the Terms of Service; the agreement is concluded together with the Terms of Service at registration.

Key provisions of the DPA:

• We process data only on your instructions and for the purpose of providing the service
• We apply appropriate technical and organizational measures (encryption in transit, RLS, roles and permissions, backups)
• We use only the sub-processors listed below; we inform you by e-mail 14 days in advance of a planned addition or change of a sub-processor - you may object and, if no agreement is reached, terminate the agreement at no cost
• We notify you of a personal data breach without undue delay, no later than within 48 hours of discovering it
• Return of data is a full export that the account owner orders in Settings; deleting the account erases the data immediately (backups are overwritten within 7 days); from 2 November 2026, an account that remains in restricted mode for 6 months after the end of the trial period or subscription is deleted, with e-mail notice 30 and 7 days in advance
• We demonstrate compliance with documentation and answers to questions; an inspection is possible when the documentation is not sufficient, after a breach or at the request of a supervisory authority

How we protect data

• Data isolation - each Organization sees only its own data (Row Level Security)
• Encryption - TLS in transit, AES-256 at rest
• Authorization - standard and custom roles with permissions granted by the organization, one account owner
• Access logs - recording of security events
• Backups - automatic, encrypted
• EU infrastructure - database in the European Union (Ireland), application functions in the Dublin region

Your rights as a User

You have the right to:

• Access your data (a full export ordered by the account owner in Settings: a ZIP archive prepared overnight, with a CSV file for each type of data, a combined XLSX workbook and KSeF invoices in XML, link valid for 24 hours; orders instantly to CSV; list exports in modules - CSV/XLSX)
• Rectification of incorrect data
• Deletion of your account and data
• Restriction of processing
• Transfer of your data to another system
• Object to processing
• Withdraw consent at any time

Contact: kontakt@bakepilot.pl

Rights of your pastry shop's customers

As the controller of your customers' data, you are responsible for fulfilling their rights under the GDPR. BakePilot provides tools that help you with this:

• Customer data export - you can export a customer profile with their orders
• Customer data deletion - you can delete a customer profile and related data
• Data editing - you can correct customer data at any time

Sub-processors

The data your organization enters into BakePilot (customers, employees, business partners) may be processed on our behalf only by the following sub-processors:

• Supabase Inc. (servers in the EU - Ireland) - database, sign-in and file storage
• Vercel Inc. (application functions in the Dublin region, Ireland) - application hosting - SCC
• Resend Inc. (USA) - sending e-mails from the application, including to your customers (e.g. offers) - SCC
• Anthropic PBC (USA) - reading documents uploaded to the invoice price scanner - SCC
• Google Ireland Ltd. / Google LLC (Ireland/USA) - push notifications in the mobile application (Firebase Cloud Messaging, notification content) - SCC
• OpenStreetMap Foundation (United Kingdom) - converting the delivery address into coordinates (Nominatim); only the address is sent, without the recipient's name or contact details
• Functional Software Inc. (Sentry) (USA) - application error diagnostics - SCC

SCC = Standard Contractual Clauses approved by the European Commission, ensuring an adequate level of data protection for transfers outside the EEA. Invoices sent to KSeF (Poland's National e-Invoicing System) and downloaded from KSeF are received by the Polish Ministry of Finance as a public authority, on your instructions - it is not our sub-processor.

The other providers we use (e.g. Stripe and Fakturownia for subscription payments, Meta and Google for advertising, Telegram and CallMeBot for notifications to us) process data for which we are the controller, not the data of your customers. Their full list is given in the Privacy Policy.

Contact and complaints

On GDPR matters: kontakt@bakepilot.pl

Supervisory authority: the Polish Data Protection Authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl