Personal data in the ordering portal

1. Controller

The controller of your data is the bakery that sent you the invitation to the portal (its name is in the invitation and in the portal header). In data matters, contact the bakery first.

Patryk Kowalski, KamikStudio Patryk Kowalski, NIP (Polish tax identification number) 6182187584, the provider of the BakePilot application, processes the data on behalf of the bakery under a data processing agreement (Annex No. 1 to the Terms of Service). Contact: kontakt@bakepilot.pl.

2. What data

• first name, last name and email address from the invitation and the account;
• the company you order for (the bakery's customer) and your link to it;
• orders sent in the portal: products, quantities, pickup date, selected delivery address, notes;
• selected language, date of accepting the terms, date of last sign-in;
• the account event log (e.g. sign-in, sending an order) - without the IP address in plain form.

3. Purpose and basis

• handling the orders of the company you order for and contact regarding their fulfillment - the bakery's legitimate interest (Article 6(1)(f) of the GDPR (Regulation (EU) 2016/679)) in performing the contract with its business partner;
• ensuring the security of the account and the portal (e.g. limits on sign-in attempts, event log) - the bakery's legitimate interest (Article 6(1)(f) of the GDPR).

4. Recipients of data

The data is visible to the bakery and to people from your company with access to the portal (the company's orders). Technically, it is processed by BakePilot's sub-processors listed on the GDPR page (including the database and hosting in the EU, email delivery, error diagnostics). The data is not sold or used for advertising.

5. How long

• the account and the link to the company - as long as you have access; after access is revoked we delete the link after 12 months, and an account without any active link - 12 months after it was disabled;
• orders rejected or cancelled in the portal - 12 months from the decision or cancellation;
• orders accepted by the bakery - as part of its sales records, for as long as the law (e.g. tax law) requires;
• invitations that nobody accepted - 30 days from expiry or withdrawal;
• the account event log - 12 months;
• all portal data disappears earlier if the bakery deletes the customer company or its own account.

6. Your rights

You have the right of access to the data, its rectification, erasure, restriction of processing and to object to processing, as well as the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO, the Polish Data Protection Authority). Address requests to the bakery; BakePilot helps it fulfill them. You can change the portal language yourself on the “Account” page.

7. Cookies

The portal uses only strictly necessary cookies: the sign-in session, the language and the selected company. The cart is saved in your browser's storage. The portal does not use analytics or advertising tools.