Privacy Policy

Information on the Processing of Personal Data(hereinafter the “Information”)

The company TasteTown s.r.o., with its registered office at Těšetice 180, Těšetice 671 71, Company ID No. (IČ): 21451265, VAT No. (DIČ): CZ21451265, registered in the Commercial Register maintained by the Regional Court in Brno, under file number C138964 (hereinafter the “Company” or “we” in all grammatical forms), as the controller of your personal data, hereby informs you by means of this Information how it processes and protects your personal data.

We always provide you with this Information at the beginning of our mutual interaction, and it is also available on our website https://tastetown.app/en/gdpr.

1 What processing of personal data does this Information concern?

This Information applies to the processing of personal data of:

• Users of the TasteTown app, Registered users of the TasteTown app (including the START Agreement and the full version) (“App Users”),
• Other visitors to or users of our website (hereinafter “Website Users”),
• Participants in our games, contests, voucher giveaways and other competition or PR projects (hereinafter “Contestants”);
• Our contractual partners, such as Partner venues, vendors and business customers (hereinafter “Business Partners”).

If you do not fall into any of the categories listed above, contact us at support@tastetown.cz and we will provide you with the version of the Information on the Processing of Personal Data that applies to you.

TasteTown is the operator of the website (hereinafter the “Website”) available at www.tastetown.czand of the TasteTown mobile application (hereinafter the “App”).

2 What data we collect about you

We collect and process your personal data in the course of our mutual interaction, for example identification and contact details and technical data and information that we obtain from you when you use our Website, the App, or during our telephone, electronic or other communication.

This also includes information you provide to us when you register as a user of our App, order our services, use our Website or services, contact us by telephone or e-mail, comment on Venues in the App, take part in a contest, promotion or survey, fill out an application or other form, for example as part of obtaining a free voucher, or when you report problems with our Website or App to us. The information you provide to us may include, for example, your name, address, e-mail, telephone number, customer ID, financial and payment details, a personal description and photograph, age and date of birth, but also technical data about your IP address, the approximate location based on that IP address, the device from which you access our services, and your movement within the environment of the Website or the App.

We will not collect or process your sensitive personal data (for example information about your health, sexuality, race or ethnic origin), unless such sensitive personal data relate to the specific purpose for which we process personal data, where required by law, and/or where you give us special explicit permission to do so. Personal data that you provide to us voluntarily (including sensitive personal data) in the course of our interaction (for example by voluntarily disclosing sensitive personal data in comments on the Website) of your own free will and not at our request, we will delete from our systems, unless we find the processing of such data to be necessary on a legitimate basis, unless you make such data publicly available (for example on publicly accessible internet message boards) — in which case we will delete such data from our Website only where we are required to do so by law, or where we no longer wish to retain it.

It may happen that we receive your personal data from third parties, such as our Business Partners, subcontractors providing technical, payment and delivery services, advertising networks, providers of analytics services and providers of search information. For example, when looking for new employees we may receive your personal data from an external agency.

If we receive your personal data from third parties, we will provide you with all material information about the processing at the earliest opportunity, but in any event no later than within one month of receiving your personal data, including information about the types of personal data processed, the purpose of the processing and its legal basis.

3 How and on what legal basis we use your personal data

General

We are entitled to process your personal data where it is necessary for the purpose of performing our mutual contract, where it is necessary to fulfil our obligations arising from law (for example from accounting regulations), where it is necessary for the purposes of our legitimate interests (or the legitimate interests of a third party), provided that such interests are not overridden by your fundamental rights, furthermore where it is necessary to protect your vital interests (or the vital interests of someone else) and/or where it is required by the public interest or for official purposes.

We process your personal data for various technical, administrative and operational purposes, for example to ensure that the App and our Website are presented to you in a manner that is most effective for you and your mobile phone, so that we can improve our Website and its functionality, for the purposes of administering our contractual relationship, internal processes including troubleshooting, data analysis, testing, research, statistics and surveys, for promotional purposes including targeted marketing, so that we can present you with content that may be of interest to you, and also as part of our efforts to keep our Website and App secure.

Your personal data may be subject to profiling. This means that we set up processes that create certain groups (segments) comprising individual data subjects according to the data we process about them. If your personal data are subject to profiling, you will learn about it in the section of this Information that concerns you.

In some cases we will process your personal data only with your consent. In such cases we will separately ask you for unambiguous consent when you provide the personal data. You will be able to withdraw this consent at any time via support@tastetown.cz. The withdrawal of consent does not, however, affect the lawfulness of processing that took place before its withdrawal. In relation to the use of cookies (except for strictly necessary cookies) you may give your consent in the pop-up window that appears on your first visit to our website, or it can be triggered by clicking the “Change cookie settings” link. Consent that has already been given can be withdrawn in the same way (thereby blocking the further use of cookies).

Where we require personal data in order to fulfil legal or contractual obligations, the provision of such personal data is mandatory. This means that if such personal data were not provided, we would not be able to administer our contractual relationship or fulfil the obligations imposed on us. Where we ask you for consent to process your personal data, the provision of personal data is voluntary and you are under no obligation to provide it.

Your personal data, such as identification and contact details and your residential address, may also be processed by us for the purposes of any future exercise of our rights and claims against you. This processing takes place on the basis of our legitimate interest in exercising our rights in any legal disputes.

(a) App Users

In connection with the fact that you are a registered user of our App, of our services, or that you receive our marketing and commercial communications, we may collect and process your personal data:

• when you download and “browse” the App, Register in the App, activate the START service or order the TasteTown full-version service;
• about the geographic location determined at the level of a specific city/municipality based on the IP address of your mobile or other device;
• when you use the App we process information about your user behaviour and your preferences (what content/venues/categories you follow, for how long, when you stop following content, etc.);
• when you contact us with a request for customer support regarding the services provided, we will process for this purpose your identification and contact details, the content of the request and, where you contact us via the customer line, to the extent necessary also a recording of the telephone communication.
• when you communicate with us in any other way, for example by telephone, via SMS, e-mail, social media or comments;
• when you sign up to our App (including the free trial period) and provide us with your personal data in this connection;
• when you attach a comment, rating or other kind of reaction to our App;
• when you use our App;
• when you communicate with us through the use of our App.

For the purposes of providing the TasteTown full-version service, making payments under the relevant contracts (including any subscription to our services) and fulfilling legal obligations (in particular tax and archiving obligations), we may process your personal data, such as identification and contact details and payment details, depending on the type of service. In such a case we have access only to the most necessary scope of payment details. In the case of electronic payment we retain the amount, first name and surname, e-mail, payment ID by which we verify that the payment was made, the payment method (card, Google Pay or Apple Pay), the brand and type of card, the bank name, the country of issue of the card, the first 6 and last 4 digits of your payment card number, the reasons for transaction failure in the case of incomplete transactions, and accompanying technical payment data; the remaining data needed to carry out card payment is held exclusively by the secure STRIPE payment gateway and the relevant banking institution.

With the STRIPE payment gateway we are, when processing payment for ordered services, joint controllers of the data entered into the payment form and the associated related data, although the majority of the payment information processed is held strictly by the relevant payment gateway. In the case of STRIPE, the following data are processed: first name, surname, address, e-mail, telephone number, account number, account holder name, payment card number, IP address and payment reference number.

For the purposes of user administration, subscription administration, communication with payment gateways, documentation of consents granted or of objections expressed, etc., and proper personalisation and the conducting of business analyses, we use in particular your registration data and data you voluntarily filled in or otherwise provided, including the payment details mentioned above, data about your user behaviour (length of search, time to activation, etc.) and data about your subscription history.

This processing of personal data is based on:

• the performance of our mutual contract(s);
• the fulfilment of the legal obligation to archive documents;
• our legitimate interest;
• for the subscription to news about the Company’s services and products, these data are subject to profiling;
• if you are already an App User, we may contact you via e-mail, social networks or SMS messages with information about TasteTown products and services similar to those you use or have previously purchased, unless you object to this when providing your contact details. You may withdraw your consent to the communication of commercial communications at any time by e-mail message to support@tastetown.cz;
• our legitimate interest in verifying user access details for the services provided in the territory where you are located, for the proper functioning of the app.

We may also disseminate commercial communications by means of so-called push notifications (banners). Push notifications are short messages that will be displayed on your end device, even where you are not currently viewing our Website or our mobile App. These notifications will be displayed to you only if you enable them on your end device. You can turn off push notifications in your mobile device settings.

In addition, we may disseminate commercial communications by means of SMS. These notifications will be displayed to you only if you enable them during registration or sign-in to the App. You can turn off SMS notifications by the procedure indicated with each SMS.

We will not share your personal data with third parties for third-party marketing purposes without your explicit prior consent.

In some cases there may be processing of your personal data obtained via the social networks you visit, for the purpose of sending personalised direct marketing. These personal data may be processed jointly between TasteTown and the operator of the specific social network or analytics tool through which the personalised direct marketing is sent.

(b) Website Users

In connection with the fact that you use our Website and the services associated with it, we may collect and process your personal data:

• when you enter our Website and move around it;
• when you post your contributions on our Website, whether in text, image or audiovisual form, including a comment, rating or other kind of reaction;
• when you communicate with us via our Website;
• when you communicate with us in any other way, for example by telephone, via SMS, e-mail, social media or comments.
• Our Website uses Cookies to distinguish you from other users. These files help us provide you with a good user experience while browsing the Website and allow us to improve the quality of the Website.

When you visit our Website, we will ask you in a pop-up window for consent to the processing of personal data obtained from cookies. We then process these personal data on the basis of your consent, which you may withdraw at any time. In addition to the personal data processed on the basis of your consent, we process further personal data obtained from cookies, namely those obtained from strictly necessary cookies. This processing is based on our legitimate interest in the operability of the Website. If you communicate with us, we process your personal data on the basis of our legitimate interest in your pleasant user experience.

(c) Contestants

In connection with your participation in a game, contest, timed voucher contest or other competition or PR project organised by us (hereinafter together the “Contest”) we may collect and process your personal data, such as first name and surname or username, residential address, e-mail address, telephone number, and possibly other data depending on the type of Contest, e.g. age, photographs and the like.

In the event that, in connection with your participation in the Contest, you provide us with the personal data of third parties, in particular their photographs, you are responsible for ensuring that their rights are not infringed, and you are obliged to obtain their written consent.

The above personal data are processed for the duration of the Contest for the purposes of maintaining a database of Contestants and the subsequent evaluation of the Contest, and further to ensure communication with the Contestants during the Contest, in particular messages relating to the Contest.

The Company further processes and collects the following personal data of winners: first name, surname and address, for the purpose of publishing the results of the Contest and distributing the prizes. Data about winners are published on the website, or on social networks, as standard to the following extent: first name, surname, the city the winner comes from, and the prize. Contact details of winners may be passed on to the person/company that provided the relevant prize to the Contest, exclusively for the purposes of distributing the prize.

(d) Business Partners

For the purposes of providing services, intermediation, the delivery of goods and making payments under the relevant contracts, we may process your personal data, such as identification details including Company ID No. (IČO), business contact details, bank account details, VAT No. (DIČ), contact person and others.

This processing is based on:

• the performance of the contract to which you, as our Business Partner, are a party;
• an obligation imposed on us by law;
• our legitimate interest.

In some cases we process personal data, such as the name and contact details of employees or suppliers of our Business Partners, for the purposes of communication in connection with the performance of a particular contract concluded with a Business Partner.

Since you are our Business Partner, we may send you commercial communications pursuant to Section 7(3) of Czech Act No. 480/2004 Coll., on Certain Information Society Services, regarding products and services relating to our previous contractual cooperation. If you do not wish to continue receiving these communications, you can unsubscribe at support@tastetown.cz.

4 How and to whom we may disclose your personal data

Only a limited number of the Company’s staff will have access to your personal data, depending on the purpose of the processing, such as the sales department, the legal department, the marketing department, the IT department, and only to the extent necessary. These staff are bound by a duty of confidentiality in connection with your personal data. Appropriate technical and organisational security measures have been adopted to secure your personal data.

Personal data may be provided to state administration bodies and/or to bodies active in criminal proceedings, where so provided by the relevant law or where it is necessary to exercise our rights, including our terms of use, or to protect our legitimate interests (including the legitimate interests of third parties) in accordance with applicable legal regulations.

Your personal data may also be disclosed to third parties, including:

• service providers that provide the Company with administrative, professional and technical support in the areas of IT, administration, customer support, security and business resources;
• Business Partners, suppliers and subcontractors, including providers of payment gateways and payment services;
• partners, on the basis of the consent you have provided, for the purpose of personalising commercial communications;
• providers of analytics services and search engines that help us improve and optimise our Website.

Where necessary, the Company is entitled to share personal data also with external advisers (for example legal advisers, accountants and auditors).

5 Storage of your personal data and its transfer abroad

The personal data we collect are stored within the territory of the European Union (hereinafter the “EU”) and the European Economic Area (hereinafter the “EEA”). Information collected by third parties via Cookies may be processed on servers located in the EEA and transferred outside the EEA.

Your personal data may further be transferred and stored outside the territory of the EU and the EEA. When your personal data are transferred from your country to another, it is possible that the laws and regulations that protect your personal data in the country to which your personal data are transferred may be different (or provide weaker protection) than the laws and regulations in force in the country where you reside.

Our aim is not to transfer your personal data outside the territory of the EEA unless adequate protection is ensured, in particular:

• by a decision of the European Commission on the adequate protection in the country or countries receiving the personal data;
• by appropriate binding internal rules;
• by an approved code of conduct together with binding and enforceable commitments of the controller or processor in a country outside the EU and the EEA;
• by an approved certification mechanism together with a binding and enforceable commitment of the controller or processor in a country outside the EU and the EEA to apply appropriate safeguards;
• by standard contractual clauses in accordance with EU standards approved by the European Commission.

6 Your rights

You may request from us confirmation as to whether we process your personal data, a copy of your personal data and/or its rectification. In certain circumstances you may request that we erase your personal data or, on the basis of the right to data portability, request that we transfer certain of your personal data to you or to other entities. You also have the right to object to certain types of processing of your personal data (for example its use and processing for direct marketing purposes). Where we have asked you for consent to the processing of personal data, you may withdraw your consent without this having adverse consequences for you. You also have the right to object where we process your personal data because we have a legitimate interest in doing so (as explained above). In certain circumstances you also have the right to request the restriction of the processing of your personal data.

Please note that your rights set out above may be limited in certain situations and are subject to applicable laws and regulations on the protection of personal data. In order for us to respond to your request, you will need to prove your identity and provide us with further personal data. We will not charge you any fees for responding to your request, unless permitted by legal regulations.

If you wish to exercise these rights, contact us using the contact details provided below. However, you also have the right to lodge a complaint with the relevant data protection authorities.

7 How long we retain your personal data

We intend to retain your personal data only for as long as is necessary in accordance with our policies for the retention of personal data, no longer than is needed to fulfil the purposes set out in this Information and/or as required by applicable legal regulations. We regularly review the scope of the personal data processed and, where the purpose of their processing has been achieved without any further reason for processing existing, they are erased.

In cases where we process your personal data on the basis of your consent, your personal data will be processed only for the duration of your consent, which you may withdraw in whole or in part at any time before its duration expires.

8 Security of personal data

We store your personal data on our servers and on third-party servers (including external cloud storage services). We use appropriate technical and organisational measures to protect your personal data and prevent unauthorised access. We have concluded contracts with external hosting providers that include arrangements on the organisational and technical security of personal data. Any payment transactions will be encrypted (for example using the TLS protocol). You are responsible for keeping your access details confidential.

The transmission of personal data over the internet is not entirely secure. Although we do everything in our power to protect your personal data, we cannot guarantee the security of your personal data provided via our Website, and any such transmission is at your own risk.

9 Commercial communications

If you are our App User and have not previously unsubscribed from receiving commercial communications, we may send you commercial communications electronically or contact you with information about goods and services similar to those you have previously purchased or about whose purchase you have negotiated with us, in accordance with Section 7(3) of Czech Act No. 480/2004 Coll., on Certain Information Society Services. Commercial communications concerning any other TasteTown services, including those not related to goods and services similar to those you have previously purchased, as well as the offers of our business partners, we may send you electronically if you have given us your explicit consent to do so.

10 Links to other websites

Our App and Website contain links to websites that are not under the Company’s control. After clicking an external link you will be referred to third-party websites. If you visit these linked websites, you should familiarise yourself with their personal data protection information. We are not responsible for the policies and practices of other companies. Our Company has no control over, and is not responsible for, the content, privacy policies and policies or practices of third-party sites or services.

11 Contact details

If you have questions or concerns regarding the processing of your personal data, or if you wish to exercise any of your rights, contact us at TasteTown s.r.o., Těšetice 180, Těšetice 671 71, and at the e-mail address support@tastetown.cz.

You may also lodge a complaint with the Office for Personal Data Protection, with its registered office at Pplk. Sochora 27, 170 00 Prague 7, e-mail posta@uoou.cz, https://www.uoou.cz.

When you contact us, please do not disclose to us any sensitive personal data (e.g. information about your ethnic origin, political opinions, religious or other beliefs, health status or trade union membership), social security number or information about criminal records.

12 Web analytics, ad measurement and opt-out

To understand how our website tastetown.app is used, we operate our own privacy-first analytics. We do not use Google Analytics, Plausible or other client-side third-party tracking scripts. We divide this section into three parts according to the legal basis: (A) our own traffic analytics on the basis of your statistics consent; (B) server-side measurement of the effectiveness of our own campaigns and fraud prevention on the basis of legitimate interest; and (C) the sharing of data with Meta for ad measurement only with your marketing consent.

(A) Own traffic analytics — statistics consent

What we collect.We run analytics at two levels. The “Events”, “City-level location”, device and browser type are collected as an anonymous aggregated baseline even without consent — with no stored IP address and no identifier of any kind, so you cannot be identified from them. The IP address, daily fingerprint and visit identifier below are processed only with statistics consent:

• Events without personal identification: page views, clicks on venues, searched terms (from which we automatically strip any e-mail addresses and phone numbers), the device category (mobile / tablet / desktop), the browser (Chrome / Safari / Firefox), the interface language (cs / sk / pl / en).
• Location at city level: country (CZ / SK / PL ...), region, city, the approximate geographic position (with an accuracy of about 10 km from the MaxMind database). These data serve to analyse which cities our visitors come from and to visualise trends on a map. We never obtain GPS coordinates from your device.
• IP address: we store it for a maximum period of 30 days to distinguish unique visits and operate the analytics (the security and fraud-prevention purpose belongs to part B below; the IP lives in a single shared table, so the same 30-day period applies). After 30 days have elapsed, the IP address is automatically deleted (NULL); the other analytics data (number of visits, city, device) remain anonymously aggregated.
• A daily-rotating anonymous fingerprint: a SHA-256-type hash of a combination of the IP, browser, date and a secret salt string, which is changed every 24 hours. It allows us to count unique visitors within a single day, but does not allow us to track you across days or across devices.
• A visit identifier for linking with a conversion:if you arrive from an ad, we store in your browser’s memory (sessionStorage, key tt_ad_click) a random visit identifier together with the campaign parameters (fbclid, utm_*), so that we can link your visit with a later registration in our app. This record is cleared when the tab is closed.

Legal basis for part (A): the anonymous aggregated baseline (no stored IP, no identifier) is processed even without consent, because no individual can be identified from it. The detailed measurement with a stored IP, fingerprint and conversion linking is carried out on the basis of your consent (Article 6(1)(a) GDPR together with the ePrivacy Directive and its national implementations); without it we do not carry it out. You can withdraw consent at any time in the cookie settings and, independently of that, object via the opt-out below.

(B) Measuring our own campaigns and fraud prevention — legitimate interest

When a visitor comes to us from paid advertising (detected from the fbclid / utm_* parameters in the address), our server records the IP address, the campaign identifier (fbclid / utm_*), the time of arrival, the approximate location from the IP (country / region / city), the browser and device type, and the landing-page address — so that we can measure how many registrations in our mobile app come from which campaign, and prevent fraud. This matching takes place exclusively within our own systems (comparison against the registration IP) and is not shared with Meta or any other third party.

Legal basis for part (B): legitimate interest pursuant to Article 6(1)(f) of the GDPR — to measure the effectiveness of our own advertising campaigns and to prevent abuse. This is server-side processing independent of the cookie bar; we apply minimisation to it (we do not store search content or any behavioural profile), a 30-day retention period for the IP, and aggregated output. You can object to this processing at any time — see the opt-out below, which applies to this measurement as well.

(C) Meta ad measurement (Pixel + Conversions API) — marketing consent

When a visitor comes to us from paid advertising on Meta’s platforms (Facebook, Instagram), we share with Meta Platforms Ireland Ltd. a limited set of data for the purpose of measuring the effectiveness of advertising campaigns:

• the visitor’s IP address and browser type (user-agent);
• the ad-click identifier (fbclid) from the address through which the visitor arrived;
• the information that a page view or a click on the “Download app” button occurred — without search content and without any other personal data.

This sharing concerns exclusively visitors arriving from Meta ads. For ordinary (organic) visitors, nothing is sent to Meta.

Measurement runs via the Meta Pixel (in the browser) and the Conversions API (server-side), deduplicated by a shared event identifier. Neither the Pixel nor the transfer activates without your marketing consent — without it no Meta script loads and no Meta cookies are set.

Legal basis for part (C): your consent (Article 6(1)(a) GDPR together with the ePrivacy Directive and its national implementations). For the collection and transmission stage we act with Meta as joint controllers within the meaning of the judgment of the Court of Justice of the EU in the Fashion ID case (C-40/17); the allocation of responsibility is governed by the Meta Business Tools terms (Controller Addendum), which we have accepted. Meta provides details about the processing on its side in its privacy policy. The data may also be processed outside the EU/EEA (in the USA) on the basis of the EU-US Data Privacy Framework, to which Meta is certified. You can withdraw consent at any time in the cookie settings.

What we do NOT use: no cookies for analytics or marketing purposes with the exception of the Meta Pixel, which is activated only after your marketing consent (part C above); no cross-site fingerprinting. We use the sessionStorage key tt_ad_click solely after statistics consent has been given, to link a visit with a conversion (part A). With the exception of the Meta conversion measurement (part C), we do not pass any analytics data to third parties.

Retention period:

• IP address: 30 days, then automatic anonymisation
• Raw event data: 90 days, then deletion
• Aggregated daily statistics (total number of visits, top cities, top venues): with no time limit, in anonymised form

Your right to object (opt-out): you can turn off tracking at any time by clicking the following link:

→ Turn off tracking

After clicking, we will store in your browser a so-called essential cookie tt_no_analytics=1 with a validity of 1 year. For as long as this cookie exists, we will not record any of your visits. The cookie will disappear if you clear your browser data — in which case it is enough to click the link again.

Your right to erasure: if you want us to remove from our database all records associated with your IP address during the last 30 days, write to us at support@tastetown.cz stating the IP address. We will remove the records within 30 days and confirm this to you by e-mail.

13 MCP server — data sharing with AI assistants

We operate an MCP (Model Context Protocol) server at mcp.tastetown.app that lets AI assistants — including ChatGPT by OpenAI, Claude by Anthropic, Cursor and similar tools — access our restaurant directory through a standardized open protocol.

What is accessible to AI assistants:

• Public branch information: name, address, opening hours, categories, ratings, photos, and contact details.
• Active deals and discounts.
• Menu items — names, descriptions, prices.
• Editorial articles.

Same information you would find on tastetown.app — no additional dataset, no non-public data.

What is NOT shared via the MCP server:

• No personal user data from the TasteTown app or website.
• No reservations or order history.
• No individual reviews with author identification (aggregated ratings yes, individual reviews no).
• No financial or technical partner data — only public marketing information.
• No user IP addresses of AI assistants — see telemetry below.

MCP call telemetry. For each MCP server call we log:

• Invoked tool name (e.g. search_restaurants).
• AI client family (e.g. claude-desktop, chatgpt, cursor) — derived from the User-Agent header.
• Model version if the client exposes it (e.g. claude-3-5-sonnet).
• Anonymized IP hash (SHA-256 with a daily-rotating salt — used only for 24-hour deduplication, does not allow user identification).
• Latency and result status.

We do not store any PII in MCP telemetry. Records are retained for 90 days for diagnostics, capacity planning, and service improvement. They are automatically deleted after 90 days.

Legal basis. Sharing public restaurant data with AI assistants relies on legitimate interest (Art. 6(1)(f) GDPR) — interest in promoting partner venues and making search easier for users — and on contractual necessity (Art. 6(1)(b) GDPR) with the partner restaurants whose data we publish.

Contact. For questions about AI integration or the MCP server, write to the contact email listed in Article 11 above.

Effective from: 6 September 2024