Privacy Policy & Cookies

Data controller

Last updated: 21.09.2026

The controller of personal data is: MPQL sp. z o.o. ul. Kompozytorów 3/93 31-356 Kraków KRS 0001266084 NIP 6772547115 e-mail: kontakt@margotcafe.pl hereinafter referred to as “Margot” or the “Controller”.

Data we process

Depending on how the Service is used, we may process data connected with the user Account, in particular e-mail address, phone number and other data provided by the user.

In connection with orders, we may process information about ordered products, pickup time and place, order history, payment, fulfilment status and communication related to the order.

If required for a specific feature, such as delivery or issuing a sales document, we may also process address or billing data.

We also process technical data related to use of the Service, such as IP address, device and browser information, security logs, and cookie or similar technology identifiers.

Purposes and legal bases

Data related to the Account, placing and fulfilling orders and sending transactional messages is processed where necessary to enter into or perform a contract — Article 6(1)(b) GDPR.

Data required by tax, accounting or other legal obligations is processed under Article 6(1)(c) GDPR.

Data necessary to ensure Service security, prevent abuse, handle claims and protect Margot’s rights is processed on the basis of our legitimate interest — Article 6(1)(f) GDPR.

Data related to optional analytics and marketing tools, including Google Analytics 4 and Meta Pixel, is processed after the required consent is obtained — Article 6(1)(a) GDPR and in accordance with rules on storing information or accessing information on the user’s device.

Messages concerning order confirmation, status, cancellation or readiness are transactional. Any marketing communication will be sent on the basis of separate consent where required.

Technology providers

To operate the Service and fulfil orders, we use external technology providers. These entities may process personal data only to the extent necessary to provide services to Margot and in accordance with appropriate agreements and applicable data protection law.

In particular, we use: Supabase for database and user authentication; Vercel for hosting, deployment and technical operation of the Service; Mailgun / Sinch for account and order-related e-mails; SENDLY by ACTIO, provided by Syntell S.A., for order-related SMS messages; Google Analytics 4 after the required consent; and Meta Pixel after marketing consent.

For SMS delivery, we may transfer in particular the recipient’s phone number and the message content necessary to handle the order.

E-mails and SMS messages directly related to order fulfilment, Account security or another service requested by the user are transactional and are not marketing communication.

If Margot sends newsletters, promotional offers or other marketing messages by e-mail or SMS in the future, they will be sent only on an appropriate legal basis and, where required, after separate user consent.

International transfers

The main application data stored in our Supabase project is hosted in the selected European region.

Some technology providers we use operate globally and may process certain data outside the European Economic Area, in particular in the United States. This applies especially to some services provided by Vercel, Google, Meta and Sinch/Mailgun.

Where personal data is transferred outside the European Economic Area, we use or require our providers to use mechanisms compliant with Chapter V GDPR, such as European Commission adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, or standard contractual clauses approved by the European Commission.

Transactional contact

In connection with creating an Account or placing an order, Margot may contact the user using the e-mail address or phone number provided in the Service.

This contact may include in particular Account creation or Account service confirmations, order acceptance confirmations, order fulfilment or status updates, readiness for pickup, delay or issue information, cancellation confirmations, and messages related to Account security or support requests.

We use Mailgun to send e-mails and SENDLY by ACTIO to send SMS messages.

The legal basis for processing data in this area is primarily the necessity to perform a contract or take steps at the user’s request before entering into a contract — Article 6(1)(b) GDPR — and, where applicable, the Controller’s legitimate interest related to Service security and user support — Article 6(1)(f) GDPR.

Cookies and similar technologies

The Service uses cookies and similar technologies.

Necessary cookies are used to provide basic Service functions such as security, Account login, session maintenance, technical preference storage and proper operation of the order flow.

Necessary cookies may be used without separate consent to the extent they are necessary to provide a service expressly requested by the user or for the proper operation of the Service.

With the user’s consent, we may use Google Analytics 4 to collect statistical information about use of the Service, such as visited pages, navigation, device type or visit source. Analytics cookies and similar technologies are not activated before the required consent is obtained.

With the user’s consent, we may use Meta Pixel to measure advertising effectiveness, analyse conversions and create or match advertising audiences. Marketing cookies and similar technologies are not activated before the required consent is obtained.

During the first visit, the user may accept all optional cookies, reject all optional cookies, or customise preferences by category.

Refusing analytics or marketing cookies does not limit access to the basic Service functions or the ability to place orders.

The user may change settings or withdraw consent at any time through the “Cookie settings” function available in the Service. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Retention and user rights

Account data is stored for the period of Account use and, after its termination, for the period necessary to comply with legal obligations or to establish, exercise or defend claims.

Order and transaction data is stored for the period required by applicable tax, accounting and claims-related regulations.

Data processed on the basis of consent is processed until consent is withdrawn or the purpose ends earlier, subject to data whose further retention is required or permitted by law.

Technical and security data is stored for the period necessary to ensure the security and proper operation of the Service.

Under the rules set out in GDPR, the user may request access to their data, rectification, erasure, restriction of processing or portability. Where processing is based on legitimate interest, the user may object to processing. Where processing is based on consent, the user may withdraw it at any time.

The user also has the right to lodge a complaint with the President of the Personal Data Protection Office: Urząd Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, www.uodo.gov.pl.

Automated decisions, security and updates

Margot does not make decisions about users based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them.

Third-party analytics and advertising tools may analyse use of the Service according to those providers’ rules if the user has given the required consents.

Margot applies appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration or disclosure.

This Policy may be updated if Service functionality, technologies used or legal provisions change. The current version of the Policy is published in the Service together with the date of the latest update.