Privacy policy

Controllers

Sult is run by Nordkrone AS, Smedsletta 4, 1383 Asker, Norway, organisation number 937 752 881, which is the controller for the app. The restaurant you order from is a separate controller for preparing and delivering your order. Contact: hi@getsult.com.

What we collect

Email, phone number and, for delivery, your address; the dishes you ordered, the amounts and the times of payment, acceptance and delivery.

Card and BLIK details go straight to the payment operator. We never see or store them.

The app remembers your email, phone and address in your own browser (local storage) so you do not retype them. That copy stays on your device; you can delete it with «Forget my details».

Why, and on what legal basis

To take and deliver your order: performance of a contract (art. 6(1)(b) GDPR).

To keep order and payment records: legal obligation under accounting and tax law (art. 6(1)(c)).

To prevent fraud and handle complaints: our legitimate interest (art. 6(1)(f)).

Push notifications: order updates when you turn them on for an order, and offers from a restaurant only if you tick that box for that restaurant (consent, art. 6(1)(a)). Your browser gives us an address to send them to; we store it with the restaurants you follow and the postcode of your last order there. You can switch offers off per restaurant or for all of them on the notification settings page, or straight from a notification, and withdrawing consent does not affect earlier messages.

We do not sell your data, and restaurants never receive your notification address.

Who receives it

The restaurant receives your order, phone number and delivery address.

Stripe Payments Europe Ltd. (Ireland) processes payments. Hetzner Online GmbH (Germany) hosts the database. Vercel Inc. hosts the app from Frankfurt; as a US company it is bound by the EU standard contractual clauses and the EU–US Data Privacy Framework.

How long we keep it

Order and payment records: as long as accounting and tax law requires, normally five years after the end of the year of the order. Other data is deleted when it is no longer needed for the order or a complaint.

Your rights

You can ask for access, correction, deletion, restriction or a copy of your data, and object to processing based on legitimate interest. Write to hi@getsult.com.

You can complain to the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych (UODO), or to the authority in your country.