Privacy policy
Valid from 30. 10. 2026
This page explains what personal data we process when you use the website kyosushi-opava.cz, why we do so, how long we keep it and what your rights are. It is a translation; the version in the website's main language is binding.
Who processes your data
The controller of your personal data is Kyo-group s.r.o., company ID (IČO) 23526980, registered office Antonína Sovy 1485/25, 747 05 Opava, zapsaná v obchodním rejstříku vedeném Krajským soudem v Ostravě, oddíl C, vložka 100289 ("we"), the operator of KYO Sushi.
For anything about personal data, contact us: e-mail info@kyosushi.cz.
Who helps us
The website and messages are run for us by Feedmetoo s.r.o., company ID (IČO) 06309798, registered office Pražská 6, 269 01 Rakovník (brand ACKO), as our processor under a data processing agreement. It may use the data only for us and on our instructions. It uses these providers:
- Cloudflare – delivering the website, protection against attacks and bots, file and backup storage.
- Supabase – database (in the EU).
- Railway – running the application in which we manage the website (in the EU).
- Resend – sending e-mails.
- Sentry – catching application errors, without anything you fill in on the website (in the EU).
Cloudflare and Resend are US companies. Transfers to the US are covered by the European Commission's adequacy decision (EU–US Data Privacy Framework) or by standard contractual clauses approved by the European Commission.
When you visit the website
When you open the website, your IP address, browser type, the time and the page address are processed. Without them the website cannot be delivered or protected against attacks. This data serves only operation and security (our legitimate interest, Art. 6(1)(f) GDPR). The website uses no advertising and no tools that would track you.
Traffic measurement. We count visits ourselves, without cookies. From the IP address and the browser type, the server makes an anonymous identifier that changes every day: the random key used to make it is deleted within three days, so your visits cannot be linked from one day to the next. The IP address and browser type are not stored. What is recorded is the page visited, the website you came from, the link's tags (utm parameters), the device type and the country. Cloudflare keeps the individual records for at most 3 months; the totals of page views and visits are kept for 25 months. Nothing is stored on your device. The measurement is our legitimate interest (Art. 6(1)(f) GDPR): knowing which pages people read and where they come from.
What the website stores in your browser is described on the Cookies page.
When you request a reservation
What we process: the day, time and number of guests, your name, phone and possibly e-mail and a note.
Why: to handle your request and tell you whether we confirm the reservation. The legal basis is steps prior to and performance of a contract (Art. 6(1)(b) GDPR).
Who sees the data: our staff who handle reservations and the processor ACKO. If you give an e-mail address, we send you a confirmation of the request and our answer there; otherwise we call you. The staff's phone receives only a notice with the number of guests and the time, never your name or contact.
How long: your name, phone, e-mail and note are deleted 30 days after the day of the reservation; only an impersonal record of the day, time and number of guests remains.
When you place an order
E-mail verification: so that we know the order is really yours, we send a six-digit code to your e-mail. It is valid for 10 minutes and we store only its one-way fingerprint, not the code itself.
The order: your name, e-mail, phone, note, the items ordered, the price, the pickup time and how the order was handled. We need them to conclude and perform the contract (Art. 6(1)(b) GDPR): to prepare the order, send you a confirmation and let you know about a change or cancellation.
Customer account: when you sign in, we remember your e-mail, name, phone and your latest orders so that you do not have to fill them in again.
Who sees the data: our staff who handle orders (the kitchen staff see only orders for today and yesterday, without the e-mail) and the processor ACKO. We send the confirmation and any changes to your order by e-mail. The staff's phone receives only a notice "New order" with the number, the amount and the time, never your name or contact.
Customer list: in our application we keep a list of our customers: name, e-mail and phone, the number of orders, their total value and the latest orders. We can search it by name, e-mail or phone. The kitchen staff do not see this list.
How long:
- the contact details of an order for 12 months from the order; then we remove them and only an impersonal record of what was sold, when and for how much remains,
- a customer without an account is deleted 12 months after the last order, a customer with an account 24 months after the last order,
- accounting documents are kept for the period required by accounting and tax law (Art. 6(1)(c) GDPR).
You can view, correct or delete your account and data at any time in the customer account on this website.
Protection against abuse
Forms are protected against bots by Cloudflare Turnstile. During the check Cloudflare processes your IP address and technical data about the browser; it does not see the content of the form. For limits against abuse we create an irreversible fingerprint of your IP address; we do not store the IP address itself and delete the fingerprint after 24 hours. The legal basis is our legitimate interest in preventing abuse of the website (Art. 6(1)(f) GDPR).
Your rights
You have the right to:
- know what data about you we process and get a copy of it,
- have inaccurate data corrected,
- ask for erasure when we no longer need the data or process it unlawfully,
- ask for processing to be restricted,
- object to processing based on legitimate interest,
- receive the data you gave us in a machine-readable format.
Just contact us (e-mail info@kyosushi.cz). We answer within one month at the latest. If you believe we handle your data in breach of the law, you can complain to the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic.
Do you have to give us your data?
Browsing the website requires no data. Without your contact details, however, we can neither answer you nor accept an order. We do not carry out automated decision-making or profiling.
Backups and changes
Data is backed up daily for security; deleted data disappears from the backups within 6 weeks at the latest. We update this page when the way the website works or the law changes.