This page explains which personal data we process about you, why, for how long, and what your rights are. We follow Regulation (EU) 2016/679 (GDPR) and the Slovak Personal Data Protection Act No. 18/2018. The Slovak version is the binding one.
1. Controller
Colette Boutique s. r. o.
Krížna 8, 811 07 Bratislava – Staré Mesto, Slovakia
Company ID (IČO): 53 923 804 · Tax ID: 2121528937 · VAT: SK2121528937
Email: info@colette.sk · Phone: +421 908 889 308
We have not appointed a data protection officer. Send any question about your data to info@colette.sk.
2. Table reservations
You can book on our website, by phone, by email, in person, or through an AI assistant (see section 4).
- Data: first and last name, email, phone, date, time and party size, chosen menu and pairing, occasion, your notes, language. For online bookings also your IP address and browser type.
- Purpose: create and manage your booking, prepare the table and the kitchen, send you the confirmation, changes, a reminder before your visit and a thank-you after it with an invitation to review us.
- Legal basis: performance of a contract and steps before entering into it (Art. 6(1)(b) GDPR). We process the IP address and browser type to protect the booking system from abuse, based on our legitimate interest (Art. 6(1)(f) GDPR).
Allergies and dietary needs
Allergies, intolerances or a pregnancy you tell us about are health data. We use them only so the kitchen can cook safely for you, based on your explicit consent, which you give by providing them (Art. 9(2)(a) GDPR). We keep them in your guest profile so we know them on your next visit. You can withdraw this consent at any time and have your allergy data deleted by writing to info@colette.sk.
Guest profile
From your bookings we keep a guest profile: number and dates of visits, cancellations and no-shows, preferences and short staff notes (such as a favourite table or wine). The system automatically assigns a guest category from your visit history, for example new or regular guest. We do this to welcome you as a known guest next time, based on our legitimate interest (Art. 6(1)(f) GDPR). The category has no legal effect on you, and you can object to this processing at any time.
Waiting list
If you join the waiting list for a full evening, we process the same data as for a booking so we can offer you a table that frees up.
3. Newsletter
If you tick the box, we email you about new menus, events and news. The legal basis is your consent (Art. 6(1)(a) GDPR). Every email has a one-click unsubscribe link. We record when you gave or refused consent so we can prove it. We use email opens and clicks only to measure how our emails perform.
4. Booking through an AI assistant
You can also book a table through an AI assistant such as ChatGPT, Claude or Perplexity. The assistant passes us the same data as our website form, and we process it as described in section 2. We only create the booking once the assistant confirms that you explicitly agreed to it. We record which assistant the booking came from. What the assistant itself does with your data is governed by its provider's privacy policy.
5. Gift vouchers and e-shop
We sell vouchers through our e-shop at eshop.colette.sk, which runs on Shopify. We process what we need to fulfil and deliver your order: name, email, billing details and order details. The legal basis is the contract and our accounting obligations (Art. 6(1)(b) and (c) GDPR). We never see card numbers; the payment provider handles them.
6. Website and cookies
We use analytics and marketing tools (Google Analytics, Google Tag Manager, Meta Pixel) only with the consent you give in the cookie banner. You can change your choice at any time. See our cookie policy for details.
7. How long we keep your data
- Bookings, waiting list and guest profile, including allergies: 3 years after your last booking or visit. After that we anonymise the data.
- Newsletter: until you unsubscribe. We keep the record of your consent or its withdrawal as long as we need to prove it.
- Accounting records (such as voucher sales): 10 years, as required by Slovak Accounting Act No. 431/2002.
- Cookies: as set out in the cookie policy.
8. Who receives your data
We do not sell your data. Only staff who need it can access it, along with these processors:
- Vercel Inc. (USA): runs the booking system, servers in Frankfurt
- Supabase Inc. (USA): booking database, servers in the EU
- Resend (USA): booking emails and newsletter delivery
- Anthropic PBC (USA): translating and summarising internal staff notes
- Shopify International Ltd. (Ireland): voucher e-shop
- Google Ireland Ltd. and Meta Platforms Ireland Ltd.: analytics and advertising, only with your consent
- the web host of colette.sk, and accounting and IT service providers
We also disclose data to public authorities where the law requires it.
9. Transfers outside the EU
Some processors are based in the USA. These transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.
10. Your rights
You have the right to access, correct, erase, restrict and port your data. You can object to processing based on legitimate interest, including the guest profile, and withdraw consent at any time. Withdrawal does not affect processing before it. We do not use automated decisions that have legal effects on you.
Write to info@colette.sk or send a letter to the controller's address. We reply without undue delay and within one month at the latest. You can change or cancel a booking at any time through the link in your confirmation email.
If you believe we handle your data unlawfully, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.
11. Security
Traffic to our website and booking system is encrypted (HTTPS). Only authorised staff with personal logins can access the admin.
12. Changes
We update this policy whenever our processing changes. The current version is always on this page.
Last updated: 24 September 2026 · Slovenská verzia