Privacy and your data
This is what happens to your data: what we need to bring you the boxes, what we keep, for how long and who gets to see it. No legalese, just how it actually works.
In force since 23 August 2026.
Who processes your data
The controller is TASTY BOX s.r.o., Olomoucká 255/2, 618 00 Brno, Czech Republic, Company ID 08149631, VAT CZ08149631, registered in the Commercial Register.
For anything about personal data: info@tastybox.cz, phone +420 703 341 314. We have not appointed a data protection officer, because the law does not require us to.
What we collect and why
| When | What we collect | Why (legal basis) | How long |
|---|---|---|---|
| Ordering meal boxes | Name, e-mail, phone, delivery address, note, the name of whoever referred you, the contents and price of the order | Performance of a contract (delivering food) and a legal obligation (accounting) | For the duration of the contract; tax documents 10 years under the VAT Act |
| Unfinished order (abandoned cart) | E-mail, name, cart contents | Legitimate interest: reminding you about an unfinished order | 7 days, then deleted; immediately once the order is completed |
| Discount for an e-mail (exit window) | Consent to receiving the discount code and news | Until you withdraw consent | |
| Catering or office lunch enquiry | Name, company, contact, description of the event | Steps taken at your request before entering into a contract | 1 year from the last communication |
| Contact form, phone, e-mail | Name, contact, content of the message | Legitimate interest: answering you | 1 year from the last communication |
| Chat with the assistant | The text of your message; a contact only if you ask us to get back to you | Legitimate interest: customer support and improving the answers | Transcript kept 14 days |
| E-mails during the programme | E-mail, name, day of the programme, number of points | Performance of a contract (order information) and legitimate interest (offering to continue) | For the duration of the order and 3 months after |
| Visiting the site with measurement consent | Cookies and identifiers of Google Analytics and the Meta Pixel, the source of the visit | Consent | As set by the service, at most 14 months |
We don't use the data for automated decision-making or profiling that would have legal effects for you.
Who gets to see the data
We don't sell data to anyone. These processors help us, each only with what they need for their work:
- Vercel Inc. (USA) — running the site and the server where orders are created
- Upstash — the database of orders, contacts and unfinished carts
- Resend — sending e-mails (confirmations, menus, news)
- Stripe — card payments; card details are handled by Stripe directly and we never see them
- Anthropic — the model that answers in the chat; don't send passwords or card numbers to the chat
- Google (Analytics) and Meta (Pixel) — only with your consent
Some processors are based outside the European Union; those transfers rely on the standard contractual clauses approved by the European Commission or on an adequacy decision. We also pass data to our accountants and, to the extent required by law, to public authorities.
Cookies and measurement
Necessary cookies (the cart, signing in to your account, your saved consent) are used without consent, because the site wouldn't work without them. Analytics and marketing tools do not load before you give consent; until then nothing leaves your browser.
You can change or withdraw consent any time through the Cookie settings link in the site footer. Withdrawing it doesn't affect what happened before.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. Consent (for example to receiving news) can be withdrawn any time; for e-mails, just reply or use the unsubscribe link.
Write to info@tastybox.cz and we'll answer within one month. If you feel we handle your data badly, you can complain to the Office for Personal Data Protection, Pplk. Sochora 27, Prague 7, Czech Republic.
Security
Only the people at Tasty Box who need the data have access to it, through a password login. The connection to the site is encrypted. Card details never reach us; the payment gateway handles them.
Anything unclear?
Write or call and we'll explain it in plain words.