1. Introduction
1.1. This Privacy Policy describes how SM-NEXA spółka z ograniczoną odpowiedzialnością (SM-NEXA sp. z o.o.) with its registered office in Warsaw, Poland, at ul. Kolejowa 9 lok. 121, 01-217 Warsaw, entered in the register of entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0001245922, NIP (tax ID) 5273221990, REGON 544940265, share capital of PLN 5,000 ("TableMind", "we") processes personal data in connection with the website table-mind.com, the TableMind platform and dashboards for restaurants, guest-facing menu and ordering pages, and our communications. Data-protection contact: privacy@table-mind.com.
1.2. We process personal data in accordance with Regulation (EU) 2016/679 ("GDPR") and Polish data-protection law.
2. Our two roles – controller and processor
TableMind as controller. We decide on the purposes and means of processing for: visitors of table-mind.com; persons who contact us or subscribe to our newsletter; representatives and users of restaurant accounts (registration, billing, support, security); and related technical logs. Sections 3–9 describe this processing.
TableMind as processor. When a guest views a menu, places an order, makes a reservation, leaves a review or participates in a loyalty programme of a specific restaurant, the controller of that data is the restaurant, and we process it on the restaurant’s behalf under a Data Processing Agreement. Section 10 contains key information for guests.
Stripe. Payments are processed by Stripe Payments Europe, Ltd. / Stripe Technology Europe, Ltd., which acts as an independent controller of certain payment data (including for its own legal obligations such as anti-money-laundering checks). Details: stripe.com/privacy.
3. Data we collect as controller
Account and contact data: name, business email address, telephone number, restaurant/company name and address, tax identification number, account settings and roles.
Billing data: subscription plan, invoicing details and payment status (full payment-card data is collected directly by Stripe and is not stored by us).
Usage and technical data: log data, IP address, device and browser information, identifiers, activity within the dashboard, diagnostic and security events.
Communications: correspondence with support and sales, newsletter subscription data, preferences and consents.
Cookies and similar technologies: as described in the Cookie Policy at table-mind.com/legal/cookies.
4. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and maintaining merchant accounts; providing the platform and support | Account, usage, communications | Art. 6(1)(b) – performance of a contract |
| Billing, invoicing, accounting and tax compliance | Account, billing | Art. 6(1)(c) – legal obligation |
| Security, fraud prevention, diagnostics, backups | Usage and technical data | Art. 6(1)(f) – legitimate interest (security of services) |
| Product analytics and improvement of the platform | Usage data, aggregated statistics | Art. 6(1)(f) – legitimate interest |
| Direct marketing to business customers; newsletter | Contact data, preferences | Art. 6(1)(f) – legitimate interest, or Art. 6(1)(a) – consent; electronic communications additionally require consent under the Polish Electronic Communications Law |
| Handling enquiries, complaints, and establishing or defending legal claims | Communications, account, billing | Art. 6(1)(b) and 6(1)(f) – legitimate interest |
| Non-essential cookies (analytics, marketing) | Cookie data | Art. 6(1)(a) – consent, given via the cookie banner |
Providing account and billing data is necessary to conclude and perform the contract; providing marketing consents is always voluntary.
5. Recipients of data
5.1. We share personal data with service providers acting on our behalf (hosting, email and SMS delivery, analytics, error monitoring, customer-support tooling), with Stripe for payment processing and merchant onboarding, with professional advisers (legal, accounting), and with public authorities where required by law. Where the merchant activates integrations (e.g. delivery marketplaces, POS systems), data is shared with those providers at the merchant’s direction. The current list of our sub-processors relevant to guest data is published at table-mind.com/legal.
6. International transfers
6.1. We primarily store data within the European Economic Area. Where a provider processes data outside the EEA (for example Stripe entities in the USA), we rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified recipients) or on Standard Contractual Clauses, with supplementary measures where required. A copy of the relevant safeguards can be requested at privacy@table-mind.com.
7. Retention
Account and contract data: for the term of the contract and thereafter until expiry of limitation periods for claims and of tax-record retention obligations (as a rule up to 5 full calendar years for accounting documents).
Technical logs and security data: as a rule up to 12 months, unless needed longer for a specific incident.
Marketing data and newsletter: until you object or withdraw consent.
Support correspondence: up to 3 years after the case is closed.
8. Your rights
8.1. You have the right to access your data and obtain a copy, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interests – including, at any time, to object to direct marketing. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
8.2. To exercise your rights, write to privacy@table-mind.com. We may need to verify your identity. We respond without undue delay, at the latest within one month (extendable by two further months for complex requests, with prior information).
8.3. You may lodge a complaint with a supervisory authority, in Poland: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority of your habitual residence.
9. Automated decision-making
9.1. We do not make decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you. Analytics and AI-supported insights offered within the platform operate on the merchant’s business data and aggregated statistics and do not involve such decisions about individuals.
10. Information for Guests
10.1. If you use a restaurant’s menu, ordering, reservation, review or loyalty features powered by TableMind, the controller of your personal data is that restaurant; its identity and contact details are shown on the menu page. We process your data on the restaurant’s behalf and on its documented instructions, as its processor, in order to display the menu, transmit and handle your order or reservation, support payments, and operate loyalty, review and marketing features activated by the restaurant.
10.2. Requests concerning this data (access, erasure, objection, etc.) are best addressed directly to the restaurant. If you address them to us at privacy@table-mind.com, we will forward them to the restaurant without undue delay. Independently of the above, we act as controller of limited technical data (such as security logs) needed to keep the service safe and functional – Sections 3–9 apply accordingly.
10.3. Payment-card data is collected directly by Stripe; we do not store full card numbers.
11. Security
11.1. We apply appropriate technical and organisational measures, including encryption of data in transit, access controls, logging, backups and personnel confidentiality obligations, reviewed and adjusted to risk on an ongoing basis.
12. Children
12.1. Our website and merchant dashboards are directed at businesses and adults. Guest menu pages may be viewed without providing personal data; placing an order requires the capacity to conclude a contract under applicable law.
13. Changes and contact
13.1. We may update this Privacy Policy, for example when we launch new features. The current version, with its effective date, is always available at table-mind.com/legal/privacy. Material changes will be additionally announced on the website or by email.
13.2. Contact on privacy matters: privacy@table-mind.com, or by post to SM-NEXA sp. z o.o., ul. Kolejowa 9 lok. 121, 01-217 Warsaw, Poland.