Privacy Policy

OKASHI Group sp. z o.o. (“OKASHI”, “we”, “us”) is the controller of personal data processed via https://www.okashigroup.com, unless this Policy states that another party is controller (for example a payment network at the physical till, or a social network if you contact us there).

• Address: ul. Świętokrzyska 37C, 50-327 Wrocław, Poland
• KRS 0001051429 · NIP PL8961628235 · REGON 526057205
• Privacy contact: support@okashigroup.com
• Supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland. You may also complain to the authority in your country of residence.

This Policy explains how we process personal data when you browse the Site, create a customer account, save favourites, contact us by email, phone, or WhatsApp, submit the complaints form, apply for a job via the Jobs form, or use cookies and similar technologies. The Cookie Policy gives the cookie-level detail. The Terms of Service govern use of the Site. This Policy does not cover independent apps or sites we only link to (Instagram, Facebook, TikTok, Google Maps).

• Account & identity: email, hashed password (via our auth provider), first name, optional surname, country, optional gender, and account role.
• Favourites: product IDs you save to your list.
• Technical & usage: IP address, approximate location derived from IP (city/region/country), device and browser type, pages viewed, referrer, a random session identifier, and language/theme preferences.
• Communications: emails, WhatsApp or social messages, the complaints form (name, surname, email, phone, subject, description, and up to five photos — typically a receipt and the product), and job applications (name, contact details, optional note, and a CV file).
• Store visit: we do not run website checkout. In-store receipts and CCTV, if used in the supermarket, follow separate in-store notices where required.

• Directly from you (registration, profile, messages, the complaints form, job applications and CV uploads).
• Automatically from your device when you use the Site (logs, security, essential storage; analytics only after consent).
• From infrastructure providers that help us run the Site (hosting, database, email).

We process personal data only when a lawful basis applies:

• Contract (Art. 6(1)(b)): create and secure your account; save favourites; send transactional messages such as password reset.
• Legitimate interests (Art. 6(1)(f)): keep the Site secure, prevent abuse, answer enquiries and complaints, review job applications, defend legal claims, and understand coarse, non-intrusive reliability issues. You may object where Art. 21 applies.
• Consent (Art. 6(1)(a)): non-essential cookies and similar technologies (analytics; marketing if we ever enable it); optional marketing emails if we offer them and you opt in. Withdraw anytime via Cookie Settings or support@okashigroup.com.
• Legal obligation (Art. 6(1)(c)): accounting, tax, employment, consumer-complaint, and food-safety records where the law requires us to keep them; responding to lawful authority requests.

We do not sell personal data. We do not use solely automated decision-making that produces legal or similarly significant effects about you (Art. 22).

We do not ask for special-category data (Art. 9) as a rule. Optional gender on the profile is a simple demographic field; you may leave it blank. Please do not send health details unless they are necessary for an allergen or complaint follow-up.

The Site is not directed at children under 16. We do not knowingly create accounts for children below that age. Contact support@okashigroup.com if you believe we have; we will delete the data promptly.

We share data only as needed to run the Site and the store:

• Supabase: authentication, database, and related storage for accounts and favourites.
• Hosting / infrastructure (currently a server in the EU operated for this Site, and related edge or backup providers as configured): application hosting and delivery.
• Email / mailbox hosting: to receive and answer support@, sales@, jobs@, and similar addresses.
• Geo-IP helper (ip-api.com): approximate city/country from IP, used only when analytics is enabled.
• Maps: if you open “open in Maps”, Google or another map provider processes that request under their terms.
• Social networks: if you write to us on Instagram, Facebook, TikTok, or WhatsApp, those platforms are separate controllers for their apps.
• Professional advisers and authorities where required by law or to establish, exercise, or defend legal claims.

Some providers may process data outside the EEA/UK. Where we transfer personal data to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs), plus supplementary measures where needed. Details are available on request at support@okashigroup.com.

• Account & favourites: for the life of the account. After deletion we delete or irreversibly anonymise personal data within 30 days, except backups (rotated within up to 90 days) and data we must keep longer by law.
• Analytics sessions (only with consent): usually up to 12 months.
• Support emails and complaint files (including uploaded photos): usually up to 24 months after closure, longer if a legal claim is reasonably anticipated.
• Job applications and CVs sent via the Jobs form or to jobs@: usually up to 12 months after the recruitment closes, unless you join us (then employment records apply) or we must keep them longer by law.
• In-store accounting documents: statutory periods under Polish tax and accounting law (typically up to 5 years, or as then in force).
• Cookie consent: stored in your browser until you clear it or reset preferences; we may also keep a simple consent cookie so the Site can respect your choice.

Subject to legal limits, you have the right to access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, withdrawal of consent without affecting prior lawful processing, and to lodge a complaint with a supervisory authority.

• In-product: update your profile; delete your account; manage cookies via “Cookie Settings” in the footer.
• By email: support@okashigroup.com — we respond within one month (extendable by two further months for complex requests, with notice).
• We may need to verify your identity before fulfilling requests.

We apply appropriate technical and organisational measures (encryption in transit, access controls, hashed passwords via our auth provider). No method of transmission or storage is 100% secure; please use a strong unique password.

We use essential cookies and local storage for authentication, security, language, theme, and storing your consent choice. Analytics (visit measurement and an approximate map pin for our internal dashboard) runs only after you agree. See the Cookie Policy for the full breakdown.

We may update this Policy when our processing or the law changes. We will revise the “Last updated” date and, for material changes, provide additional notice where appropriate.

Data protection enquiries: support@okashigroup.com. Controller: OKASHI Group sp. z o.o., ul. Świętokrzyska 37C, 50-327 Wrocław, Poland.