Loyalty program · banh-mi-ba

Privacy
Policy

Last updated: 28 June 2026

The controller and operator of personal data is banh-mi-ba s.r.o., Company ID 04767683, with its registered office at Dlouhá 715/38, 110 00 Prague, registered in the Commercial Register kept by [add court and file number] (the “we” or “controller”).

You can contact us by e-mail at vzkazpro@banhmiba.com or by phone at [add phone].

In operating our stores, selling products, maintaining customer accounts and running the Crunchy Club loyalty program, we process certain personal data. The processing is governed in particular by Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”).


I.What data we process and why

Below you’ll find the individual situations in which we work with your data.

A. Enquiries and communication with us

When you contact us (by e-mail, via the form or on social media), we work with the data you provide — typically your name, e-mail, phone and the content of your message.

Purpose
Handling your enquiry and further arrangements.
Legal basis
Our legitimate interest, or pre-contractual steps (Art. 6(1)(f) and (b) GDPR).
Retention period
No longer than 2 years from our last communication.

B. Purchasing products

When you make a purchase, we process the data needed to complete it — in particular your name, e-mail, phone, and where applicable billing and delivery details and details of the order itself.

Purpose
Processing the order, communicating about its status and complaints, meeting statutory (accounting and tax) obligations.
Legal basis
Performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR).
Retention period
For the duration of performance and then 10 years due to tax and accounting regulations.

C. Newsletters and commercial messages

If you subscribe to our newsletter or have shopped with us and have not opted out, we may send you our offers and news by e-mail (or phone).

Purpose
Sending news and offers from Crunchy Club and banh-mi-ba.
Legal basis
Your consent; for existing customers, legitimate interest under Act No. 480/2004 Coll. Consent can be withdrawn at any time.
Retention period
2 years from giving consent or your last purchase. You can unsubscribe at any time.

D. Purchase analytics

We also use purchase data (what and when you bought, under what conditions) for analytics — to know what to offer, where to improve and how to make our products better.

Purpose
Managing and developing our business, optimizing our offer.
Legal basis
Our legitimate interest (Art. 6(1)(f) GDPR). You can object.
Retention period
2 years, after which we anonymize the data for this purpose.

E. Cookies and ad targeting

If you give us consent (e.g. in the cookie bar), we use some data for analytics and ad targeting, including through third-party tools.

Legal basis
Your consent (Art. 6(1)(a) GDPR). Consent is voluntary and can be withdrawn at any time.
Retention period
As per the consent given, up to 1 year unless you renew it.

F. Sending a CV

If you respond to a job offer and send us a CV, we process the data it contains for the purposes of the recruitment process.

Legal basis
Steps towards cooperation (Art. 6(1)(b) GDPR).
Retention period
Until the end of the recruitment process, longer only with your consent.

II.Who can access your data

Your data stays with us. However, some partners (processors) help us and access the data to the extent necessary for their service:
  • the Crunchy Club loyalty platform provider — KiloMayo (banhmiba.kilomayo.app), [add exact name and Company ID of the operator];
  • payment and point-of-sale service providers [add];
  • delivery providers [add, e.g. Wolt, Bolt Food];
  • e-mailing service provider [add];
  • IT, hosting and marketing tool providers [add].

III.Customer account

If you create an account with us, we process the data from registration. Name and e-mail are mandatory — without them the account cannot be maintained. You may voluntarily add your date of birth, gender, address, phone or dietary preferences; we use these for faster orders, better-targeted offers and possibly gifts (typically on your birthday).

Within the account we also keep data about your orders, the services you have used and the number of credits collected.

Legal basis
Your consent, or performance of the account contract (Art. 6(1)(a) and (b) GDPR).
Retention period
For as long as the account is used. We deactivate the account and delete the data 5 years after the last purchase, or at any time upon your request.

IV.Crunchy Club loyalty program

After registering for Crunchy Club, we process the data you provide — in particular first name, surname, e-mail, and optionally phone and date of birth — as well as data about your purchases and collected credits. You can find details about the program in the Crunchy Club Terms.

Purpose
Running the program — awarding credits, providing rewards and offers, membership communication.
Legal basis
Performance of a contract (the program terms) and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR).
Retention period
For the duration of membership and then 10 years from the last product or service provided.

V.Your rights

In relation to your personal data you have in particular the right of access, to rectification or erasure, to restriction of processing, to portability, and the right to object to processing based on legitimate interest. You can withdraw any consent given at any time. For any question, contact us at vzkazpro@banhmiba.com.

We do not carry out profiling or automated decision-making and we have not appointed a data protection officer. We process data within the EU, or in tools whose providers guarantee an adequate level of protection.

If you believe we do not handle your data properly, you have the right to lodge a complaint with the Czech Data Protection Authority (Pplk. Sochora 27, 170 00 Prague 7), or to turn to a court.