Privacy Policy

Version 2.0 · effective 1 September 2026 · KebApp s.r.o.

Courtesy translation. The Slovak version (zasady-ochrany-osobnych-udajov-2.0.md) is the binding one. Marketing communications are governed by a separate document, Marketing Communications Policy.

This policy explains how KebApp s.r.o. processes the personal data of people who use any of its services: the BellyButton Shop online store, the Belly Button loyalty mobile app, the bellybutton.sk website (reservations and events) and table ordering in the café.

We have written it so that you can find your way around it without a legal dictionary: for each activity we state which data we process, why we need it, on what legal basis and for how long we keep it. It is based on Regulation (EU) 2016/679 (GDPR) and on Act No. 18/2018 Coll. on the protection of personal data.

Why one document for everything. Our services share a single user account — the same account works in the online store, in the app and on the website. The controller is one company, so data does not move between "firms" but between parts of the same service. Separate documents per app could not honestly describe what happens to your account as a whole.

---

1. Who the controller is and how to contact us

The controller of your personal data is KebApp s.r.o., with its registered office at Timonova 13, 040 01 Košice – Staré Mesto, Slovakia, Company ID (IČO) 54 866 596, Tax ID (DIČ) 2121806621, VAT ID (IČ DPH) SK2121806621, registered in the Commercial Register of the Municipal Court Košice, Section Sro, Insert No. 54966/V.

Under the trade names Belly Button and BellyButton Shop it operates a café, an online store, a loyalty app and the bellybutton.sk website. All of these are operated by the same company — the controller is always KebApp s.r.o., whichever one you are using.

For anything concerning your personal data, write to kontakt@bellybutton.sk or by post to KebApp s.r.o., Timonova 13, 040 01 Košice, Slovakia. We have not appointed a data protection officer, because the scope and nature of our processing does not trigger that obligation; we handle your requests directly at the contact details above.

2. One account across all our services

This is the most important part of this policy, which is why it comes first.

If you create an account with us, it is one account for all our services. The same e-mail and password (or signing in with Google or Apple) get you into the online store, the loyalty app and the website. We do not create separate accounts for you and we do not keep separate profiles.

In practice:

• Account data is shared. You have one name, e-mail, password and set of preferences, wherever you sign in. Change your name in the app and it changes in the online store too.
• History belongs to the account, not to an app. Online-store orders, loyalty points from scanned receipts and table orders you placed while signed in all belong to one account and you see them together.
• Purchases may count towards the loyalty programme. If you are enrolled, your purchases may affect your loyalty benefits — which is exactly what you expect from a loyalty programme, and we do it on the basis of your enrolment in it (article 7).
• This is not disclosure to anyone else. Since one company operates all the services, moving data between them is neither a disclosure to a third party nor a transfer. The list of actual external recipients is in article 16.

You can shop and order without an account. You can buy in the online store as a guest, order at a table without signing in, and make a reservation or sign up for an event without registering. An account is not a condition of any of these services.

When your account is first used in a new service, we will tell you before the new processing starts — for example when you first sign in to the loyalty app with an online-store account.

Overview by service

• Online store — Accepting and fulfilling orders, invoicing, complaints. Legal basis: Contract, legal obligation. (Details: art. 4–6, 11)
• Customer account — Running the account across services. Legal basis: Contract. (Details: art. 6)
• Loyalty app — Verifying receipts, loyalty points and rewards. Legal basis: Contract (programme enrolment). (Details: art. 7)
• Table ordering — Accepting the order, paying the bill. Legal basis: Contract. (Details: art. 8)
• Table reservations — Reserving a table. Legal basis: Contract. (Details: art. 9)
• Events — Sign-ups, capacity, photo gallery. Legal basis: Contract, consent (photos). (Details: art. 10)
• Product reviews — Publishing verified reviews. Legal basis: Legitimate interest. (Details: art. 12)
• Marketing communications — News and offers. Legal basis: Consent. (Details: art. 14)
• Traffic measurement — Improving the store. Legal basis: Consent (cookie bar). (Details: art. 15)

3. Where the data comes from and what we require

We primarily process data you give us yourself when ordering, registering, reserving, complaining or writing to us, plus data that arises from ordinary use of our services — the contents of your basket, a scanned receipt, or a record of the consent you gave.

We do not buy data about you from external databases. We obtain it from third parties in two cases:

• If you choose to sign in with a Google or Apple account, those companies pass us your name and e-mail address on the basis of your choice, and we use them to create or sign you in.
• When you scan a receipt in the app, we verify it against the public interface of the Financial Administration of the Slovak Republic and receive details of the document from there (article 7).

Data marked as mandatory in a form is data we need to conclude and perform the contract — without it an order, reservation or sign-up cannot be handled. Everything else (order note, company details, photographs attached to a complaint) is voluntary.

4. Orders in the online store

To accept and fulfil an order we process your first name and surname, e-mail address, telephone number, billing address and any different delivery address, the list of goods ordered and their prices, the chosen delivery and payment method and any order note. If you are buying on behalf of a company, we also process the Company ID, Tax ID and VAT ID. For delivery by carrier we also process the Packeta pick-up point you selected.

For every order we store the date and time the terms and conditions were accepted and the identifier of the accepted version, so that we can evidence the content of the contract concluded.

Legal basis: performance of a contract under Article 6(1)(b) GDPR. E-mails about the status of an order (confirmation, dispatch, ready for collection) form part of performing the contract and are not marketing.

Retention: while the order is being fulfilled and, afterwards, for the period during which rights under the contract may be exercised — the two-year liability-for-defects period and the limitation periods following it. Accounting documents for longer, per article 5.

We have no access whatsoever to your payment card details. Card payments are processed exclusively by the payment gateway provider Stripe on its own secure page. If the billing form contains bank-details fields (IBAN, BIC), that data is not transmitted to us and we do not process it.

5. Invoices and accounting documents

An electronic invoice is issued for every paid order, containing the billing details given in the order including any Company ID, Tax ID and VAT ID. The invoice is issued and delivered to your e-mail by Stripe, acting on our instructions and on our behalf.

Legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR (Act No. 431/2002 Coll. on accounting, Act No. 222/2004 Coll. on VAT).

Retention: ten years following the year to which the document relates. We cannot shorten this, even at your request.

6. Customer account

If you create an account, we process your e-mail address, name, password in secured form, saved addresses, wishlist and order history. The password is stored solely as a cryptographic hash, so not even we know it or can display it.

You can also create an account by signing in with Google or Apple, or use them to sign in to an existing account. Those companies then pass us your name and e-mail address on the basis of your choice; the sign-in verification itself is carried out by them as separate controllers under their own privacy policies.

Legal basis: performance of a contract under Article 6(1)(b) GDPR — running the account is a service you ordered by creating it. Creating an account never amounts to subscribing to our newsletter; marketing is governed exclusively by article 14.

Retention: until you close the account. You can ask for that at any time at kontakt@bellybutton.sk or in the app. Closing the account does not affect data we must retain for orders already placed under articles 4 and 5.

7. The loyalty app and the loyalty programme

Scanning receipts

In the app you can scan the QR code on a café receipt and credit yourself loyalty benefits. We want to be very precise here, because people often picture this differently:

• We do not photograph or store images of receipts. The camera is used solely to read the QR code. No photo or video is saved, transmitted or shared. We use no text recognition (OCR).
• Only the document identifier from the QR code is sent.
• We verify that identifier against the public interface of the Financial Administration of the Slovak Republic (eKasa). From there we receive details of the document: its number, the date and time of issue, the amount, the identification of the cash register and premises, and verification codes (OKP, PKP). We store this so that the benefit can be credited and the same receipt cannot be used twice.

Legal basis: performance of a contract under Article 6(1)(b) GDPR — by joining the loyalty programme you ordered this service, and it cannot be provided without verifying the receipt.

Camera access is requested only when you want to scan, and you can withdraw the permission at any time in your device settings.

Loyalty benefits

We keep your loyalty points, level, character, rewards earned and the history of how they were credited. Enrolment is voluntary and you can leave the programme at any time by closing your account.

What the app does not do

So that this policy matches reality, here is what the app does not process:

• We do not process location data. The app does not ask for your location and does not even hold the system permission for it.
• We do not send push notifications. The app currently has no means of delivering them. If we introduce them, we will ask for consent and update this policy.

8. Table ordering

When you scan the QR code on a table in the café and order, we process the table number, the contents of the order, its time and status, and any order note you add. The note is free text seen by the kitchen and the staff — please include only what concerns the order (for example allergies).

So that we know which orders are yours, a temporary visit identifier is stored in your browser. It is not tied to your identity and expires after a few hours.

If you are signed in, the order and payment are linked to your account — so you find them in your history and they can count towards loyalty benefits.

Paying the bill by card happens on the secure page of Stripe. Card details never reach us. Stripe asks for your e-mail address in order to send you a payment receipt; that address stays with Stripe. We also process any tip you choose.

Orders and payments are reflected in our point-of-sale system, where the table's bill is kept and the fiscal document issued.

Legal basis: performance of a contract under Article 6(1)(b) GDPR and, for issuing the fiscal document, compliance with a legal obligation under Article 6(1)(c) GDPR.

Retention: the order and payment for the period during which rights arising from them may be exercised, and further as accounting documents per article 5.

9. Table reservations

For a reservation we process your name, e-mail address, telephone number, the date, time, number of people and any note.

Legal basis: performance of a contract under Article 6(1)(b) GDPR — without this data we cannot accept or confirm the reservation.

Retention: for the duration of the reservation and then for at most 12 months, to deal with any questions or disputes.

10. Events and sign-ups

When you sign up for an event we process the data from the sign-up form — always a name and e-mail address, further fields depending on the event. With every sign-up we also store a record of the consents you ticked, with the date and the identifier of the document version.

Legal basis: performance of a contract (participation in the event) under Article 6(1)(b) GDPR.

Photographs from events

We produce photo galleries from some events. We publish them on the website and may also publish them on our Discord server (Discord Inc., United States) — see article 17 on transfers.

If you do not wish to be photographed, please say so to the organiser on the spot; if a published photograph concerns you and you want it removed, write to kontakt@bellybutton.sk and we will remove it without delay.

Retention: sign-ups 12 months after the event; galleries until we take them down or you ask for removal.

11. Complaints, returns and withdrawal from the contract

When handling a complaint or a withdrawal we process your identification and contact details, the number and contents of the order, the description of the defect or the reason for the return, the course and outcome of the handling, and any photographs you voluntarily attach (up to five).

Photographs attached to a complaint are never published. They are held in non-public storage and accessible only to you and the authorised staff handling the request.

Legal basis: compliance with our legal obligations under Article 6(1)(c) GDPR and performance of a contract under Article 6(1)(b) GDPR.

Retention: while being handled and, after closure, for the limitation period.

12. Product reviews

Only verified buyers can post reviews — after an order is completed we send a one-off invitation with a link tied to your order. We process the rating, the comment text and your name, which on publication we display solely in shortened form as a first name and the initial of the surname; if no name is available, the label "Customer" is shown.

Legal basis: our legitimate interest under Article 6(1)(f) GDPR in obtaining and publishing truthful reviews from genuine buyers. Posting is voluntary and you may object to this processing, including the invitations, at any time at kontakt@bellybutton.sk.

Retention: while the goods are in our range; sooner if you ask.

13. Contact form and ordinary correspondence

If you write to us we process your name, e-mail address, telephone number (if given) and the content of the message. We use them solely to reply and resolve the matter.

Legal basis: our legitimate interest under Article 6(1)(f) GDPR in replying to messages addressed to us; if the message concerns a future purchase, it is a step prior to entering into a contract under Article 6(1)(b) GDPR.

Retention: at most 12 months from the last message in the matter; messages about an order, complaint or withdrawal together with the relevant record.

14. Marketing communications

We send marketing messages only with your consent under Article 6(1)(a) GDPR.

The consent is one for the whole ecosystem — you give it once and it covers news about all our services. Withdrawal works the same way: unsubscribing stops marketing messages from all our services at once.

Buying, reserving, signing up for an event or creating an account never in themselves amount to subscribing. The marketing checkbox is never pre-ticked and leaving it unticked has no effect on your order, reservation, sign-up or account.

The details — exactly what we send, how we measure campaigns and how to unsubscribe — are in the separate Marketing Communications Policy.

15. Traffic measurement and cookies

The online store uses two kinds of cookies:

• Strictly necessary ones make the basics work — basket contents, signing in, remembering your cookie-bar choice, and the temporary identifier used for table ordering. They require no consent, because the service does not work without them.
• Analytics cookies are stored only if you allow them in the cookie bar. This is our own measurement running on our own systems — we do not use Google Analytics or any other third-party measurement or advertising tools, and we give nobody data about your behaviour. We record events such as viewing an item, adding it to the basket or moving through checkout.

Sign-in cookies are limited to the bellybutton.sk domain and its subdomains — that is what makes one account work across the services.

Legal basis for analytics is your consent under Article 6(1)(a) GDPR. You can change your choice at any time; if you refuse analytics cookies, the visit identifier is deleted and is not stored with your order. You can also delete cookies in your browser settings at any time.

Retention: event records for at most 13 months, then deleted automatically.

When you choose a pick-up point, Packeta's map is loaded, and when you sign in with Google or Apple, their sign-in service — only at the moment you use that feature, and under those companies' own terms.

16. Recipients and processors

We process your data primarily ourselves. Some activities are carried out by vetted suppliers:

• Stripe Payments Europe, Ltd. / Stripe, Inc. — Card payments, issuing invoices (Separate controller + processor)
• Amazon Web Services — Server infrastructure, storage, hosting (eu-central-1, Frankfurt) (Processor)
• Websupport, s.r.o. (SK) — Delivery of transactional and marketing e-mails (Processor)
• Packeta Slovakia s. r. o. — Delivering the parcel — name, phone, e-mail, pick-up point (carrier delivery only) (Separate controller)
• Financial Administration of the Slovak Republic — Verifying receipt validity when scanning in the app (Public authority)
• Discord Inc. (USA) — Publishing an event photo gallery on our Discord server (Separate controller)
• External accounting firm — Bookkeeping (Processor)
• Google LLC / Apple Inc. — Sign-in verification if you choose it (Separate controller)

We provide data to public authorities only where required by law or a final decision. We do not provide your data to any other recipients, do not sell it and do not exchange it with anyone for marketing purposes.

Staff who work with the data (service, kitchen, store administration) are not recipients — they act under our authority, through a system with role-based access control.

17. Transfers to third countries

We process your data in the European Union. The exceptions are:

• Stripe — data may be transferred to the United States within its group. The transfer is safeguarded by the EU-US Data Privacy Framework, to which Stripe is certified, and by the European Commission's standard contractual clauses. You can verify the certification at www.dataprivacyframework.gov.
• Discord — when an event gallery is published, the photographs are stored on Discord Inc. servers in the United States, on the basis of standard contractual clauses.
• Google / Apple — if you sign in with them, your browser or device communicates with them directly as separate controllers under their own policies; we do not pass them your data.

On request we will provide a copy of the standard contractual clauses, or information on where they are available, at kontakt@bellybutton.sk.

18. How we protect your data

• All communication is encrypted over HTTPS/TLS.
• Passwords are stored solely as a cryptographic hash, never in readable form.
• Complaint photographs are in non-public storage, accessible only through a secured system tied to the specific request and the signed-in user.
• Staff access customer data exclusively through the administration system with role-based access control; data is not exported to private devices.
• We do not process payment card data and it never reaches us.

19. How long we keep data

A summary of the periods stated in the individual articles:

• Orders and contract documentation — 2-year liability period + limitation periods
• Accounting documents and invoices — 10 years following the year concerned
• Customer account — Until you close it
• Loyalty points and verified receipts — Until you close the account
• Reservations — Duration + 12 months
• Event sign-ups — 12 months after the event
• Complaints and withdrawals — Handling + limitation period
• Correspondence — At most 12 months from the last message
• Reviews — While the goods are in our range
• Marketing list — Until you withdraw consent
• Record of consent given and withdrawn — 3 years from withdrawal
• Analytics events — At most 13 months

20. Your rights

In relation to your personal data you have the following rights:

• Access — confirmation of whether we process your data, and a copy of it.
• Rectification — we will correct or complete inaccurate or incomplete data without undue delay.
• Erasure — we will erase data no longer needed and not required by law to be kept (such as accounting documents).
• Restriction of processing — in the cases laid down by law, for example while accuracy is verified.
• Portability — data processed on the basis of a contract or consent will be issued in a structured, commonly used and machine-readable format.
• Objection — to processing based on our legitimate interest.
• Withdrawal of consent — at any time, for example by unsubscribing or changing your cookie-bar choice. Withdrawal does not affect the lawfulness of processing before it.

Rights apply to the whole account at once — you do not have to exercise them separately for the online store, the app and the website.

Submit a request by e-mail to kontakt@bellybutton.sk or in writing to KebApp s.r.o., Timonova 13, 040 01 Košice, Slovakia. We will reply without undue delay and at the latest within one month; for complex or numerous requests we may extend that by a further two months, and will inform you in advance. Handling is free of charge.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk. We would be glad, though, if you came to us first.

21. Children

Our services are not intended for children under 16 and they should not create an account with us. If we discover that an account was created by a child under 16 without the consent of a legal guardian, we will close it and erase the data. If you are a legal guardian and believe this has happened, write to kontakt@bellybutton.sk.

22. Automated decision-making and profiling

We carry out no automated individual decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.

Prices are not personalised — they do not depend on your behaviour on the site, the device used or your purchase history. Loyalty benefits depend on your enrolment in the loyalty programme and on purchases you credited to it yourself; that is the mechanics of a programme you joined voluntarily, not profiling with legal effect.

Segmentation for marketing purposes is governed by the Marketing Communications Policy.

23. Changes to this policy

We may update this policy, in particular when legislation, suppliers or the features of our services change. The current wording, with its version number and effective date, is always published on bellybutton.sk and in the terms section of the online store.

We will give advance notice of material changes — on the site, in the app and by e-mail if you have an account — a reasonable time before they take effect. A change is never conditional on your continued use of the service: the new wording applies only from its effective date.

This policy is issued as version 2.0 and takes effect on 1 September 2026. It replaces the previously separate documents for the online store, the bellybutton.sk website and the mobile app. Previous versions remain available in the archive.

---

This English version is a courtesy translation provided for convenience only. The Slovak version is the legally binding one; in the event of any discrepancy between the English and the Slovak version, the Slovak version prevails.