1. Controller and contact
The controller of data collected through the CouCou website and NINJA Concierge is NINJA GROUP, Warsaw, Poland, acting as the operator of CouCou. Privacy requests can be submitted through the Concierge contact available on this website.
Where a connected provider independently decides how it processes data, that provider is a separate controller under its own privacy policy.
2. Data we process
We may process contact details, social-media username, message and comment content, reservation and visit details, order value and history, dietary or accessibility information you choose to provide, collaboration records, and customer-service notes.
Our websites can also record device and browser information, IP address, first-party visitor and session identifiers, consent status, page activity, menu or booking clicks, UTM parameters and advertising identifiers such as fbclid, fbp and fbc.
3. Purposes and legal bases
We use data to answer enquiries, provide the concierge, manage reservations, orders and events, maintain guest and collaboration records, secure the service, resolve complaints, measure service quality and meet accounting or other legal duties. Depending on the activity, the basis is performance of a contract or pre-contract request, a legal obligation, or our legitimate interest in operating and improving our services.
Optional analytics, advertising measurement and marketing cookies are used only after consent where consent is required. Consent can be withdrawn at any time without affecting earlier lawful processing.
4. Sources and recipients
Data comes directly from you and, where connected, from ChoiceQR, Meta or Instagram, Google services and other communication channels. We may use vetted hosting, analytics, CRM, messaging and AI providers as processors, and disclose data to professional advisers or authorities when legally required.
We share only the data required for a given purpose. We do not sell personal data.
5. International transfers
Some technology providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, Standard Contractual Clauses or another lawful safeguard, with supplementary measures where appropriate.
6. AI concierge and human handoff
The concierge may use an AI model to draft or deliver routine answers using the conversation and approved venue knowledge. Conversations are stored in the communications workspace. A team member can take over, and the system is designed to route a conversation to the team when the agent is unavailable, lacks sufficient context or cannot safely answer.
We do not use the concierge to make decisions producing legal or similarly significant effects solely by automated means.
7. Retention
Communication and CRM records are normally kept for up to 24 months after the last meaningful contact, security logs for up to 12 months, and consent records for as long as needed to demonstrate the choice. Reservation, transaction and accounting records are retained for the statutory period or until related claims expire. Data is then deleted or anonymised unless a longer period is legally required.
8. Your rights
Subject to applicable conditions, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests or direct marketing. You may withdraw consent at any time and lodge a complaint with the President of the Personal Data Protection Office (UODO).
10. Changes to this policy
We may update this policy when services, providers or legal requirements change. The current version and effective date are published on this page.