Privacy notice

Short and without the legal fog: what this website stores about you, what it is for and how long it stays there.

Who runs it

Galimar s. r. o.
Štúrova 1, 040 01 Košice
Company ID: 56096470 · Tax ID: 2122204865 · VAT ID: SK2122204865

Company registration (Slovak Commercial Register):
Zapísaná v Obchodnom registri Mestského súdu Košice, oddiel Sro, vložka č. 59023/V

Phone: 0944 423 033 · E-mail: galimar@galimar.sk

The registered office and the premises are at the same address — OD Dargov stands on Štúrova 1.

We do not store your IP address

Nowhere. Not even shortened. When we need to limit how many times a form is sent from one place per day — or how many failed attempts to log into the administration there are — we store a fingerprint of the IP, not the address itself.

The fingerprint is a one-way hash with a secret random salt known only to a configuration file on the server. Without that salt the fingerprint cannot be turned back into an address, not even by trying every possibility — and that is exactly why it is not personal data. (A hash without a secret salt would be: there are "only" four and a half billion IPv4 addresses and working through all of them is a matter of minutes.)

Measuring traffic

We measure it ourselves, without Google Analytics and without any outside service. On every page view we store:

• the time and the address of the page (without anything after the question mark),
• where you came from — the domain only of the referring page, not the full address; if you came from our own site, nothing is stored,
• the utm_source, utm_medium and utm_campaign tags from the link, if there are any,
• which dish you opened,
• the random visit number from a cookie (see below),
• the browser identification (user-agent) — we use it to tell people from robots.

None of that identifies you. There is no name, no e-mail and no IP address in it.

Cookies

The site sets two cookies and neither of them is for advertising:

• galimar_sk_sid — a random number, 30 days. It keeps five page views by one person from counting as five visits.
• galimar_sk_vid — a random number, 1 year. We use it to count the daily limit of form submissions so that nobody can flood it.

Besides cookies, the Order page also uses localStorage under the key galimar_objednavka_v1. It is the same kind of thing as a cookie with one difference in your favour: localStorage is never sent to the server, not even when the page loads. It holds the contents of an order in progress and stays in your browser until you clear it.

Both cookies are HttpOnly (JavaScript cannot reach them) and SameSite=Lax (they do not travel to other sites).

A third cookie, galimar_sk_admin, is a session cookie. It is created on pages that carry a form — the food finder and the catalogue, where the „what are we missing" box is — because it holds the token that protects the form against misuse from another site, and it is also used when someone logs into the administration. It lasts only until you close the browser, contains nothing about you, and does not mean you are logged in.

Ordering by SMS

The contents of your order never reach our server. It is put together in your browser, saved only there (so you do not lose it when the page reloads) and sent straight from your phone as an SMS to our number. We receive it the same way as any other message — on a phone, not on the website.

So we store neither the items, nor the note, nor the name you write into the order. We have nowhere to put them.

The only thing we measure about orders is the count: how many times someone put an order together and how many times they sent it. Those are two numbers without content — no items, no names, no notes and no prices. They serve one purpose: to see whether ordering breaks for people halfway through.

You clear the order from your browser by removing every item from it, or by clearing the site data in your browser settings.

What you type into the search

We store four things: the text you type into the advisor, how many dishes we found for it, the language of the page (Slovak, English or Ukrainian) and the date — the day, not the exact time. It serves one purpose: to see what people look for and do not find.

No IP address, cookie, session identifier or anything else that could tie the text to a particular person is stored with it. That is also why we do not store the exact time: a second together with the text is exactly what would set one visitor apart from the rest.

The same goes for the "what are we missing" form — only the text itself and the number of times someone wrote it are stored.

So we ask you: please do not type personal data into these fields. We do not need it and we cannot reliably strip it out of the text.

How long we keep it

• traffic measurement — 14 months
• text from the search and from the form — 24 months
• daily form limits — 30 days
• failed attempts to log into the administration — 30 days

This is not just a promise. Older records are deleted by an automated job that runs every day — nobody has to remember to do it. When the job fails, it reports an error rather than staying quiet.

The map on the Contact and About pages

Those two pages carry a map showing where we are. It does not load by itself. Until you click it, there is only a picture with the address and our page talks to no outside service — no Google, no third-party cookies.

When you click Show map, a map by Google is embedded. From that moment Google sees your IP address, information about your browser and the fact that you opened this page, and it may set its own cookies. It does so as a separate controller under its own rules; we have no say in it and it is not governed by this page.

The decision is therefore yours and it holds for that one visit only — the next time you open the page, the map again does not load by itself. If you would rather not see it, click the address directly: navigation opens without anything from Google loading on our page.

Who we pass it to

Nobody. We do not send data from the website to third parties, we do not sell it and we do not use it for advertising.

The site runs on a server of the hosting provider Websupport, s. r. o., which accesses the data as a processor under a contract.

Delivery platforms are a different matter. When you order through Wolt, Bolt Food or Bistro.sk, their system handles the order and they process your data as separate controllers under their own rules. We have no say in it and it is not governed by this page.

Your rights

You have the right to know what we process about you, to ask for correction or deletion, to object to the processing and to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic.

In practice: since we store nothing that would let us identify you, we usually cannot tell you "this is your data" — we have no way of finding it. If you think you have sent us some personal data, write to galimar@galimar.sk and we will delete it.

This document is effective from: 1 September 2026