by the company Bombay Food Production s.r.o.,
ID. No.: 078 83 145, with its registered seat at Konviktská 1055/7, Staré Město, 110 00 Praha 1,
company registered with a commercial register maintained by the Municipal Court in Prague, File No. C 284334 ("Company"),

as the personal data controller, wishes to inform you about the key aspects of personal data processing, which takes place in relation to their business activities. The objective of this information is to provide transparency of the processing within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR"),

which take place within the Company's business activities related to the operation of the portal for ordering the delivery of food and beverages, which is available on this website and in the Bombay Express App ("Application"), which the Company makes available to download and use to and by its customers for free.

The Company also provides delivery services in connection with the purchase of products on the Application.


The Company protects all personal data and handles it in accordance with personal data protection legislation, in particular the GDPR.

Based on nature of each activity (in particular, but not only limited, during telephone contact with customers, upon receipt and processing of the order, upon order delivery, upon registration and login on the Application) the Company usually processes personal data as follows:

  • name and surname;
  • permanent residence;
  • geolocation data (GPS coordinates)
  • phone number;
  • contact address; and
  • e-mail.


The processing of personal data takes place both manually and automatically in electronic information systems, in electronic or paper form, always with high technical, organizational and staffing in accordance with legislative requirements.

The legal ground for processing of the above-mentioned personal data is set out in Article 6, Section 1, letter b) of the GDPR – the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.

In some cases, the Company process personal data also on legal ground set out in Article 6, Section 1, letter c) of the GDPR – processing is necessary for compliance with a legal obligation to which the controller is a subject, in particular legal obligations under the relevant acts on accounting legislation, as well as under other applicable legislation.

In addition to the abovementioned, within the ordinary course of trade the Company processes contact data of its customers for the purpose of informing them about news (newsletter). The objective of the newsletter is to inform the data subject and strengthen their awareness about activities of the Company in order to build and maintain good business relationship with them, which constitutes its legitimate interest within the meaning of Article 6, Section 1, letter f) of the GDPR.

Should the processing not be carried out on the basis of a legal, contractual relationship or a legitimate interest, it is necessary for the data subject to consent to their processing, which constitutes its legitimate interest of the Company within the meaning of Article 6, Section 1, letter a) of the GDPR.

According to GDPR the consent of the data subject means any „freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Except as listed above, the Company does not collect, request or process any personal data.


The personal data of clients of the Company are usually processed for one or more of the below purposes:

  • performance of a contract;
  • protection of legitimate interests of the controller;
  • accounting;
  • fulfilment of legal obligations pursuant to legislation;
  • distributing newsletter;
  • fulfilment of other legal obligations.


In compliance with the principles of the GDPR the personal data are kept in a form which permits identification of customers of the Company, for no longer than is necessary for the purposes for which the personal data are processed and in compliance with time limitations set out in applicable law and contracts of the Company. Once the respective purpose has been fulfilled, the personal data processing is terminated, nevertheless, archival documents shall continue to be stored for archiving purposes pursuant to applicable law. Some data may also be retained if necessary, to protect the legitimate interests of the Company, in particular, for the purposes of claiming or enforcing its legal claims.


During processing of the personal data, the Company provides them to its employees and to the following third parties:

  • courier (order delivery), in case the delivery is outsourced by the Company;
  • authorized entities and business partners of the Company;

Customers do not need to issue a consent to share personal information with personal data processors. Entities who are the processors of personal data are contractually bound to properly protect such data. A written agreement on the processing of personal data is concluded with any entity that may act as a processor of personal data for the Company, and the processor is only entitled to dispose of the personal data to the extent necessary to fulfil its task, for the purpose of fulfilling his task and for the agreed period.


The personal data processed by the Company is stored within the European Economic Area. Outside the European Economic Area, there are entities performing the maintenance of the Application's network. Such entities do not have access to the processed personal data, and if this were to happen, the Company always ensures an adequate level of protection of the personal data in the jurisdictions where their processing takes place before they are made available.

The protection of personal data is specifically ensured in contract with entities that provide their services to the Company, in particular standard contractual clauses, or in another form. Detailed information shall be provided by the Company on request.


The company fully respects all rights of its customers, which arise to them in relation to processing of their personal data by the Company. Beside the right to obtain information pursuant to Article 13 and 14 of the GDPR, it includes the following rights:

  • right of access to the personal data processed;
  • right to rectification of inaccurate and completion of incompetent personal data;
  • right to erasure (“right to be forgotten”);
  • right to restriction of processing;
  • right to data portability;
  • right to object processing;
  • right not to be subject to automated individual decision-making with legal or similar effects, including profiling;
  • right to file a complaint with the data protection authority.

For further information about rights of the data subjects in the Czech language please see the link, information in English language please see here.

For the avoidance of any doubt, the Company states that it is not obliged to appoint a data protection officer within the meaning of Article No. 37 GDPR.

Should the client wish to exercise any of his/her rights, or should the client want detailed information regarding the personal data processing, the Company will gladly provide the Client with further information about processing of your personal data on the basis of your written of phone request addressed to following contact details: Bombay Food Production s.r.o., registered office: Konviktská 1055/7, Staré Město, 110 00 Praha 1, www:, e-mail:

Should the Client believe that his/her personal data has been processed unjustifiably by the Company, or if the Company has violated any of rights of the Customer, the Customer can at any time file a complaint with the supervisory authority, which is the Office for Personal Data Protection, registered office: Pplk. Sochora 27, PSČ 170 00, Praha 7 – Holešovice, Česká republika, phone: +420 234 665 111, www:, e-mail:

In Prague on January 1, 2021