LEGAL INFORMATION
Privacy Policy
Version 2.0, in force from 19 October 2026. This version replaces the Privacy Policy of September 2022.
1. Introduction
This Privacy Policy explains how the Koykan Group collects, uses, shares and protects personal data, and what rights you have in relation to it. It has been adopted in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, “GDPR”) and the Act on the Implementation of the General Data Protection Regulation (Official Gazette no. 42/18), together with the other laws of the Republic of Croatia and the European Union that apply to the processing of personal data.
The Policy applies to the websites www.koykan.com and www.koykan-capital.hr and their subpages, to Koykan restaurants and the digital services connected with them (self-service kiosks, till systems, online ordering and the loyalty programme), to investors and bondholders, to franchise applicants and partners, to job applicants, to business partners and suppliers, and to visitors to events organised by Koykan.
Where a specific service has its own privacy notice (for example, the offering documentation for a particular securities issue or a notice displayed in a restaurant), that notice applies alongside this Policy and prevails for that service.
2. Controller and contact details
The controller responsible for the processing of personal data described in this Policy is:
PLANETS GROUP d.o.o. putnička agencija, trgovina i usluge
Registered office: Ivanićgradska ulica 38, Šumećani, Grad Ivanić-Grad, Republic of Croatia
Registered with the Commercial Court in Zagreb under MBS 080479467, OIB 90924418279
Websites: www.koykan.com, www.koykan-capital.hr, email: info@koykan.com
(hereinafter: “Koykan”, the “Company”, “we” or “us”)
Koykan is the brand owner and parent company of the Koykan Group, which comprises the Company and the companies it controls in the Republic of Croatia, the Slovak Republic, the Czech Republic and the Federal Republic of Germany (hereinafter: “Koykan Group”). Each Koykan restaurant is run by a separate restaurant company. The restaurant company that runs the restaurant you visit processes the data generated in that restaurant (for example orders, receipts and complaints) as a controller. Where data is processed in systems shared across the whole network, such as the loyalty programme, online ordering and the central till and business system, the Company and the restaurant company act as joint controllers. The essence of the arrangement between them is available on request, and you may exercise your rights against either of them using the contact details below.
If you invest in a company of the Koykan capital platform other than the Company, the controller for your investment is that company, and it provides its own privacy notice in the offering documentation.
Contact for data protection enquiries
The Company has not appointed a data protection officer, as the conditions under Article 37 of the GDPR are not met. For any questions about the processing of your personal data and to exercise your rights, please contact us:
- by email: info@koykan.com, marked “Personal data protection”
- by post: PLANETS GROUP d.o.o., for the attention of Boro Milivojević, Ivanićgradska ulica 38, Šumećani, Grad Ivanić-Grad, Croatia
3. Principles we follow
We process personal data lawfully, fairly and transparently; only for specified, explicit and legitimate purposes; to the extent that is adequate, relevant and limited to what is necessary; accurately and kept up to date; for no longer than necessary; and in a manner that ensures appropriate security, integrity and confidentiality. We are responsible for complying with these principles and are able to demonstrate that we do so. Where a purpose can be achieved with anonymised or aggregated data, we use data in that form.
4. Whose data we process and what data
4.1 Website visitors
- technical data: IP address, type of device and browser, operating system, date and time of access, pages visited and the page you came from
- data collected through cookies and similar technologies, as described in section 6
- data you enter in contact forms: first and last name, email address, telephone number, the content of your enquiry and the enquiry category you select
4.2 Restaurant guests and users of digital services
- order data: products ordered, time, restaurant, amount, payment method and receipt data
- card and other cashless payments are processed by the payment service provider; we receive confirmation of the transaction and do not see or store full payment card details
- loyalty programme: first and last name, email address, telephone number, member identifier, purchase history, points balance, rewards redeemed and communication preferences
- online ordering: contact details, delivery address, order history and notes you add to an order
- feedback, reviews and complaints: your contact details, the content of the feedback or complaint and our correspondence with you; if you post a review on a public platform, the content of that public review and our reply
Orders placed through third-party delivery platforms are subject to the privacy policy of that platform, which acts as an independent controller. We receive from the platform only the data needed to prepare and hand over your order.
4.3 Investors, bondholders and prospective investors
- identification data: first and last name, date of birth, address, OIB, nationality, details from your identity document; for legal entities, company details and details of representatives and beneficial owners
- contact details: email address, telephone number and address for correspondence
- data needed to subscribe for and hold securities: the amount you wish to invest, subscription forms, your account number with the Central Depository & Clearing Company (SKDD), bank account (IBAN), payments made, securities you hold, coupons and repayments, and your choices under any exchange or conversion programme
- tax data: tax residence and the data needed for correct tax withholding and tax reporting
- investor status, together with any statements you make about your investor category or how you came into contact with us
- data relating to meetings of bondholders or shareholders: registration, attendance, proxies and voting
- communication with the investor relations team, including records of calls and meetings of which you have been informed
Investors provide their data in the subscription form on the offer page at www.koykan-capital.hr. This data is used to enter the investor in the subscription register kept for SKDD and to carry out the subscription.
4.4 Franchise applicants and partners
- contact details of the applicant and its representatives
- data about the applicant’s business: trading history, the number and brands of units it operates, organisation, financial capacity and references
- data needed to assess reputation and suitability, obtained from the applicant and from publicly available sources such as court and business registers
- for signed partners: contract data, reports on business and performance, training records and correspondence
4.5 Job applicants
- first and last name, contact details, CV, education, work experience, skills, covering letter and any other data you choose to provide
- interview notes, as well as the results of practical tests where relevant to the position
Recruitment for the Koykan Group is carried out by the Company and by the Group’s recruitment company, KSEE Recruitment d.o.o. Please do not send us data that is not needed for your application, in particular data about health, religious belief or other special categories of personal data.
4.6 Business partners, suppliers and event visitors
- contact details of contact persons, their position and company, and correspondence
- for events: registration and attendance data, as well as photographs and video recordings where this is announced at the event
4.7 Sources of data
We obtain personal data primarily from you. We also receive data from other Koykan Group companies, from franchise and operating partners, from delivery platforms, from SKDD and the banks involved in the subscription, from providers of identity verification and list screening services, and from publicly available sources such as court, business and sanctions registers.
5. Purposes and legal bases
We process personal data only where one of the legal bases under Article 6 of the GDPR applies. The table below sets out our main purposes and the legal basis for each.
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Operation and security of the website | Displaying pages, preventing misuse, technical logs, strictly necessary cookies | Legitimate interest, Art. 6(1)(f) |
| Responding to enquiries | Contact form, emails, telephone enquiries | Steps prior to entering into a contract, Art. 6(1)(b), or legitimate interest, Art. 6(1)(f) |
| Sale of products and delivery of orders | Orders in the restaurant, at the kiosk and online, delivery, receipts | Contract, Art. 6(1)(b); legal obligation of fiscalisation and accounting, Art. 6(1)(c) |
| Loyalty programme | Membership, points, rewards, personalised offers within the programme | Contract, Art. 6(1)(b); consent for marketing messages, Art. 6(1)(a) |
| Handling complaints and feedback | Consumer complaints, replies to reviews, quality improvement | Legal obligation, Art. 6(1)(c); legitimate interest, Art. 6(1)(f) |
| Subscription for and administration of securities | Expression of interest, subscription register, payment, registration with SKDD, coupons, repayments, exchanges and conversions, meetings | Contract and steps prior to entering into a contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Investor relations and regulatory reporting | Periodic investor letters, invitations to investors, disclosures required by capital markets rules | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c); legitimate interest, Art. 6(1)(f) |
| Selecting and managing franchise partners | Assessing applicants, concluding and performing franchise agreements, reporting | Steps prior to entering into a contract and contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) |
| Recruitment | Assessing applications, interviews, retaining applications for future vacancies | Steps prior to entering into a contract, Art. 6(1)(b); consent to retain data for future vacancies, Art. 6(1)(a) |
| Direct marketing | Newsletter, information about products, promotions and events | Consent, Art. 6(1)(a); for existing customers, legitimate interest in similar products, Art. 6(1)(f) |
| Analytics and service improvement | Website statistics, aggregated analysis of sales and user behaviour | Consent for analytics cookies, Art. 6(1)(a); legitimate interest in aggregated analysis, Art. 6(1)(f) |
| Accounting, tax and legal obligations | Bookkeeping, tax reporting, responding to requests from public authorities | Legal obligation, Art. 6(1)(c) |
| Establishment, exercise or defence of legal claims | Disputes, enforcement, preservation of evidence | Legitimate interest, Art. 6(1)(f) |
Where we rely on legitimate interest, we have assessed that our interest is not overridden by your interests or fundamental rights and freedoms. You may request more information about that assessment. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you. Screening against sanctions and PEP lists may be carried out using automated tools, but a person reviews every match before a decision is taken.
6. Cookies and similar technologies
A cookie is a small data file stored on your computer or mobile device when you visit a website. We use:
- strictly necessary cookies, which are needed for the website to function and to remember your cookie choices; these are used without consent
- analytics cookies, which help us understand how visitors use the website so that we can improve it; these are used only with your consent
- marketing cookies, which make it possible to show relevant content and advertisements on other websites and social networks; these are used only with your consent
On your first visit to the website you can accept all cookies, reject cookies that are not strictly necessary, or choose by category. You can change your choice at any time using the cookie settings link in the footer of every page, or delete cookies in your browser settings. If you reject cookies that are not strictly necessary, you can still use the website, although some features may be unavailable. A list of the cookies used, their providers and their duration is available in the cookie settings.
If you consent to marketing cookies, we also set our own cookie, koykan_src. It records the code of the medium or publication through which you reached the website and the date of arrival, so that we know which channel led to your subscription or enquiry. The cookie lasts 12 months and we delete it when you withdraw your consent. When you submit a subscription request, we send the channel code (for example D01) together with the request to the issuer and to Escont Partners, which receives subscription requests. The code contains no data about you other than the channel through which you came.
7. Recipients of personal data
We disclose personal data only to the extent necessary for the purposes described above, to the following categories of recipients:
- companies of the Koykan Group, including restaurant companies and group companies that provide recruitment, procurement, logistics and technology services
- franchise and operating partners that run Koykan restaurants, to the extent necessary to provide the service in their restaurant
- processors acting on our behalf under data processing agreements: providers of IT, hosting and cloud services, till and business systems, website and email services, subscription and investor administration services, identity verification and list screening services, and marketing and communication services
- payment service providers and banks, including Zagrebačka banka d.d. for payments made under a subscription
- the Central Depository & Clearing Company (SKDD), which keeps the registers of securities and carries out corporate actions
- competent authorities where required by law, including the Croatian Financial Services Supervisory Agency (HANFA), the Anti-Money Laundering Office, the Tax Administration, the courts and other public authorities
- auditors, tax, legal and other professional advisers and notaries, who are bound by confidentiality
- delivery platforms, for orders placed through them
- in the event of a reorganisation, merger, sale or transfer of the business or part of it, the acquirer or legal successor, subject to an obligation of confidentiality and compliance with this Policy
We do not sell personal data. Data on sales and user behaviour is shared outside the Koykan Group only in anonymised or aggregated form.
8. Where personal data is processed
We process personal data in the European Union and the European Economic Area, in particular in the Republic of Croatia and other countries in which the Koykan Group operates or in which our service providers are established. If data is transferred to a country outside the European Economic Area, for example because an IT service provider processes data there, we transfer it only if the European Commission has adopted an adequacy decision for that country or if appropriate safeguards are in place, such as the standard contractual clauses adopted by the European Commission. You can ask us for information about the safeguards applied.
9. How long we keep personal data
We keep personal data only for as long as necessary for the purpose for which it was collected, or for as long as the law requires. After that, the data is deleted or anonymised.
| Data | Retention period |
|---|---|
| Technical logs of the website | Up to 6 months |
| Cookies | As stated in the cookie settings, no more than 13 months for cookies that are not strictly necessary |
| Enquiries through contact forms | Up to 12 months after the last communication, unless a contract follows |
| Accounting records, including receipts and invoices | 11 years after the end of the financial year to which they relate |
| Consumer complaints | At least 1 year from receipt of the complaint, and longer if a dispute is ongoing |
| Loyalty programme account | While the membership is active; the account is closed and the data deleted after 24 months of inactivity |
| Expression of interest without a subscription | Up to 12 months after submission |
| Data on securities held and their administration | For the life of the securities, and thereafter for the period prescribed by accounting, tax and capital markets rules |
| Franchise applicants without a concluded contract | Up to 12 months after the last contact |
| Franchise partners and suppliers | For the term of the contract and 5 years after it expires, and longer if required by accounting rules |
| Job applicants | Up to 6 months after the end of the selection process, or up to 12 months with your consent for future vacancies |
| Consent-based marketing | Until consent is withdrawn |
| Photographs and recordings from events | For as long as needed to report on the event and for the Company’s archive |
Where data is needed for the establishment, exercise or defence of a legal claim, we keep it until the dispute is finally resolved.
10. Security of personal data
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, including need-to-know access controls, encryption of data in transit, secure storage, regular backups and confidentiality obligations for employees and service providers. Our processors may process personal data only on our documented instructions. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we notify the supervisory authority and, where required, you.
11. Your rights
Under the GDPR you have the following rights:
- right of access: to obtain confirmation of whether we process your data and a copy of that data, together with information on the purposes, categories, recipients, retention period and source
- right to rectification: to have inaccurate data corrected and incomplete data completed
- right to erasure: to have your data erased where it is no longer needed, where you withdraw consent and there is no other legal basis, where you object and there are no overriding legitimate grounds, or where the data has been processed unlawfully; this right does not apply where we are required by law to retain the data
- right to restriction of processing: for example while the accuracy of the data is being verified, or where you need the data for a legal claim
- right to data portability: to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller, where the processing is based on consent or contract and is carried out by automated means
- right to object: to processing based on our legitimate interest, on grounds relating to your particular situation, and at any time to processing for direct marketing purposes, including profiling related to it; after you object to direct marketing, we no longer process your data for that purpose
- right to withdraw consent at any time, for example through the unsubscribe link in every marketing message or in your loyalty programme settings
- right to lodge a complaint with a supervisory authority: the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr, www.azop.hr, or the supervisory authority of the Member State of your habitual residence or place of work
How to exercise your rights
Send your request to info@koykan.com or in writing to the address given in section 2. We respond without undue delay and in any event within one month of receipt. That period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in which case we will inform you within the first month. Exercising your rights is free of charge. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on it. To protect your data, we may ask you to confirm your identity before acting on a request.
12. Obligation to provide data
Providing data is voluntary. However, certain data is necessary to conclude and perform a contract or to comply with a legal obligation. Without it, for example, we cannot process an online order, register you in the loyalty programme, carry out a subscription for securities or complete the checks required by anti-money laundering rules. Where data is mandatory, we indicate this when it is collected.
13. Children
Our digital services and investment offers are not intended for persons under the age of 16, and we do not knowingly collect their data through the website or the loyalty programme. If you believe that a child has provided us with personal data, please contact us and we will delete it.
14. Changes to this Policy
We review this Policy regularly and update it when our processing, the structure of our group or the applicable regulations change. The version currently in force is always published at www.koykan.com and www.koykan-capital.hr, with the date from which it applies. Where a change materially affects the way we process your data, we notify you on the website and, where we hold your contact details and the change directly concerns you, by email.
Ivanić-Grad, 19 October 2026
PLANETS GROUP d.o.o.