Version 2.0 – effective from 19 October 2026. This version replaces the Privacy Policy of September 2022.
1. Introduction
This Privacy Policy explains how the Koykan Group collects, uses, shares and protects personal data, and which rights you have in relation to it. It is issued in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, “GDPR”) and the Act on the Implementation of the General Data Protection Regulation (Official Gazette No. 42/18), together with the other regulations of the Republic of Croatia and of the European Union that apply to the processing of personal data.
The Policy applies to the website www.koykan.com and its subpages, to the Koykan restaurants and the digital services connected with them (self-service kiosks, point-of-sale systems, online ordering and the loyalty programme), to investors and bondholders, to franchise candidates and partners, to job applicants, to business partners and suppliers, and to visitors of events that Koykan organises.
Where a specific service carries its own privacy notice (for example the offering documentation of a particular securities issue, or the notice displayed at a restaurant), that notice applies in addition to this Policy and prevails for that service.
2. Controller and contact
The controller responsible for the processing of personal data described in this Policy is:
PLANETS GROUP d.o.o. putnička agencija, trgovina i usluge
Registered seat: Ivanićgradska ulica 38, Šumećani, Grad Ivanić-Grad, Republic of Croatia
Registered with the Commercial Court in Zagreb under MBS 080479467, OIB 90924418279
Website: www.koykan.com, e-mail: info@koykan.com
(hereinafter: “Koykan”, “the Company”, “we” or “us”)
Koykan is the brand owner and the parent company of the Koykan Group, which comprises the Company and the companies it controls in the Republic of Croatia, the Slovak Republic, the Czech Republic and the Federal Republic of Germany (hereinafter: “the Koykan Group”). Each Koykan restaurant is operated by a separate restaurant company. The restaurant company that operates the restaurant you visit processes the data generated at that restaurant (for example orders, receipts and complaints) as a controller. Where data is processed in systems that are common to the whole network, such as the loyalty programme, online ordering and the central point-of-sale and business systems, the Company and the restaurant company act as joint controllers. The essence of the arrangement between them is available on request, and you may exercise your rights against either of them through the contact below.
Where you invest in a company of the Koykan capital platform other than the Company, that company is the controller for your investment and provides its own privacy notice in the offering documentation.
Contact for data protection matters
The Company has not appointed a data protection officer, because the conditions of Article 37 of the GDPR are not met. For all questions about the processing of your personal data and for exercising your rights, please contact us:
- by e-mail: info@koykan.com, with the subject line “Personal data protection”
- in writing: PLANETS GROUP d.o.o., Attn: Boro Milivojević, Ivanićgradska ulica 38, Šumećani, Grad Ivanić-Grad, Croatia
3. Principles we follow
We process personal data lawfully, fairly and transparently; only for specified, explicit and legitimate purposes; to the extent that is adequate, relevant and limited to what is necessary; accurately and kept up to date; for no longer than is necessary; and in a manner that ensures appropriate security, integrity and confidentiality. We are responsible for, and able to demonstrate, compliance with these principles. Where a purpose can be achieved with anonymised or aggregated data, we use data in that form.
4. Whose data we process and which data
4.1 Website visitors
- technical data: IP address, device and browser type, operating system, date and time of access, pages visited and referring page
- data collected through cookies and similar technologies, as described in section 6
- data you enter in contact forms: first and last name, e-mail address, telephone number, the content of your enquiry and the category of enquiry you select
4.2 Restaurant guests and users of digital services
- order data: products ordered, time, restaurant, amount, payment method and receipt data
- card and other non-cash payments are processed by the payment service provider; we receive the transaction confirmation and do not see or store full payment card data
- loyalty programme: first and last name, e-mail address, telephone number, member identifier, purchase history, points balance, rewards redeemed and communication preferences
- online ordering: contact details, delivery address, order history and notes you add to an order
- feedback, reviews and complaints: your contact details, the content of the feedback or complaint and our correspondence with you; where you publish a review on a public platform, the content of that public review and our reply
Orders placed through third-party delivery platforms are subject to the privacy policy of that platform, which acts as an independent controller. We receive from the platform only the data needed to prepare and hand over your order.
4.3 Investors, bondholders and prospective investors
- identification data: first and last name, date of birth, address, OIB, nationality, data from your identity document; for legal entities, the company details and data on representatives and beneficial owners
- contact data: e-mail address, telephone number and correspondence address
- data needed for the subscription and holding of securities: the amount you wish to invest, subscription forms, number of the account with the Central Depository and Clearing Company (SKDD), bank account (IBAN), payments made, securities held, coupons and repayments, and your choices within any exchange or conversion programme
- tax data: tax residence and data needed for correct withholding and tax reporting
- investor status, together with any statements you give about your investor category or about how you came into contact with us
- data related to bondholder or shareholder assemblies: registration, attendance, proxies and votes
- communication with the investor relations team, including records of calls and meetings where you have been informed of this
Investors provide their data in the subscription form on the offer page at www.koykan-capital.hr. That data is used to enter the investor in the subscription book kept for SKDD and to carry out the subscription.
4.4 Franchise candidates and partners
- contact data of the candidate and of its representatives
- data on the candidate’s business: operating track record, number and brands of units operated, organisation, financial capacity and references
- data needed to assess reputation and suitability, obtained from the candidate and from publicly available sources such as court and business registers
- for signed partners: contract data, operating and performance reports, training records and correspondence
4.5 Job applicants
- first and last name, contact data, CV, education, work experience, skills, motivation letter and any other data you choose to provide
- notes from interviews, as well as results of practical tests where relevant to the position
Recruitment for the Koykan Group is carried out by the Company and by the group staffing company KSEE Recruitment d.o.o. Please do not send us data that is not needed for the application, in particular data on health, religion or other special categories of personal data.
4.6 Business partners, suppliers and event visitors
- contact data of contact persons, their position and company, and correspondence
- for events: registration data and attendance, as well as photographs and video recordings where this is announced at the event
4.7 Sources of data
We obtain personal data primarily from you. In addition, we receive data from other companies of the Koykan Group, from franchise and operating partners, from delivery platforms, from SKDD and the banks involved in a subscription, from identity verification and screening providers, and from publicly available sources such as court, business and sanctions registers.
5. Purposes and legal bases
We process personal data only where one of the legal bases of Article 6 of the GDPR applies. The table below sets out our main purposes and the legal basis for each.
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Operating the website and keeping it secure | Displaying pages, preventing abuse, technical logs, necessary cookies | Legitimate interest, Art. 6(1)(f) |
| Answering enquiries | Contact form, e-mails, telephone enquiries | Steps prior to a contract, Art. 6(1)(b), or legitimate interest, Art. 6(1)(f) |
| Selling products and delivering orders | Orders at the restaurant, kiosk and online, delivery, receipts | Contract, Art. 6(1)(b); legal obligation for fiscalisation and accounting, Art. 6(1)(c) |
| Loyalty programme | Membership, points, rewards, personalised offers within the programme | Contract, Art. 6(1)(b); consent for marketing messages, Art. 6(1)(a) |
| Handling complaints and feedback | Consumer complaints, replies to reviews, quality improvement | Legal obligation, Art. 6(1)(c); legitimate interest, Art. 6(1)(f) |
| Subscription and administration of securities | Expression of interest, subscription book, payment, registration at SKDD, coupons, repayments, exchanges and conversions, assemblies | Contract and steps prior to a contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Investor relations and regulatory disclosure | Periodic letters to investors, investor calls, publications required by capital markets rules | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c); legitimate interest, Art. 6(1)(f) |
| Selecting and managing franchise partners | Assessing candidates, concluding and performing franchise agreements, reporting | Steps prior to a contract and contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) |
| Recruitment | Assessing applications, interviews, keeping applications for future openings | Steps prior to a contract, Art. 6(1)(b); consent for keeping data for future openings, Art. 6(1)(a) |
| Direct marketing | Newsletters, information on products, promotions and events | Consent, Art. 6(1)(a); for existing customers, legitimate interest for similar products, Art. 6(1)(f) |
| Analytics and improvement of services | Website statistics, aggregated analysis of sales and customer behaviour | Consent for analytics cookies, Art. 6(1)(a); legitimate interest for aggregated analysis, Art. 6(1)(f) |
| Accounting, tax and legal obligations | Bookkeeping, tax reporting, responding to requests of authorities | Legal obligation, Art. 6(1)(c) |
| Establishing, exercising or defending legal claims | Disputes, enforcement, keeping evidence | Legitimate interest, Art. 6(1)(f) |
Where we rely on legitimate interest, we have assessed that our interest is not overridden by your interests or fundamental rights and freedoms. You may request more information about this assessment. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Screening against sanctions and PEP lists may use automated tools, but every match is reviewed by a person before any decision is taken.
6. Cookies and similar technologies
A cookie is a small data file stored on your computer or mobile device when you visit a website. We use:
- necessary cookies, which are required for the website to function and to remember your cookie choices; they are used without consent
- analytics cookies, which help us understand how visitors use the website so that we can improve it; they are used only with your consent
- marketing cookies, which make it possible to show you relevant content and advertisements on other websites and social networks; they are used only with your consent
When you first visit the website you can accept all cookies, reject non-necessary cookies or choose by category. You can change your choice at any time through the cookie settings link at the bottom of every page, or delete cookies in your browser settings. If you reject non-necessary cookies you can still use the website, although some features may be unavailable. The list of cookies used, their providers and their duration is available in the cookie settings.
7. Recipients of personal data
We disclose personal data only to the extent necessary for the purposes described above, to the following categories of recipients:
- companies of the Koykan Group, including restaurant companies and group service companies for staffing, procurement and logistics, and technology
- franchise and operating partners who operate Koykan restaurants, to the extent needed to serve you at their restaurant
- processors acting on our behalf under a data processing agreement: providers of IT, hosting, cloud, point-of-sale and business systems, website and e-mail services, the provider of subscription and investor administration services, identity verification and screening providers, and marketing and communication services
- payment service providers and banks, including Zagrebačka banka d.d. for payments within a subscription
- the Central Depository and Clearing Company (SKDD), which keeps the registers of securities and executes corporate actions
- competent authorities where we are required by law, including the Croatian Financial Services Supervisory Agency (HANFA), the Anti-Money Laundering Office, the Tax Administration, courts and other public bodies
- auditors, tax, legal and other professional advisers and notaries, who are bound by confidentiality
- delivery platforms, for orders placed through them
- in the case of a reorganisation, merger, sale or transfer of a business or of a part of it, the acquirer or successor, subject to confidentiality and to this Policy
We do not sell personal data. Data about sales and customer behaviour is shared outside the Koykan Group only in anonymised or aggregated form.
8. Where personal data is processed
We process personal data in the European Union and the European Economic Area, in particular in the Republic of Croatia and in the other countries where the Koykan Group operates or where our providers are established. If data is transferred to a country outside the European Economic Area, for example because a provider of IT services processes data there, we transfer it only where the European Commission has adopted an adequacy decision for that country or where appropriate safeguards are in place, such as the standard contractual clauses adopted by the European Commission. You may request information about the safeguards applied.
9. How long we keep personal data
We keep personal data only as long as needed for the purpose for which it was collected, or as long as required by law. After that the data is deleted or anonymised.
| Data | Retention period |
|---|---|
| Website technical logs | Up to 6 months |
| Cookies | As stated in the cookie settings, at most 13 months for non-necessary cookies |
| Enquiries through contact forms | Up to 12 months after the last communication, unless a contract follows |
| Accounting documents, including receipts and invoices | 11 years after the end of the business year to which they relate |
| Consumer complaints | At least 1 year from receipt of the complaint, and longer where a dispute is pending |
| Loyalty programme account | While the membership is active; the account is closed and the data deleted after 24 months without activity |
| Expression of interest without subscription | Up to 12 months after submission |
| Data on securities held and their administration | For the life of the securities and afterwards for the period prescribed by accounting, tax and capital markets rules |
| Franchise candidates without an agreement | Up to 12 months after the last contact |
| Franchise partners and suppliers | For the term of the agreement and 5 years after its end, and longer where required by accounting rules |
| Job applicants | Up to 6 months after the end of the selection process, or up to 12 months with your consent for future openings |
| Marketing based on consent | Until you withdraw consent |
| Event photographs and recordings | As long as they are needed for reporting on the event and the archive of the Company |
Where data is needed to establish, exercise or defend a legal claim, we keep it until the claim is finally resolved.
10. Security of personal data
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, including access control based on need to know, encrypted transmission of data, secure storage, regular back-ups and confidentiality obligations of employees and providers. Our processors may process personal data only on our documented instructions. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we notify the supervisory authority, as well as you where required.
11. Your rights
In accordance with the GDPR you have the following rights:
- right of access: to obtain confirmation whether we process your data and a copy of that data, together with information on the purposes, categories, recipients, retention period and source
- right to rectification: to have inaccurate data corrected and incomplete data completed
- right to erasure: to have your data deleted where it is no longer needed, where you withdraw consent and there is no other legal basis, where you object and there are no overriding legitimate grounds, or where the data has been processed unlawfully; this right does not apply where we must keep the data by law
- right to restriction of processing: for example while the accuracy of the data is being verified, or where you need the data for a legal claim
- right to data portability: to receive the data you provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller, where the processing is based on consent or contract and carried out by automated means
- right to object: to processing based on our legitimate interest, on grounds relating to your particular situation, and at any time to processing for direct marketing, including profiling related to it; after an objection to direct marketing we no longer process your data for that purpose
- right to withdraw consent at any time, for example through the unsubscribe link in every marketing message or in your loyalty programme settings
- right to lodge a complaint with the supervisory authority: Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency), Selska cesta 136, 10000 Zagreb, azop@azop.hr, www.azop.hr, or with the supervisory authority of the Member State of your habitual residence or place of work
How to exercise your rights
Send your request to info@koykan.com or in writing to the address in section 2. We respond without undue delay and at the latest within one month of receipt. That period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we inform you within the first month. Exercising your rights is free of charge. Where a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse to act on it. To protect your data, we may ask you to confirm your identity before we act on a request.
12. Obligation to provide data
Providing data is voluntary. However, some data is necessary to conclude and perform a contract or to meet a legal obligation. Without it we cannot, for example, deliver an online order, register you in the loyalty programme, carry out the subscription of securities or complete the checks required by anti-money laundering rules. Where data is mandatory, we mark it as such when we collect it.
13. Children
Our digital services and investment offers are not intended for persons under 16 years of age, and we do not knowingly collect their data through the website or the loyalty programme. If you believe that a child has provided us with personal data, please contact us and we will delete it.
14. Changes to this Policy
We review this Policy regularly and update it when our processing, our group structure or the applicable regulations change. The current version is always published on www.koykan.com with the date from which it applies. Where a change materially affects the way we process your data, we inform you through the website, as well as by e-mail where we have your contact details and the change concerns you directly.
Ivanić-Grad, 19 October 2026
PLANETS GROUP d.o.o.
