Privacy policy

This site collects anonymous statistics about how it is used, and only if you consent to it. There are no user accounts, no newsletter, no forms, and we neither sell your data nor share it with anyone for marketing.

01 Who the data controller is

The controller of personal data collected through this site is ZZB sp. z o.o., registered at ul. Cicha 2, 20-078 Lublin, Poland (NIP 7123425663, KRS 0000927672, REGON 520236289) — the company that runs the Just Crafted pub.

For anything concerning personal data or this policy, write to rodo@justcrafted.pl. We have not appointed a data protection officer; mail to that address is read by the company's board.

02 What we collect

The only tool here that collects data about you is Google Analytics 4 (measurement ID G-W0SW21JJLH). Once you consent, it stores a pseudonymous identifier in your browser (the _ga, _ga_W0SW21JJLH cookies) and sends Google information about your visit:

which pages you opened, when, and in what order,
how you arrived (the referring address, e.g. a search engine or Facebook),
approximate location at country and city level,
device type, operating system, browser, screen size and language,
on-page events, such as following the link to the tap list.

You give us no name, e-mail address or contact details in the process — the site has no form in which you could enter them. Your IP address is used by Google only transiently, to derive that approximate location, and is not stored in Google Analytics 4 or made available to us.

We read these statistics only in aggregate — how many people visited, which pages are read most, what devices they use. We do not try to work out who an individual visitor is, and we have no tools for doing so.

03 Legal basis and your consent

Analytics runs on the basis of your consent only — art. 6(1)(a) GDPR. Until you give it, the Google Analytics script is not executed on this site; it is held back technically, not merely switched off in a setting.

Consent is collected through the Cookiebot banner. You can withdraw or change it at any time — use the "Change cookie consent" link in the footer, or the consent icon shown on the page. Withdrawing consent does not affect the lawfulness of processing carried out beforehand, and is as easy as giving it.

Refusing consent limits nothing: every part of the site — menu, taps, bottles, events, board games, contact — works exactly the same.

04 Cookies

The site uses two kinds of cookie:

necessary — a single cookie (CookieConsent) recording your consent decision, so that you are not asked again on every page. Without it the banner could not remember a refusal;
statistics — the Google Analytics cookies (_ga, _ga_W0SW21JJLH), set only after you consent.

Beyond those, we store one value in your browser's local storage, `jc_age_ok` — the date on which you confirmed you are of legal drinking age at the door. It is a timestamp and nothing else: it holds no date of birth and no identifier, it is never sent to a server, and it expires 30 days after your last visit. Clearing site data removes it, and the gate asks again.

We use no marketing, advertising or cross-site tracking cookies. The list below is generated and kept current automatically by Cookiebot from a monthly scan of this site — if anything new ever appears here, you will see it below, whatever the paragraph above says.

05 Who receives the data

We do not sell your data and do not share it for marketing. We do use three service providers that process data on our behalf:

Google Ireland Limited (Google Analytics) — visit statistics;
Usercentrics A/S (Cookiebot) — the cookie consent banner and the record of consents given;
Cloudflare, Inc. — site hosting (Cloudflare Pages); like any server, it records technical request data.

Transfers outside the EEA. Google and Cloudflare may also process data in the United States. This takes place under standard contractual clauses approved by the European Commission and those providers' participation in the EU–U.S. Data Privacy Framework. Usercentrics A/S is a Danish company and processes data within the EU.

Data may also be disclosed to competent authorities where the law requires it.

06 Server logs

Independently of analytics and of your consent, delivering a page to your browser requires processing the IP address you connect from — otherwise the response would have nowhere to go. Cloudflare, Inc. records such requests in standard logs and uses them to deliver content and to protect the site against abuse and attacks.

The basis is our legitimate interest in running and securing the site (art. 6(1)(f) GDPR). We do not combine these logs with Google Analytics data and do not use them to analyse visitor behaviour.

07 How long we keep data

Google Analytics data — 14 months from a user's last visit, after which Google deletes it automatically. Aggregate reports (visit counts, page popularity) remain available for longer, but no individual can be extracted from them.
Your consent record — 12 months, after which the banner asks again.
Server logs — per Cloudflare, Inc.'s own policy, in practice days rather than months.

You can remove the cookies sooner yourself, by clearing site data in your browser settings.

08 Your rights

You have the right to: access your data and obtain a copy (art. 15 GDPR), rectification (art. 16), erasure (art. 17), restriction of processing (art. 18), data portability (art. 20), objection (art. 21), and to withdraw consent at any time (art. 7(3)).

⚠️ One honest limitation: the data Google Analytics collects is pseudonymous and contains nothing that would let us link it to your name or e-mail address. In practice this means that without further information from you — a cookie identifier, for instance — we cannot locate your data in the statistics at all (art. 11 GDPR). The fastest route to having it gone is to withdraw consent and clear the cookies in your browser.

You can also block Google Analytics independently of our banner by installing the Google Analytics opt-out browser add-on.

We make no automated decisions about you and carry out no profiling.

09 Complaint to the supervisory authority

If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl). We would appreciate a note to rodo@justcrafted.pl first, though — most things can be sorted out straight away.

10 What we don't do

For the avoidance of doubt, because this matters as much as the list above. This site has no user accounts or logins, no data-collecting forms, no newsletter, no advertising pixels (Meta, Google Ads) or remarketing, no visitor profiling, and we neither sell nor exchange data with anyone for marketing.

Bookings, event sign-ups and messages to us happen away from this site — by phone, e-mail, or through Facebook, Instagram and Telegram. Data you send through those channels is governed by those services' own terms and privacy policies, and we use it solely to reply to you.

11 Changes to this policy

If we add anything to the site that collects data, we will update this policy before switching it on, and update the date below. The automatic cookie list under "Cookies" will show any such change whether or not we have got round to editing the prose.

Last updated: 2026-09-16