Data protection declaration of GMS Gourmet GmbH

Protecting your personal data and privacy is very important to us. We process your personal data exclusively within the framework of the provisions of the General Data Protection Regulation (GDPR) and the Data Protection Act (DSG). Below we will inform you about our company and the type, scope and purpose of data collection and use:

The contact details of the responsible entity

GMS GOURMET GmbH
Oberlaaer Straße 298
1230 Vienna, Austria
Tel. +43 (0) 50/8760
dsgvo@gourmet.at

Our privacy policy explains:

• What information we collect and for what reason;
• how we use this information;
• your data subject rights

We process personal data exclusively on one of the following legal bases:

• your consent
• on a contractual basis
• in legitimate interest

On the website, data is processed exclusively on the basis of the legal provisions (DSGVO, DSG, TKG 2021).

You have the right to revoke a given consent with effect for the future at any time and free of charge and without giving reasons. To do so, please contact dsgvo@gourmet.at.

1. Data collection and use

• Contact form

By means of a contact form you can send us inquiries, suggestions and requests. In order to contact us, it is necessary that you provide us with your data. Furthermore you have to write a text in the corresponding field.

You acknowledge that the aforementioned data will be processed by us for the purpose of handling or responding to your request. Without providing this information, we will not be able to process your request.

Legal basis:

• Consent according to Art. 6 para. 1 lit. a DSGVO
• Fulfillment of contract or pre-contractual measure according to Art. 6 para.1 lit. b DSGVO

Storage period:

The deletion of stored personal data takes place when your data is no longer required for the fulfillment of the purpose pursued with the storage or if you revoke the consent to storage, in each case in compliance with the statutory retention obligations.

• Orders via our online store (webshop)

We require your data for the conclusion, execution and termination of your orders. This includes, for example:

• First name and last name
• Invoice and delivery address
• E-mail address
• Invoice and payment data
• Telephone number.

Order processing includes, but is not limited to, shipping orders, processing your payment, sending electronic order confirmations and invoices or supporting customer service.

Legal basis:

• Consent according to Art. 6 para. 1 lit. a DSGVO.
• Fulfillment of contract or pre-contractual measure according to Art. 6 para.1 lit. b DSGVO.

Storage period:

The deletion of stored personal data takes place when your data is no longer required for the fulfillment of the purpose pursued with the storage (e.g. order processing, processing of warranty claims and claims for damages, etc.) in each case in compliance with the statutory retention obligations.

• Vouchers

We use the data provided in the context of an order for vouchers to check and process the order and to send and redeem the voucher. This also includes the logging and processing of data related to the use of the voucher, in particular to prevent fraud.

For these purposes, we also store the following data:

• Voucher value
• Voucher type
• Voucher number / code
• payment method, if applicable
• Order date or date of issue, if applicable

Legal basis:

• Consent according to Art. 6 para. 1 lit. a DSGVO
• Contract fulfillment or pre-contractual measure according to Art. 6 para.1 lit. b DSGVO

Storage period:

Your personal data will be deleted when your data is no longer required to fulfill the purpose for which it was stored or when you revoke your consent to storage, in each case in compliance with the statutory retention obligations.

• Reservation

You can make reservations in our restaurants using the reservation form. We use the reservation tool of the provider molzait GmbH (https://molzait.com) for reservations. Please note the privacy policy of molzait GmbH, to which you will be referred when making your reservation (https://molzait.com/privacy). The person responsible for data processing for reservations is molzait GmbH.

• Server log

When calling up this website, information is automatically sent to the server of our website by the browser used on your end device. This information is temporarily stored in a so-called log file. The following information is collected without your intervention and stored until automated deletion:

• IP address of the requesting computer,
• Date and time of access,
• Name and URL of the accessed file,
• website of origin (referrer URL),
• browser used and, if applicable, the operating system of your computer as well as the name of your access provider.

The possibility of using this data for purposes such as

• ensuring a smooth connection of the website,
• the guarantee of a comfortable use of our website
• the evaluation of system security and stability as well as
• for other administrative purposes

is currently performed by us. The collected data will in no case be used to draw conclusions about your person.

Legal basis:

Our legitimate interests according to Art. 6 para. 1 lit. f DSGVO.

Storage period:

6 months from attachment

2. The rights of data subjects

You have the right to obtain information about your personal data processed by us, its origin and recipient, its storage period and the purpose of its processing. Upon written request, we will be happy to inform you at any time about your personal data stored by us.

If your data processed by us is inaccurate or incomplete, you may request that it be corrected or completed. We will correct or complete your data immediately. If it is unclear whether the processed personal data is inaccurate, incomplete or processed unlawfully, you may request that the processing of your data be restricted until this issue has been resolved.

You may also request the deletion of unlawfully processed personal data. Please note, however, that this only applies to data that is processed incorrectly, incompletely or unlawfully. You also have the right to object to the processing of your personal data if such data processing is based on the legal basis of our legitimate interest.

If you wish to exercise your rights, we kindly ask you to email us on dsgvo@gourmet.at.

If you nonetheless suspect that our data processing violates data privacy law or your data protection rights have been violated in any other way, you have the option of submitting a complaint to the competent supervisory authority (the Austrian data protection authority).

3. Newsletter
You can give us your consent to send you newsletters. Through our newsletters we inform you about news concerning our company, seasonal offers, our products, promotions, contests, etc.. For this purpose, we need your e-mail address, and in the case of personalized newsletters also your title and first and last name, which you provide to us when you register for the newsletter.

Legal basis:

• Consent in accordance with Art. 6 Para. 1 lit. a DSGVO.
• Contract fulfillment or pre-contractual measure according to Art. 6 para.1 lit. b DSGVO
• Our legitimate interests according to Art. 6 para. 1 lit. f DSGVO.

Storage period:

Your personal data will be deleted if your data is no longer required to fulfill the purpose for which it was stored or if you revoke your consent to its storage, in each case in compliance with the statutory retention obligations.

You have the right to revoke a given consent with effect for the future at any time and free of charge and without giving reasons. Please contact dsgvo@gourmet.at. You can also cancel the newsletter subscription at any time by clicking on the unsubscribe link provided in each newsletter/mailing. If you revoke your consent, your personal data will be routinely blocked or deleted in accordance with the statutory provisions, unless otherwise stipulated by law.

Double-Opt-In and Logging

Registration for our newsletter takes place in a so-called double opt-in process. This means that after registration you will receive an e-mail in which you are asked to confirm your registration. The registrations to the newsletter are logged in order to be able to prove the registration process according to the legal requirements. This includes the storage of the registration and confirmation time, as well as the IP address.

Statistical collection and analyses

When you call up the newsletter, technical information, such as information about the browser and your system, as well as your IP address and the time of the call-up are initially collected. This information is used for the technical improvement of the services based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined with the help of the IP address) or the access times. Statistical surveys also include determining whether newsletters are opened, when they are opened and which links are clicked. This information can be assigned to individual newsletter recipients for technical reasons. However, it is not our intention to observe individual users. The analyses are more used to identify the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

Newsletter Tracking

Our newsletters contain so-called tracking pixels (web bugs), which allow us to recognize if and when an email was opened and which links in the email were followed by the personalized recipient. We store this data so that we can optimally tailor our newsletters to the wishes and interests of our subscribers. Accordingly, the data thus collected is used to send personalized newsletters to the respective recipient.

The data processing is based on your consent in accordance with Art. 6 Para. 1 lit. a DSGVO. With the revocation of the consent to receive the newsletter, the consent to tracking is also revoked.

4. Data transmission

• Data transmission

We do not transfer your personal data to third parties (e.g. insurance companies, courts, authorities, banks, tax consultants, auditors, companies within our group of companies, etc.) and order processors (e.g.: IT service providers) for purposes other than those listed below.

We only pass on your personal data if:

• you have given your express consent to this in accordance with Art. 6 Para. 1 lit. a DSGVO,
• the disclosure is necessary in accordance with Art. 6 (1) (f) DSGVO to protect the interests of the company and to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding legitimate interest in not disclosing your data, – in the event that there is a legal obligation to disclose your data in accordance with Art. 6 (1) (c) DSGVO, and
• this is legally permissible and necessary according to Art. 6 para. 1 lit. b DSGVO for the processing of contractual relationships with you.

The processing of the data by the order processor is carried out exclusively for the fulfillment of the order and in accordance with our instructions. You can find the list of GMS GOURMET GmbH’s order processors here.

We also reserve the right to transfer personal data we have about you if we sell or transfer all or part of our business or assets (including in the event of restructuring, dissolution or liquidation).

• Data Transfers

We may also transfer your personal information to countries outside the country where the information was originally collected. These countries may not have the same data protection laws as the country where you originally provided the personal information.

When we transfer your information to other countries, we protect that information as described in this Privacy Policy, and those transfers are governed by the applicable law. The countries to which we transfer personal data are located

• within the European Union or
• outside the European Union

When we transfer personal data from the European Union to countries or international organizations outside the European Union, the transfer is made on the basis of:

• an adequacy decision of the European Commission;
• in the absence of such, on the basis of other legally permissible grounds, such as the existence of a legally binding and enforceable document between public authorities or public bodies, binding internal corporate rules, standard data protection clauses, and approved or certified codes of conduct.

In exceptional cases, a data transfer may also take place on the basis of Art. 49 DSGVO:

• Art. 49(1)(a) GDPR the data subject has given his or her explicit consent to the proposed data transfer after having been informed of the potential risks to him or her of such data transfers without the existence of an adequacy decision and without appropriate safeguards,
• Art. 49(1)(b) GDPR the transfer is necessary for the performance of a contract between the data subject and the controller or for the performance of pre-contractual measures at the request of the data subject,
• Art. 49(1)(c) DSGVO the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject by the controller with another natural or legal person.

5. Google Tools

• Google AdWords and Google Conversion Tracking

This website uses the online advertising program “Google AdWords” and as part of it the “Google Ads Conversion”. Google AdWords sets a cookie on your computer if you have landed on our website via a Google ad. These cookies usually lose their validity after 30 days and are not used to identify you personally. If the user visits certain pages of our website and the cookie has not yet expired, we and Google can recognize that the user clicked on the ad and was redirected to this website. For this cookie, the unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marking that the user no longer wishes to be addressed) are usually stored as analysis values. A different cookie is assigned to each Google AdWords customer. Thus, cookies cannot be tracked via the website of AdWords customers. We ourselves do not collect or process any personal data in the aforementioned advertising measures. We only receive statistical evaluations from Google. Based on these evaluations, we can see which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising tools; in particular, we cannot identify users on the basis of this information. Due to the marketing tool used, your browser automatically establishes a direct connection with Google’s server. We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you according to our state of knowledge: Through the integration of Google Ads Conversion, Google receives the information that you have called up the corresponding part of our website or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that Google will find out and store your IP address.

Users who do not wish to participate in the tracking can easily deactivate the Google conversion tracking cookie via their internet browser under the user settings. These users will not be included in the conversion tracking statistics.

The storage of “conversion cookies” is based on your consent pursuant to Art. 6 (1) lit. a DSGVO. If you would like to find out more about Google’s privacy policy and terms of use, you can find more information at the following link: https://policies.google.com/privacy?hl=de

• Google Analytics Remarketing

This website uses the functions of Google Analytics Remarketing in conjunction with the cross-device functions of Google AdWords. The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. This function makes it possible to link the advertising target groups created with Google Analytics Remarketing with the cross-device functions of Google AdWords. In this way, interest-based, personalized advertising messages that have been adapted to you depending on your previous usage and surfing behavior on one end device (e.g. cell phone) can also be displayed on another of your end devices (e.g. tablet or PC).

If you have given your consent, Google will link your web and app browsing history with your Google account for this purpose. In this way, the same personalized advertising messages can be displayed on every end device on which you log in with your Google account.

To support this feature, Google Analytics collects Google-authenticated IDs of users that are temporarily linked to our Google Analytics data to define and create audiences for cross-device ad targeting.

You can permanently object to cross-device remarketing/targeting by deactivating personalized advertising in your Google account; follow this link: https://support.google.com/ads/answer/2662922

The aggregation of the collected data in your Google account is based solely on your consent (Art. 6 para. 1 lit. a DSGVO), which you give to Google. You can revoke this consent at any time without giving reasons with effect for the future. In the case of data collection processes that are not merged in your Google account (e.g. because you do not have a Google account or have objected to the merging), the collection of data by us is also based on your consent (Art. 6 para. 1 lit. a DSGVO) that you have given us. You can revoke this consent at any time without giving reasons with effect for the future.

Further information can be found

here: https://www.google.com/policies/technologies/ads/. and

here: https://support.google.com/google-ads/answer/7664943?hl=de&ref_topic=3122875

Use of Google Analytics

This website uses Google Analytics, a web analytics service provided by Google, Inc (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. In the event that IP anonymization is activated on this website, however, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area.

Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. Your usage data will not be passed on to third parties. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

• Google Signals

We would like to inform you that we have activated Google Signals in Google Analytics. This gives us greater insight into the statistics of our website. This particularly applies to visitors to our website. If you have agreed to personalized advertising in your Google account, your visitor data from our website will be collected in Google Analytics and linked to the Google information from your Google account.

Existing Google Analytics functionality will be updated (target groups can be created and shared with linked advertising accounts to place advertisements in cross-device remarketing campaigns, advertising reporting will be expanded, interest and demographic information will be collected, and cross-platform reporting will be possible) to receive aggregated and anonymized data.

Your data can be analysed across devices (cross device tracking). By activating Google Signals, data is collected and linked to your Google account. Multiple website visits by a single visitor can therefore be attributed exclusively to that visitor, even if the visitor interacts with the website using different devices (e.g., smartphone and notebook). This helps us launching cross-device remarketing campaigns and show you our products on other websites. Cross-device reports only contain aggregated data. Individual user data is not disclosed.

By activating Google Signals, further visitor data is collected on our website (e.g., device combinations used, purchasing process analysed on different devices, cross-device marketing services recorded). This gives us better advertising reports from Google.

Information about your interests and demographic characteristics (gender, age) is also collected. This makes it possible to define target groups in Google Analytics and we have the opportunity to adapt our products to the target groups.

You can manage and delete this data in your Google account. Data from Google Signals is stored in our Google Analytics account for a maximum of 14 months. By default, logged in Google user data expires after 26 months.

Further information about Google Signals can be found here: https://support.google.com/analytics

6. friendly captcha

This website uses Friendly Captcha. Provider is Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany. Friendly Captcha is intended to verify whether data entry on this website (e.g. in a contact form) is done by a human or by an automated program. For more information about Friendly Captcha, please see the privacy policy at the following link: https://friendlycaptcha.com/de/privacy/gdpr/?

7. SSL Encryption

To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. SSL) via HTTPS. You can recognize an encrypted connection by the string https:// and the lock symbol in your browser line.

8. changes or additions

We reserve the right to make changes or additions to the information content at any time and without notice. If sections or individual terms of this statement are not legal or correct, the content or validity of the other parts remain uninfluenced by this fact.

Status: 25.04.2023