Privacy Policy

Data protection declaration of GMS GOURMET GmbH

The protection of your personal data and your privacy is very important to us. We process your personal data exclusively within the framework of the provisions of the General Data Protection Regulation (GDPR) and the Data Protection Act (DSG). In the following we inform you about our company as well as the type, scope and purpose of data collection and use:

Contact details of the person responsible

GMS GOURMET GmbH
Oberlaaer Straße 298
1230 Vienna
Tel. +43 (0) 50/8760

dsgvo@gourmet.at

Our privacy policy explains:

• what information we collect and for what reason;

• how we use that information;

• their data subject rights

We only process personal data on one of the following legal bases:

• their consent

• on a contract basis

• in the legitimate interest

Data is processed on the website exclusively on the basis of the statutory provisions (GDPR, DSG, TKG 2021).

You have the right to revoke your consent with effect for the future at any time, free of charge and without giving reasons. Please contact us about this dsgvo@gourmet.at.

1. Data Collection and Use

contact form

You can use a contact form to send us enquiries, suggestions and requests. In order to be able to contact us, it is necessary for you to send us your data. You must also enter a text in the appropriate field.

You acknowledge that the aforementioned data will be processed by us for the purpose of processing or answering your request. If you do not provide this information, we cannot process your request.

Legal bases:

• Consent in accordance with Article 6 (1) (a) GDPR
• Fulfillment of contract or pre-contractual measure in accordance with Article 6 Paragraph 1 lit. b GDPR

Storage duration:

The stored personal data will be deleted if your data is no longer required to fulfill the purpose for which it was stored or if you revoke your consent to storage, in each case in compliance with the statutory storage obligations.

Registration (customer account)

In order for you to be able to order goods in one of our web shops or for us to be able to provide you with our online service, you may need to register in advance. When registering, you must enter your data. Without providing this data, we cannot accept and process any orders or provide you with our service.

You acknowledge that the aforementioned data will be processed by us for the purpose of fulfilling the contract or for the purpose of pre-contractual measures.

Legal bases:

• Consent in accordance with Article 6 (1) (a) GDPR
• Fulfillment of contract or pre-contractual measure in accordance with Article 6 Paragraph 1 lit. b GDPR

Storage duration:

Orders via our online shop (webshop)

We need your data for the conclusion, execution and completion of your orders. These include e.g.:

• first name and last name
• Billing and shipping address
• E-Mail-Address
• Billing and payment data
• Telephone number.

The processing of the order processing includes, among other things, the dispatch of orders, the processing of your payment, the dispatch of electronic order confirmations and invoices or supporting customer service.

Legal bases:
• Consent in accordance with Article 6 (1) (a) GDPR
• Fulfillment of contract or pre-contractual measure in accordance with Article 6 Paragraph 1 lit. b GDPR

Storage duration:
The deletion of the stored personal data takes place when your data is no longer required to fulfill the purpose for which it was stored (e.g. order processing, processing of warranty and damage claims, etc.) in compliance with the statutory storage obligations.

coupons

We use the data provided when ordering vouchers to check and process the order and to send and redeem the voucher. This also includes the logging and processing of data related to the use of vouchers, in particular to prevent fraud.

For these purposes we also store the following data:

• Voucher value
• Voucher type
• Voucher Number / Code
• payment method, if applicable
• Where applicable, order date or date of issue

Legal bases:

• Consent in accordance with Article 6(1)(a) GDPR
• Performance of a contract or pre-contractual measure in accordance with Article 6(1)(b) GDPR

Storage duration:

Your personal data will be deleted if your data is no longer required to fulfill the purpose for which it was stored or if you revoke your consent to storage, in each case in compliance with the statutory storage obligations.

Server-Log

When you visit this website, the browser used on your device automatically sends information to our website server. This information is temporarily stored in a so-called log file. The following information is recorded without your intervention and stored until it is automatically deleted:

• IP address of the computer to be queried,
• date and time of access,
• Name and URL of the retrieved file,
• origin website (referrer URL),
• Browser used and, if applicable, the operating system of your computer and the name of your access provider.

The ability to use this data for purposes such as

• ensuring a smooth connection establishment of the website,
• ensuring comfortable use of our website,
• the evaluation of the system security and stability as well as
• for other administrative purposes

to use, is currently perceived by us. Under no circumstances will the data collected be used to draw conclusions about your person.

Legal bases:
our legitimate interests in accordance with Article 6 (1) (f) GDPR

Storage duration:
6 months from investment

2. Rights of data subjects

You have the right to information about the personal data we process about you, its origin and recipient, its storage period and the purpose of the data processing. Upon written request, we will be happy to inform you at any time about the data stored about you.

If your data processed by us is incorrect or incomplete, you can request that it be corrected or completed. We will correct or complete your data immediately. If it is unclear whether the data processed about you is incorrect or incomplete or whether it is being processed unlawfully, you can request that the processing of your data be restricted until this question has been finally clarified.

You can also request the deletion of unlawfully processed personal data. Please note, however, that this only applies to incorrect, incomplete or unlawfully processed data. You also have the right to object to data processing relating to your person, provided that this data processing is based on the legal basis of our legitimate interest.

Should you wish to make use of your rights, please contact us at dsgvo@gourmet.at to contact.

We cannot process requests for data subjects without prior successful identification. For this reason, we ask you to support the identification process accordingly and to enclose a copy of your ID with your request.

If you come to the conclusion that the processing of your data violates data protection regulations or your data protection claims have otherwise been violated in any way, you can complain to the supervisory authority. In Austria, this is the data protection authority, Barichgasse 40-42, 1030 Vienna.

3. Newsletter

You can give us your consent to send you newsletters. We use our newsletter to inform you about news relating to our company, seasonal offers, our products, promotions, competitions, etc. For this we need your e-mail address, and in the case of personalized newsletters also your salutation and first and last name, which you gave us when you subscribed to the newsletter. announce registration.

Legal bases:

• Consent in accordance with Article 6(1)(a) GDPR fulfillment of contract or pre-contractual measure in accordance with Article 6(1)(b) GDPR
• Our legitimate interests in accordance with Article 6 (1) (f) GDPR

Storage duration:

You have the right to revoke your consent with effect for the future at any time, free of charge and without giving reasons. Please contact dsgvo@gourmet.at. You can also unsubscribe from the newsletter at any time by clicking on the unsubscribe link provided in each newsletter/mailing. If you revoke your consent, your personal data will be blocked or deleted as a matter of routine and in accordance with the statutory provisions, unless the law provides otherwise.

Double opt-in and logging

Registration for our newsletter takes place in a so-called double opt-in procedure. This means that after registration you will receive an e-mail in which you will be asked to confirm your registration. The registrations for the newsletter are logged in order to be able to prove the registration process in accordance with the legal requirements. This includes storing the time of registration and confirmation as well as the IP address.

Statistical survey and analysis

When accessing the newsletter, technical information such as information about the browser and your system, as well as your IP address and the time of access are initially collected. This information is used to technically improve the services based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or the access times. The statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to the individual newsletter recipients. However, it is not our aim to monitor individual users. The evaluations serve much more to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users

Newsletter Tracking

Our newsletters contain so-called tracking pixels (web bugs), which we can use to recognize whether and when an e-mail was opened and which links in the e-mail were followed by the personalized recipient. This data is stored by us so that we can optimally tailor our newsletter to the wishes and interests of our subscribers. Accordingly, the data collected in this way is used to send personalized newsletters to the respective recipient.

The data processing takes place on the basis of your consent in accordance with Article 6 (1) (a) GDPR. With the revocation of the consent to receive the newsletter, the consent to tracking is also revoked.

4. Data Transfer/Data Transmission

data transmission

Your personal data will not be transmitted to third parties (e.g. insurance companies, courts, authorities, banks, tax consultants, accountants, companies within our group of companies, etc.) and processors (e.g. IT service providers) for purposes other than those listed below.

We only share your personal information when:

• You have given your express consent to this in accordance with Art. 6 (1) (a) GDPR,
• the transfer according to Art. 6 Paragraph 1 lit. f GDPR is necessary to safeguard operational interests and to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding legitimate interest in not disclosing your data , • in the event that there is a legal obligation for disclosure under Article 6 Paragraph 1 lit. c GDPR, and
• This is permitted by law and required for the processing of contractual relationships with you in accordance with Article 6 (1) (b) GDPR.

The processing of the data by the processor takes place exclusively for the fulfillment of the order and in accordance with our instructions. You can find the list of processors of GMS GOURMET GmbH here.

We also reserve the right to port any personal information we have about you if we sell or transfer all or a portion of our business or assets (including in the event of a reorganization, dissolution or liquidation).

data transfers

We may also transfer your personal information to countries outside of the country where the information was originally collected. These countries may not have the same data protection laws as the country where you originally provided the personal information.

If we transfer your information to other countries, we will protect that information as described in this Privacy Policy and such transfers will be governed by applicable law. The countries to which we transfer the personal data are located

• within the European Union or
• Outside the European Union

If we transfer personal data from the European Union to countries or international organizations outside the European Union, the transfer takes place on the basis:

• an adequacy decision by the European Commission;
• In the absence of such due to other legally permissible reasons such as the existence of a legally binding and enforceable document between the authorities or public bodies, binding internal company rules, standard data protection clauses and approved or certified codes of conduct.

In exceptional cases, data can also be transferred on the basis of Art. 49 GDPR:

• Art. 49 (1) (a) GDPR, the data subject has expressly consented to the proposed data transfer after being informed of the possible risks for them of such data transfers without the existence of an adequacy decision and without suitable guarantees,
• Art. 49 (1) (b) GDPR, the transmission is necessary for the performance of a contract between the data subject and the person responsible or for the implementation of pre-contractual measures at the request of the data subject,
• Art. 49 (1) (c) GDPR, the transmission is required to conclude or to fulfill a contract concluded in the interests of the data subject by the person responsible with another natural or legal person.

5. Google-Tools

Google AdWords and Google Conversion Tracking

This website uses the online advertising program “Google AdWords” and, as part of this, the “Google Ads Conversion”. Google AdWords places a cookie on your computer when you land on our website via a Google ad. These cookies usually lose their validity after 30 days and are not used to identify you personally. If the user visits certain pages of our website and the cookie has not yet expired, we and Google can recognize that the user clicked on the ad and went to the website www.eshop.gerstner-konditorei.at was forwarded. For this cookie, the unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marking that the user does not wants to be addressed more) is saved. Each Google AdWords customer is assigned a different cookie. This means that cookies cannot be tracked via the website of AdWords customers. We ourselves do not collect or process any personal data in the advertising measures mentioned. We only receive statistical evaluations from Google. Based on these evaluations, we can see which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising material, in particular we cannot identify the user based on this information. Due to the marketing tool used, your browser automatically establishes a direct connection to the Google server. We have no influence on the scope and further use of the data collected by Google through the use of this tool and are therefore informing you according to our state of knowledge: By integrating Google Ads Conversion, Google receives the information that you have accessed the corresponding part of our website or clicked on one of our advertisements. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, there is a possibility that Google will find out and store your IP address.

Users who do not wish to participate in the tracking can easily deactivate the Google conversion tracking cookie via their Internet browser under the user settings. These users are not included in the conversion tracking statistics.

"Conversion cookies" are stored on the basis of your consent in accordance with Article 6(1)(a) GDPR. If you would like to find out more about the Google privacy policy and terms of use, you can find more information under the following link: https://policies.google.com/privacy?hl=de

Google Analytics Remarketing

The website www.eshop.gerstner-konditorei.at uses the functions of Google Analytics Remarketing in connection with the cross-device functions of Google AdWords. The provider is Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA. This function makes it possible to link the advertising target groups created with Google Analytics Remarketing to the cross-device functions of Google AdWords. In this way, interest-related, personalized advertising messages that have been adapted to you depending on your previous usage and surfing behavior on one end device (e.g. mobile phone) can also be displayed on another of your end devices (e.g. tablet or PC).

If you have given your consent, Google will link your web and app browser history to your Google account for this purpose. In this way, the same personalized advertising messages can be placed on every device on which you log in with your Google account.

In support of this feature, Google Analytics collects Google-authenticated user IDs, which are temporarily linked to our Google Analytics data to define and create target groups for cross-device advertising.

You can permanently object to cross-device remarketing/targeting by deactivating personalized advertising in your Google account; follow this link: https://support.google.com/ads/answer/2662922

The data collected is summarized in your Google account solely on the basis of your consent (Art. 6 Para. 1 lit. a GDPR), which you give to Google. You can revoke this consent at any time without giving reasons with effect for the future. In the case of data collection processes that are not merged in your Google account (e.g. because you do not have a Google account or have objected to the merger), the collection of the data by us is also based on your consent (Art. 6 Para. 1 lit. a GDPR) that you have given us. You can revoke this consent at any time without giving reasons with effect for the future.

Further information can be found here: https://www.google.com/policies/technologies/ads/.and here: https://support.google.com/google-ads/answer/7664943?hl=de&ref_topic=3122875

Use of Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. ("Google"). Google Analytics uses so-called "cookies", text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. If IP anonymization is activated on this website, however, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area.

Only in exceptional cases will the full IP address be sent to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website activity and internet usage to the website operator. Your usage data will not be passed on to third parties. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

You can prevent the storage of cookies by setting your browser software accordingly; we would like to point out to you however that in this case you will if applicable not be able to use all functions of this website in full. You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address) and from processing this data by Google by downloading the browser plug-in available under the following link and install: https://tools.google.com/dlpage/gaoptout?hl=de

6. SSL Encryption

In order to protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. SSL) via HTTPS. You can recognize an encrypted connection by the character string https:// and the lock symbol in your browser line.

7. Website and Use of Cookies

We use so-called cookies on various pages. These are small text files that are stored on your end device. Some of the cookies we use are deleted after the end of the browser session, i.e. after closing your browser (so-called session cookies). Other cookies remain on your end device and enable us or our partner companies to recognize your browser on your next visit (persistent cookies).

You can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them or exclude the acceptance of cookies for certain cases or in general. If cookies are not accepted, the functionality of our website may be restricted.

Our website can generally be used without providing your personal data. Only the information provided by your Internet provider (in particular IP address, browser used) and the duration and time of your visit are collected. This data is stored by us for the duration of the website visit; an evaluation is carried out exclusively for statistical purposes while maintaining the anonymity of the individual users.

We process the personal data collected as a result of using our website for the following purposes:

to make this website available to you and to further improve and develop this website;
to be able to create usage statistics;
to detect, prevent and investigate attacks on our website;
to be able to process your request

The legal basis for the processing of your personal data in connection with the use of our website is your consent and/or our overriding legitimate interest, which is to achieve the purposes specified above. We expressly point out that you have the right to revoke your consent at any time.

8. Changes or additions

We reserve the right to make changes or additions to the information content at any time and without prior notice. If parts or individual formulations of this text do not, no longer or not completely correspond to the applicable legal situation, the remaining parts of the document remain unaffected in their content and validity.

Stand: 25.04.2023