Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Cumpania OG / GastroSupport
Am Irrsee 30
4893 Tiefgraben
Austria
Email: office@gastrosupport.at

Vjekoslav Ostojić is responsible for the content and operational implementation.

2. Legal bases for processing

We process personal data only to the extent legally permissible and necessary for the respective purpose. Depending on the process, we rely in particular on the following legal bases:

• Art. 6 Abs. 1 lit. b DSGVO for pre-contractual measures and performance of a contract, especially for enquiries and the Gastro Performance Check,
• Art. 6 Abs. 1 lit. c DSGVO for legal obligations, in particular tax and company-law retention duties,
• Art. 6 Abs. 1 lit. f DSGVO for legitimate interests in the secure, stable and traceable operation of the website and prevention of misuse,
• Art. 6 Abs. 1 lit. a DSGVO, where we expressly ask you for voluntary consent in a specific case.

3. Website access and server data

When you access our website, technically necessary connection data may be processed. This may include, in particular, IP address, date and time of access, page or file requested, amount of data transferred, referrer information, browser type, operating system, and technical status and error data.

This processing serves to deliver the website, maintain stability, analyse errors, detect misuse and attacks, and ensure technical security. The legal basis is Art. 6(1)(f) GDPR. Server and security logs are retained only for as long as necessary for operation, error analysis and security; in the event of specific security incidents, affected logs may be retained for longer for investigation and legal enforcement.

4. Contact form and email

If you contact us via the contact form or by email, we process the information you provide. For the contact form, this includes in particular your name, email address, selected consulting package and message.

The data is used to process your enquiry, for follow-up questions and, where applicable, to prepare a contract. The legal basis is Art. 6(1)(b) GDPR; where the enquiry is not related to a contract, processing is based on our legitimate interest in handling incoming communications pursuant to Art. 6(1)(f) GDPR.

Website emails are currently sent via Yaahh - Netzwerktechnik.

5. Gastro Performance Check

For the paid Gastro Performance Check, we process the data required for payment, activation, performance, evaluation and communication. This may include:

• name and email address,
• internal case and payment references, payment status and transaction data,
• your information in the online questionnaire, in particular commercial and organisational information about the hospitality business or concept,
• documents and file attachments voluntarily provided by you or provided for processing,
• technical status, delivery and log data to the extent required for performance and traceability.

Processing is carried out to perform the booked Gastro Performance Check pursuant to Art. 6(1)(b) GDPR. Data required for accounting, tax obligations, or the defence or enforcement of claims may additionally be retained on the basis of Art. 6(1)(c) or (f) GDPR.

While you complete the Performance Check form, your entries are additionally stored locally in your browser. This local copy is removed after successful submission; you can remove it at any time by deleting the website data in your browser.

6. Payment via Stripe

Online payment for the Gastro Performance Check is processed via Stripe. When you actively start the payment process, you are redirected to a payment page provided by Stripe. Stripe processes in particular payment, transaction, device and security data as well as the information you enter during payment.

According to Stripe’s contractual documentation, accounts operated in the European Economic Area involve in particular Stripe Payments Europe, Limited, Ireland. Stripe processes data partly as a processor and partly under its own data protection responsibility, for example for payment processing, fraud prevention and compliance with regulatory obligations.

Stripe may also process data outside the European Economic Area. Stripe cites, among other safeguards, adequacy mechanisms, the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses.

Further information: Stripe Privacy Policy.

7. Cookies and local storage

This website currently uses no analytics, advertising or marketing cookies. Only technically necessary cookies and local browser storage are used:

Technically necessary storage mechanisms are required for the requested functionality and may be used without consent. If analytics, marketing or comparable non-essential services are used in the future, an appropriate consent solution will be implemented beforehand.

8. Online withdrawal

If you, as a consumer, withdraw from a contract concluded online, we process the data provided in the online withdrawal form to identify the contract, process the withdrawal and send confirmation of receipt. The legal basis is Art. 6(1)(c) GDPR in conjunction with statutory consumer-law obligations and Art. 6(1)(b) GDPR.

9. Recipients and service providers

Personal data is disclosed only where required for the respective purpose, where a legal obligation exists, or where another legal basis applies. Possible categories of recipients include in particular:

• web hosting, server and technical IT service providers,
• email/SMTP service providers,
• Stripe and banks or payment service providers involved in the payment process,
• tax advisers, accounting providers, legal advisers or other professional advisers where required,
• authorities, courts or other public bodies where there is a legal obligation.

Processors are contractually bound in accordance with Art. 28 GDPR where required.

10. Retention period

We generally retain personal data only for as long as necessary for the respective purpose. Thereafter, data is deleted or anonymised unless statutory retention obligations, legitimate evidentiary interests or ongoing proceedings require otherwise.

Business and accounting records may generally need to be retained for seven years under tax and company-law rules. Enquiries and project documents are retained after completion only for as long as necessary for contract performance, documentation, and the assertion or defence of possible claims.

11. Your data protection rights

Subject to the statutory requirements, you have in particular the right of access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

To exercise your rights, simply send a message to office@gastrosupport.at. To prevent unauthorised disclosure of data, we may request suitable proof of identity.

You also have the right to lodge a complaint with the competent supervisory authority:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Wien
Email: dsb@dsb.gv.at
www.dsb.gv.at

12. Automated decision-making and profiling

GastroSupport does not carry out solely automated decision-making with legal or similarly significant effects on this website, nor does it conduct profiling for marketing purposes.

13. Updates to this Privacy Policy

We update this Privacy Policy when functions, service providers or legal requirements change. The version published on this website at the relevant time applies.