Privacy Policy

The protection of your personal data and your privacy is very important to us. We process your personal data exclusively in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). Below, we inform you about our company as well as the nature, scope and purpose of data collection and use:

Contact details of the responsible entity

GMS GOURMET GmbH
Oberlaaer Straße 298
1230 Vienna
Tel. +43 (0) 50/8760

dsgvo@gourmet.at

Our Privacy Policy explains:

• what information we collect and for what reason;
• how we use this information;
• your data subject rights.

We process personal data exclusively on one of the following legal bases:

• your consent
• on a contractual basis
• on the basis of legitimate interests

On the website, data is processed exclusively on the basis of statutory provisions (GDPR, DSG, TKG 2021).

You have the right to withdraw any consent you have given at any time with effect for the future, free of charge and without giving reasons. To do so, please contact dsgvo@gourmet.at.

• Server log

When you access this website, the browser used on your device automatically sends information to our website server. This information is temporarily stored in a log file. The following information is collected without any action on your part and stored until it is automatically deleted:

• IP address of the requesting computer,
• date and time of access,
• name and URL of the file accessed,
• referring website (referrer URL),
• browser used and, where applicable, the operating system of your computer and the name of your access provider.

We currently use the option of using this data for purposes such as

• ensuring a smooth connection to the website,
• ensuring convenient use of our website,
• evaluating system security and stability, and
• for further administrative purposes.

The collected data is never used to draw conclusions about your person.

Legal basis: our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR

Storage period: 6 months from creation

You have the right to obtain information about the personal data concerning you that we process, its origin and recipients, the storage period and the purpose of the data processing. Upon written request, we will be happy to inform you at any time about the data stored about you.

If the data concerning you that we process is incorrect or incomplete, you may request its rectification or completion. We will correct or complete your data without delay. If it is unclear whether the data concerning you that is being processed is incorrect or incomplete or is being processed unlawfully, you may request the restriction of the processing of your data until this matter has been finally clarified.

You may also request the deletion of unlawfully processed personal data. Please note, however, that this only applies to incorrect, incomplete or unlawfully processed data. You also have the right to object to data processing concerning you if such processing is based on our legitimate interests.

If you wish to exercise your rights, please contact us at dsgvo@gourmet.at.

We cannot process data subject requests without prior successful identification. For this reason, we ask you to support the identification process accordingly and to enclose a copy of your identity document with your request.

If you believe that the processing of your data violates data protection provisions or that your data protection rights have otherwise been infringed, you may lodge a complaint with the supervisory authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna

• Data disclosure

Your personal data will not be disclosed to third parties (e.g. insurance companies, courts, authorities, banks, tax advisors, public accountants, companies within our corporate group, etc.) or processors (e.g. IT service providers) for purposes other than those listed below.

We only disclose your personal data if:

• you have given your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR,

• disclosure is necessary pursuant to Art. 6 para. 1 lit. f GDPR to safeguard business interests and to assert, exercise or defend legal claims, and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed,
• there is a legal obligation for disclosure pursuant to Art. 6 para. 1 lit. c GDPR, and

• this is legally permissible and required pursuant to Art. 6 para. 1 lit. b GDPR for the performance of contractual relationships with you.

Data is processed by the processor exclusively for the fulfilment of the assignment and in accordance with our instructions. You can find the list of processors of GMS GOURMET GmbH here.

We also reserve the right to transfer personal data we hold about you if we sell or transfer all or part of our business operations or assets, including in the event of restructuring, dissolution or liquidation.

• Data transfers

We may also transfer your personal data to countries outside the country in which the information was originally collected. These countries may not have the same data protection laws as the country in which you originally provided the personal data.

When we transfer your data to other countries, we protect this data as described in this Privacy Policy, and these transfers are subject to the applicable law. The countries to which we transfer personal data are located

• within the European Union or
• outside the European Union.

If we transfer personal data from the European Union to countries or international organisations outside the European Union, the transfer is based on:

• an adequacy decision by the European Commission;
• in the absence of such a decision, on other legally permissible grounds, such as the existence of a legally binding and enforceable instrument between authorities or public bodies, binding corporate rules, standard data protection clauses as well as approved or certified codes of conduct.

In exceptional cases, a data transfer may also take place on the basis of Art. 49 GDPR:

• Art. 49 para. 1 lit. a GDPR: the data subject has explicitly consented to the proposed data transfer after having been informed of the possible risks of such transfers in the absence of an adequacy decision and appropriate safeguards,
• Art. 49 para. 1 lit. b GDPR: the transfer is necessary for the performance of a contract between the data subject and the controller or for the implementation of pre-contractual measures taken at the data subject’s request,

Art. 49 para. 1 lit. c GDPR: the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person

• Use of Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies”, text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to and stored on a Google server in the USA. If IP anonymisation is activated on this website, however, your IP address will first be shortened by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area.

Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity and provide further services relating to website and internet use to the website operator. Your usage data will not be passed on to third parties. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

You can prevent cookies from being stored by selecting the appropriate settings in your browser software; however, please note that in this case you may not be able to use all functions of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website, including your IP address, and from processing this data by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de

• Google Signals

We would like to inform you that we have activated Google Signals in Google Analytics. This gives us greater insight into the statistics of our website, particularly with regard to visitors to our website. If you have consented to personalised advertising in your Google Account, your visitor data from our website will be collected in Google Analytics and linked with the Google information from your Google Account.

Existing Google Analytics functions are updated in order to obtain aggregated and anonymised data: audiences can be created and shared with linked advertising accounts to deliver ads in cross-device remarketing campaigns, advertising reports are expanded, information on interests and demographic characteristics is collected, and cross-platform reports are enabled.

Your data may be analysed across devices (cross-device tracking). By activating Google Signals, data is collected and linked to your Google Account. Multiple visits to websites by a single visitor can thus be assigned exclusively to that visitor, even if the respective visitor interacts with the website via different devices, such as a smartphone and notebook. This helps us launch cross-device remarketing campaigns and display our products to you on other websites as well. Cross-device reports contain aggregated data only. Data of individual users is not disclosed.

By activating Google Signals, additional visitor data is collected on our website, such as device combinations used, purchasing processes across different devices and cross-device marketing performance. This enables Google to provide us with improved advertising reports.

Information about your interests and demographic characteristics, such as gender and age, is also collected. This makes it possible to define audiences in Google Analytics, and we have the opportunity to adapt our products to these audiences.

You can manage and delete this data in your Google Account. Data from Google Signals is stored in our Google Analytics account for a maximum of 14 months. By default, the data of signed-in Google users expires after 26 months.

Further information on Google Signals can be found here: https://support.google.com/analytics

To protect the security of your data during transmission, we use encryption methods that correspond to the current state of the art, such as SSL via HTTPS. You can recognise an encrypted connection by the string https:// and the lock symbol in your browser bar.

We reserve the right to make changes or additions to the informational content at any time and without prior notice. If parts or individual formulations of this text do not, no longer or do not fully correspond to the applicable legal situation, the remaining parts of the document shall remain unaffected in their content and validity.

Version: 04/05/2026