Privacy Policy For The Restaurant Business
1. INTRODUCTION
Dealing sensitively with your personal information is of greatest importance for DO & CO im Haas Haus Restaurantbetriebs GmbH, Stephansplatz 12, 1010 Vien, Tel: +43 1 535-3969 ("DO & CO STEPHANSPLATZ", "we"). Thus, we process your personal data solely in accordance with the laws, particularly the EU General Data Protection Regulation ("GDPR"), the applicable Austrian Data Protection Act 2018 ("DPA").
In the following we will inform you about which information we process, if you as customer or prospective customer, supplier or as contact person of a customer or prospective customer make use of our restaurant services, including event services (e.g., for private events), or are interested in these services.
2. WHAT ARE PERSONAL DATA?
Personal data is information that can be used on its own or with other information to identify a natural person. This includes, for example, your name, email address, address, bank and account data etc.
3. WHAT INTEREST DOES DO & CO STEPHANSPLATZ HAVE IN YOUR PERSONAL DATA AND FOR WHICH REASON AND PURPOSE IS DO & CO STEPHANSPLATZ ENTITLED TO PROCESS YOUR DATA?
3.1. RESERVATIONS AND CONSUMPTIONS IN OUR RESTAURANT
We process the following personal data in connection with our restaurant services, if you make use of our services offer:
If you, as a private person, make use of our restaurant services or submit a respective request, we process your name; salutation; title; address and VAT number (if relevant for invoicing); telephone number for check-backs regarding reservations; date of birth, if indicated by you and relevant for the provision of services (e.g., birthday dinner); civil status, if indicated by you and relevant for the provision of services (e.g., engagement dinner); data of a possible limited physical mobility, if indicated by you; credit card data for guarantee purposes at reservations involving a higher amount of food & beverage; care and consumption data; data of family members or other third persons, if indicated by you and relevant for the provision of services; reason for reservation or occasion, if indicated by you as well as reservation date and time; health data (e.g., physical disabilities, allergies and intolerances), if provided by you voluntarily for the contract fulfilment and if you consent to the processing; other data provided by you in relation to the reservation, if relevant (e.g., smoker or non-smoker) and data provided in connection with complaints or positive feedback; data in connection with misbehavior or criminal acts due to prior behavior or information by any authority (e.g., bill-dodging, fraud or other misbehavior in the context of a restaurant visit).
If the customer or prospective customer is an entrepreneur and an assignment to/identification of the (a) person is possible, we additionally process the following data: company name; VAT number; business, branch and professional title and designation.
If prospective customers and customers book the event via contact persons, we – with regard to the contact persons – process additionally the name; salutation; associated customer; telephone and fax number; correspondence language; function or task area with the customer or prospective customer; business address of the enterprise.
When suppliers are used, we also process the company number and the certification level of the company as well as compliance with certain quality standards (e.g., Halal certification) of the supplier.
We process this data for the purpose of receiving and processing customer reservations for our restaurant; transmitting customer data to other DO & CO restaurant companies (in particular for exchanging customer behavior, including consumption data) in line with our service concept; forwarding consumption data to the centralized controlling and accounting department of DO & CO Aktiengesellschaft; forwarding customer complaints to the centralized complaint management and quality management department of DO & CO Aktiengesellschaft and for orders of services provided by external suppliers (e.g., flower suppliers or DO & CO Pastry GmbH) and for entering the data into the reservation and booking system.
We thus process your data in order to fulfill our contractual obligations towards you and based on your voluntary consent. We further process data in connection with limited physical mobility and other physical impairments also on the basis of our legal obligation to guarantee a barrier-free access.
3.2. BOOKINGS AND ORGANISATION OF EVENTS
We process the following personal data in connection with our event services, if you book an event (e.g., birthday parties, baptismal celebrations, company celebrations etc.) with us or submit a respective request:
If you, as a private person, book our event services or submit a respective request, we process your name; salutation; title; address (if relevant for invoicing); date of birth (if you are a special customer in accordance with point 3.3 below, or if this data is relevant for the event); civil status (if relevant for the event); data on any physical disability; health data (e.g., allergies and intolerances), if such data have been voluntarily provided by you in relation with our contract and if you have consented to the processing of such data; credit card details (also for guarantee purposes); the delivery and performance objects; contact details of the person in charge for processing deliveries or services; delivery and service conditions (including details of the place of delivery or service, etc.); financing and payment terms; bank details; data in relation to dunning and complaints; deficiencies in performance; event dates (type of event, date, number of persons attending the event) and other relevant data provided by the customer for the respective event and data in connection with customer complaints or feedback.
If the customer or prospective customer is an entrepreneur and an assignment to/identification of the (a) person is possible, we additionally process the following data: company name; VAT number; business, branch and professional title and designation.
If prospective customers and customers book the event via contact persons, we – with regard to the contact persons – process additionally the name; salutation; associated customer; telephone and fax number; correspondence language; function or task area with the customer or prospective customer; business address of the enterprise.
When suppliers are used, we also process the company number and the certification level of the company as well as compliance with certain quality standards (e.g., Halal certification) of the supplier.
We process this data for the purpose of receiving customer orders (event bookings); processing customer orders; transmitting the customer data to the production, to our event management department as well as to the invoicing / merchandising department; for the purpose of forwarding customer complaint data to the centralized complaint and quality management department of DO & CO Aktiengesellschaft and for the purpose of forwarding this data to the marketing and graphics department of DO & CO Aktiengesellschaft (e.g., for graphical processing and design of photos or other customer-specific orders, but not for purposes of direct marketing) and to the centralized controlling and accounting department of DO & CO Aktiengesellschaft or for orders of services provided by external suppliers (e.g., DO & CO Pastry GmbH) and for entering the data into the reservation and booking system.
We thus process your data in order to fulfill our contractual obligations towards you or based on your consent.
3.3. MANAGEMENT OF DATA OF SPECIAL CUSTOMERS
On request, DO & CO STEPHANSPLATZ is happy to manage your personal data in the special customer database and collect your name/company name, address, e-mail address, telephone number, date of birth, specified demand interests; preferences (due to previous demand behavior or customer's own information); allergies; intolerances; care and consumption data; confession of religion, if the latter is provided voluntarily by you and is relevant for the services of DO & CO STEPHANSPLATZ as well as any other data provided by you in relation to the service contract and data in connection with your feedback. With your explicit consent, we process this data for the central management of data of our special customers and for providing an all-inclusive customer service, considering the individual customer behavior and needs.
For the purposes described above your personal data will also be submitted to affiliated companies of DO & CO STEPHANSPLATZ (to DO & CO Aktiengesellschaft, Stephansplatz 12, 1010 Vienna, Tel: +43 (1) 74 000-1001; to DO & CO Albertina GmbH, Albertinaplatz 1, 1010 Vienna, Tel: +43 (1) 5329669 and to K.u.K Hofzuckerbäcker Ch. Demel's Söhne GmbH, Kohlmarkt 14, 1010 Vienna, Tel .: +43 (1) 535 17 17 - 0), so that these companies may also render individual services and may contact you per e-mail for the above-mentioned purposes.
We therefore process your data based on your given consent (Art 6 (1) (a) and Art 9 (2) (a) GDPR).
You can revoke your consent at any time for all or individual purposes with effect for the future (e.g., via e-mail to datenschutz@doco.com).
3.4. NEWSLETTER
If you have registered for our newsletter, we process the data provided by you when using the services of our restaurant (name/company name, e-mail address, date of birth) for the purpose of sending you personal greeting cards, DO & CO STEPHANSPLATZ event invitations, coupons, for promotional contact and provision with marketing and product information related to the DO & CO STEPHANSPLATZ’s goods and services and for satisfaction surveys per e-mail which aim at improving our services and advice.
We therefore process your data based on your given consent (Art 6 (1) (a) and Art 9 (2) (a) GDPR).
You can revoke your consent at any time for all or individual purposes with effect for the future (e.g., via e-mail to datenschutz@doco.com).
3.5. GUEST HOSPITALITY
In connection with our hospitality services at and organization of events, we also process the following personal data of guests (if this information is provided voluntarily and/or is relevant for the event): name (eg, for place cards or meetings); salutation; business and private address; professional, branch and business name and function of the person concerned; date of birth and civil status; data on physical disabilities or other health data (including allergies and intolerances) and whether they are smokers or non-smokers.
We process this data in order to fulfil our service obligations towards you and thus based on our (pre-) contractual obligations towards you.
We also process photos and other visual material of your person at the event, if you have consented thereto.
On behalf of our customer, we also process photos and other visual material of your person at the event.
3.6. COMPLAINTS AND FEEDBACK
If you address complaints or feedback to us, we process the information provided by the customer in connection with complaints or positive feedback and, where appropriate, the contact details provided by the customer in order to deal with these inquiries. Therefore, we process the personal information based on our legitimate interests to improve our customer service.
4. TRANSFER TO THIRD PARTIES
In addition to the above-mentioned data transfers, we transfer your personal data to the extent necessary to external agents or service providers:
- to the following group companies to assist with the provision of services and thus to fulfill the contract (reservations/event bookings; orders for cakes and other patisseries; orders for equipment; logistics) or on the basis of our legitimate interests in the exchange of information about reservations/event bookings and about customer preferences and customer feedback (shared access to our booking and reservation system) within the DO & CO Group:
- DO & CO Pastry GmbH
Dampfmühlgasse 5, 1110 Wien
Tel.: +43 (1) 74000 - DO & CO Gourmet Kitchen Cold GmbH
Dampfmühlgasse 5, 1110 Wien
Tel.: +43 (1) 74000 - DO & CO Gourmet Kitchen Hot GmbH
Dampfmühlgasse 5, 1110 Wien
Tel.: +43 (1) 74000 - DO & CO Catering & Logistics Austria GmbH
Stephansplatz 12, 1010 Wien
Tel.: +43 (1) 74000 - DO & CO Event Austria GmbH
Stephansplatz 12, 1010 Wien
Tel.: +43 (1) 74000 - K.u.K. Hofzuckerbäcker Ch. Demel's Söhne GmbH
Kohlmarkt 14, 1010 Wien
Tel.: +43 (1) 535 17 17 – 0 - DO & CO Albertina GmbH
Albertinaplatz 1
1010 Wien
Tel.: +43 (1) 532 96 69 - DO & CO Aktiengesellschaft
Mahlerstraße 9/1, 1010 Wien
Tel.: +43 (1) 535 06 44
- DO & CO Pastry GmbH
- to other external third parties for the fulfilment of our contractual obligations towards the customer (eg, flower supplier or decoration supplier for ordering various articles for events);
- to other external third parties to the extent necessary (eg, accountants, insurance companies in the insurance event, legal advisors as the occasion arises, etc);
- to authorities and other public bodies to the extent required or mandatory (eg, district municipal authority etc);
- to offices (registry office) for transmitting information in case of weddings, if required by the customer.
5. STORAGE DURATION
Your personal data will be stored by us only for as long as required to fulfil our obligations towards you. However, due to our statutory retention obligations, we store your personal data provided in connection with a contractual relationship for a maximum of seven years after contract fulfilment.
We store your personal data provided in course of requests, feedback and complaints for a period of six months after answering your request in order to respond to any follow-up questions and in order to implement any required measures. This storage is based on our legitimate interests. So, DO & CO STEPHANSPLATZ has to develop a user-friendly customer support and to strengthen the company's reputation. In this case, no overriding interests of you exist.
If you have consented to the registration as a regular customer, we store your data until you revoke such consent.
If you have only registered for our newsletter and the receipt of promotional information and are not a customer of us, we store your personal data until you revoke your consent and for a maximum of three years from our last contact. In addition, we store your data until the termination of any litigation in which the data is required as evidence.
6. DATA SECRECY
We take appropriate technical and organizational security measures to protect your personal data against accidental or unauthorized destruction, alteration or against loss, theft and unauthorized access, disclosure, reproduction, use, modification or access. In addition, we and our employees are obliged to maintain confidentiality and data secrecy. Likewise, our agents and data processors who need to have access to your personal data to fulfill their obligations towards us are obliged to the same obligations to maintain confidentiality and data secrecy.
7. YOUR RIGHTS AS DATA SUBJECT
You have the right to access the personal data concerning you that is being processed by us. Additionally, you have the right to rectification of inaccurate data and to erasure your data. You can furthermore be entitled to the right to restriction of processing of your data as well as the right to receive the personal data concerning you in a structured, commonly used and machine-readable format.
You also have a right to object to the use of your data at any time if the processing is done for purposes of direct marketing. Insofar as we process data for our legitimate interests, you additionally have the right to object at any time if reasons arise for this from your specific situation.
Apart from that you have the right to lodge a complaint with the supervisory authority. The competent authority for us is the Österreichische Datenschutzbehörde, Wickenburggasse 8, 1080 Vienna.
Should you have questions concerning your personal data, contact us:
DO & CO im Haas Haus Restaurantbetriebs GmbH
Stephansplatz 12, 1010 Wien
Tel: +43 1 535 39 69
E-Mail: stephansplatz@doco.com or datenschutz@doco.com
In order to be able to process your requests of the above mentioned data subject rights above and to ensure that personal data will not be disclosed to unauthorized third parties, please address the request by clearly identifying your person as well as a short description of the scope of the exercised data subject right listed above.