Privacy Policy

This privacy policy applies to the Papaburrito website (www.papaburrito.ch). It does not apply to other websites that we may link to.

We are pleased that you are visiting our website and thank you for your interest. Below we provide information about how we handle your personal data when you use our website.

Personal data in this sense is all data that can be used to personally identify you. We always treat your personal data confidentially and in accordance with statutory data protection regulations. In particular, we are proud to comply with the provisions of the Swiss Data Protection Act (DSG) and the General Data Protection Regulation of the European Union (DSGVO), as well as this privacy policy.

Who is responsible for data collection on this website?

The data processing on this website is carried out by

Swiss Bar Group GmbH

Kornhausplatz 14

3011 Bern

Legal form: Limited liability company

Registered office: Bern

UID: CHE-110.125.164

CH-ID: CH-035-4031753-9

EHRA-ID: 708939

W: www.papaburrito.ch

T: 031 311 98 82

Our principles:

Papa Burrito respects your right to privacy and is committed to the following principles:

• We protect your privacy and are committed to providing you with a service tailored to your needs.
• Personal data is collected for specific purposes based on your consent or a legitimate interest when you contact us.
• You have the right to request information and access to your personal data at any time and you can request that it be corrected or deleted.
• We do not sell your personal data to third parties. However, if necessary, and if you have been expressly informed or have given your consent, we may pass your data on to group companies, brand licensees, partners, and other service providers. In this case, their own data protection statements may also apply.
• We take all reasonable measures to ensure the security and protection of your data against misuse.

What rights do you have with regard to your data?

With regard to the data processing described in more detail below, users and data subjects have the right to:

• obtain confirmation as to whether or not data concerning them is being processed;
• obtain information about the data being processed, obtain further information about the data processing, and obtain copies of the data;
• have inaccurate or incomplete data corrected or completed;
• the immediate deletion of data concerning them;
• receive the data concerning them and provided by them and to transmit this data to other providers/controllers;
• file a complaint with the supervisory authority if they believe that the data concerning them is being processed by the provider in violation of data protection regulations.

The provider is also obliged to inform all recipients to whom it has forwarded data about any correction or deletion of data or the restriction of processing. However, this obligation does not apply if such notification is impossible or involves a disproportionate effort. Regardless of this, the user has a right to information about these recipients.

Likewise, users and data subjects have the right to object to the future processing of their data, insofar as it is processed by the provider. In particular, an objection to data processing for the purpose of direct mail is permissible.

The above rights may be limited under certain circumstances, such as when fulfilling your request would reveal personal information about another person, when you ask us to delete information that we are legally obligated to store, or when we have compelling legitimate interests in keeping the information. We will let you know if this is the case and will then only use your data for those purposes. You may no longer be able to use our services if you want us to stop processing your personal data.

We ask that you contact us if you have any concerns about the way we collect or use your personal information.

The legal bases for processing

The following are the legal bases for processing, at least one of which must apply when we process personal data:

• Consent: the data subject has unambiguously consented to personal data being processed for a specific purpose;
• Contract: the processing is necessary for a contract or because you have asked us to take certain steps before entering into a contract;
• Legal obligation: processing is necessary for us to comply with the law (this does not apply to contractual obligations);
• Vital interests: processing is necessary to protect someone’s life;
• Public task: processing is necessary for us to perform a task in the public interest or for an official function, and the task or function has a clear legal basis;
• Legitimate interests: the processing is necessary for the purposes of our legitimate interests or those of a third party, unless there is a good reason to protect your personal data that overrides those legitimate interests.

Processing of special categories of data

No special categories of data are processed.

Automated decision-making and profiling

We do not use automated decision-making or profiling.

Children’s data

Our website is not intended for children, and we do not knowingly collect data about children. If you discover that your child has provided us with personal data without parental consent, please contact us so that we can take the necessary steps to remove this data from our server.

What are the categories of data subjects?

Customers, prospects, visitors and users of our online offerings, business partners. Visitors and users of our online offerings. Below, we refer to the data subjects collectively as “users”.

Collection, use, and storage of personal data

When you use our online offerings, Papa Burrito collects various data from you, including “personal data”. This is information that relates to an identified or identifiable natural person (hereinafter the “data subject”).

Visiting the Papa Burrito website in general

When you visit the Papa Burrito website, you (due to technical necessities) transmit data to our web server via your internet browser. The following data is stored during communication between your internet browser and our web server while a connection is active:

• Date and time of the request
• Name of the requested file
• Page from which the file was requested
• Access status (file transferred, file not found, etc.)
• Web browser and operating system used
• Full IP address of the requesting computer
• Amount of data transferred

For reasons of technical security, in particular to prevent attempts to attack our web server, we store this data for a short period of time. It is not possible for us to draw conclusions about individual persons on the basis of this data; the legal basis for the storage is our legitimate interest.

Cookies

We use cookies on our website. Cookies are small text files or other storage technologies that are stored on your end device by the internet browser you use. These cookies are used to process certain information about you individually, such as your browser or location data or your IP address.

This processing serves to make our offerings more user-friendly, effective, and secure. The legal basis for this processing is a contract, provided that this cookie data is processed for the purpose of initiating or executing a contract. If the processing does not serve to initiate or execute a contract, our legitimate interest lies in improving the functionality of our website. In this case, the legal basis is our legitimate interest.

If you would like to learn more about cookies in general and how they work, please visit https://ico.org.uk/your-data-matters/online/cookies/ or www.allaboutcookies.org.

Additional personal data is only collected if you provide this information voluntarily, for example, in the context of an inquiry. Papaburrito uses the personal data you provide to answer your inquiries, process your order, and for the technical administration of the websites, depending on the subject area. In detail, the use in the respective areas is as follows:

Contact requests and contact options

If you contact us using the contact form, social media or by telephone, the data you provide will be used to process your request. The provision of the data is necessary for processing and answering your request – without the provision of this data, we cannot answer your request or can only answer it to a limited extent. The legal basis is the execution of a contract. If the processing does not serve to initiate or execute a contract, our legitimate interest lies in improving the functionality of our website. In this case, the legal basis is our legitimate interest. Your data will be deleted as soon as your request has been finally answered and there are no legal storage requirements, e.g. for subsequent contract processing.

Order process

We process the personal data that you provide to us when you place your order. This personal data is required to process and confirm your order and to evaluate your order, the payment, and any possible reimbursement. The legal basis for this processing of personal data is that it is necessary for the execution of a contract. We process the following personal data in the ordering process:

• Name
• Address data
• Contact details
• Order data
• Payment data
• Comments (if applicable)

Reviews

In addition to the above processing activities, we process personal data that you submit when you submit a restaurant review. The legal basis for this processing of personal data is that you have given your consent to this processing (by posting a restaurant review). You can withdraw your consent by contacting us. We process the following personal data when you post a restaurant review:

• Name (if submitted)
• Rating, including comments (if applicable)

Customer service

When you contact our customer service, we use the personal data you provide to answer your question or process your request. The legal basis for this processing of personal data is that it is necessary for the execution of a contract. We process the following personal data for customer service purposes:

• Name
• Address details (if applicable)
• Contact details
• Order details
• Payment details (if applicable)
• Comments (if applicable)

Customer satisfaction surveys

To ensure that our services are aligned with your preferences, personal data that you submit to our customer service department may be used for activities such as customer satisfaction surveys. The legal basis for this processing activity is that it is necessary to pursue a legitimate interest.

Marketing communications

We also process your personal data to send you personalized marketing communications and notifications. Such communications include the latest news, discount promotions, and updates on new restaurants, regardless of the format we use to distribute these types of communications. The legal basis for this processing of personal data is that you have given your consent when placing an order. If you wish to change your preferences regarding the receipt of such messages and notifications, you can unsubscribe using the link in the marketing message in question.

We process the following personal data for marketing purposes:

• Name
• Contact details
• Postal code

Contractual relationship

In order to establish or execute the contractual relationship with our customers, it is regularly necessary to process the personal master, contract, and payment data provided to us. We also process data on customers and prospective customers for evaluation and marketing purposes. This processing is carried out on the legal basis of our legitimate interest and serves our interest in further developing our offerings and providing you with targeted information about our offers. Further data processing may be performed if you have given your consent or if it serves to fulfill a legal obligation.

Legal defense and enforcement of our rights

The legal basis for the processing of your personal data in the context of legal defense and the enforcement of our rights is our legitimate interest. The purpose of processing your personal data in the context of legal defense and enforcement is to defend against unjustified claims and to assert and enforce claims and rights in court.

Your personal data will be deleted as soon as it is no longer required for the purpose for which it was collected. The processing of your personal data in the context of legal defense and enforcement is absolutely necessary for the legal defense and enforcement of our rights. Therefore, you are not permitted to object.

Social media (Facebook, Twitter, Instagram)

We maintain an online presence on social networks and platforms in order to be able to communicate with customers, interested parties, and users active there and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and data processing guidelines of the respective operators apply.

Unless otherwise stated, we process user data when they communicate with us on social networks and platforms, e.g. write posts on our online presences or send us messages.

The data you enter on our social media pages, such as comments, videos, pictures, likes, public messages, etc., are published by the social media platform and are never used or processed by us for any other purpose. We only reserve the right to delete content if necessary. We may share your content on our page if this is a function of the social media platform and communicate with you via the social media platform. The legal basis is our legitimate interest. The data processing is carried out in the interest of our public relations and communication.

If you wish to object to certain data processing over which we have influence, please contact us. We will then review your objection. If you send us a request via the social media platform, we can also refer you to other secure communication channels that guarantee confidentiality, depending on the desired response. You can always send us confidential requests to our address given in the imprint.

As already mentioned, we specifically design our social media pages to be as privacy-compliant as possible if the social media platform provider gives us the option to do so. We have only limited influence over the statistics that the social media platform provider makes available to us, and we cannot turn them off. However, we ensure that no additional optional statistics are made available to us.

Data processing by the social media platform operator

The social media platform operator uses web-tracking methods. Web tracking can also be done regardless of whether you are logged in or registered with the social media platform. As already explained, we unfortunately have little influence on the web-tracking methods of the social media platform. For example, we cannot turn them off.

Please note: The social media platform provider may use your profile and behavioral data to evaluate your habits, personal relationships, preferences, etc.. We have no influence over this. In this respect, we cannot influence the processing of your data by the social media platform provider.

Who receives my data?

Within the company, access to your data is provided to those departments that require it to fulfill our contractual and legal obligations. Contractors we use may also receive data for the purposes mentioned above. These are companies in the fields of IT services, telecommunications, debt collection, consulting, and sales and marketing. Insofar as we use processors to provide our services, we take appropriate legal precautions and appropriate technical and organizational measures to ensure the protection of personal data in accordance with the relevant legal provisions.

We only pass user data on to third parties if this is necessary such as for the purposes of a contract, due to legitimate interests in the economic and effective operation of our company, or if you have consented to the data transfer. If you use the website for information purposes only, we do not pass any data on to third parties.

How long will my data be stored?

For security reasons (e.g. to investigate abuse or fraud), log file information is stored for a maximum of 30 days and then deleted. Data required to be stored longer for evidence purposes is excluded from deletion until the respective incident has been conclusively clarified.

Where necessary, we process and store your personal data for the duration of our business relationship, which includes, for example, the initiation and execution of a contract using a contact form or by email.

We are also subject to various storage and documentation obligations arising from, among other things, UK commercial and tax law. Finally, the storage period is determined by the statutory limitation periods.

How do we protect your personal data?

We protect your data using the latest technical and physical security measures and operate a fixed system of guidelines, confidentiality agreements, digital security measures, and procedures to ensure the highest level of administrative protection. The data we collect from you may be stored on our servers using appropriate technical and organizational security measures. In any case, we employ generally high privacy standards and follow advanced security measures to protect the personal data submitted to us, both during transmission and after receipt.

Economic analyses and market research

In order to manage our business economically and to recognize market trends, customer and user wishes, we evaluate the data available to us about business transactions, contracts, inquiries, etc. In doing so, we process inventory data, communication data, contract data, payment data, usage data, metadata on the basis of our legitimate interest, in which the data subjects include customers, interested parties, business partners, visitors, and users of the website. The evaluations are carried out for the purposes of business analysis, marketing, and market research.

In doing so, we can take into account the profiles of registered users with information about their purchases and other relevant matters. The evaluations serve to increase user-friendliness, to optimize our offerings and business efficiency, and are not passed on to third parties, unless they are anonymous evaluations with summarized values.

If personal evaluations or profiles are involved, these will be deleted or anonymized upon termination by the user or after two years from the conclusion of the contract. The macroeconomic analyses and general trend determinations are also anonymized as much as possible.

Is the data transferred to a third country or to an international organization?

The data provided will be processed within the United Kingdom. Please note that we have agreed to standard data protection clauses with the recipients of your data for countries without an adequacy decision. This is done in order to protect your data and to achieve an adequate level of protection for your personal data.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as purchase orders or inquiries you submit to us as the website operator, this website uses either an SSL or a TLS encryption program. You can recognize an encrypted connection by checking whether the address line of the browser switches from “https://” to “httpss://” and also by the appearance of the lock icon in the browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

External links

Our website contains links to the online offerings of other providers. We would like to point out that we have no influence on the content of the linked online offers and the compliance with data protection regulations by their operators.

Amendments and updates to the data protection regulations

We ask you to regularly review the contents of our data protection statement. We will adapt the data protection statement as soon as changes to the data processing activities require this. We will inform you if any of the changes require action on your part (e.g. consent) or another individual notification.

Concerns and contact

If you have concerns about a possible infringement on your privacy or misuse of your personal data by us or if you have any other questions or comments, please feel free to contact us.