Privacy Policy

Thank you for your interest in our website. The protection of your personal data is important to us. Below you will find information on how we handle the data collected through your use of our website. Your data will be processed in accordance with the statutory data protection regulations. Links to other websites are provided without our influence or control over the linked content and their data protection policies. We recommend checking the privacy policies on the linked websites to determine whether and to what extent personal data is collected, processed, used, or made accessible to third parties.

Responsible body within the meaning of data protection law

Five Guys Germany GmbH
Neumannstr. 10
40235 Düsseldorf
Email address:  [email protected]
www.fiveguys.de

Contact details of our data protection officer

PROLIANCE GmbH
Data Protection Officer
Leopoldstr. 21
80802 Munich
[email protected] or [email protected]

Definitions

Our privacy policy is intended to be simple and understandable for everyone. This privacy policy generally uses the official terms of the General Data Protection Regulation (GDPR). The official definitions are explained in Article 4 of the GDPR.

Data processing through visiting our website

When you access our website, it is technically necessary for data to be transmitted to our web server via your internet browser. The following data is recorded during an ongoing connection for communication between your internet browser and our web server:

  • Visited domain
  • Date and time of the request
  • Page from which the file was requested
  • Access status (file transferred, file not found, etc.)
  • web browser and operating system used
  • IP address of the requesting computer
  • amount of data transferred

We collect the listed data to ensure a smooth connection to the website and to enable users to use our website comfortably. The log file is also used to evaluate system security and stability, as well as for administrative purposes. The legal basis for the temporary storage of the data or log files is Art. 6 (1) (f) GDPR.

Cookies

Our website uses so-called “cookies.” Cookies are small text files that are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted after your visit. Permanent cookies remain stored on your device until you delete them yourself or an automatic deletion is carried out by your web browser. Cookies have various functions. Many cookies are technically necessary because certain

Website functions would not work without them (e.g. the shopping cart function or language settings). Other cookies are used to evaluate user behavior or to display advertising. Technically necessary cookies are stored on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in storing cookies for the technically error-free and optimized provision of our services. Other cookies are only stored with your consent on the basis of Art. 6 (1) (a) GDPR. The consent can be revoked at any time for the future. The legal basis can also arise from Art. 6 (1) (b) GDPR if the processing is necessary for the fulfillment of a contract to which the data subject is a party or for the implementation of pre-contractual measures that are taken at the request of the data subject. If cookies are used for analysis purposes, we will inform you separately within the framework of this data protection declaration and obtain your consent.
You can set your browser so that you

  • be informed about the setting of cookies,
  • Allow cookies only in individual cases,
  • exclude the acceptance of cookies for certain cases or in general,
  • Enable automatic deletion of cookies when closing the browser.

Cookie settings can be managed for each browser using the following links.

You can also individually manage the cookies of many companies and features used for advertising. To do so, use the appropriate user tools available at https://www.aboutads.info/choices/ or http://www.youronlinechoices.com/uk/your-ad-choices . Most browsers also offer a so-called “Do Not Track” feature that allows you to indicate that you do not want to be “tracked” by websites. When this feature is enabled, the respective browser informs advertising networks, websites, and applications that you do not want to be tracked for behavioral advertising and similar purposes. Information and instructions on how to manage this feature can be found at the following links, depending on your browser provider:

Additionally, you can prevent the loading of so-called scripts by default. NoScript allows JavaScript, Java, and other plug-ins to run only on trusted domains of your choice. Information and instructions on how to configure this feature can be obtained from your browser provider (e.g., for Mozilla Firefox at: https://addons.mozilla.org/de/firefox/addon/noscript/ ). Please note that disabling cookies may limit the functionality of this website.

Contact form and contact via email

If you send us inquiries via contact form or email, your details from the inquiry form or your email, including the contact details you provided there, will be stored by us to process the inquiry and in the event of follow-up questions. We will never pass this data on without your consent. The legal basis for the processing of the data is our legitimate interest in answering your request in accordance with Art. 6 (1) (f) GDPR and, if applicable, Art. 6 (1) (b) GDPR if your inquiry aims to conclude a contract. Your data will be deleted after your inquiry has been processed, unless there are statutory retention periods to the contrary. In the case of Art. 6 (1) (f) GDPR, you can object to the processing of your personal data at any time with effect for the future.

Online ordering and payment

To access online ordering (Click & Collect, Curbside Pickup), we offer the option of registering to create a customer account by providing personal information. The data is entered into an input mask and transmitted to us and stored. The data will not be shared with third parties. When registering for a customer account, we store the data you require to conclude and fulfill the contract:

  • First name Last Name
  • Postal address
  • User’s email address
  • Date and time of registration

User registration is required to provide the desired services. The legal basis for data processing is Art. 6 (1) (b) GDPR. The data will be deleted when it is no longer required to perform the contract. Even after the contract has been concluded, it may be necessary to store personal data of our contractual partners in order to fulfill contractual or legal obligations. As a user, you have the option of canceling your registration at any time. Premature deletion of data is only possible if there are no contractual or legal obligations that prevent deletion. Your data will be deleted as soon as the user account on our website is deleted and there are no statutory retention periods. You can usually change and/or delete your user account, including the data you have provided, directly in your user account after logging in or by sending a corresponding message to [email protected].

In your customer account, you can also store your credit card information (cardholder name, card number, expiration date, card security number) for orders. You can change or delete the credit card information provided at any time in your customer account under the “Payment Methods” navigation item. When you register for card payment, your credit card information is stored by a payment service provider commissioned by Five Guys. The payment service provider stores the credit card information directly via an integrated input mask (iFrame) of the payment service provider. Five Guys has no access to the data transmitted to the payment service provider via the input mask.

Newsletter (marketing emails)

If you would like to receive the newsletter offered on the website with regular information about our offers and products, we require your email address as mandatory information. We use the so-called double opt-in procedure to send the newsletter. This means that we will only send you our newsletter by email once you have expressly confirmed that you consent to the sending of newsletters. To do this, you confirm by checking the box during the registration process that you, as the owner of the corresponding email address, wish to receive newsletters in the future. By confirming, you give us your consent in accordance with Art. 6 (1) (a) GDPR that we may use your personal data for the purpose of sending the desired newsletter.

When you register for the newsletter, we save the email address required for dispatch, the IP address you used to register for the newsletter, as well as the date and time of registration and confirmation so that we can trace any possible misuse at a later date.

You can unsubscribe from the newsletter at any time in your customer account under “Marketing Emails”. After unsubscribing, your email address will be immediately deleted from our newsletter distribution list unless you have expressly consented to continued use of the collected data or continued processing is otherwise permitted by law.

Google Analytics

Our website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses so-called “cookies.”

Google will use this information on behalf of the operator of this website to evaluate your use of the website and to compile reports on website activity. Google will also use this information to provide the website operator with other services relating to website and internet usage. The IP address sent by your browser as part of Google Analytics will not be combined with other Google data. Processing is carried out in accordance with Art. 6 (1) (a) GDPR on the basis of your consent.
We only use Google Analytics with activated IP anonymization. This means that your IP address will only be processed by Google in a shortened form.
We have concluded a data processing agreement with the service provider in which we oblige them to protect our customers’ data and not to pass it on to third parties.

Since personal data is transferred to the USA, additional protective mechanisms are required to ensure the level of data protection required by the GDPR. To ensure this, we have agreed to standard data protection clauses with the provider in accordance with Art. 46 (2) (c) GDPR. These oblige the recipient of the data in the USA to process the data in accordance with the level of protection in Europe. In cases where this cannot be ensured even through this contractual extension, we will endeavor to obtain additional regulations and commitments from the recipient in the USA.

The Google Analytics terms of use and data protection information can be accessed via the following links:
http://www.google.com/analytics/terms/de.html
https://www.google.de/intl/de/policies/

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. User- and event-level data linked to cookies, user identifiers (e.g., user ID), and advertising IDs (e.g., DoubleClick cookies, Android advertising ID, IDFA [Apple identifier for advertisers]) will be deleted no later than 14 months after collection.

You can prevent cookies from being saved by adjusting your browser settings accordingly. However, please note that if you do this, you may not be able to use all the features of this website without restrictions. You can also prevent Google from collecting the data generated by the cookie and analyzing your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at https://tools.google.com/dlpage/gaoptout?hl=de .

Google Maps

Our website uses the online map service provider Google Maps via an interface. This enables us to show you interactive maps directly on the website and enables you to conveniently use the map function. The provider of the map service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To use the functions of Google Maps, it is necessary to save your IP address. The legal basis for the processing of your personal data is your consent in accordance with Art. 6 (1) (a) GDPR.


Using the service results in the transfer of personal data to the USA. The legal basis for the transmission of your personal data to the USA is your consent in accordance with Art. 49 (1) (a) GDPR. Please be aware that such transfers of personal data without an adequacy decision and without suitable guarantees pose a risk to you. The risk lies that, due to US legislation, American authorities (in particular the intelligence services) may access the personal data. Legal recourse or information about the handling of your data from the US authorities is very limited or even impossible. A level of data protection in accordance with the GDPR requirements cannot therefore be guaranteed.

Further information on the handling of user data can be found in Google’s privacy policy:
https://www.google.de/intl/de/policies/privacy/
Opt-out: https://www.google.com/settings/ads/

Social media links

Social networks (Facebook, Twitter, LinkedIn, Google Plus) are integrated into our website merely as links to the corresponding services. After clicking on the embedded text/image link, you will be redirected to the respective provider’s website. Only after redirection is user information transferred to the respective provider. Information on how your personal data is handled when using these websites can be found in the respective privacy policies of the providers you use.

Data transfer and recipients

Your personal data will not be transferred to third parties unless

  • We have explicitly pointed this out in the description of the respective data processing,
  • You have given your express consent in accordance with Art. 6 (1) (a) GDPR,
  • the transfer is necessary according to Art. 6 (1) (f) GDPR to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding legitimate interest in not transferring your data,
  • there is a legal obligation for the transfer according to Art. 6 (1) (c) GDPR and
  • According to Art. 6 (1) (b) GDPR, this is necessary for the processing of contractual relationships with you.

We also use external service providers to provide and process our services. They have been carefully selected and commissioned in writing. They are bound by our instructions and are regularly monitored by us. Where necessary, we have concluded data processing agreements with them in accordance with Art. 28 GDPR. These service providers are responsible for web hosting, sending emails, and maintaining and servicing our IT systems, among other things. The service providers will not share this data with third parties.

Duration of storage of personal data

The duration of storage of personal data is determined by the relevant statutory retention periods, e.g., under commercial law and tax law. After expiration of the respective retention period, the corresponding data is routinely deleted. If data is required for the fulfillment or initiation of a contract, or if we have a legitimate interest in continued storage, the data will be deleted when it is no longer required for these purposes or when you exercise your right of withdrawal or objection.

Your rights

Below you will find information on the rights granted to you by applicable data protection law vis-à-vis the controller with regard to the processing of your personal data:

  • The right to request information about your personal data processed by us in accordance with Art. 15 GDPR. In particular, you can request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected from us, as well as the existence of automated decision-making, including profiling, and, where applicable, meaningful information on its details.
  • The right to request the immediate correction of inaccurate or incomplete personal data stored by us in accordance with Art. 16 GDPR.
  • The right to request the deletion of your personal data stored by us in accordance with Art. 17 GDPR, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims.
  • The right to request the restriction of the processing of your personal data pursuant to Art. 18 GDPR if you contest the accuracy of the data, the processing is unlawful but you refuse to delete it and we no longer need the data, but you need it to assert, exercise or defend legal claims or you have objected to the processing pursuant to Art. 21 GDPR.
  • The right, in accordance with Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request that it be transmitted to another controller.
  • The right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR. As a rule, you can contact the supervisory authority of the federal state in which we are headquartered, or, if applicable, the supervisory authority of your usual place of residence or work.
  • Right to revoke consent granted in accordance with Art. 7 (3) GDPR. You have the right to revoke your consent to the processing of data at any time with future effect. In the event of revocation, we will delete the data in question immediately, unless further processing can be based on a legal basis for processing without consent. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.

Right of objection

If your personal data is processed by us on the basis of legitimate interests pursuant to Art. 6 (1) (f) GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR, provided this is based on reasons arising from your particular situation. If the objection is directed against the processing of personal data for the purposes of direct marketing, you have a general right of objection without having to state a particular situation.
If you wish to exercise your right of withdrawal or objection, simply send an email to [email protected] .

Changes to our privacy policy

We reserve the right to adapt or update this privacy policy as necessary, in compliance with applicable data protection regulations. This allows us to adapt it to current legal requirements and to take into account changes to our services, for example, when introducing new services. The most recent version applies to your visit.

Status of this privacy policy: 17.06.2021