Privacy Policy
In principle, you can use our website without providing any personal data. In certain cases, however, it may be necessary to collect and process your personal data in order for you to use specific features of our website. In addition, we collect and process personal data to optimise our website and services, which we process in accordance with data protection regulations.
We take the protection of your personal data very seriously and would therefore like to inform you below about your rights and the nature and scope of the data we collect.
1. Data controller and data protection officer
Contact details of the data controller
The person responsible for processing within the meaning of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG):
Abraxas, die Küche gGmbH
Billerbecker Weg 123 A
13507 Berlin
Website: https://www.abraxas-diekueche.de
E-Mail: info@abraxas-diekueche.de
Contact details of the Data Protection Officer
We have appointed a Data Protection Officer within the company. You can contact them regarding any matters relating to your personal data as follows:
Michel Wanke
Abraxas, die Küche gGmbH
Billerbecker Weg 123 A
13507 Berlin
E-Mail: datenschutz@abraxas-diekueche.de
2. Definitions
Personal data
Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as the ‘data subject’). A natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data subject
A data subject is a person whose personal data is processed by the data controller.
Processing
Processing means any operation or set of operations which is carried out on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution or any other form of disclosure, the matching or linking, the restriction, erasure or destruction.
Pseudonymisation
Pseudonymisation is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.
Data controller
The data controller is the person who determines the purposes and means of processing personal data and who also carries out such processing accordingly.
Data processor
A data processor is any other natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller.
Recipient
A recipient is a natural or legal person, public authority, agency or other body to whom personal data is disclosed.
Consent
Consent by the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes, by a statement or by a clear affirmative action, by which the data subject indicates that they agree to the processing of their personal data.
Personal data breach
A personal data breach is a breach of security leading to the destruction, loss or alteration – whether accidental or unlawful – of, or unauthorised disclosure of or access to, personal data that has been transmitted, stored or otherwise processed.
Supervisory authority
The supervisory authority is an independent public body established by a Member State in accordance with Article 51 of the GDPR, which is responsible for monitoring compliance with data protection laws and regulations.
3. Information on the processing of personal data
We process your personal data using various technical means and, where necessary, may also engage additional service providers. We would like to provide you with specific details of this processing in the following sections.
Visiting our website
(1) When you visit our website – that is, if you do not register or otherwise provide us with information – we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security:
- IP address and service provider
- Date and time of the request
- Content of the request (specific page)
- Access status/HTTP status code
- Amount of data transferred in each instance
- Website from which the request originates
- Browser, including language and software version
- Operating system and its user interface
(2) The data listed in paragraph 1 is also automatically stored in our server’s log files. The log data is stored separately from other data and can only be accessed by the hosting provider. The log data is retained for 7 days. The legal basis for the processing of your data when you visit our website is Article 6(1), first sentence, point (f) of the GDPR and Section 15 of the Telemedia Act (TMG).
Use of cookies
(1) In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive and associated with the browser you are using, and through which certain information is transmitted to the party setting the cookie (in this case, us). Cookies cannot run programmes or transmit viruses to your computer. They serve to make the website more user-friendly and effective overall. The legal basis for the use of cookies is Article 6(1)(f) of the GDPR.
(2) This website uses the following types of cookies, the scope and functioning of which are explained below:
- Session cookies
- Persistent cookies
(3) Transient cookies are automatically deleted when you close your browser. These include, in particular, session cookies. These store a so-called session ID, which allows various requests from your browser to be associated with the same session. This enables your computer to be recognised when you return to our website. Session cookies are deleted when you log out or close your browser.
(4) Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete these cookies at any time via your browser’s security settings.
(5) You can configure your browser settings as you wish and also choose to block third-party cookies or all cookies. Please note, however, that you may then not be able to use all the features of this website.
Use of the ordering function on our website
(1) If you wish to use our online portal to order lunch, you must first register by providing your personal data (surname, title, email address, password, postal address, payment method and the institution to which the order is to be delivered, as well as, optionally, academic title, first name, and telephone numbers). The advantage of this is that, via the log-in function, you can always view the data you have provided and your orders. The legal basis for the processing of your personal data during registration is Article 6(1), first sentence, point (b) of the GDPR.
(2) To use the ordering function on our website, you must provide further personal data (first name and surname, school, class/group, start date and, optionally, date of birth) for at least one child. You will then be prompted to select your meals separately. You also have the option, where applicable, to submit a discount certificate or, in the case of allergies or intolerances, a medical certificate, so that these can be taken into account accordingly. The data you provide during the login and ordering process will be stored by us at the time the registration is submitted, the menu selection is made, or when other data is provided, in order to ensure the smooth operation of the portal and to process the order. You can manage and amend your details in the secure customer area. The legal basis for the processing of your personal data when using the ordering function is Article 6(1)(b) of the GDPR.
(3) We will delete any personal data relating to you in this context once it is no longer necessary to retain it. Alternatively, we will restrict the processing of such data where statutory retention obligations apply.
Use of the contact form for the Whistleblower Protection Reporting Centre
(1) When you use our contact form for the Whistleblower Protection Reporting Centre, we collect the following personal data from you (surname [optional], first name [optional], email address [optional]); we also record your report. The personal data is forwarded to the member of staff responsible for managing the reporting centre. We collect this data for the purposes of making contact as required by law, in order to inform you of the status of your report.
The legal basis for the processing of your personal data in connection with a report under the Whistleblower Protection Act (HinSchG) is Article 6(1), first sentence, point (b) of the GDPR.
(2) Your personal data will be stored at least until the report has been investigated and concluded. However, under the Whistleblower Protection Act (HinSchG), reports must be documented permanently and in a retrievable manner. The Federal Government has, however, stipulated a maximum retention period of five years in its implementing regulation for the HinSchG, which we also adhere to.
Use of the quick application form
(1) When you use our quick application form, we collect the following personal data from you (surname, first name, email address); we also collect your preferred role and your brief application text. The personal data is transferred to our HR department. We collect this data to make initial contact regarding a recruitment process.
The legal basis for the processing of your personal data is Article 6(1)(b) of the GDPR.
(2) We will delete your personal data as soon as it is no longer necessary to retain it. At the latest, this will be after the 6 months required by law.
4. Transfer to third countries
As part of the data processing carried out on our website, no personal data is, as a matter of principle, transferred to data processors outside the EU.
5. Your rights
You have the following rights in relation to the processing of your personal data, which you may exercise at any time by contacting the person listed in point 2 above, without the need for any formalities.
Right of access
Upon request, we will provide you with information regarding which of your personal data we have stored, for what purpose, for how long, from which source and on what legal basis, and whether we have disclosed this data to third parties.
Right to rectification
Should it transpire that the personal data you have provided to us is incorrect or incomplete, we will correct or supplement it without delay upon request.
Right to erasure (right to be forgotten)
You have the right to have your personal data erased without delay, provided there is no legal obligation to retain it.
Right to restriction of processing
You may request that we restrict the processing of your personal data.
Right to object to processing
You may object to the processing of your personal data at any time. This applies in particular where the legal basis for the processing is Article 6(1), first sentence, point (f) of the GDPR.
Right to data portability
You have the right to receive the personal data we hold about you in a universally readable format.
Right to lodge a complaint with a supervisory authority
You also have the right to lodge a complaint with the relevant data protection supervisory authority regarding our processing of your personal data. The competent authority is the data protection authority of the federal state in which we are based. You can find further details at https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
We would like to politely point out that, in individual cases, the exercise of your rights may be subject to certain conditions.
Ensuring data security and data protection
To ensure the protection and security of your personal data, we implement a wide range of technical and organisational security measures, the effectiveness of which we review on a regular basis.