Privacy Policy

Date of last update:

11.01.2023

Please note that the terms are sent to all users via email at the time of registration and, in the event of any discrepancies with this online version, the version sent to the users shall be considered the valid one.

Schrankerl GmbH (hereinafter “Schrankerl”, “we”, “us”) is aware of the importance of the personal data entrusted to it. It is therefore particularly important to us to ensure the confidentiality and lawful processing of your data when you visit our website and as part of the provision of our fresh and healthy meals.

In this Privacy Policy, you will find information regarding the data processing we perform. We use the terms set forth in the General Data Protection Regulation (“GDPR”). For better clarity, we would like to present the most important terms below according to their legal definition.

Personal Data: Any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Processing: Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
Data Subject: The person whose personal data is being processed.
Controller: The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processor: A natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
Consent (of the data subject): Any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Personal Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

1. Who is responsible for data processing and whom can I contact?

Schrankerl is the controller within the meaning of Article 4(7) GDPR. You can reach us at:
Schrankerl GmbH
Franz-Josefs-Kai 45, 1010 Vienna
Phone: +43 664 78 39 618
Email: support@schrankerl.at
Our contact person for data protection is Sara Mari.

2. For what purposes do we process your personal data?

1. Use of the website and contacting us via the website

Processing purposes: We process your personal data to provide information about our products and services through the website www.schrankerl.at. To facilitate contact, we provide an interactive contact field on the website. The website can generally be used without processing your personal data, although no contact can be established without you providing personal data.
Data categories: For the aforementioned processing purposes, we process your contact details (first and last name, address, phone number, email address), IP address, and additional personal data that you voluntarily provide to us for contact purposes via the input mask used for registration.
Legal basis: We process your personal data on the basis of legitimate legal interests (Article 6(1)(f) GDPR) for the proper operation of our website and to provide information about our products and services.
Storage period: We store your personal data for the aforementioned processing purposes for the duration of your visit to our website or, in the case of an inquiry via the contact field, for the duration of the processing of your inquiry.

2. Use of the app to provide our meals

Processing purposes: We process your personal data to provide you with our fresh and healthy meals and to execute the contract concluded with you. When purchasing our meals via the “FrescoFrigo” app, the following data categories are collected, stored, and transmitted to us by FrescoFrigo S.R.L. We cannot provide our meals to you without processing this data.
Data categories: For the aforementioned processing purposes, we process your contact details (first and last name, email address, date of birth, gender), your user ID, and additional personal data that you voluntarily provide to us for the above purposes.
Legal basis: We process your personal data for the aforementioned processing purposes on the basis of the performance of a contract (Article 6(1)(b) GDPR).
Storage period: We process your personal data for the aforementioned processing purposes for the duration of your contract and beyond in accordance with the respective statutory retention periods (including tax retention obligations under § 132(1) BAO: 7 years, and longer if relevant for the tax authorities in pending proceedings; corporate law retention obligations under §§ 190, 212 UGB: 7 years; VAT law retention obligations for invoices under § 11(2) UStG: 7 years).

3. Processing of personal data for sending information about our products and services

Processing purposes: Upon request, we send you information about our products and services, such as weekly menu suggestions and credits, via email. We process your personal data for this purpose. We cannot send you this information and services without this data.
Data categories: For the aforementioned processing purposes, we process your first and last name, email address, phone number, and the company you work for.
Legal basis: We process your personal data for the aforementioned processing purposes on the basis of your consent (Article 6(1)(a) GDPR).
Storage period: We process your personal data for the aforementioned processing purposes until the time the respective consent is withdrawn. A withdrawal means that we will no longer process your data from that point forward, although the lawfulness of the data processing carried out based on the consent until the withdrawal remains unaffected. To withdraw your consent, please contact us at support@schrankerl.at.

4. Assortment optimization and creation of internal statistics

Processing purposes: We process your personal data for the purpose of assortment optimization and for the creation of internal statistics to optimize our offerings.
Data categories: For the aforementioned processing purposes, we process your contact details (first and last name, email address, date of birth, gender, company), your user ID, and your purchase history.
Legal basis: We process your personal data for the aforementioned processing purposes on the basis of legitimate legal interests (Article 6(1)(f) GDPR) in optimizing our assortment and offerings and the creation of internal statistics required for this.
Storage period: We store your personal data for the aforementioned processing purposes for a period of 3 months.

5. Legal enforcement

Processing purposes: In the event of a legal dispute, the data necessary for appropriate legal enforcement will be stored and transmitted to legal representatives and courts.
Data categories: For the aforementioned processing purposes, we process your contact details (e.g., first and last name, academic title, address), information and data related to the legal dispute in question (e.g., your purchase history or your behavior regarding the use of the website or the purchase of our meals).
Legal basis: We process your personal data on the basis of legitimate legal interests (Article 6(1)(f) in conjunction with Article 9(2)(f) GDPR) for appropriate legal enforcement.
Storage period: We store your personal data for the aforementioned processing purposes as long as necessary to enforce claims against you or to defend ourselves against claims raised by you against us, or until the expiration of statutory limitation periods, whereby the statutory limitation period for claims arising from breach of contract is three years.

3. To which recipients will your personal data be transmitted?

In the course of our data processing, we transmit your personal data to the following recipients to the extent necessary: service partners, engaged service providers, legal representatives, courts, and administrative authorities, as well as companies commissioned within the framework of supporting our internal IT infrastructure (software, hardware).

4. What rights do you have?

You have the right to access under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR, the right to object under Art. 21 GDPR, the right not to be subject to a decision based solely on automated processing, including profiling, and the right to data portability under Art. 20 GDPR. Furthermore, there is a right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR). Further information on your rights can be found at: https://www.dsb.gv.at/rechte-der-betroffenen.
The competent supervisory authority is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna (https://www.dsb.gv.at/).

5. Embedding of Social Media Plugins and Similar Tools

We use the following social media plugins on our website. In particular, we integrate elements from social media services on our website to display images, videos, and text. By visiting pages that display these elements, data can be transferred from your browser to the respective social media service and stored there. We have no access to this data. Below you will find information on the respective services and the personal data processed in each case.
The legal basis for embedding the following services is your consent pursuant to Article 6(1)(a) GDPR.
Storage period: We process your personal data until you withdraw your valid consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. You can (partially) prevent the use of the following services by adjusting the settings of your internet browser, thereby permanently preventing such data processing.
Google Maps
1. We use Google Maps from Google Inc. on our website. For the European region, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible for all Google services. With Google Maps, we can better show you locations and thus adapt our service to your needs.
2. By using Google Maps, data, particularly data about the use of Maps functions by website visitors, is transmitted to Google and processed on Google servers. Further information about data processing by Google can be found in Google’s privacy policy at https://www.google.at/intl/en/policies/privacy/. There, you can also change your settings in the Privacy Center to manage and protect your data.
Instagram

We have integrated components of the Instagram service on our website. Instagram is a service that qualifies as an audiovisual platform and allows users to share photos and videos and also to redistribute such data to other social networks.
The operating company for Instagram services is Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, USA.
With each call-up to one of the individual pages of this website, which is operated by the controller and on which an Instagram component (Insta button) has been integrated, the internet browser on the information technology system of the data subject is automatically prompted by the respective Instagram component to download a representation of the corresponding component from Instagram. As part of this technical process, Instagram gains knowledge of which specific subpage of our website is visited by the data subject.
If the data subject is logged into Instagram at the same time, Instagram recognizes with every call-up to our website by the data subject and for the entire duration of their stay on our website which specific subpage the data subject visits. This information is collected by the Instagram component and assigned by Instagram to the respective Instagram account of the data subject. If the data subject clicks one of the Instagram buttons integrated on our website, the data and information transmitted with it are assigned to the personal Instagram user account of the data subject and stored and processed by Instagram.
Instagram always receives information via the Instagram component that the data subject has visited our website if the data subject is logged into Instagram at the same time as calling up our website; this occurs regardless of whether the data subject clicks the Instagram component or not. If the data subject does not want this information to be transmitted to Instagram, they can prevent the transmission by logging out of their Instagram account before calling up our website.
Further information and the applicable privacy policy of Instagram can be accessed at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.

5. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies”, which are text files stored on your computer that allow an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymization is activated on this website, your IP address will be shortened by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area beforehand. We point out that on this website Google Analytics has been extended by the code “gat._anonymizeIp();” to ensure an anonymized collection of IP addresses (so-called IP masking).
Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
You can prevent the storage of cookies by adjusting your browser software settings; however, we point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=en”>http://tools.google.com/dlpage/gaoptout?hl=en. You can also prevent collection by Google Analytics by clicking on the following link. An opt-out cookie will be set that prevents the future collection of your data when visiting this website: Deactivate Google Analytics.
Further information on terms of use and data protection can be found at https://marketingplatform.google.com/about/analytics/terms/us/

6. Google Tag Manager

1. We use Google Tag Manager. This service allows website tags to be managed via an interface. Google Tag Manager only implements tags. This means: no cookies are used and no personal data is collected. Google Tag Manager triggers other tags, which in turn may collect data. However, Google Tag Manager does not access this data. If a deactivation has been made at the domain or cookie level, it remains in effect for all tracking tags, provided they are implemented with Google Tag Manager.

7. Facebook Pixel

We use the “Facebook Pixel” from the social network Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA, within our website. So-called tracking pixels are integrated into our pages. When you visit our pages, a direct connection is established between your browser and the Facebook server via the tracking pixel.
Facebook thereby receives information from your browser, among other things, that our page was called up from your device. If you are a Facebook user, Facebook can thereby assign the visit to our pages to your user account. We point out that we, as the provider of the pages, have no knowledge of the content of the transmitted data or its use by Facebook. We can only select which segments of Facebook users (such as age, interests) our advertising should be displayed to.
By calling up the pixel from your browser, Facebook can also recognize whether a Facebook advertisement was successful, e.g., whether it led to an online purchase. This allows us to record the effectiveness of Facebook advertisements for statistical and market research purposes.
Please click here if you do not wish for data collection via Facebook Pixel: https://www.facebook.com/ds/preferences/?entry_product=ad_settings_screen&expand_ad_settings=1. Alternatively, you can deactivate the Facebook Pixel on the Digital Advertising Alliance page at the following link: http://www.aboutads.info/choices/.
The transmission of data to the USA is permissible under Art. 45 GDPR, as Facebook is Privacy Shield certified and thus an adequate level of data protection exists according to the Commission’s Implementing Decision (EU) 2016/1250 (http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016D1250&from=EN). The certification can be viewed at https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active.
The legal basis is a legitimate interest according to Art. 6(1)(f) GDPR, namely the pursuit of our business purposes, specifically the targeted advertising of our services.

8. Google Remarketing

We use the remarketing or “Similar Audiences” function of Google Inc. (“Google”) on our websites. This allows us to target visitors to our websites with advertising by displaying personalized, interest-based advertisements to website visitors when they visit other websites in the Google Display Network. Google uses cookies to perform the analysis of website usage, which forms the basis for creating interest-based advertisements. No personal data of website visitors is stored. If you subsequently visit another website in the Google Display Network, you will be shown advertisements that are highly likely to take into account previously accessed product and information areas.
You can permanently deactivate the use of cookies by Google by following the link below and downloading and installing the plugin provided there: https://www.google.com/settings/ads/plugin. Alternatively, you can deactivate the use of cookies by third-party providers by visiting the deactivation page of the Network Advertising Initiative at http://www.networkadvertising.org/choices/ and implementing the additional opt-out information mentioned there. Further information on Google Remarketing and Google’s privacy policy can be viewed at: http://www.google.com/privacy/ads/.
The legal basis is a legitimate interest according to Art. 6(1)(f) GDPR, namely the pursuit of our business purposes, specifically the targeted advertising of our services.

9. Google Conversion Tracking

We use the marketing and remarketing services (in short “Google Marketing Services”) of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, (“Google”) on the basis of our legitimate interests (i.e., interest in the analysis, optimization, and economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR).
Google is certified under the Privacy Shield agreement and thereby offers a guarantee to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
Google Marketing Services allow us to display advertisements for and on our website in a more targeted manner to present users only with ads that potentially correspond to their interests. For example, if a user is shown ads for products they were interested in on other websites, this is referred to as “remarketing”. For these purposes, when our and other websites on which Google Marketing Services are active are called up, a code from Google is executed directly by Google and so-called (re)marketing tags (invisible graphics or code, also known as “web beacons”) are integrated into the website. With their help, an individual cookie, i.e., a small file, is stored on the user’s device (comparable technologies can also be used instead of cookies). The cookies can be set by various domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com, or googleadservices.com. This file records which websites the user has visited, what content they were interested in, and which offers they clicked on, as well as technical information about the browser and operating system, referring websites, visit time, and other information on the use of the online offering. The IP address of users is also recorded, whereby we state within the framework of Google Analytics that the IP address is shortened within member states of the European Union or in other contracting states to the Agreement on the European Economic Area and only in exceptional cases transmitted in full to a Google server in the USA and shortened there. The IP address will not be merged with user data within other Google offerings. The aforementioned information can also be combined by Google with such information from other sources. If the user subsequently visits other websites, ads tailored to them can be displayed according to their interests.
User data is processed pseudonymously within the framework of Google Marketing Services. This means Google does not store and process, for example, the name or email address of users, but processes the relevant data cookie-related within pseudonymous user profiles. This means from Google’s perspective, the ads are not managed and displayed for a specifically identified person, but for the cookie holder, regardless of who this cookie holder is. This does not apply if a user has explicitly allowed Google to process the data without this pseudonymization. The information collected by Google Marketing Services about users is transmitted to Google and stored on Google’s servers in the USA.
The Google Marketing Services we use include the online advertising program “Google AdWords”. In the case of Google AdWords, each AdWords customer receives a different “conversion cookie”. Cookies can therefore not be tracked across the websites of AdWords customers. The information obtained with the help of the cookie is used to create conversion statistics for AdWords customers who have opted for conversion tracking. AdWords customers learn the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that allows users to be personally identified.
We can integrate third-party advertisements based on the Google Marketing Service “DoubleClick”. DoubleClick uses cookies that enable Google and its partner websites to serve ads based on users’ visits to this website or other websites on the internet.
Furthermore, we can use “Google Tag Manager” to integrate and manage Google analysis and marketing services into our website.
Further information on data use for marketing purposes by Google can be found on the overview page: https://www.google.com/policies/technologies/ads, Google’s privacy policy is available at https://www.google.com/policies/privacy.
If you wish to object to interest-based advertising by Google Marketing Services, you can use the settings and opt-out options provided by Google: http://www.google.com/ads/preferences.

10. LinkedIn Insight Tag

We use the retargeting tool and conversion tracking from LinkedIn Ireland, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn”). For this purpose, the LinkedIn Insight Tag is integrated into our website, which enables LinkedIn to collect statistical data about your visit and use of our website and to provide us with corresponding aggregated statistics on this basis. In addition, the service serves to display interest-specific and relevant offers and recommendations to you after you have informed yourself on the website about certain services, information, and offers. The relevant information is stored in a cookie. Further information on data processing can be found in LinkedIn’s privacy policy.
The following data is generally collected and processed:
– IP address
– Device information
– Browser information
– Referrer URL
– Timestamp
The legal basis for processing is your consent pursuant to Art. 6(1)(a) GDPR. If you do not want the aforementioned data to be collected and processed via LinkedIn, you can refuse your consent or withdraw it at any time with effect for the future.
Personal data is stored for as long as necessary to fulfill the processing purpose. The data is deleted as soon as it is no longer required to achieve the purpose.
As part of processing via LinkedIn, data may be transmitted to the USA and Singapore. The security of the transmission is regularly secured via so-called standard contractual clauses, which ensure that the processing of personal data is subject to a security level that corresponds to that of the GDPR. If the standard contractual clauses are not sufficient to establish an adequate level of security, consent pursuant to Art. 49(1)(a) GDPR will be obtained from you in advance via the CookieYes consent management system.

11. HubSpot

We use HubSpot on this website for our online marketing activities and support activities. HubSpot is a software company from the USA with a branch in Ireland. Contact: HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, Phone: +353 1 5187500.
HubSpot is an integrated software solution with which we cover various aspects of our online marketing and support. These include, among others:
Email marketing (newsletters and automated mailings, e.g., for providing downloads), social media publishing & reporting, reporting (e.g., traffic sources, access, etc.), contact management (e.g., user segmentation & CRM), landing pages, and contact forms.
Our website allows visitors to learn more about our company, download content, and provide their contact information as well as other demographic information. This information and the content of our website are stored on servers of our software partner HubSpot. They can be used by us to get in touch with visitors to our website and to determine which of our company’s services are of interest to them. All information collected by us is subject to this privacy policy. We use all collected information exclusively to optimize our marketing measures.
Furthermore, to improve the user experience on our website, we use the HubSpot live chat service “Messages” on some subpages for sending and receiving messages (round chat icon at the bottom right of the screen). Upon consent and use of this function, the following data is transmitted to HubSpot’s servers:
– Content of all sent and received chat messages
– Contextual information (e.g., page on which the chat was used)
– Optional: User’s email address (if provided by the user via the chat function)
The legal basis for using HubSpot services is Art. 6(1)(f) GDPR – legitimate interest. Our legitimate interest in using this service is the optimization of our marketing measures and the improvement of our service quality on the website.
HubSpot is certified under the terms of the “EU – U.S. Privacy Shield Framework” and is subject to TRUSTe’s Privacy Seal and the “U.S. – Swiss Safe Harbor” Framework.
If you generally do not want collection by HubSpot, you can prevent the storage of cookies at any time through your browser settings.