We take the protection of your personal data seriously. Below, we inform you about the most important aspects of data processing on our website and app in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and applicable telecommunications laws. ¡Qué Rico! is committed to protecting your privacy and ensuring transparency in how we collect, use, and process your personal data.
Data Controller
The data controller within the meaning of the GDPR is: ¡Qué Rico!, Lorenz Kothmayr, Patrik Huber, Gundackergasse 21/1/9, 1220 Vienna, Austria. Phone: +43 676 44 11 241. Email: que-rico-org@proton.me
Website Data
When you visit our website, the following data is processed: Browser type and version, Operating system, Country, Date, time, and duration of access, IP address and visited pages, Language settings, Device identifiers (when transmitted by the browser). This data processing is technically necessary to ensure the security and functionality of the website (Art 6 para 1 lit f GDPR). Our website uses only technically necessary cookies required for the operation of the website. These cookies are set on the basis of Art 6 para 1 lit f GDPR and do not require explicit consent. Server log files are automatically stored when you visit our website and automatically deleted after a maximum of 30 days.
App Data
When you use the app, the following data is processed: User ID and authentication data, Recipe history, favorites, and user preferences, Household data and inventory management, Device identifiers (for syncing across multiple devices and delivery of push notifications). This data is stored and processed on secure servers (Art 6 para 1 lit f GDPR for legitimate interests, Art 6 para 1 lit b GDPR for contract performance). If you use app features that require access to your device's camera or media (e.g., for ingredient recognition), images and recordings are used exclusively to provide the respective function. Processing takes place, as far as possible, locally on your device. If you enable push notifications, device identifiers are processed to deliver notifications. You can disable push notifications at any time in your device settings or in the app. The ¡Qué Rico! App uses personalized filtering and recommendations based on your preferences, dietary requirements, and available ingredients. This occurs based on rules and your explicit settings, not through fully automated decision-making within the meaning of Art 22 GDPR.
Recipients and Data Processors
Recipients of your data may be IT service providers we use to provide and maintain our website and app. Hetzner Online GmbH (Germany) - Purpose: Hosting provider for website and software, under Data Processing Agreement Art 28 GDPR. DeepL SE (Germany) - Purpose: Translation service for website and app content, under Data Processing Agreement Art 28 GDPR.
International Data Transfers
All personal data is processed exclusively on servers within the European Union (EU) or the European Economic Area (EEA). No transfer to third countries takes place.
Data Retention
We retain your personal data only as long as necessary for the purposes stated or as required by law. Server log files (website): 30 days. Cookies (technically necessary): Until browser closure or per cookie settings. User account and profile data: Duration of use, then 90 days after deletion request. Recipe history and favorites: Duration of use, then 90 days after deletion request. Household inventory: Duration of use, then 90 days after deletion request. Device identifiers (push notifications): Duration of use of push feature. Support communications: 2 years after request completion. After the retention period expires, your data is completely deleted or anonymized unless legal obligations require further retention.
Your Rights
You have the following GDPR Data Protection Rights: Access (Art 15 GDPR) - Obtain information about your personal data we process. Correction (Art 16 GDPR) - Correct inaccurate or incomplete data. Deletion (Art 17 GDPR) - Delete your data (right to be forgotten). Restrict Processing (Art 18 GDPR) - Restrict processing under certain conditions. Data Portability (Art 20 GDPR) - Receive your data in a structured, machine-readable format. Withdraw Consent (Art 7 GDPR) - Withdraw consent without providing reasons. Object to Processing (Art 21 GDPR) - Object to processing for certain purposes. To exercise any of these rights, send an email to que-rico-org@proton.me with specification of the right you wish to exercise, sufficient identification information (e.g., user ID, email address), and date and signature if in writing. We will process your request within 30 days of receipt (Art 12 GDPR). If necessary, we may extend this period by an additional 60 days and will notify you accordingly.
Protection of Minors
Our services are intended for persons aged 16 and over. Persons under 16 may only use our services with the explicit consent of their parents or legal guardians (Art 8 GDPR). If we become aware that we have processed personal data of minors without appropriate consent, this data will be deleted immediately.
Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or destruction. These include: Encrypted data transmission (SSL/TLS), Secure server storage with protection mechanisms, Limited access through authorization controls, Regular security audits, Incident response plan for data breaches. Despite all security measures, absolute security on the internet cannot be guaranteed. Use strong passwords and report suspicious activities immediately.
Data Breach Notification
In the event of a personal data breach likely to result in a high risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach in accordance with Art 33 GDPR. Affected individuals will be notified without undue delay in accordance with Art 34 GDPR.
Changes to This Privacy Policy
We may update this privacy policy to reflect changes in our practices or for other reasons. We will notify you of material changes by updating the 'Last Updated' date in this policy and providing additional notice as appropriate.
Contact
For data protection inquiries or questions about this privacy policy, you can contact us at any time at que-rico-org@proton.me. If you suspect data protection violations in the processing of your data, you can file a complaint with the Austrian Data Protection Authority (DSB) at Wickenburggasse 8, 1080 Vienna, Austria. Phone: +43 1 52 152-0, Website: https://www.dsb.gv.at, Email: dsb@dsb.gv.at