Privacy notice

Controller

Taco Ranch GmbH, Duisburger Straße 24, 40477 Düsseldorf, Germany. Privacy contact: info@tacoranch.de, telephone +49 211 15830750.

Website and protected test access

Requests process in particular your IP address, requested address, time and technical browser information to deliver content and protect the service from misuse. The test website runs on a STRATO server in Germany (STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin). The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in a secure, functioning website.

Password-protected sessions secure access to the test website and administration. Login-attempt data helps prevent abuse. Operational error logs may contain technical information; form contents and passwords do not belong in these logs. Retention depends on necessary troubleshooting, protection against attacks and, where relevant, preservation of evidence of specific incidents.

Franchise enquiries and appointments

To handle a franchise enquiry, we process the contact, experience and planning information entered in the form: name, email address, telephone number, experience, motivation, desired location and equity range, plus your intended operating role and preferred opening timeframe if you choose to provide them. These details help us contact you and assess possible cooperation. Please do not submit health data or other particularly sensitive information.

The legal basis is Article 6(1)(b) GDPR for pre-contractual steps at your request. If you act as a company contact, Article 6(1)(f) GDPR applies, with the legitimate interest of handling business enquiries. Marketing consent is not required.

There is no statutory obligation to submit a franchise enquiry. The marked information is needed to identify and answer your enquiry and assess your proposed project. The form cannot be processed without these details.

Access is restricted to the Taco Ranch staff responsible for enquiries. Appointment scheduling stores the appointment, its relationship to your enquiry and necessary confirmation data in the website calendar for as long as needed to handle the enquiry. No appointment is sent to Microsoft, Teams or another external calendar service. The location or contact method is arranged separately.

Enquiries and correspondence are needed for the duration of the enquiry and follow-up. They are then deleted unless statutory retention duties or overriding reasons such as establishing or defending legal claims apply. Decisions on franchise cooperation are not made solely by automated processing.

Franchise waitlist and invitation

The controller is Taco Ranch GmbH, Duisburger Straße 24, 40477 Düsseldorf, info@tacoranch.de. The waitlist requires your email address and chosen language. We use them to announce the opening of franchise applications and send an invitation with the application link. Registration does not reserve a licence.

This processing relies on your separate, voluntary consent under Articles 6(1)(a) and 7 GDPR. Section 7(2)(2) of the German Act Against Unfair Competition also applies to advertising emails. Consent is not preselected. Your address joins the confirmed list only after you use the confirmation link. We record the consent wording, version, language and registration, confirmation, invitation and withdrawal times.

Confirmation links expire after 48 hours. Unconfirmed registrations are removed after no more than seven days. Confirmed and invited contacts are retained for this purpose for no more than twelve months from registration. After withdrawal we remove the contact address within 30 days and block further invitations immediately. Completed email payloads are removed after seven days. Unresolved sending records retain necessary information within those contact retention periods.

Limited evidence of the consent process, including its wording, times and a protected reference to the address that is not directly readable, is retained for no more than three years to establish or defend legal claims under Article 6(1)(f) GDPR. This is our limited evidential policy, not a blanket statutory retention period. Necessary, narrowly limited abuse prevention is separate from visitor statistics.

We send through our existing STRATO mailbox. The data is processed on our server and by the email service for this purpose. These emails contain no open or click trackers. Waitlist records are not used for franchise AI assessments, giveaway entries or visitor statistics. Invitations require manual approval and link only to the application that has actually been released.

You can withdraw consent at any time without logging in, using the unsubscribe link in every waitlist email or contacting info@tacoranch.de. Withdrawal does not affect the lawfulness of earlier processing. The other data subject rights and complaint options described in this privacy notice also apply to the waitlist.

Email and form confirmations

When you email us directly, we process your sender address, message and any attachments to handle your request. Depending on its content, Article 6(1)(b) or (f) GDPR applies. The business mailbox is hosted by STRATO.

We send acknowledgements for new franchise enquiries, necessary internal notifications and related correspondence through the STRATO mailbox. For separately enabled raffles, one-time codes, entry confirmations, internal entry notices and, where applicable, winner notifications use the same service. A draft or technical test message does not constitute an entry or a prize. This processes the recipient address, necessary message content and technical delivery data. Earlier sandbox cases remain in the access-protected local test mailbox and are never sent externally afterwards. Status information distinguishes storage, queued delivery, errors and acceptance by the mail server; acceptance does not establish delivery to an inbox. These enquiry confirmations and giveaway messages contain no advertising. Optional franchise updates follow the separate consent and unsubscribe information in the waitlist section.

Joint giveaway and tickets

For the joint GTA VI/Sephora promotion, we process names, date of birth, email address, prize option, ticket and verification data to administer entries, check age, select winners and hand over prizes. Article 6(1)(b) GDPR applies. Abuse prevention and necessary records rely on Article 6(1)(f) GDPR. Entering is voluntary; required details and email verification are necessary to register a ticket.

One person may hold many tickets for both options but may win only once overall. Matching names and dates of birth supports review but does not prove identity. A human eligibility review precedes binding prize confirmation. Names and age are checked against photo ID at collection; no ID copies or document numbers are stored.

Responsible Taco Ranch staff and necessary technical processors have access, including STRATO for hosting and email. Giveaway information is not sent to AI services and is not used for advertising or publication of winner names without a separate basis. Camera images remain on the device.

Retention depends on completion of entry and prize administration and specific statutory retention or evidential needs. Data no longer needed must then be deleted or effectively anonymised; necessary records remain limited to their purpose. The separate giveaway privacy notice provides full details and rights.

Internal AI assistance

New franchise enquiries receive an automatic initial assessment to prepare human handling. On our server, the reported equity range is checked against the €20,000 minimum. Experience and motivation texts are used only to identify limited business information, such as team leadership, commercial experience or personal involvement. For the AI summary, only predefined business statements are sent to OpenAI. Names, email addresses, phone numbers, location, equity range and original free text are not sent in this automatic process. Unclear or conflicting information is referred for personal review.

Initial assessment supports handling and organising business enquiries on the legal bases stated in the franchise section. The derived information remains associated with your enquiry on our server; this is not a claim of complete anonymity. AI does not calculate a probability of success. A classification alone cannot trigger rejection: actual human review and separate message approval are required. An approved rejection may be sent no earlier than 120 hours after receipt. You can request correction or personal review by replying to our email or contacting info@tacoranch.de.

Authorised staff may also explicitly approve a separate business summary for additional AI assessment. Names, contact details and particularly sensitive information must be removed beforehand. Your complete enquiry and meal-planner targets are not sent to OpenAI. Automatic initial assessment does not overwrite human ratings or notes.

The provider is OpenAI. For business customers in the European Economic Area, its terms name OpenAI Ireland Ltd. as the contracting party; processing by other entities, including outside the European Economic Area, is possible. OpenAI describes safeguards including standard contractual clauses in its data processing addendum. According to its documentation, API content is not used for model training by default; security logs may contain content and generally be retained for up to 30 days. Disabling response storage therefore does not establish zero retention by the provider. Further information: https://openai.com/policies/data-processing-addendum/ and https://developers.openai.com/api/docs/guides/your-data.

Cookies, browser storage and nutrition calculator

The website itself sets technically necessary cookies for protected access, administration and protection against abusive requests. Details and durations are available under “Cookies & storage”. The exemption in section 25(2)(2) TDDDG applies only to these necessary functions; subsequent processing is based on Article 6(1)(f) GDPR.

Language is selected through the page address. The meal planner processes your selections, targets and history for the current page in browser memory. History is discarded on reload and is not stored in a persistent browser profile. Calculations run in your browser; entered targets are not sent to an external planning service.

Swipe hints appear again with each full website visit. A successful gesture is remembered only in the open page’s memory, including internal navigation. Reloading discards this state. This creates no visit counter, identifier or transfer to our server. An existing, separately adjustable hint preference in the browser also counts no visits; its details appear under “Cookies & storage”.

Google Maps and optional visitor statistics have separate permissions. Each choice, including refusal, notice version and expiry, is remembered without a user identifier for up to 180 days. Statistics create additional random identifiers only after their separate permission, for at most 30 days. Without permission there are no map requests, statistics identifiers or measurement requests.

When you save a Meal Planner suggestion, only the selected meal, special requests and nutrition are passed at your request to the share menu, clipboard or a downloaded text file. Nothing is sent automatically. You choose the destination app; its further processing is subject to its terms and privacy notice. Your device controls the clipboard, and files remain until you delete them. The website is not told which app you select.

Fonts and external links

Web fonts are loaded from this website’s server. Loading them does not require a request to Google Fonts. Social-media pages, ordering services and external directions are links. Only clicking a link takes you to its provider, whose privacy information applies. The separately enabled embedded map is described below.

Our own visitor statistics remain disabled without separate permission. We use no advertising trackers. No map resources are requested before you permit the map.

Optional location map with Google Maps

On the location page, you can allow Google Maps. For users in the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map helps you find our restaurant and is optional. Without consent we show only a locally provided preview; the address and directions link remain available.

Only after consent does the map load automatically, including on later visits while your choice remains valid. The legal bases are Article 6(1)(a) GDPR and, where device information is stored or accessed, section 25(1) TDDDG. Google receives IP address, browser and device information and requested map content, and may use cookies or similar technologies. Our form contents and your device location are not passed to the map. The permitted Google map also loads Google Maps resources and Google fonts; none are requested before permission.

Google may process data in the USA and other third countries. Google states that Google LLC is certified under the EU-US Data Privacy Framework; transfers covered by it rely on the European Commission’s adequacy decision (Article 45 GDPR). Where transfers are not covered, Google uses standard contractual clauses where required (Article 46 GDPR). Information about these safeguards and requesting a copy: https://policies.google.com/privacy/frameworks. Further processing, retention and your options with Google: https://policies.google.com/privacy.

We store your choice, including refusal, notice version, choice time and expiry without a user identifier in this browser’s local storage under ranch_google_maps_consent_v1 for up to 180 days. This only remembers and respects your privacy choice (section 25(2)(2) TDDDG). If storage is blocked, the choice applies only to the open page. Earlier permission for other map providers does not grant Google Maps permission.

You may withdraw consent at the map or under Cookies & storage at any time for the future. The map is removed and further requests by the embed are stopped. This does not recall data already transferred or delete data stored by Google. Withdrawal does not affect the lawfulness of processing before withdrawal.

Optional visitor statistics

Only if you actively allow the Statistics category do we measure public page views, returning browsers, general sources and estimated active time. The controller is Taco Ranch GmbH identified above. Statistics help improve our website and run only on our STRATO server in Germany. The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. Refusal does not restrict website features. Google Maps has separate, independent permission.

After permission, ranch_statistics_browser_v1 in local storage holds random browser, consent and session identifiers with their expiry. Only derived random identifiers are used on the server. We measure approved page paths without URL parameters, views, sessions, a general source category and active time. There is no fingerprinting or IP-derived identifier. Form contents, dates of birth, email addresses, raffle codes, invitation tokens, complete page or referrer addresses and login identities are excluded. Statistics are not linked with applications, raffles or advertising. IP addresses are processed for the technical connection but not stored in statistics.

An identifier represents a browser, not a reliably recognised person. A session ends after 30 minutes without a measurement request. Active time is estimated only in visible, focused tabs with interaction in the last 90 seconds. Final measurements may be missing. Multiple devices, refusal, blockers and cleared identifiers limit completeness. Sources are stored only as a search engine, grouped external referral, QR campaign link or direct/unknown. A QR link visit does not prove a physical scan. Administration pages, protected previews, private raffle tests and owner visits are excluded.

Browser identifiers and corresponding measurements are retained for at most 30 days. The separate permission or refusal, notice version, choice time and expiry in ranch_statistics_choice_v1 last at most 180 days. Consent records contain no contact or IP data and expire no later than their identifiers. Short technical rate counters last one minute. We never reconstruct old visits from security logs or collect events before permission.

You can withdraw permission at any time in Cookies & storage for future processing. Measurement stops immediately, pending measurement events are discarded and the browser identifier is removed. A separate deletion request removes corresponding measurements from our server. Only an unlinked revoked-consent blocking value remains for up to 30 days, to reject late measurements. If the connection fails, server deletion cannot be confirmed; measurements expire within 30 days at most. For questions or data-subject requests, contact info@tacoranch.de. Withdrawal does not affect lawful processing before withdrawal.

Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction and data portability under Articles 15 to 20 GDPR. Where processing is based on consent, you may withdraw it for the future without affecting the lawfulness of earlier processing.

For processing based on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. You may object to direct marketing at any time.

You may complain to a supervisory authority, particularly in your place of residence or work or where a suspected infringement occurred. The authority responsible for our registered location is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information: www.ldi.nrw.de. You can send requests to us at info@tacoranch.de.

North Rhine-Westphalia supervisory authority