PRIVACY NOTICE
Version: Taco-Ranch-2026-10-24-gemeinsame-Aktion-2
Controller and contact
Taco Ranch GmbH, Duisburger Straße 24, 40477 Düsseldorf, Germany; info@tacoranch.de. Full company details appear in the legal notice.
Administration and required information
We process first and last names, date of birth, email address, selected prize option, redeemed ticket codes, entry numbers and verification timestamps to administer the joint promotion. Names and date of birth support the minimum age of 18 and the one-prize-per-person rule; email and the private entry area support verification and notification. Article 6(1)(b) GDPR applies to the entry relationship. Entering is not a statutory obligation. A valid ticket cannot be registered without the required details and timely email verification. These data are not used for newsletters or AI analysis.
Security, selection and collection
Security checks process technical connection data and pseudonymous IP/visitor identifiers. The purpose and legitimate interest under Article 6(1)(f) GDPR are preventing misuse and maintaining an auditable promotion. Random selection and checks against previously selected people are recorded; a human eligibility review precedes binding prize confirmation. Matching names and dates of birth does not reliably prove identity. At collection, names and age are checked against photo ID; no copy or document number is stored. Personal vouchers, collection status, time and the staff access used are recorded for prize verification and handover.
Recipients and services
Access is limited to responsible Taco Ranch staff and necessary technical processors. STRATO hosts the test website and mailbox and processes the data necessary for hosting and email delivery. No external AI service is used for entries. Camera images are processed only on your device for code recognition and are not uploaded. The promotion loads no additional analytics or advertising services. Entry alone does not result in sharing participant lists with prize brands or publishing names or photographs. Emails may be processed by your chosen mailbox provider, whose privacy notice also applies.
Cookies and technical time limits
The private entry area uses a necessary HttpOnly session lasting two hours. The ranch_visitor security cookie lasts 24 hours. One-time codes expire after ten minutes. Five wrong ticket codes within 30 minutes lock code checking for 30 minutes; additional IP limits accommodate shared networks. These technical limits do not cap legitimately obtained tickets. “Cookies & storage” provides device-storage details. Necessary access supports requested sign-in and abuse prevention; section 25(2)(2) TDDDG and the GDPR bases stated above are assessed for these specific purposes.
Storage limitation
Entry data are needed to administer the promotion, review eligibility, notify winners and hand over prizes. Continued necessity is reviewed afterwards. Data without a remaining purpose are deleted or effectively anonymised. Where specific statutory retention duties or necessary evidence for legal claims apply, only the required data remain restricted to that purpose. Retention depends on completion of the relevant process and expiry of those duties or the specific need for evidence; no blanket indefinite retention period is imposed. Send access or deletion requests to info@tacoranch.de.
Your rights
Subject to statutory conditions, you have rights of access, rectification, erasure, restriction and portability under Articles 15 to 20 GDPR. You may object under Article 21 GDPR to processing based on legitimate interests on grounds relating to your particular situation. Where separate processing relies on consent, it may be withdrawn for the future without affecting earlier lawful processing. You may complain to a supervisory authority, particularly where you live or work or where an infringement is suspected. The authority for our registered office is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information: www.ldi.nrw.de.