Protecting your personal data is very important to us. We process your data exclusively on the basis of the statutory provisions (GDPR, Austrian Data Protection Act DSG, Austrian Telecommunications Act TKG 2021). In this privacy policy we inform you about the most important aspects of data processing on our website. This is a translation for your convenience; the German version is legally binding.
Controller
Burger Snacks Cafe, owner Arslaner Özer
Marie-Louisen-Str. 2, 4820 Bad Ischl, Austria
Phone: +43 650 925 13 86
Email: burgersnackscafe@hotmail.com
Hosting and server log files
This website is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare processes the data on our behalf (data processing under Art. 28 GDPR). When you visit the website, technically necessary data (e.g. IP address, date and time, page visited, browser type) is stored in server log files. This is based on our legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR).
Cloudflare is a company based in the USA, so a transfer to the USA cannot be ruled out. Such a transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Cloudflare is certified, and on the European Commission's standard contractual clauses.
Cookies, browser storage and visitor statistics
We do not use cookies for analytics or advertising. Fonts are loaded directly from our server; there is no connection to Google Fonts.
If you log in, we store a login token, your account data and a copy of your Burger Club Card in your browser's storage (localStorage), so that you stay logged in and the QR code can be shown even without an internet connection. This is strictly necessary for the service you requested (§ 165(3) TKG 2021) and is deleted when you log out. When you register, we also remember there which page you came from (e.g. Burger Club Card) until you confirm your email address, so that you get back to it afterwards. This is not personal data; the entry is deleted when you confirm.
If you switch the language to English, we also remember this choice in your browser's storage so that the site appears in English straight away on your next visit. Only the language is stored, with no link to you as a person. This, too, is necessary for the function you requested (§ 165(3) TKG 2021). If you switch back to German, the entry is deleted.
To see how often our pages are visited, we use Cloudflare Web Analytics (Cloudflare, Inc., see above). It collects aggregated data without cookies and without storing anything on your device, e.g. page visited, referring page, country, device type, browser and loading time. Your IP address is not stored for this purpose, no profiles are created and visits are not tracked across several days or websites. This is based on our legitimate interest in improving our website (Art. 6(1)(f) GDPR). We also store the aggregated daily figures (e.g. visits per day and page) in our database so that we can evaluate them over longer periods. They cannot be linked to individual visitors.
We also count ourselves how often visitors click on call, plan route, email, Instagram or Facebook on our website. We only store one number per day and type of link, without cookies and with no link to you as a person. So that repeated tapping is not counted several times, we keep your IP address for this for at most 10 minutes; this counter is deleted after one day at the latest. This is based on our legitimate interest in improving our website (Art. 6(1)(f) GDPR).
Contacting us
If you contact us by phone, email or via the contact form, we store your details to handle your enquiry and any follow-up questions (Art. 6(1)(b) and (f) GDPR). We keep them until your enquiry has been dealt with, unless statutory retention obligations require longer storage.
The details from the contact form (first and last name, email address, optionally your phone number, subject, message) are processed by our hosting provider Cloudflare and delivered to us as an email via the email service Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany). We send you a copy of your message to the email address you provided in the same way. They are not stored permanently on our website. To protect against spam we use Cloudflare Turnstile, which sends technical data (e.g. IP address, browser information) to Cloudflare to detect automated requests (Art. 6(1)(f) GDPR, legitimate interest in a spam-free contact form).
Customer account and Burger Club Card
If you create a customer account, we process your first and last name, your email address and your password (only encrypted as a hash, we cannot read it) and – only if you provide them voluntarily – your phone number and your address. For the Burger Club Card we also process the card number, the times of your stamps and redeemed and expired rewards. The purpose is to provide the account and run the loyalty programme according to the terms of participation (in German) (Art. 6(1)(b) GDPR). We cannot create an account without first name, last name, email address and password; all other details are voluntary.
If our staff enter the purchase amount at the till when giving stamps (the stamps are calculated from it), we store this amount together with your card and the time of the purchase. We do not store what you bought. Only the administration (owners) can see the amount, not the staff at the till. We use it only internally to see how the Burger Club Card is used (e.g. revenue with the card, average purchase, regular customers), not for advertising. The legal basis is our legitimate interest in evaluating and improving our loyalty programme (Art. 6(1)(f) GDPR). You can object to this at any time (Art. 21 GDPR), e.g. by email or at the counter; we will then delete the amounts stored so far and no longer store any for your card. You will still receive stamps as usual.
At your request, our staff can also create the account for you, e.g. at the counter. We then record the details mentioned above after you have agreed to the terms of participation and this privacy policy, and send you an email with a link to set your password yourself (valid for 7 days). If you do not set a password, we delete the account automatically afterwards, unless stamps have already been given on the card.
We use your email address only for messages about your account (confirming your address, setting or resetting your password), not for advertising. To send these messages it is passed on to the email service Brevo (see above). Brevo technically records whether emails are delivered and opened; this evaluation is anonymous only, without reference to individual recipients. To prevent misuse we use Cloudflare Turnstile (see above) for registration and "Forgot password", and we briefly count login and registration attempts per IP address; these counters are deleted after one day at the latest. In addition, without IP address or any other personal reference, we count per day how often the spam protection rejected a request or could not load in a browser, to see whether it gets in the way of real customers.
When scanning at the till, our staff see your name, card number and card status; in the customer search they also see your email address, your voluntary details and the history of your card. This is necessary to give stamps, redeem rewards and help with questions. So that stamps can still be reversed shortly afterwards, the till device remembers the name and card number of purchases from the last 10 minutes. In the administration area (owner), accounts can be created, customer details corrected, stamps corrected and accounts deleted.
The data is stored in the database of our hosting provider Cloudflare, located in the EU. A login remains valid for a maximum of 180 days. We store your data for as long as you have your account. If you do not confirm your email address after registering, we delete the account automatically after 7 days. You can delete your account, including your card and all stamps, yourself at any time under "My account" → "Delete account". We then delete your name, email address, password, phone number, address, card number and your logins.
For our statistics, the days on which stamps were given (and, where applicable, reversed) and rewards redeemed, the purchase amounts entered, as well as the days on which the account was created and deleted, are kept afterwards without name, email address and card number, and without the time of day. These entries only appear under a sequential number ("Anonym 1", "Anonym 2" …) so that figures for past periods remain correct; they can no longer be linked to you. If the administration created your account, changed your details, corrected your stamps or deleted your account, this action is kept in an internal log with date, stamp count and reason so that changes can be traced (for changed details only which fields were changed, not the details themselves); there, too, only the sequential number appears instead of the card number.
For security reasons we create a daily backup of the database, which is automatically deleted after 30 days. In addition, an encrypted backup is sent once a week by email to a mailbox of the operator, so that the data is preserved even if our hosting provider fails. These copies are protected by a password known only to us and are deleted after 3 months at the latest. Until then, deleted data may still be contained in a backup; we only use it to restore operation after a technical fault.
Google Maps
A map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) can be shown on the contact page. The map is only loaded when you click "Load map". Only then is data such as your IP address transferred to Google, including to servers of Google LLC in the USA (EU-US Data Privacy Framework). The legal basis is your consent (Art. 6(1)(a) GDPR). Your decision is not stored: on your next visit the map is again only loaded after a click. Further information: Google's privacy policy.
Disclosure of data
We do not sell your data and do not pass it on for advertising purposes. The only recipients are the service providers named above who work on our behalf (Cloudflare, Brevo) and Google if you load the map. Authorities and courts may also receive your data if we are legally obliged to disclose it. There is no automated decision-making or profiling.
Data security
The connection to our website is always encrypted (HTTPS). We store passwords only as a hash, the till is protected by a PIN, and the administration area can only be accessed after a separate login.
Your rights
In principle, you have the following rights:
- Access to your stored data (Art. 15 GDPR)
- Rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
To exercise these rights, simply contact us (see contact details above). You can change or delete your account details yourself at any time under "My account".
If you believe that the processing of your data violates data protection law, you can complain to us or to the Austrian Data Protection Authority (www.dsb.gv.at).
Last updated: November 2026