Privacy Policy

1. Find information about data protection in our web application here.

Read this privacy policy and all other notices regarding data protection and fair data processing that we provide when collecting or processing your personal data to understand how and why we use your data.
Definitions of terms used follow Art. 4 of the EU General Data Protection Regulation (GDPR).

2. The entity responsible for processing your personal data that operates and manages this web application is:

Horeca Digital System GmbH
Thomasiusstr. 7
D- 04109 Leipzig, Germany
Email: datenschutz@so-use.de
Managing Director: Ben Kamran Wollscheid

Please use these contact details for questions about data protection.

3. Summary

a. We store your IP address in shortened form to create statistics when you visit our pages.
b. We process data to operate our website.
c. We need your address, contact details, and payment information to process your order or purchase.
d. We work with selected service providers who may receive your data for specific purposes.

4. Server Log Files

The site provider automatically collects and stores information in server log files that your browser transmits to us. These are:

- Browser type and version
- Operating system used
- Referrer URL, hostname of the accessing computer
- Time of the server request
- IP address

The legal basis for data processing is Art. 6 (1) (b) and (f) GDPR, which permits processing for contract fulfillment or pre-contractual measures, and our legitimate interest in operating our online shop.

5. Orders

a. "Order on-site" and/or "Pay on-site"
We may collect and process your email address to forward your order to the respective restaurateur. This information is mandatory for order processing. You can also provide comments and instructions with your order. We use the data provided for contract fulfillment in accordance with Art. 6 (1) (b) GDPR. We generally store your data for up to 10 years for commercial and tax reasons and for up to 2 years for potential warranty claims. You can find more details below.

b. "Delivery" and "Pickup"
You can have your order delivered or pick it up on-site. We collect and process your name, address, email address, and phone number to forward your delivery or pickup request to the respective restaurateur. You can also provide comments and instructions here. Required fields are marked because we need this data for contract fulfillment and cannot process the order without it. We use the data provided for contract fulfillment in accordance with Art. 6 (1) (b) GDPR. We generally store your data for up to 10 years for commercial and tax reasons and for up to 2 years for potential warranty claims. You can find more details below.

c. Payments via Adyen 
Depending on the restaurant where you use SO’USE, you can pay via credit card, Apple Pay, Google Pay, Giropay, Paypal, or other common online payment methods. For this, we use the payment service provider Adyen N.V., Friedrichstraße 63, 10117 Berlin. Adyen and the payment providers (Apple and Google) process your credit card data directly; we do not store it and do not gain knowledge of it at any time. Adyen states they process at least the following information:

For all transactions:

- Date of the transaction,
- Amount of the transaction,
- Transaction status (accepted/declined).

For credit card payments: 

- Card origin (only the last four digits are visible to us and stored by Adyen), 
- The IP address from which the order was placed to identify fraud,
- Expiry date (month and year), 
- Country of origin, card type (credit or debit), 
- Name of the card company (Visa, American Express, Mastercard…) 

We process this data for order fulfillment in accordance with Art. 6 (1) (b) GDPR. Adyen will also use your data for identity and credit checks, subject to Adyen's terms. Read Adyen’s current privacy policy and additional information here: https://www.adyen.com/policies-and-disclaimer/privacy-policy. We also use transaction data (except account/credit card info) for statistical analysis of our web application. We have a legitimate interest in analyzing our services for further development according to Art. 6 (1) (f) GDPR. Financial information is stored exclusively by Adyen, Apple, Google, and Paypal. We have no access to this.


6. Communication

a. Contact
Email or call us with questions or comments. We store your details such as email address, phone number, and the content of your request to process the inquiry and for follow-up questions. We do not share this information without your consent unless the inquiry requires the involvement of the restaurateur or we are legally obliged to do so. Processing is based on Art. 6 (1) (b) and (f) GDPR. Our legitimate interest follows from answering your inquiry.

b. Advertising
We would like to inform you about news related to your last SO’USE order, provided you have purchased from us before. We use your contact details such as email address and name for this purpose. The legal basis for this processing is Art. 6 (1) (f) GDPR. We have a legitimate interest in using your data for advertising once you have ordered through us.

c. Objection
You can object to the processing of your personal data for direct marketing purposes at any time and free of charge. Please see the information on your rights below for more details.

7. Cookies

We use cookies. Cookies do not damage your computer and do not contain viruses. Cookies make our offer user-friendly, effective, and secure. Cookies are small text files stored on your computer by your browser.

Most cookies we use are "session cookies". They are automatically deleted after your visit. These cookies allow us to recognize your browser during your visit, so you can still view your orders even if you closed your browser in the meantime.

You can set your browser to notify you about the use of cookies and only allow them in individual cases. You can also exclude the acceptance of cookies for specific cases or generally and activate the automatic deletion of cookies when closing the browser. Deactivating cookies may limit the functionality of this website.

8. Recipients

We primarily share your data with restaurateurs and payment providers to process your order. Unless explained otherwise in individual sections, we forward your data internally to responsible employees and, if necessary, to other recipients such as authorities, tax advisors, lawyers, web hosts, and other third parties typically involved in normal business operations. Data may also be shared if required to pursue our claims or if there is a legal obligation.

We do not share data with third parties for their own use without your express consent, and we always follow the requirement of lawfulness. All service providers are involved in accordance with GDPR requirements.


9. Deletion

We store your personal data only as long as necessary for the purposes for which it was collected, including compliance with legal accounting or reporting requirements.
We are legally required to retain basic customer information (including contact, identity, and transaction data, business letters) for tax and commercial law reasons for six years after the end of the business relationship or ten years after the end of the current tax year in which the invoice was created (§257 HGB, §147 AO, etc.).

Specific deletion periods apply in individual cases as highlighted in the respective sections.

In certain circumstances, you can request the deletion of your personal data.

10. Your Rights

In certain cases, you have the following rights regarding your personal data:

Right of Access (Art. 15 GDPR) to the personal data we process. You can receive a copy of your stored personal data and check whether we are processing it lawfully.

Right to Rectification (Art. 16 GDPR) of your personal data stored with us. You can have incomplete or incorrect data corrected, although we may need to verify the accuracy of the new data provided.

Right to Erasure (Art. 17 GDPR) of your personal data. You can request the deletion or removal of personal data if there is no compelling reason for further processing. You can also request deletion if you have successfully exercised your right to object (see below), if we processed your data unlawfully, or if we are required to delete it to comply with local laws. Legal reasons may prevent us from always fulfilling your deletion request, which will be communicated at the time of the request.

Right to Restriction of Processing (Art. 18 GDPR) of your personal data. You can ask us to suspend processing in the following cases: (a) if you want us to establish the accuracy of the data; (b) if our use of the data is unlawful but you oppose deletion; (c) if you want us to store the data longer than necessary for us because you need it to establish, exercise, or defend legal claims; or (d) if you have objected to our use of your data but we need to check for overriding legitimate reasons for its use.

Right to Data Portability (Art. 20 GDPR) of your personal data to you or a third party. We will provide a copy of your personal data in a structured, commonly used, machine-readable format to you or a designated third party. This right only applies to automated data which you initially consented to or which was used to fulfill a contract with you.

Right to Object (Art. 21 GDPR) to the processing of your personal data. This right exists if we rely on a legitimate interest (or that of a third party) and your particular situation causes you to object to processing because you feel it affects your fundamental rights and freedoms. You also have a right to object if your personal data is processed for direct marketing. In some cases, we may demonstrate compelling legitimate grounds for processing that outweigh your rights and freedoms.

Right not to be subject to automated decision-making (Art. 22 GDPR) (including profiling) if this would significantly affect you. Since we do not engage in such activities, this right is not practically relevant for your use of the website.

Right to withdraw consent at any time (Art. 7 (3) GDPR) if we require your consent for processing. This does not affect the lawfulness of processing before the withdrawal. If you withdraw consent, we may no longer be able to provide certain products, content, or services. We will inform you of this at the time of withdrawal.

Right to lodge a complaint with a supervisory authority.
The supervisory authority responsible for us is:

Saxon Data Protection Officer
Mr. Andreas Schurig
Devrientstraße 5
01067 Dresden

11. Changes to this Privacy Policy
This privacy policy may be updated or changed at any time.
You will be notified of any changes by the publication of the amended version on the website. This version was last modified on the date below. Request older versions from us.

This Privacy Policy is provided in English for informational purposes only. In the event of any discrepancies or inconsistencies between the English and German versions, the German version shall prevail and be legally binding.

Last modified: 20.09.2023
Email: datenschutz@so-use.de