Privacy Policy

This Privacy Policy explains how Guzman y Gomez ("we," "us," "our," or "the Company") collects, uses, discloses, stores, and protects your personal information when you visit our website at guzmasnygomez.com, use our mobile application, place orders, participate in loyalty programs, or otherwise interact with our services. We are committed to handling your personal information responsibly and in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act, as well as any applicable state and territory privacy legislation.

Please read this Privacy Policy carefully before using our website or submitting any personal information to us. By accessing our website or using our services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with these terms, please discontinue use of our services immediately.

1. About Us

Guzman y Gomez is a food service and restaurant business operating in Australia. We are dedicated to providing fresh, authentic Mexican-inspired food to our customers across Australia and beyond. As an Australian business, we are bound by the Privacy Act 1988 (Cth) and take our obligations under that legislation seriously.

2. Scope of This Privacy Policy

This Privacy Policy applies to all personal information collected by Guzman y Gomez through the following channels and interactions:

• Our official website at guzmasnygomez.com
• Our mobile ordering application (iOS and Android)
• In-restaurant dining and ordering (including kiosk and point-of-sale systems)
• Our loyalty and rewards program
• Online food ordering and delivery platforms (where we share data responsibility)
• Marketing communications including email newsletters, SMS campaigns, and push notifications
• Social media pages and online advertising interactions
• Customer service and support inquiries
• Catering orders and corporate account management
• Competitions, promotions, surveys, and other marketing activities

This Policy does not apply to third-party websites or services that may be linked to or from our website. We encourage you to review the privacy policies of any third-party platforms you visit independently of our services.

3. What Personal Information We Collect

We collect several categories of personal information depending on how you interact with us. "Personal information" has the meaning given to it in the Privacy Act 1988 (Cth) and refers to information or an opinion about an identified individual, or an individual who is reasonably identifiable.

3.1 Information You Provide Directly to Us

When you create an account, place an order, contact us, or engage with our loyalty program, you may provide us with:

• Identity Information: Full name, username or nickname, date of birth, and gender (where voluntarily provided)
• Contact Information: Email address, phone number, residential or delivery address, and postcode
• Account Credentials: Password (stored in encrypted form), security questions and answers
• Payment Information: Credit or debit card details, billing address, and transaction history (note: full payment card numbers are processed by our PCI-DSS compliant payment processors and are not stored directly by us)
• Order History: Items ordered, customisation preferences, order frequency, spend amounts, and delivery instructions
• Loyalty Program Data: Points balances, rewards redeemed, membership tier, and participation history
• Dietary and Allergy Information: Where you choose to provide this to us for the purpose of personalising your food experience or for allergen management (this may be sensitive information and is handled accordingly)
• Communications: The content of any messages, feedback, complaints, or inquiries you send us via email, web form, phone, or social media
• Competition and Survey Responses: Information provided when you participate in promotions, competitions, or customer satisfaction surveys

3.2 Information We Collect Automatically

When you access our website or mobile application, we automatically collect certain technical and usage information, including:

• Device Information: Device type, operating system version, device identifiers (such as IDFA or Android Advertising ID), screen resolution, and browser type
• Log Data: IP address, date and time of access, pages viewed, referring URLs, links clicked, and session duration
• Location Data: General location inferred from your IP address, or precise geolocation data if you grant permission through our app (used to show nearby restaurants and enable location-based features)
• Usage Data: How you navigate our website or app, features you use, search terms entered, items browsed, and your interaction patterns
• Cookie and Tracking Data: Information collected through cookies, pixels, web beacons, and similar tracking technologies (see Section 9 on Cookies)
• Transaction Data: Records of purchases made through our digital platforms

3.3 Information We Collect from Third Parties

We may receive personal information about you from third parties, including:

• Delivery Platform Partners: Where you order through third-party delivery platforms such as Uber Eats, DoorDash, or Menulog, we may receive order and contact details to fulfil your order
• Social Media Platforms: If you log in to our services using a social media account (e.g., Facebook, Google, or Apple), we receive certain profile information from those platforms as permitted by your privacy settings on those services
• Analytics and Advertising Partners: Aggregated or pseudonymous audience data used for targeting and campaign measurement
• Publicly Available Sources: Information about businesses or individuals that is lawfully available to the public
• Fraud Prevention Services: Risk signals and fraud detection data to protect the integrity of our transactions

4. How We Use Your Personal Information

We use the personal information we collect for the following purposes, always in accordance with the Australian Privacy Principles:

4.1 Providing and Managing Our Services

• Processing and fulfilling your food orders, including delivery and pick-up arrangements
• Creating and managing your online account and loyalty program membership
• Processing payments and managing billing enquiries
• Communicating with you about your orders, bookings, and account activity
• Providing customer support, handling complaints, and resolving disputes
• Managing allergen and dietary requirement information to personalise your experience and maintain safety

4.2 Marketing and Communications

• Sending you promotional offers, new menu announcements, special events, and loyalty program updates (where you have consented or where permitted by the Spam Act 2003 (Cth))
• Personalising marketing communications based on your order history, location, and preferences
• Running competitions, surveys, and promotional campaigns
• Serving targeted digital advertising across social media platforms and other online channels
• Measuring the effectiveness of our marketing activities and campaigns

You may opt out of marketing communications at any time by clicking the "unsubscribe" link in our emails, updating your communication preferences in your account settings, or by contacting us at [email protected].

4.3 Analytics and Service Improvement

• Analysing how customers use our website, app, and in-restaurant services to improve our offerings
• Understanding customer preferences and trends to develop new menu items and services
• Conducting internal research, reporting, and business analysis
• Testing and improving our website and application functionality
• Training our staff and improving our customer service processes

4.4 Legal and Compliance Purposes

• Complying with our legal obligations under Australian law, including the Privacy Act 1988 (Cth), the Australian Consumer Law (ACL), and tax and financial reporting requirements
• Detecting, investigating, and preventing fraudulent transactions, security incidents, and other unlawful activities
• Enforcing our Terms of Service and other applicable agreements
• Responding to legal processes, court orders, and requests from government or regulatory authorities
• Establishing, exercising, or defending legal claims

4.5 Safety and Security

• Verifying your identity when you access your account or request changes
• Protecting the security and integrity of our IT systems, networks, and data
• Monitoring for and responding to cybersecurity threats
• Ensuring food safety and managing allergen-related risks

5. Legal Bases for Processing Your Personal Information

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, we collect and use your personal information on the following grounds:

• Consent: Where you have given us your express consent, such as when subscribing to marketing communications or granting access to your device location
• Contractual Necessity: Where processing is necessary to fulfil our contract with you, such as processing your food order or managing your loyalty account
• Legitimate Interests: Where we have a legitimate business interest in processing your information (such as for fraud prevention, analytics, and service improvement) that is not overridden by your privacy interests
• Legal Obligation: Where we are required to process your information to comply with a legal obligation
• Vital Interests: In rare circumstances, where processing is necessary to protect your vital interests or those of another person (e.g., in a food safety emergency)

6. Sharing Your Personal Information with Third Parties

We do not sell your personal information to third parties. However, we may share your information in the following circumstances:

6.1 Service Providers and Business Partners

We engage trusted third-party service providers who assist us in operating our business. These parties process personal information on our behalf and are bound by contractual obligations to keep your information confidential and to use it only for the purposes we specify. These providers include:

• Payment processors and financial institutions (e.g., card payment gateways operating under PCI-DSS standards)
• Cloud computing and data hosting providers
• Delivery and logistics partners
• Email marketing and CRM platform providers
• Analytics and business intelligence providers (e.g., Google Analytics)
• Customer support and help desk software providers
• IT security and fraud prevention services
• Loyalty program technology providers
• Advertising and media agencies
• SMS and push notification delivery services

6.2 Delivery Platform Partners

Where you place an order via a third-party delivery platform (such as Uber Eats, DoorDash, or Menulog), your personal information will also be subject to that platform's privacy policy. We receive limited information necessary to fulfil your order from such platforms.

6.3 Franchisees and Business Partners

Guzman y Gomez operates through both company-owned and franchised restaurant locations. We may share relevant order and customer data with our franchisees as necessary to operate our restaurant network and loyalty program consistently. All franchisees are required to comply with applicable privacy obligations.

6.4 Legal Requirements and Law Enforcement

We may disclose your personal information where required or permitted by law, including:

• In response to a valid subpoena, court order, or other legal process
• To comply with requests from government regulators, tax authorities, or law enforcement agencies
• Where disclosure is necessary to prevent or investigate suspected illegal activity, fraud, or threats to safety
• Where required under Australian food safety, consumer protection, or other regulatory frameworks

6.5 Business Transactions

In the event of a merger, acquisition, restructure, sale of assets, or similar corporate transaction involving Guzman y Gomez, your personal information may be transferred to the relevant third party as part of that transaction. We will take steps to ensure the confidentiality of your information throughout such a process and notify you if your information becomes subject to a different privacy policy as a result.

6.6 With Your Consent

We may share your personal information with other parties where you have given us your express consent to do so.

7. International Transfers of Personal Information

Guzman y Gomez is an Australian business, and we primarily store and process your personal information in Australia. However, some of our third-party service providers are located overseas, including in the United States, the United Kingdom, the European Union, Singapore, and other countries. When we transfer your personal information outside of Australia, we take steps to ensure that it receives a level of protection consistent with the Australian Privacy Principles.

These steps include:

• Entering into data processing agreements with overseas recipients that contain obligations equivalent to the APPs
• Relying on adequacy determinations where applicable
• Implementing appropriate technical and organisational safeguards to protect your information during transfer and storage

By using our services, you acknowledge that your personal information may be transferred to, stored in, and processed in countries other than Australia. If you have questions about our international data transfer practices, please contact us at [email protected].

8. Data Security

We take the security of your personal information seriously and implement a range of technical, administrative, and physical safeguards designed to protect your information from unauthorised access, use, disclosure, alteration, or destruction. Our security measures include:

• Encryption: Personal information transmitted between your browser or device and our servers is encrypted using industry-standard Transport Layer Security (TLS) protocols. Sensitive data such as passwords is stored using strong one-way hashing algorithms.
• Access Controls: Access to personal information is restricted to authorised personnel who need it to perform their job functions. We use role-based access controls and multi-factor authentication for administrative systems.
• Payment Security: We use PCI-DSS compliant payment processing providers and do not store full credit or debit card numbers on our systems.
• Regular Security Assessments: We conduct regular security audits, vulnerability assessments, and penetration testing to identify and address security risks.
• Data Minimisation: We collect only the personal information that is necessary for the purposes described in this Policy.
• Employee Training: Our staff receive regular privacy and security training to ensure they handle personal information appropriately.
• Incident Response: We maintain a data breach response plan and are committed to notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) in the event of an eligible data breach under the Notifiable Data Breaches (NDB) scheme established under Part IIIC of the Privacy Act 1988 (Cth).

While we take these precautions, no method of data transmission or storage over the internet is completely secure. We cannot guarantee the absolute security of your information. In the event you become aware of any security concerns relating to your account, please contact us immediately at [email protected].

9. Cookies and Tracking Technologies

Our website and mobile application use cookies and similar tracking technologies (including pixels, web beacons, and local storage) to enhance your browsing experience, analyse website traffic, and deliver personalised advertising.

9.1 Types of Cookies We Use

• Essential Cookies: Necessary for the operation of our website and to enable core functionality such as login, shopping cart, and order processing
• Performance and Analytics Cookies: Used to understand how visitors interact with our website (e.g., Google Analytics) so we can improve our services
• Functionality Cookies: Allow us to remember your preferences and settings (such as language and location) to provide a more personalised experience
• Marketing and Advertising Cookies: Used to deliver relevant advertisements and to track the effectiveness of our marketing campaigns across third-party websites and social media platforms

9.2 Managing Cookie Preferences

You can control and manage cookies through your browser settings. Most browsers allow you to block or delete cookies; however, doing so may affect the functionality of our website. You can also opt out of interest-based advertising by visiting the Network Advertising Initiative opt-out page or the Digital Advertising Alliance opt-out tool.

For full details about the cookies we use and how to manage them, please refer to our Cookie Policy.

10. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. The specific retention periods depend on the nature of the information and the purpose for which it was collected:

When your personal information is no longer required, we will take reasonable steps to destroy or de-identify it in a secure manner, in accordance with APP 11.2 of the Australian Privacy Principles.

11. Your Privacy Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights in relation to your personal information:

11.1 Right of Access

You have the right to request access to the personal information we hold about you. We will respond to your access request within 30 days and will provide the information in a format that is accessible to you. In some circumstances, we may charge a reasonable fee for providing access (we will advise you of any applicable fee before processing your request). We may refuse access in limited circumstances permitted by the APPs, such as where access would unreasonably impact the privacy of another individual or where granting access would be unlawful.

11.2 Right to Correction

If you believe that the personal information we hold about you is inaccurate, incomplete, out-of-date, irrelevant, or misleading, you have the right to request that we correct it. We will take reasonable steps to correct your information within 30 days of receiving your request. If we disagree with your correction request, we will explain our reasons and provide information about how to escalate your complaint.

11.3 Right to Deletion (Erasure)

In certain circumstances, you may request that we delete or de-identify personal information we hold about you — for example, where you withdraw consent, where the information is no longer needed for the purpose for which it was collected, or where continued retention would be unlawful. Please note that we may retain certain information where we are required to do so by law or where we have a legitimate reason to retain it (such as to resolve disputes or enforce our agreements).

11.4 Right to Data Portability

Where technically feasible, you may request a copy of your personal information in a structured, commonly used, and machine-readable format (such as CSV) so that you can transmit it to another service provider. You can exercise this right by contacting us directly.

11.5 Right to Opt Out of Direct Marketing

You have the right to opt out of receiving direct marketing communications from us at any time. You can do this by:

• Clicking the "unsubscribe" link at the bottom of any marketing email we send you
• Updating your communication preferences in your online account settings
• Contacting us directly at [email protected] and requesting removal from our marketing lists
• Opting out of SMS marketing by replying "STOP" to any marketing SMS

Please allow up to 10 business days for your opt-out request to take effect. Note that even after you opt out of marketing communications, we may still send you transactional messages related to your orders and account.

11.6 Right to Complain

If you believe we have not handled your personal information in accordance with the Privacy Act 1988 (Cth) or the Australian Privacy Principles, you have the right to make a complaint. Please see Section 14 of this Policy for details on how to file a complaint with us and with the Office of the Australian Information Commissioner (OAIC).

To exercise any of your privacy rights, please contact our Privacy Officer using the details in Section 13 of this Policy. We will verify your identity before processing your request.

12. Children's Privacy

Our digital services, including our website and mobile application, are not directed at children under the age of 18. We do not knowingly collect personal information from individuals under 18 years of age without the verifiable consent of a parent or legal guardian.

If you are under 18 years of age, please do not submit personal information to us through our website or app without the supervision and consent of your parent or guardian. If we become aware that we have inadvertently collected personal information from a child under 18 without appropriate consent, we will take prompt steps to delete that information from our systems.

Parents or guardians who believe that their child has provided us with personal information without their consent should contact us at [email protected] so that we can investigate and take appropriate action.

13. Sensitive Information

The Privacy Act 1988 (Cth) provides additional protections for "sensitive information," which includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal records, and biometric data. We treat any dietary or allergy information you provide to us as sensitive information and handle it with an additional level of care. We will only collect sensitive information about you where:

• You have consented to its collection; or
• The collection is required or authorised by law; or
• It is directly related to our primary purpose in collecting the information (such as ensuring your food safety).

We will not use sensitive information for secondary purposes such as marketing without your explicit consent.

14. Contact Us and Privacy Complaints

We welcome your questions, feedback, and requests about this Privacy Policy and our privacy practices. If you have a question or wish to exercise your privacy rights, please contact our Privacy Officer:

14.1 How to Make a Privacy Complaint

If you believe we have breached the Australian Privacy Principles or otherwise mishandled your personal information, we encourage you to contact us first so that we have an opportunity to resolve the issue. To make a complaint:

1. Contact our Privacy Officer at [email protected] with the subject line "Privacy Complaint"
2. Describe the nature of your complaint in as much detail as possible, including the specific conduct you believe was a breach of privacy
3. We will acknowledge receipt of your complaint within 5 business days and will aim to investigate and respond to your complaint within 30 days
4. If we are unable to resolve your complaint to your satisfaction, we will explain our decision and advise you of further options

14.2 Escalating Your Complaint to the OAIC

If you are not satisfied with our response, or if you have not received a response within 30 days, you have the right to escalate your complaint to the Office of the Australian Information Commissioner (OAIC). The OAIC is Australia's national regulator for privacy and freedom of information. You can contact the OAIC by:

The OAIC can investigate complaints about alleged breaches of the Privacy Act 1988 (Cth) and the Australian Privacy Principles. The OAIC may attempt conciliation between you and us as part of the complaints process.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, technology, legal requirements, or regulatory guidance. When we make material changes to this Policy, we will notify you by:

• Posting the updated Privacy Policy on our website at guzmasnygomez.com with a revised "Last Updated" date
• Sending an email notification to the email address associated with your account (for significant changes)
• Displaying a prominent notice on our website or app at the time you next log in

Your continued use of our services after the updated Privacy Policy becomes effective constitutes your acceptance of the revised terms. If you do not agree with any changes, you should discontinue use of our services and may request deletion of your account and associated data.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

16. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Australia, including the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), and the Australian Consumer Law as set out in Schedule 2 of the Competition and Consumer Act 2010 (Cth). Any disputes arising in connection with this Privacy Policy shall be subject to the jurisdiction of the courts of Australia.