Privacy Policy

This Privacy Policy explains how Guzman y Gomez ("we", "us", "our", or "the Company") collects, uses, discloses, stores, and protects your personal information when you visit our website at guzmanssgomez.com, use our mobile applications, place orders, participate in our loyalty programs, or otherwise interact with us. We are committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act.

Please read this Privacy Policy carefully. By accessing our website, placing an order, or engaging with our services, you acknowledge that you have read, understood, and agree to the collection and use of your information as described in this policy. If you do not agree with this policy, please discontinue your use of our services.

1. About Us

Guzman y Gomez is an Australian food service business operating restaurants and digital food ordering platforms across Australia. We are committed to delivering fresh, flavourful Mexican-inspired food while maintaining the highest standards of privacy and data protection for our customers, employees, and business partners.

2. Scope of This Privacy Policy

This Privacy Policy applies to all personal information we collect about:

• Customers who visit our restaurants, use our website, or engage with our mobile application
• Individuals who register for our loyalty and rewards programs
• Individuals who contact us for customer support or make inquiries
• Job applicants and prospective employees
• Suppliers, vendors, and business partners
• Any other individual who interacts with Guzman y Gomez in any capacity

This policy does not apply to the privacy practices of third-party websites, platforms, or services that may be linked from our website. We encourage you to read the privacy policies of those third parties independently.

3. What Personal Information We Collect

We collect personal information that is reasonably necessary for our business activities and the provision of our food and related services. The types of personal information we collect include, but are not limited to, the following:

3.1 Identity and Contact Information

• Full name
• Date of birth (where required for age verification or promotional purposes)
• Email address
• Phone number (mobile and/or landline)
• Residential or delivery address
• Username and password (for account registration)
• Profile photograph (if uploaded by the user)

3.2 Order and Transaction Information

• Food and beverage order history, including items ordered, quantities, customisations, and preferences
• Payment information, including credit/debit card details (processed and stored securely through compliant payment gateways), PayPal, Apple Pay, Google Pay, and other payment methods
• Billing address
• Delivery instructions and notes
• Order timestamps and restaurant location details
• Loyalty points balance and redemption history

3.3 Usage and Behavioural Data

• Pages visited on our website or in-app screens accessed
• Time spent on pages and navigation paths
• Links clicked, buttons pressed, and menu items browsed
• Search queries entered within our website or application
• Frequency and patterns of visits
• Referring URLs (how you arrived at our site)
• Cart abandonment data

3.4 Device and Technical Information

• IP address
• Device type, model, and manufacturer
• Operating system and version
• Browser type and version
• Unique device identifiers
• Mobile network information
• Time zone and regional settings
• Cookie identifiers and session tokens

3.5 Location Data

• Approximate location data derived from your IP address
• Precise geolocation data from your mobile device (only where you have granted explicit permission through your device settings)
• Preferred restaurant location selected by you

3.6 Communications and Feedback

• Messages sent to us via email, contact forms, or social media
• Customer service inquiries and complaint records
• Survey responses and feedback submissions
• Competition and promotion entries
• Reviews and ratings submitted about our food or services

3.7 Marketing Preferences

• Subscription preferences for marketing communications
• Communication channel preferences (email, SMS, push notifications)
• Opt-in and opt-out records

3.8 Employment and Application Data

If you apply for a position with Guzman y Gomez, we may collect additional information including your resume, work history, qualifications, references, and information obtained during the recruitment process, including background check results where applicable and permitted by law.

4. How We Collect Personal Information

We collect personal information through a variety of means, including:

4.1 Directly From You

• When you create an account on our website or mobile application
• When you place an order online, in-app, or at one of our restaurant locations
• When you sign up for our loyalty or rewards program
• When you contact our customer service team
• When you fill in forms on our website or in-store
• When you participate in competitions, promotions, or surveys
• When you apply for employment with us

4.2 Automatically Through Technology

• Cookies, web beacons, pixels, and similar tracking technologies placed on your browser or device
• Our website analytics platforms
• Our mobile application, which may collect device and usage data automatically
• Server logs that record technical information about your visit

4.3 From Third Parties

• Third-party food delivery platforms (such as Uber Eats, DoorDash, or Menulog) who may share information about orders placed through their services for fulfilment purposes
• Social media platforms, if you connect your social account or interact with our social media pages
• Marketing partners and advertising networks
• Payment processors and financial institutions
• Publicly available sources

5. How We Use Your Personal Information

We use your personal information only for purposes that are lawful and necessary for our operations. The primary purposes for which we use your information include:

5.1 Service Provision and Order Fulfilment

• Processing and fulfilling your food and beverage orders
• Managing your account and loyalty program membership
• Facilitating payment processing and issuing receipts
• Arranging delivery or pickup of your orders
• Communicating with you about your orders, including confirmations, updates, and delays

5.2 Customer Support and Communications

• Responding to your inquiries, questions, and complaints
• Providing technical support for our website and application
• Sending service-related notices, such as policy updates or changes to your account

5.3 Analytics and Service Improvement

• Analysing how customers use our website, application, and services to identify trends and areas for improvement
• Conducting research and development to improve our menu, services, and customer experience
• Generating aggregate, anonymised statistics about our customers and their behaviour
• Monitoring the performance and security of our digital platforms

5.4 Marketing and Promotions

• Sending you promotional offers, special deals, and news about Guzman y Gomez products and services, where you have provided consent or where permitted by the Spam Act 2003 (Cth)
• Personalising marketing communications based on your order history and preferences
• Running competitions, prize draws, and loyalty reward campaigns
• Delivering targeted advertisements through third-party platforms and advertising networks

5.5 Legal and Regulatory Compliance

• Complying with our obligations under Australian law, including the Privacy Act 1988 (Cth), the Australian Consumer Law (ACL) under the Competition and Consumer Act 2010 (Cth), and applicable food safety regulations
• Responding to lawful requests from government authorities or law enforcement agencies
• Protecting our legal rights and defending against claims
• Preventing and detecting fraud, security breaches, and illegal activity

5.6 Employment Purposes

• Assessing job applications and conducting recruitment processes
• Managing employment relationships in accordance with applicable employment laws

6. Disclosure of Personal Information to Third Parties

We do not sell your personal information to third parties. However, we may share your personal information with third parties in the following circumstances:

6.1 Service Providers and Business Partners

We engage trusted third-party service providers who assist us in operating our business and delivering our services. These may include:

• Payment processors — to securely process your payments
• Delivery platforms — to coordinate and fulfil food delivery orders
• Cloud computing and hosting providers — to host our website, application, and data
• Analytics providers — such as Google Analytics and similar tools, to help us understand how our services are used
• Email and SMS marketing platforms — to send communications on our behalf
• Customer relationship management (CRM) providers — to manage customer interactions
• Loyalty program platform providers — to manage rewards and points systems
• IT support and cybersecurity providers — to maintain the security and integrity of our systems

All third-party service providers are required to handle your personal information in accordance with our instructions and applicable privacy laws. We do not permit them to use your personal information for their own marketing purposes unless you have separately consented to this.

6.2 Advertising and Social Media Networks

We may share certain information, such as hashed email addresses or device identifiers, with advertising platforms (including Meta, Google, and other digital advertising networks) to deliver targeted advertisements and measure advertising effectiveness. You may opt out of personalised advertising through the settings of the relevant platforms.

6.3 Legal and Regulatory Disclosures

We may disclose your personal information if we are required to do so by law, court order, or regulatory requirement, or if we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation under Australian law
• Protect and defend the rights or property of Guzman y Gomez
• Prevent or investigate possible wrongdoing in connection with our services
• Protect the personal safety of users of our services or the public

6.4 Business Transfers

In the event of a merger, acquisition, restructure, asset sale, or other business transition, your personal information may be transferred to the relevant successor entity. We will notify you of any such change and ensure that your information continues to be protected in accordance with this Privacy Policy.

6.5 With Your Consent

We may share your personal information with other third parties where you have given us your explicit consent to do so.

7. Cookies and Tracking Technologies

Our website and mobile application use cookies, web beacons, pixel tags, and similar tracking technologies to enhance your browsing experience, analyse website traffic, and deliver personalised content and advertising.

7.1 Types of Cookies We Use

• Essential Cookies: Necessary for the website to function correctly, including session management and security features
• Functional Cookies: Enable personalised features such as remembering your preferences, saved cart items, and language settings
• Analytics Cookies: Collect information about how visitors use our website to help us improve its performance and content
• Marketing and Advertising Cookies: Used to deliver relevant advertisements and track the effectiveness of our marketing campaigns

7.2 Managing Cookies

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality and performance of our website. For more detailed information about the specific cookies we use, how long they are retained, and how to manage your preferences, please refer to our Cookie Policy.

8. Data Security

We take the security of your personal information seriously and implement a range of technical, organisational, and administrative measures to protect it from unauthorised access, use, disclosure, alteration, or destruction. Our security measures include:

• Encryption: All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS) protocols. Sensitive information such as payment card data is encrypted both in transit and at rest.
• Access Controls: Access to personal information is restricted to authorised employees, contractors, and service providers who require access to perform their job functions. All personnel with access to personal data are subject to confidentiality obligations.
• Payment Card Industry (PCI DSS) Compliance: Our payment processing systems comply with the Payment Card Industry Data Security Standard to protect your financial information.
• Regular Security Assessments: We conduct periodic reviews of our information security practices, including vulnerability assessments and penetration testing.
• Incident Response: We maintain a data breach response plan and will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in the event of an eligible data breach, as required under the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth).
• Employee Training: All staff are trained on privacy obligations and data handling procedures.

Despite our best efforts, no method of electronic transmission or storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. If you suspect any unauthorised access to your account, please contact us immediately at [email protected].

9. Your Privacy Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights in relation to your personal information:

9.1 Right of Access

You have the right to request access to the personal information we hold about you. We will respond to your access request within a reasonable period (generally within 30 days). In most cases, we will provide access free of charge; however, in some cases, we may charge a reasonable fee to cover the cost of processing complex requests.

9.2 Right to Correction

If you believe that personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you have the right to request that we correct it. We will take reasonable steps to correct the information within 30 days of receiving your request. If we are unable to make the correction you request, we will explain why.

9.3 Right to Deletion (Erasure)

In certain circumstances, you may request that we delete your personal information. We will consider your request in light of our legal and regulatory obligations, including our obligations to retain records under Australian tax, employment, and business laws. Where we are unable to delete certain information, we will inform you of the reasons.

9.4 Right to Data Portability

Where technically feasible and appropriate, you may request that we provide you with a copy of your personal information in a structured, commonly used, and machine-readable format so that you can transfer it to another service provider.

9.5 Right to Opt Out of Marketing

You may opt out of receiving marketing communications from us at any time by:

• Clicking the "unsubscribe" link included in any marketing email we send you
• Replying "STOP" to any marketing SMS message
• Adjusting your push notification preferences in your device or app settings
• Contacting us directly at [email protected]

Please note that even if you opt out of marketing communications, we may still send you service-related or transactional communications (such as order confirmations, account security alerts, or important policy updates).

9.6 Right to Withdraw Consent

Where we rely on your consent to process your personal information (for example, for location tracking or personalised marketing), you have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before consent was withdrawn.

9.7 How to Exercise Your Rights

To exercise any of the above rights, please contact our Privacy Officer using the details provided in Section 14 of this policy. We may need to verify your identity before processing your request to ensure the security of your personal information.

10. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following general retention periods apply:

When personal information is no longer required, we will take reasonable steps to destroy or permanently de-identify it in a secure manner.

11. Children's Privacy

Our online services, including our website and mobile application, are not directed at children under the age of 18. We do not knowingly collect personal information from individuals under 18 years of age through our digital platforms.

If you are under 18 years of age, please do not provide us with any personal information, create an account, or use our online ordering services without the supervision of a parent or legal guardian. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at [email protected] so that we can take appropriate steps to remove such information.

In-store purchases may be made by individuals of any age, subject to applicable food and beverage regulations. However, any digital accounts, loyalty memberships, or online registrations require the account holder to be at least 18 years of age.

12. International Data Transfers

Guzman y Gomez is an Australian business, and the primary location of our data storage and processing is within Australia. However, some of our third-party service providers — including cloud hosting providers, analytics platforms, and marketing tools — may store or process data on servers located outside of Australia.

Where we transfer personal information to overseas recipients, we take reasonable steps to ensure that those recipients handle your information in a manner consistent with the Australian Privacy Principles. This may include:

• Entering into data processing agreements with overseas service providers that impose obligations consistent with Australian privacy standards
• Assessing whether the overseas jurisdiction has privacy laws that are substantially similar to Australia's Privacy Act 1988 (Cth)
• Relying on your consent to the overseas transfer, where appropriate

Countries to which your data may be transferred include, but are not limited to, the United States of America (for providers such as Google, Meta, and Amazon Web Services), Singapore, and other countries in which our technology partners operate. Please be aware that the privacy laws in these jurisdictions may differ from those in Australia.

By using our services, you acknowledge and consent to the possible transfer of your personal information to countries outside Australia, provided we have taken reasonable steps to ensure adequate protections are in place as described above.

13. Third-Party Links and Services

Our website and application may contain links to third-party websites, social media platforms, delivery partner applications, and other external services. This Privacy Policy does not apply to those third-party services, and we are not responsible for the privacy practices of any external websites or platforms. We encourage you to read the privacy policies of any third-party services you visit or use, including:

• Food delivery platforms (such as Uber Eats, DoorDash, and Menulog)
• Social media platforms (such as Instagram, Facebook, TikTok, and X/Twitter)
• Payment providers (such as PayPal, Apple Pay, and Google Pay)
• Review platforms and comparison websites

14. Contact Us — Privacy Inquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal information, please contact our Privacy Officer using the following details:

We will acknowledge your inquiry promptly and aim to resolve it within 30 days. If your request is complex or involves a large volume of information, we will notify you of the expected timeframe for resolution.

15. How to Make a Privacy Complaint

15.1 Internal Complaint Process

If you believe that we have handled your personal information in a way that does not comply with the Privacy Act 1988 (Cth) or the Australian Privacy Principles, we encourage you to contact us first so that we have the opportunity to resolve your concern directly. Please submit your complaint in writing to the contact details provided in Section 14 above, including:

• Your full name and contact details
• A description of the privacy concern or complaint
• Details of what outcome you are seeking

We will investigate your complaint and respond in writing within 30 days. In complex cases, we may require additional time to investigate, and we will keep you informed of progress.

15.2 External Complaint — Office of the Australian Information Commissioner (OAIC)

If you are not satisfied with our response to your complaint, or if you prefer to lodge a complaint directly with the relevant regulatory authority, you have the right to contact the Office of the Australian Information Commissioner (OAIC):

The OAIC can investigate privacy complaints and, where it finds a breach has occurred, may make determinations requiring us to take remedial action. You may also contact the Australian Competition and Consumer Commission (ACCC) if your concern relates to consumer protection matters under the Australian Consumer Law.

16. Changes to This Privacy Policy

We may update or amend this Privacy Policy from time to time to reflect changes in our business practices, legal obligations, or the services we provide. When we make significant changes to this policy, we will:

• Update the "Last Updated" date at the top of this page
• Post a notice on our website alerting users to the update
• Where required by law or where the changes are material, notify you directly via email or in-app notification

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information. Your continued use of our services after any changes to this policy are posted constitutes your acceptance of those changes.

17. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Australia, including the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), and the Competition and Consumer Act 2010 (Cth) (including the Australian Consumer Law contained in Schedule 2). Any disputes arising in connection with this Privacy Policy shall be subject to the jurisdiction of Australian courts.