Privacy policy
Updated: 15 October 2026
1. Controller and contact
Gastro Oma München GmbH, Pasinger Bahnhofsplatz 5, 81241 München, Germany; [email protected]; +49 89 35746541 is the controller. This policy covers order.gastrooma.eu and its ordering and Oma Club functions.
2. Operation and security
Visits involve processing IP address, request time and URL, browser information and technical errors to deliver and protect the service. The website uses OpenAI Sites and Cloudflare infrastructure, including database and file storage. The basis is Article 6(1)(f) GDPR: secure and reliable operation. Necessary device storage access is based on section 25(2) TDDDG.
3. Orders and payments
We process name, email, phone, basket, prices, fulfilment method and time, delivery address where applicable, and order, payment and processing status. Do not enter unnecessary sensitive information in free-text fields. The basis is Article 6(1)(b) GDPR, and Article 6(1)(c) for tax retention. HubRise transfers orders to our Lightspeed till. Stripe processes online payment and transaction data; our ordering system does not store full card details. The privacy information of the payment provider identified at checkout also applies.
4. Delivery and address search
For deliveries actually fulfilled through Wolt Drive, necessary contact, address, handover and order data are shared with Wolt. Selecting pickup does not commission a courier. Geoapify provides address search and maps, processing search text, map area and technical connection data. The basis is Article 6(1)(b) GDPR for the requested order, or Article 6(1)(f) for reliable address verification. Device location is accessed only after browser permission.
5. Account and sign-in
Sign in using an email code or Google. Google shares the identity information authorised for sign-in, notably identifier, email and possibly name. SendPulse sends sign-in codes and supported email notifications. Codes expire after 10 minutes; email sessions last up to 30 days. The necessary __Host-oma_session cookie maintains sign-in. The basis is Article 6(1)(b) GDPR.
6. Oma Club and Wallet
For the optional Oma Club we process member identifier, contact information, confirmed purchases, points, credits, redemptions, reservations and referral associations where relevant to operate the programme (Article 6(1)(b) GDPR). Automated calculations determine points and levels; no decision with legal or similarly significant effects under Article 22 GDPR is made. When you actively add a card to Google Wallet, name, member number, card identifier and points are shared with Google and processed for card updates. The account QR card works without Wallet. Apple Wallet is not currently offered, so no loyalty-card data are transferred to Apple.
7. Email offers
Advertising emails and optional marketing functions require separate consent (Article 6(1)(a) GDPR). Club membership alone does not give newsletter consent. Withdraw at any time using the unsubscribe link or email. Necessary account and order messages are separate. SendPulse may process sending and delivery status; campaign links may associate an offer with its redemption.
8. Local storage, Clickio and analytics
The browser stores the basket and selections under oma-hot-v1 and language under oma-language. Clickio manages privacy choices. Google Analytics (measurement ID G-1NGJKJCH6Y) and Google Consent Mode are included; initial consent signals are denied. Consent Mode may send technical signals to Google even without analytics cookies. Optional analytics, personalisation or advertising storage require consent (Article 6(1)(a) GDPR and section 25(1) TDDDG). Change your choice through privacy settings. Refusing optional purposes does not prevent ordering.
9. Recipients and international processing
Only parties needing data for the purposes described receive it, including hosting, payments, order transmission, till, selected delivery service, email and activated Google functions. Processing outside the EEA must meet Articles 44 et seq. GDPR, such as an applicable adequacy decision or EU Standard Contractual Clauses with necessary supplementary measures. Ask our privacy contact about the recipients and safeguards applying to your transaction.
10. Retention and required data
Order and invoice data are kept for contract performance and statutory periods, notably eight or ten years depending on document type. Account and Club data are processed for participation and necessary accounting or legal claims; request deletion by email. Withdrawal of consent does not remove legal retention requirements. Without necessary order, delivery or payment data the relevant service cannot be provided; optional marketing data are voluntary.
11. Your rights
Subject to the statutory conditions you have rights to access, correction, erasure, restriction, portability and objection, particularly to direct marketing and processing under Article 6(1)(f) GDPR. Withdraw consent at any time for the future. You may complain to a supervisory authority, especially the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.