1. Who is responsible for data processing and whom can I contact?
Responsible for data processing: Quandoo Hong Kong Limited, 7th Floor, Cheung Hing Industrial Building, 12P Smithfield Road, Kennedy Town, Hong Kong. This company is also meant if the terms "we" or "us" are used below.
You can contact our Data Protection Officer at:
2. What personal data do we process and from which sources does such data originate?
When we make our platform available to you for use, we process personal data from various sources. On the one hand, this is data that we automatically collect when you use the platform. However, this may also include data which you have voluntarily provided to us or which we receive from our partners.
Data that we collect automatically when you use our platform
As soon as you visit the website or open the app, you send technical information to our web servers. This happens regardless of whether you make a reservation at a restaurant or whether you log in later using an account with us to use the platform. In each case we collect the following access data and web access data (which we refer to collectively as "access data" ):
We process access data so that you and other users can use the platform and we can ensure the functionality of the platform. We also process access data to carry out performance analyses on the platform, continuously improve the platform and correct errors to ensure IT security and the operation of our systems, and to prevent or detect misuse, particularly fraud.
In addition, we process access data to adapt the platform to your needs (personalisation). To this end, we also assign you what is known as a "Unique User ID". With this unique user ID, we can associate your bookings and other interactions.
Data that you transmit to us yourself
In addition to the data we receive from all visitors, we also process other data. The exact volume of such data depends on how you use the platform. You can use the platform with or without creating a user account.
If you decide to create a user account and complete the registration form, we will process the following information:
However, you can also use the social login functions on our platform to create your user account. If you choose this feature, send us your user name on the social network of your choice (e.g. Facebook or Google), the e-mail address you use to log in to the social network, and, if applicable, the mobile phone number you have stored on the social network.
The data entered during registration is used for the purpose of providing the platform and informing you by e-mail of all information relevant to the platform or the registration, such as changes to the scope of the platform or technical circumstances.
When you book or reserve, we also process your:
Please do not enter any sensitive personal information in the field "special preferences".
We process such data in order to be able to handle your reservation, inform you about the status of your reservation, and customise the platform based on your previous reservations and bookings.
The platform offers you the possibility to use certain social functions: You can leave ratings and reviews for restaurants. You can also subscribe to comments and reviews from other users.
When you use these features, your IP address will be stored when you post a comment or rating. This is a protective measure for us in case someone publishes illegal content, comments and/or contributions (insults, forbidden political propaganda, etc.). In such cases, we must be able to determine the identity of the author, as legal action can be taken based on the content in the comments or posts.
If you would like to subscribe to the following comments, a confirmation email will be sent to confirm that you are actually the owner of the email address you entered. Subscriptions for comments can be deleted at any time. The confirmation e-mail contains the corresponding instructions.
If you wish to participate in our loyalty points program, additional data must be processed in order to provide this service to you. To this end, we will process your reservation and booking history in order to manage your loyalty points and offer you bonuses and other offers.
We do not process any sensitive details about card payments ourselves, but use secure payment providers who do this for us. The payment data you enter is encrypted in your browser by the payment provider in a way that only the payment provider can access, while we only receive non-sensitive data (payment method) and references that confirm that you have made a payment. We do not store any other payment information in our system.
If you wish to receive the newsletter, we need a valid email address and information that confirms that the subscriber is the owner of the email address or that the owner of the email address used for the subscription agrees to receive the newsletter. No further information is collected. This particular data is used exclusively for dispatch of the newsletter.
When subscribing to the newsletter, we store the IP address of the respective user and the date of the subscription. The storage of this data serves the sole purpose of proof in cases where a third party misuses an e-mail address and subscribes to the newsletter without the knowledge of the owner of the respective e-mail address.
Perhaps you would like to ask our customer service for assistance or make a complaint. In this case, we will process your IP address and contact information as well as the content of your request in order to respond to your request.
Data we receive from partners and third-party platforms
Since our platform serves as an intermediary between you and the restaurant where you make your reservation, we also process data that we receive from our partner restaurants. Similarly, we may receive information from third party platforms where a reservation made by you on that third party platform is made by Quandoo. The data in question comprises:
Other data collected
3. For what other purposes do we process your data?
We possibly process your data for additional purposes.
These include the following:
4. What is the legal basis of data processing?
When processing your personal data, we rely on local data protection law and use your personal data only for the fulfilment of our services.
In this context, we refer in detail to the following legal foundations:
Fulfilment of our contractual obligations towards you
At the same time, the processing serves to make the platform available within the scope of performance under our contract with you. Accordingly, in most cases the processing is justified not only with your consent, but also because it is necessary to fulfil our contract with you. For example, if you make a reservation at a restaurant via our platform, we need to process the reservation data to secure your reservation.
Our legitimate interests
There are also cases in which we would be entitled to process your data without your consent if this is necessary to protect our legitimate interests (or those of third parties). In this respect, the purposes described above, for which we process your data, in many cases also represent legitimate interests. This means that we may process the data necessary to ensure the security of our IT systems in any case, even if you have not given or withdrawn your consent to such processing. This also refers to the prevention of abuse of our platform or the personalisation of advertising for your interests (referred to as direct marketing).
In addition, we are required by law to provide certain information to the law enforcement or tax authorities upon request in individual cases.
5. To whom do we transmit your data?
We treat your personal data with care and confidentiality and pass such data on to third parties only to the extent described below and no further. We only transmit data to public authorities if there is a legal obligation to do so as a result of a request for information from the competent authority.
Beyond statutory obligations to public authorities, we will only share your information with other users of the platform, with our third-party providers who assist us in providing the platform, or within the Quandoo Group of Companies.
Other users of the platform
We transfer the booking and reservation data via the platform to our partner restaurants to enable reservations to be made at their restaurants. We also share your loyalty points with the restaurants to ensure the smooth running of these programs. Restaurants will receive your account information (except your password) and any ratings or reviews you enter into the platform's system. Ratings and reviews will also be published on the platform so that they can be seen by all remaining users (including visitors without an account on the platform).
Other third parties
Within the Quandoo Group of Companies
We are part of a worldwide group of affiliated companies of Quandoo GmbH, KulturBrauerei, Schönhauser Allee 36, 10435 Berlin, Germany ("Quandoo DE"). Quandoo DE itself is a wholly owned subsidiary of Recruit Holdings Co., Ltd, 8-4-17 Ginza, Chuo-ku, Tokyo 104-0061 Japan ("Recruit"). Accordingly, we are obliged to provide Quandoo DE or Recruit with certain information either in accordance with legal reporting requirements or in the normal course of business as a global company. As a rule, all business intelligence data is anonymised to ensure that your right to privacy is respected. However, Quandoo DE or Recruit may also have access to personal, non-anonymised information, such as an internal audit or an audit required by public authorities.
6. How long will my data be stored?
We process and store your personal data as long as this is necessary for compliance with our contractual or statutory obligations. We therefore store the data as long as our contractual relationship with you exists and after termination only to the extent that and as long as the applicable laws require. All other data will be deleted immediately when you log out of the platform. If the remaining data is no longer required for fulfilment of such obligations, then the data in question will be deleted regularly unless further processing thereof is necessary for the preservation of evidence or for legal claims subject to the statute of limitations.
7. Does Quandoo create a user profile with my personal data?
We use your data to optimise your Quandoo browser experience. This means that we use your data to provide you with a personalised platform based on your personal preferences and interests and to create customised offers based on your previous behaviour patterns. For example, the IP address of your computer is used to identify your geographic location and provide you with localised content in your language. We can make suggestions and offers for new restaurants based on the restaurants you have previously viewed or booked through our platform. However, we will never process and analyse your personal data in the course of profiling in such a way that this leads to an automated decision that is legally valid for you or that significantly affects you in a similar manner.
8. Do I have to provide data? What happens if I do not provide my data or no longer provide it?
9. Changes to current data protection information
We provide you below with a list of all cookies and other web tracking tools that are provided on our platform either by us or by third parties.
1. Quandoo's own cookies (referred to as "first-party cookies"):
| Name | Duration | Purpose | | --- | --- | --- | | AID | Browser session | Partner allocation | | T | 30 days after last change | Channel allocation | | sem_attributes | Browser session | SEM tracking | | quandooUserGeoData | 24h | saves the user location based on the IP address used | | quandooUserLanguage | Session | saves the language selected by the user | | quandooUserSearchDestination | Session | saves the default search area of the user | | ut | Session or 90 days | User SessionToken |
We use these cookies to analyse web traffic, customise services, content and advertising, measure the effectiveness of advertising campaigns, and promote trust and security of the platform. We continue to use first-party cookies to be able to differentiate users from each other and, in conjunction with the log files from our web server, to determine the total number of people who visit the platform. The web usage data collected in this way helps us obtain the feedback we need to continually improve the platform and provide better service to users.
Users can prevent the acceptance of first-party cookies by adjusting their browser settings so that no cookies are accepted at all. However, if you configure this setting in this way, you may not be able to use certain current or future elements of our website.
2. Cookies and plugins provided by third parties (referred to as "third-party cookies")
In addition to first-party cookies, we also use the following third-party cookies and plug-ins provided on our website by the following parties:
| Name of the operator | Address | Data protection information | | --- | --- | --- | | Facebook, Inc. ("Facebook") | 1601 South California Avenue, Palo Alto, California 94304, USA | Facebook data privacy statement; | | Google LLC ("Google") | 1600 Amphitheatre Parkway Mountain View, California 94043, USA | https://policies.google.com/privacy | | Twitter, Inc. ("Twitter") | 795 Folsom St., Suite 600, San Francisco, California 94107, USA | Twitter data privacy statement | | Instagram, Inc. ("Instagram") | 1601 Willow Road, Menlo Park, California 94025, USA | Instagram data privacy statement | | Pinterest, Inc. ("Pinterest") | 635 High Street, Palo Alto, California 94301, USA | Pinterest data privacy statement | | Segment.io, Inc. ("Segment") | 101 15th St, San Francisco, CA 94103, USA | https://segment.com/docs/legal/privacy/ | | Microsoft Corporation ("Bing") | Microsoft Corporation, One Microsoft Way Redmond, WA 98052-6399 USA | https://privacy.microsoft.com/en-us/privacystatement | | Wisepops | Wisepops SAS 49 rue Jean de La Fontaine, 75016 Paris, France | https://support.wisepops.com/more-info/data-and-cookie-policy | | New Relic, Inc ("New Relic") | 188 Spear St., Suite 1200 San Francisco, CA USA 94105 | https://newrelic.com/termsandconditions/privacy | | Hotjar Ltd. | Level 2, St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 1000, Malta | https://www.hotjar.com/legal/policies/privacy | | Wingify ("Visual Website Optimizer") | 14th Floor, KLJ Tower North, Netaji Subhash Place, Pitampura, Delhi 110034, India | https://vwo.com/privacy-policy/ | | Zenloop | zenloop GmbH, Brunnenstrasse 196, 10119 Berlin | https://www.zenloop.com/en/legal/privacy |
Google Analytics and Google Tag Manager
Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on our behalf for the purpose of evaluating your use of the platform, compiling reports on website activity and providing other services for us relating to website activity and Internet usage. The IP address transmitted by your browser within the scope of Google Analytics and Google Tag Manager is not merged with other Google data.
You can prevent cookies from being stored by configuring the operating system settings of your browser or mobile device accordingly. Please note, however, that in this case you may not be able to use all the functions of our platform to their full extent. In addition, you can prevent Google from collecting the data generated by the cookie about your use of our platform (including your IP address) and Google from processing this data by downloading and installing the browser plug-in available via the Internet using the following link: https://tools.google.com/dlpage/gaoptout
We use Google Maps to display maps and show you the location of our partner restaurants. Ratings that you have posted on our platform, as well as the user name specified in this context, can be published on Google Maps.
Google Ads & Google Remarketing
With Google Ads & Google Remarketing, users who have already visited our platform and are interested in the relevant offer can be addressed again by targeted advertising on the pages of the Google partner network. Advertising is inserted with the aid of cookies.
Google Marketing Platform
Facebook plugins are integrated into our platform. You can recognize the Facebook plugins by the Facebook logo or the "Like button" on our page. An overview of Facebook plugins available can be found here: http://developers.facebook.com/docs/plugins/.
When you visit our platform, a direct connection is established between your device and the Facebook server. Facebook receives the information that you have visited our platform with your IP address. If you click the Facebook "Like" button while logged into your Facebook account, you can link the content of our platform to your Facebook profile. This allows Facebook to assign the visit to our platform to your user account. Please note that as the provider of the platform, we do not receive any information about the content of the transmitted data or its use by Facebook. However, if you are not a Facebook member, your IP address and information will be stored when you visit these websites and apps, including device information (operating system, hardware version, device settings, file and software names and types, battery and signal strength, device identifiers, device locations, including specific geographic locations, such as GPS, Bluetooth or WiFi signals, connection information such as the name of your mobile operator or ISP, browser type, language and time zone, mobile phone number) and information about your activity. According to Facebook, only an anonymous IP address is processed.
Facebook user-defined target groups
Facebook users should be aware that this website also uses the Facebook communication tool Website Custom Audiences.
Twitter plugins are integrated into our platform. By using Twitter and the "Re-Tweet" function, the websites you visit are linked to your Twitter account and made known to other users. Data is also transmitted to Twitter in the process.
You can change your Twitter privacy settings in the account settings at http://twitter.com/account/settings.
Instagram plugins are integrated into our platform. If you are logged into your Instagram account, you can link the content of our platform to your Instagram profile by clicking the Instagram button. This allows Instagram to assign the visit to our platform to your user account. Please note that as the provider of the platform, we do not receive any information about the content of the transmitted data or its use by Instagram.
If you do not want Pinterest to personalise your experience in this way, you can access your account settings and deactivate personalisation on Pinterest. You can also change the "Do not track" feature of your browser or device to prevent Pinterest from using this information.
We cooperate with various affiliation networks that allow us to display various advertising materials such as banners or other promotional content on so-called publisher websites. Cookies are used to record which users came to our site via the respective advertising medium clicked on and then made a reservation. These cookies do not contain any personal data, but only a pseudonymous user and reservation ID, which makes it possible to assign them to the respective network. This information is required for the purpose of payment processing with the relevant network. If you do not agree to such processing, you have the option to prevent the storage of cookies by changing a setting in your Internet browser.
We also use Segment for data analysis and to create a customer profile for food preferences and intentions. Segment helps us to collect and analyse the technical usage data resulting from the use of our platform and to evaluate and use such data for optimization with the aid of the analysis tools described in this statement. The collected usage data is processed in pseudonymised form, IP addresses are truncated accordingly after collection and the data is only linked to user profiles with your personal data if a reservation is made on our consumer portal or if you provide access data to your account. As a rule, the information about the use of our website is transferred to Segment servers in the USA and stored there as well as in our own data warehouse (EU). You can object to the collection of data for these purposes by preventing the storage of cookies via your browser settings.
We cooperate with Wisepops, 49 rue Jean De La Fontaine, 75016 Paris, France. Wisepops is a provider that allows us to play pop-ups based on the user's surfing behaviour. To this end, Wisepops collects surf data and plays out popups accordingly. Cookies are set for this purpose. Further information can be found at https://support.wisepops.com/more-info/data-and-cookie-policy.
Bing Universal Event Tracking
We use Bing Ads to advertise our business online. In order to market our product or service more effectively, we allow Bing to set a cookie to record your visit to our website and to record the completion of a transaction. Bing Ads does not collect any personally identifiable information that could be used to identify you.
You can object to the collection of data for these purposes by preventing the storage of cookies for the bing.com domain via your browser settings. Further information on data collection by Microsoft can be found here: https://privacy.microsoft.com/en-gb/privacystatement.
You can opt-out to the creation of a user profile, Hotjar's storing of data about your usage of our site and Hotjar's use of tracking cookies on other websites by visiting: https://www.hotjar.com/opt-out
VWO / Visual Website Optimizer
We use Visual Website Optimizer ("VWO") to better understand the needs of our users and to optimise our services. VWO is an A/B test and conversion optimisation platform with which we can present different variants of elements on the website to different users (e.g. different colour keys, different on-page elements). VWO is provided and hosted by Wingify Ltd and is used to collect, test and analyse information about the use of the platform, also by placing cookies on the user's devices. The information collected by VWO may contain your IP address.
Wingify publishes a privacy statement that governs how it collects and uses user information that is available at https://vwo.com/privacy-policy/. Information on the cookies used by VWO can be found at https://vwo.com/knowledge/cookies-used-by-vwo/.
You can deactivate VWO tracking using the Wingify Opt-Out tool available at https://vwo.com/opt-out/. When you log off, a cookie is stored on your device that is valid for up to ten years (unless previously deleted) and signals to VWO not to collect any information about your use of the website.
We use the services of zenloop GmbH. zenloop is a business-to-business software-as-a-service platform that enables us to collect and analyse feedback from our customers via various channels. This enables us to tailor and improve our services to the needs of our customers, which constitutes a legitimate interest.
If you participate in the survey, we will also send your e-mail address to Zenloop. The reason for this is that if you inform us of problems within this survey (e.g. in the reservation process), we may contact you to find a solution together. Your e-mail address helps us to identify you here.
You can opt-out of the data collection by all tools mentioned below by disabling the respective slider in the Quandoo app.
For data analysis and personalised customer contact within our app, we also use the services of Leanplum, Inc., 1550 Bryant Street, Ste. 545 San Francisco, California 94103, United States. The collected usage data is processed in pseudonymised form, IP addresses are deleted after their collection and the data is internally linked to your personal data only if you have registered using the app. The information about the use of our app is usually transferred to Leanplum servers in the USA and stored there as well as in our own data warehouse (EU).
Furthermore, we use the technologies of Firebase Analytics (Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) in order to analyse the use of our app. Firebase collects several data, such as your device's Advertising ID. You can find a full list of the data collected here: https://firebase.google.com/support/privacy#data_processing_information.