Privacy Policy

This Privacy Policy explains how Guzman y Gomez ("we," "us," "our," or "the Company") collects, uses, discloses, stores, and protects your personal information when you visit our website at guzmasygomez.com, use our mobile application, place orders, participate in loyalty programs, or otherwise interact with our food services and related offerings. We are committed to handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act, as well as any applicable state and territory privacy legislation.

Please read this Privacy Policy carefully before using our services. By accessing our website, creating an account, making a purchase, or otherwise engaging with Guzman y Gomez, you acknowledge that you have read, understood, and agree to the practices described in this policy. If you do not agree with any part of this policy, please discontinue use of our services immediately.

1. About Us

Guzman y Gomez is a food service business operating within Australia, offering fresh Mexican-inspired cuisine through our restaurants, online ordering platform, mobile application, and delivery services.

For all privacy-related inquiries, requests, or complaints, please contact us using the contact details provided in Section 14 of this policy.

2. Scope of This Policy

This Privacy Policy applies to all personal information we collect through:

• Our website located at guzmasygomez.com
• Our mobile ordering application
• In-restaurant interactions and point-of-sale transactions
• Our loyalty and rewards program
• Promotional campaigns, competitions, and surveys
• Social media platforms and digital advertising
• Third-party delivery and aggregator platforms
• Customer service and support communications
• Email, SMS, and other direct marketing channels

This policy does not apply to the privacy practices of third-party websites or services that may be linked from our website. We encourage you to review the privacy policies of any third-party sites you visit independently.

3. What Personal Information We Collect

We collect various types of personal information depending on how you interact with us. "Personal information" has the meaning given under the Privacy Act 1988 (Cth) and generally refers to any information or opinion about an identified individual, or an individual who is reasonably identifiable.

3.1 Information You Provide Directly

When you create an account, place an order, join our loyalty program, or contact us, we may collect:

• Identity Information: Full name, date of birth, gender (where voluntarily provided)
• Contact Information: Email address, phone number, residential or delivery address
• Account Credentials: Username, password (stored in encrypted form), security questions
• Order Information: Items ordered, order history, special dietary requirements or preferences, delivery instructions
• Payment Information: Credit or debit card details (processed securely via third-party payment gateways — we do not store full card numbers), billing address, payment method preferences
• Loyalty Program Data: Points balance, redemption history, membership tier, reward preferences
• Communications: Messages, feedback, complaints, survey responses, or any other correspondence you send us
• Competition Entries: Information submitted when entering promotions, giveaways, or contests
• Dietary and Allergy Information: Where you voluntarily provide information about dietary restrictions or food allergies to facilitate safe food preparation

3.2 Information Collected Automatically

When you use our website or mobile application, we automatically collect certain technical and usage information, including:

• Device Information: Device type, operating system and version, browser type and version, unique device identifiers, mobile network information
• Log Data: IP address, access times, pages viewed, referring URLs, links clicked, session duration
• Location Data: Approximate geographic location derived from your IP address; precise GPS location (only if you grant permission through your device settings)
• Usage Data: Browsing behaviour on our website, products viewed or searched for, cart activity, order flow interactions
• Cookie and Tracking Data: Information collected through cookies, web beacons, pixels, and similar tracking technologies (see Section 9 for details)
• App Performance Data: Crash reports, load times, and error logs from our mobile application

3.3 Information from Third Parties

We may receive personal information about you from third parties, including:

• Delivery Partners: Third-party food delivery platforms (such as DoorDash, Uber Eats, or Menulog) may share order and contact details necessary to fulfil your delivery
• Social Media Platforms: If you log in using a social media account (e.g., Facebook, Google, Apple), we receive basic profile information such as name and email address from that platform
• Payment Processors: Transaction confirmation and fraud detection signals from our payment gateway providers
• Marketing Partners: Aggregated demographic and interest data from advertising technology partners to help us reach relevant audiences
• Analytics Providers: Aggregated and de-identified insights about website traffic and user behaviour

3.4 Sensitive Information

Under the Privacy Act 1988 (Cth), certain categories of information are classified as "sensitive information" and attract a higher level of protection. Dietary and allergy information may, in some cases, constitute health information, which is a subset of sensitive information. We only collect such information where you choose to provide it, and we use it solely for the purpose of preparing and delivering your food order safely. We will not use or disclose your health or dietary information for any other purpose without your explicit consent, except where required by law.

4. How We Use Your Personal Information

We use the personal information we collect for the following purposes:

4.1 Service Provision and Order Fulfilment

• Processing and fulfilling your food orders, whether placed online, in-app, or in-restaurant
• Arranging delivery or pick-up of your orders
• Managing your account and loyalty program membership
• Processing payments and issuing receipts or tax invoices
• Communicating with you about your orders, account, or bookings
• Catering to dietary requirements or allergy information you have provided

4.2 Customer Service and Support

• Responding to your inquiries, complaints, or feedback
• Investigating and resolving disputes or issues with orders
• Providing technical support for our digital platforms
• Processing refunds, replacements, or compensation where applicable

4.3 Marketing and Promotions

• Sending you promotional emails, SMS messages, or push notifications about new menu items, special offers, and events — where you have provided your consent or where we are otherwise permitted to do so under the Spam Act 2003 (Cth)
• Personalising marketing content based on your order history and preferences
• Running targeted advertising campaigns on third-party platforms such as Google, Meta (Facebook and Instagram), and other digital advertising networks
• Administering competitions, giveaways, and promotional activities
• Sending loyalty program communications including points statements and reward notifications

You may opt out of receiving direct marketing communications at any time by following the unsubscribe instructions in any marketing message, adjusting your account notification settings, or contacting us at [email protected].

4.4 Analytics and Service Improvement

• Analysing usage patterns and customer behaviour to improve our website, app, and menu offerings
• Conducting market research and customer satisfaction surveys
• Monitoring and improving the performance, security, and reliability of our digital platforms
• Developing new products, services, and features
• Generating aggregated and de-identified statistical reports

4.5 Legal, Compliance, and Safety Purposes

• Complying with applicable Australian laws, regulations, and regulatory requirements
• Preventing, detecting, and investigating fraud, identity theft, and other unlawful activities
• Protecting the rights, property, or safety of Guzman y Gomez, our customers, employees, and the public
• Responding to lawful requests from government authorities, courts, or law enforcement agencies
• Enforcing our Terms of Service and other contractual agreements

5. Legal Basis for Processing

We process your personal information on the following lawful grounds under the Privacy Act 1988 (Cth) and the Australian Privacy Principles:

• Contract Performance: Processing necessary to fulfil your order, manage your account, or provide services you have requested
• Legitimate Interests: Processing necessary for our legitimate business interests, provided these are not overridden by your privacy rights (e.g., fraud prevention, service improvement, direct marketing to existing customers)
• Consent: Where you have provided express consent, such as subscribing to marketing communications or sharing precise location data
• Legal Obligation: Processing required to comply with applicable laws and regulatory obligations

6. Sharing Your Personal Information with Third Parties

We do not sell your personal information to third parties. We may, however, share your personal information with trusted third parties in the following circumstances:

6.1 Service Providers

We engage third-party service providers to assist in operating our business. These providers are only permitted to use your information for the specific purpose we have engaged them and are required to maintain appropriate confidentiality and security measures. Service providers include:

• Cloud hosting and infrastructure providers
• Payment gateway and fraud prevention providers
• Third-party food delivery aggregators (e.g., Uber Eats, DoorDash, Menulog)
• Email marketing and SMS platform providers
• Customer relationship management (CRM) software providers
• Web analytics and advertising technology providers (e.g., Google Analytics, Meta Pixel)
• Loyalty program technology providers
• IT support and cybersecurity service providers
• Legal, accounting, and professional advisory firms

6.2 Business Transfers

In the event of a merger, acquisition, sale of assets, restructure, or similar corporate transaction involving Guzman y Gomez, your personal information may be transferred to the relevant successor entity as part of that transaction. We will notify you of any such transfer that materially affects your privacy rights and ensure the recipient is bound by equivalent privacy obligations.

6.3 Legal Requirements and Safety

We may disclose your personal information where required or permitted by law, including:

• In response to a court order, subpoena, or other lawful legal process
• To comply with a request from an Australian government authority, regulator, or law enforcement agency
• To protect the safety, rights, or property of Guzman y Gomez or others
• To investigate or prevent fraud or other criminal activity

6.4 With Your Consent

We may share your personal information with other third parties where you have provided your express consent to such sharing.

7. International Data Transfers

Guzman y Gomez is an Australian business and primarily processes and stores your personal information within Australia. However, some of our third-party service providers — including cloud hosting services, analytics platforms, and marketing technology providers — may be located in or operate from countries outside Australia, including the United States, Singapore, Ireland, or other jurisdictions.

Where we transfer your personal information overseas, we take steps to ensure that such transfers comply with Australian Privacy Principle 8 (APP 8) of the Privacy Act 1988 (Cth). This includes:

• Assessing whether the recipient country has comparable privacy protections to Australia
• Entering into contractual arrangements with overseas recipients that require them to handle your personal information in accordance with the APPs
• Only engaging reputable service providers with robust data protection programs and relevant certifications

Please note that by submitting personal information to us, you acknowledge that your information may be transferred to overseas recipients as described above. Where we are unable to ensure an overseas recipient will comply with the APPs, we will seek your consent before the transfer or will not make the transfer.

8. Data Security

We take the security of your personal information seriously and implement a range of technical, physical, and organisational measures to protect your data against unauthorised access, disclosure, alteration, misuse, or destruction. Our security measures include:

• Encryption: Data transmitted between your browser or app and our servers is protected using Transport Layer Security (TLS) encryption. Sensitive data at rest is stored using industry-standard encryption protocols.
• Access Controls: Access to personal information is restricted to authorised personnel on a need-to-know basis. All employees and contractors with access to personal data are subject to confidentiality obligations.
• Payment Security: We do not store full payment card numbers. All payment card transactions are processed by PCI-DSS compliant third-party payment processors.
• Regular Security Assessments: We conduct periodic security assessments, vulnerability scanning, and penetration testing of our systems.
• Incident Response: We maintain a data breach response plan and will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in the event of an eligible data breach, in accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth).
• Staff Training: Our staff receive regular training on privacy obligations and data handling best practices.

While we implement robust security measures, no data transmission over the internet or electronic storage system is entirely secure. We cannot guarantee the absolute security of your information, and you should also take steps to protect your own information, such as using a strong and unique password for your account and keeping your login credentials confidential.

9. Cookies and Tracking Technologies

Our website and mobile application use cookies, web beacons, pixel tags, local storage, and similar tracking technologies to enhance your experience, analyse usage, and deliver relevant advertising.

9.1 Types of Cookies We Use

9.2 Managing Your Cookie Preferences

You can manage your cookie preferences through our cookie consent banner displayed when you first visit our website. You may also adjust your browser settings to block or delete cookies; however, disabling certain cookies may affect the functionality of our website. For more detailed information about the cookies we use and how to manage them, please refer to our Cookie Policy.

10. Your Privacy Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have a number of rights in relation to your personal information:

10.1 Right to Access

You have the right to request access to the personal information we hold about you. We will provide you with a copy of your personal information within a reasonable period, generally within 30 days of receiving your request. In some circumstances, we may be unable to provide access — for example, where doing so would unreasonably impact the privacy of other individuals, or where an exception under the APPs applies. We will explain any such refusal in writing.

10.2 Right to Correction

If you believe that any personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you have the right to request that we correct it. We will take reasonable steps to correct the information within 30 days of receiving your request. If we refuse to make a correction, we will notify you in writing with our reasons.

10.3 Right to Deletion

In certain circumstances, you may request that we delete personal information we hold about you. We will comply with deletion requests where we are not required to retain the information for legal, regulatory, or legitimate business purposes. Please note that if you request deletion of your account, you will lose access to your loyalty points, order history, and other account-related data.

10.4 Right to Opt Out of Marketing

You have the right to opt out of receiving direct marketing communications from us at any time. You can exercise this right by:

• Clicking the "unsubscribe" link in any marketing email we send you
• Replying "STOP" to any SMS marketing message
• Adjusting your notification preferences within your online account settings
• Contacting us at [email protected]

10.5 Right to Data Portability

Where technically feasible and reasonable, you may request a copy of your personal information in a structured, commonly used, and machine-readable format, so that you can transfer it to another service provider.

10.6 Right to Withdraw Consent

Where we process your personal information based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to your withdrawal. To withdraw consent, please contact us at [email protected].

10.7 How to Exercise Your Rights

To exercise any of your privacy rights, please submit a written request to us using the contact details in Section 14 of this policy. We may need to verify your identity before processing your request. We will not charge a fee for access requests unless the request is unusually complex or time-consuming, in which case we will notify you of any applicable fee in advance.

11. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required or permitted by law. Our general retention practices are as follows:

When your personal information is no longer required for any permitted purpose, we will take reasonable steps to securely destroy, de-identify, or permanently delete it in accordance with our data disposal procedures.

12. Children's Privacy

Our online services, including our website and mobile application, are directed at individuals who are 18 years of age or older. We do not knowingly collect personal information from children under the age of 18. If you are under 18, please do not use our online services or provide any personal information to us without the involvement and consent of a parent or legal guardian.

If we become aware that we have inadvertently collected personal information from a person under the age of 18 without appropriate parental consent, we will take prompt steps to delete that information from our records. If you believe we may have collected personal information from a child under 18, please contact us immediately at [email protected].

In-restaurant visits are open to customers of all ages; however, any online account creation, loyalty program registration, or digital marketing subscription requires the user to be 18 years of age or older.

13. Links to Third-Party Websites

Our website and app may contain links to third-party websites, social media platforms, delivery partner apps, and other external services. These links are provided for your convenience. Once you leave our website or app, this Privacy Policy no longer applies. We are not responsible for the privacy practices or content of any third-party websites, and we encourage you to review the privacy policies of any external sites you visit.

14. Contact Us — Privacy Inquiries

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal information, please contact our Privacy team using the details below:

When submitting a privacy request, please include your full name, contact details, and a clear description of your inquiry or the right you wish to exercise. We will acknowledge your request promptly and aim to respond in full within 30 days. In some circumstances, where requests are complex or numerous, we may require additional time to respond and will notify you accordingly.

15. How to File a Complaint with the Regulatory Authority

If you believe that we have breached the Australian Privacy Principles or the Privacy Act 1988 (Cth), we encourage you to contact us first so that we have an opportunity to resolve your concern. Please submit your complaint to us using the contact details in Section 14 above. We will investigate your complaint and respond within 30 days.

If you are not satisfied with our response, or if you do not receive a response within a reasonable period, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC), which is the independent national regulator for privacy and freedom of information.

If you are located in a specific Australian state or territory, you may also have additional rights under state or territory privacy legislation, such as the Health Records Act 2001 (Vic) or the Information Privacy Act 2009 (Qld), where applicable. Relevant state privacy commissioners may also be available to assist with complaints relating to health information or state government bodies.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, technology, legal requirements, or regulatory guidance. When we make material changes to this policy, we will:

• Update the "Last Updated" date at the top of this policy
• Post the revised policy prominently on our website at guzmasygomez.com
• Where required by law or where changes are significant, notify you directly via email or in-app notification

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information. Your continued use of our services after any changes to this policy constitutes your acceptance of the updated terms.

17. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Australia, including the Privacy Act 1988 (Cth), the Australian Privacy Principles, and the Notifiable Data Breaches scheme. Any disputes arising in connection with this Privacy Policy shall be subject to the jurisdiction of the courts of Australia.