Privacy Policy

This Privacy Policy explains how Guzman y Gomez ("we", "us", "our", or "the Company") collects, uses, discloses, stores, and protects your personal information when you visit our website at guzminagomez.com, use our mobile application, place orders online or in-store, participate in loyalty programs, or otherwise interact with our food services and digital platforms.

We are committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act, as well as any applicable state and territory privacy legislation. By accessing our website or using our services, you acknowledge that you have read and understood this Privacy Policy.

Please read this policy carefully. If you do not agree with the terms set out in this Privacy Policy, you should discontinue your use of our services immediately and contact us with any questions before proceeding.

1. About Us

Guzman y Gomez is a food and beverage business operating in Australia, offering Mexican-inspired food products and dining experiences through our restaurant locations, online ordering platform, and mobile application. We are the entity responsible for managing your personal information as described in this Privacy Policy.

Contact Details:

2. Scope of This Policy

This Privacy Policy applies to all personal information collected by Guzman y Gomez through the following channels and activities:

• Visits to our website at guzminagomez.com and any related subdomains
• Use of our mobile ordering application
• In-store purchases, including contactless payments and loyalty card scanning
• Online food ordering and delivery platforms operated by or in partnership with us
• Customer feedback forms, surveys, and competitions
• Email newsletters, SMS marketing communications, and push notifications
• Social media interactions and promotions
• Job applications and recruitment processes
• Any other interaction you may have with our business

This policy does not apply to third-party websites, apps, or services that may be linked from our platforms. We encourage you to read the privacy policies of those third parties independently.

3. What Personal Information We Collect

We collect different categories of personal information depending on how you interact with us. "Personal information" has the meaning given to it under the Privacy Act 1988 (Cth), meaning information or an opinion about an identified individual, or an individual who is reasonably identifiable.

3.1 Identity and Contact Information

• Full name
• Date of birth (where required for age verification or promotional purposes)
• Email address
• Phone number (mobile and/or landline)
• Residential or delivery address
• Gender (where voluntarily provided)

3.2 Account and Transaction Information

• Username and password for online accounts
• Order history, including items purchased, frequency, and spend amounts
• Loyalty program membership details and points balance
• Payment method type (e.g., credit card, debit card, digital wallet) — note: we do not store full card numbers
• Billing information and transaction records
• Promotional codes and discount usage history

3.3 Usage and Technical Data

When you use our website or mobile application, we may automatically collect certain technical information, including:

• IP address
• Browser type and version
• Operating system and device type
• Device identifier and mobile advertising ID
• Pages visited and time spent on each page
• Referring URL and exit pages
• Clickstream data and navigation patterns
• Search queries made on our website
• Session duration and timestamps

3.4 Location Data

• Approximate location derived from your IP address
• Precise geolocation data (if you grant permission through our mobile app)
• Preferred restaurant location or nearest restaurant data

3.5 Communication and Feedback Data

• Emails, messages, or correspondence sent to our customer service team
• Customer feedback, reviews, and survey responses
• Competition entries and promotional submissions
• Social media comments, mentions, or messages directed to our accounts

3.6 Cookie and Tracking Data

We use cookies and similar tracking technologies to collect information about your browsing behaviour on our website. Please refer to Section 9 of this policy for detailed information about our use of cookies.

3.7 Sensitive Information

In general, we do not seek to collect sensitive information (as defined under the Privacy Act 1988) such as health information, racial or ethnic origin, religious beliefs, or biometric data. However, if you voluntarily provide information about dietary requirements, food allergies, or health-related preferences to assist us in providing our services, this may constitute sensitive information. We will only collect and use such information with your consent and for the purpose it was provided.

4. How We Collect Your Personal Information

We collect personal information in the following ways:

4.1 Directly From You

We collect information directly from you when you:

• Create an account on our website or mobile app
• Place an order online or through our app
• Sign up for our loyalty program or rewards scheme
• Subscribe to our newsletter or marketing communications
• Contact our customer service team
• Participate in a competition, promotion, or survey
• Apply for a job with us
• Interact with us on social media platforms

4.2 Automatically

We automatically collect certain technical and usage data when you visit our website or use our mobile application, through the use of cookies, web beacons, pixel tags, and other similar tracking technologies.

4.3 From Third Parties

We may receive personal information about you from third parties, including:

• Third-party food delivery platforms (such as Uber Eats, DoorDash, or Menulog) when you place an order through those services
• Social media platforms when you interact with our accounts or use social login features
• Analytics and advertising partners
• Payment processors and financial institutions
• Fraud prevention and identity verification services

5. How We Use Your Personal Information

We use your personal information only for lawful purposes and in accordance with the Australian Privacy Principles. The purposes for which we use your information include:

5.1 Service Provision

• Processing and fulfilling your food orders
• Managing your account and loyalty program membership
• Arranging delivery or in-store pickup of orders
• Processing payments and issuing receipts
• Responding to your enquiries, complaints, and feedback
• Providing customer support and after-service care

5.2 Business Operations and Improvement

• Analysing usage patterns and customer behaviour to improve our website, app, and menu offerings
• Conducting internal research and business analytics
• Monitoring and improving the performance and security of our digital platforms
• Training staff and improving service quality
• Fulfilling our legal and regulatory obligations

5.3 Marketing and Communications

• Sending you promotional offers, deals, and news about Guzman y Gomez (with your consent)
• Personalising marketing communications based on your order history and preferences
• Conducting competitions, giveaways, and promotional campaigns
• Delivering targeted advertising through third-party platforms
• Measuring the effectiveness of our marketing campaigns

You may opt out of receiving marketing communications at any time by clicking the "unsubscribe" link in any of our emails, replying "STOP" to any SMS, adjusting your notification preferences in our app, or contacting us directly at [email protected].

5.4 Legal and Compliance Purposes

• Complying with applicable laws and regulations in Australia
• Responding to lawful requests from government authorities, courts, or law enforcement agencies
• Enforcing our Terms of Service and other agreements
• Detecting, investigating, and preventing fraudulent or illegal activity
• Protecting the rights, property, or safety of our customers, staff, and the public

6. Disclosure of Your Personal Information to Third Parties

We may share your personal information with third parties in the following circumstances. We take reasonable steps to ensure that any third parties with whom we share your information handle it in accordance with the Australian Privacy Principles.

6.1 Service Providers and Business Partners

We engage trusted third-party service providers to assist us in operating our business. These may include:

• Payment processors: to securely process credit, debit, and digital wallet transactions
• Delivery and logistics partners: to facilitate food delivery to your address
• Cloud hosting and IT providers: to store data and operate our digital infrastructure
• Email and SMS marketing platforms: to manage and send communications on our behalf
• Analytics providers: such as Google Analytics, to help us understand website and app usage
• Customer support tools: to manage and respond to customer enquiries
• Advertising networks: to deliver targeted advertisements across digital platforms

6.2 Food Delivery Platforms

If you order through a third-party food delivery platform (e.g., Uber Eats, DoorDash, Menulog), your personal information will be shared with those platforms and their service providers in accordance with their own privacy policies. We encourage you to review the privacy policies of any third-party platform you use.

6.3 Legal and Regulatory Disclosures

We may disclose your personal information to government agencies, courts, law enforcement bodies, or other authorised parties where we are required or permitted to do so by law, including under the Privacy Act 1988 (Cth), the Australian Consumer Law, or any other applicable legislation.

6.4 Business Transfers

In the event of a merger, acquisition, sale of assets, or other corporate restructuring, your personal information may be transferred to the acquiring entity, subject to that entity agreeing to protect your information in accordance with applicable privacy laws.

6.5 With Your Consent

We may share your information with other third parties in circumstances not listed above if we obtain your express consent to do so.

7. International Data Transfers

Guzman y Gomez is an Australian business, and we primarily store and process your personal information within Australia. However, some of our third-party service providers (such as cloud hosting companies, analytics providers, and marketing platforms) may be located overseas, including in the United States, the United Kingdom, the European Union, or other countries.

Before disclosing your personal information to an overseas recipient, we take reasonable steps to ensure that the overseas recipient handles the information in a manner consistent with the Australian Privacy Principles, as required under Australian Privacy Principle 8. This may involve:

• Entering into contractual arrangements with overseas recipients that require them to comply with applicable privacy standards
• Only engaging overseas service providers that are subject to privacy frameworks that provide similar protections to Australian law
• Assessing the adequacy of privacy protections in the destination country

By providing us with your personal information and using our services, you acknowledge that your information may be transferred, stored, and processed overseas in the circumstances described above.

8. Data Security

We take the security of your personal information seriously and implement a range of technical, organisational, and physical security measures to protect it from unauthorised access, disclosure, alteration, misuse, or loss. Our security measures include:

8.1 Technical Measures

• SSL/TLS encryption for all data transmitted through our website and app
• Encryption of sensitive data at rest (including payment information)
• Secure, access-controlled servers hosted in certified data centres
• Regular vulnerability assessments and penetration testing
• Firewalls and intrusion detection systems
• Multi-factor authentication for administrative access to our systems

8.2 Organisational Measures

• Staff training on privacy and data protection obligations
• Role-based access controls limiting access to personal information on a need-to-know basis
• Data breach response and notification procedures compliant with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988
• Privacy impact assessments for new projects and systems
• Third-party supplier due diligence and contractual privacy requirements

Despite our best efforts, no method of transmission over the internet or electronic storage is completely secure. In the event of a data breach that is likely to result in serious harm to affected individuals, we will comply with our notification obligations under the Notifiable Data Breaches scheme, including notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals as required.

9. Cookies and Tracking Technologies

Our website and mobile application use cookies and similar tracking technologies (such as web beacons, pixel tags, and local storage) to enhance your user experience, analyse site usage, and support our marketing activities.

9.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites function properly, improve efficiency, and provide information to site owners about how users interact with their content.

9.2 Types of Cookies We Use

9.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse all cookies, accept only certain types, or delete cookies that have already been stored. Please note that disabling certain cookies may affect the functionality of our website and your experience. For more detailed information, please refer to our Cookie Policy.

10. Data Retention

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. Our general data retention practices are as follows:

When personal information is no longer required, we take reasonable steps to destroy, de-identify, or securely delete it.

11. Your Rights and Choices

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have a number of rights in relation to your personal information. We are committed to honouring these rights in a timely and transparent manner.

11.1 Right of Access

You have the right to request access to the personal information we hold about you. We will respond to your access request within 30 days of receipt. In some circumstances, we may need to verify your identity before providing access. We may charge a reasonable fee to cover the administrative costs of fulfilling complex access requests.

11.2 Right to Correction

If you believe that any personal information we hold about you is inaccurate, incomplete, out of date, or misleading, you have the right to request that we correct it. We will take reasonable steps to correct the information promptly.

11.3 Right to Deletion

You may request the deletion of your personal information in certain circumstances, such as where the information is no longer necessary for the purposes for which it was collected, or where you withdraw consent. Note that we may be unable to delete certain information where retention is required by law or where deletion would affect the provision of our services.

11.4 Right to Opt Out of Marketing

You can withdraw your consent to receive marketing communications at any time. You can do this by:

• Clicking the "unsubscribe" link at the bottom of any marketing email
• Replying "STOP" to any promotional SMS message
• Updating your communication preferences in your account settings
• Contacting us at [email protected]

11.5 Right to Data Portability

You may request a copy of the personal information you have provided to us in a structured, commonly used, and machine-readable format. While Australian law does not currently mandate data portability in the same way as the European GDPR, we will make reasonable efforts to accommodate such requests.

11.6 Right to Withdraw Consent

Where we rely on your consent to process your personal information (e.g., for marketing or the collection of sensitive information such as dietary requirements), you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before the withdrawal.

11.7 How to Exercise Your Rights

To exercise any of the rights described above, please contact our Privacy Officer at:

Please include your full name, contact details, and a description of the request. We may need to verify your identity before processing your request.

12. Children's Privacy

Our online services, including our website and mobile application, are not directed at children under the age of 18 years. We do not knowingly collect personal information from individuals under 18 without the consent of a parent or guardian.

While our food products and restaurants are accessible to individuals of all ages (including families and children), our digital services such as account registration, loyalty program membership, and online ordering are intended for use by adults aged 18 years and over, or by minors under the supervision and with the consent of a parent or legal guardian.

If we become aware that we have inadvertently collected personal information from a child under the age of 18 without appropriate consent, we will take prompt steps to delete that information. If you believe we have collected such information, please contact us immediately at [email protected].

13. Links to Third-Party Websites and Services

Our website and digital platforms may contain links to third-party websites, social media platforms, partner services, and food delivery apps. These third-party sites have their own privacy policies, which we encourage you to read. We are not responsible for the privacy practices of those third parties, and this Privacy Policy does not apply to any information collected through external sites or services.

Third-party services that may be linked from or integrated with our platforms include, but are not limited to:

• Social media platforms (Facebook, Instagram, TikTok, X/Twitter)
• Food delivery platforms (Uber Eats, DoorDash, Menulog)
• Payment gateways (such as Stripe, PayPal, or Apple Pay)
• Google Maps for restaurant location services

14. How to Make a Privacy Complaint

If you have a concern or complaint about how we have handled your personal information, or if you believe we have breached our obligations under the Privacy Act 1988 or the Australian Privacy Principles, we encourage you to contact us in the first instance so that we can attempt to resolve the matter directly.

14.1 Internal Complaint Process

1. Submit your complaint: Contact our Privacy Officer by email at [email protected], clearly describing the nature of your concern and the outcome you are seeking.
2. Acknowledgement: We will acknowledge receipt of your complaint within 5 business days.
3. Investigation: We will investigate your complaint and endeavour to provide a substantive response within 30 days. If the matter is complex, we will keep you informed of progress and any expected delays.
4. Resolution: We will advise you of the outcome of our investigation and any steps we have taken or propose to take to address your concern.

14.2 External Complaint — Office of the Australian Information Commissioner (OAIC)

If you are not satisfied with our response, or if you do not hear from us within the timeframes described above, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

The OAIC can investigate complaints about breaches of the Australian Privacy Principles, consider whether a breach has occurred, and attempt to resolve complaints through conciliation or other means.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, legal obligations, or regulatory requirements. When we make material changes to this policy, we will take reasonable steps to notify you, which may include:

• Posting a notice on our website homepage
• Sending an email notification to registered account holders
• Displaying an in-app notification

The updated Privacy Policy will take effect from the date shown at the top of this page. We encourage you to review this page periodically to stay informed about how we protect your information. Your continued use of our services after any changes have been posted constitutes your acceptance of the updated policy.

16. Applicable Law

This Privacy Policy is governed by and construed in accordance with the laws of Australia. In particular, our privacy practices are designed to comply with:

• Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
• Spam Act 2003 (Cth) — governing electronic marketing communications
• Do Not Call Register Act 2006 (Cth) — governing unsolicited telephone marketing
• Australian Consumer Law (Schedule 2 of the Competition and Consumer Act 2010 (Cth))
• Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988
• Applicable state and territory privacy legislation where relevant

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact our Privacy Officer using the details below:

We are committed to resolving any privacy concerns you may have promptly and transparently. We aim to respond to all privacy enquiries within 5 business days and to substantively resolve concerns within 30 days of receipt.