Skip to content
Aguacate

Privacy Policy

Last updated: May 17, 2026

This privacy policy informs you about the nature, scope and purpose of the processing of personal data on our website in accordance with the GDPR and the Austrian Data Protection Act. In case of dispute, the German version is legally binding.

1. Controller

The controller for data processing on this website is Aguacate GmbH, Mohsgasse 28/2, 1030 Vienna. Contact: info@aguacatelatinfood.at · +43 660 3209995.

2. General information

We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. Our website can generally be used without providing personal data. Data is only collected if you actively submit it, for example by placing an order or making a request.

3. Collection and processing of data

3.1 Server log files

When you access our website, technical data is automatically recorded and stored in server log files: IP address, date and time, requested page, browser type, operating system. This data serves technical security and is deleted after 30 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technical security and operability of the website).

3.2 Cookies

Currently we use only technically necessary cookies (language preference, session). As soon as we activate third-party services such as embedded maps or online payments, a cookie banner with a consent option will appear.

3.3 Online orders

If you place an online order, we process your name, phone number, email address and order details for contract fulfillment. Payment data is processed directly by Stripe · we do not store credit card numbers. Legal basis: Art. 6(1)(b) GDPR (contract performance). This feature is currently not active and will be enabled when it launches.

3.4 Reservations

If you reserve a table via the reservation form, we process your name, phone number, email address, date, time and party size. Legal basis: Art. 6(1)(b) GDPR. This feature is currently not active.

3.5 Catering and private event requests

If you request catering or a private event, we process the data submitted in the form to handle your request. Legal basis: Art. 6(1)(b) GDPR. This feature is currently not active.

3.6 Newsletter

If you subscribe to our newsletter, we process your email address on the basis of your consent (Art. 6(1)(a) GDPR). Subscription uses a double opt-in procedure: after signing up you receive a confirmation email with a link to activate. You can revoke your consent at any time by unsubscribing. This feature is currently not active.

4. Data processors

We use carefully selected service providers who process data on behalf of Aguacate GmbH. Data processing agreements pursuant to Art. 28 GDPR are in place with all processors.

  • Vercel Inc.

    Website hosting. Server location: European Union (Frankfurt).

  • Supabase, Inc.

    Database. Server location: European Union (Frankfurt).

  • Stripe Payments Europe, Ltd.

    Processing of online payments once activated. Data transfer to Stripe in Ireland and Stripe, Inc. in the USA.

  • Resend, Inc.

    Sending of transactional emails such as order confirmations, once activated.

  • Google Ireland Ltd.

    Embedding of Google Maps to display the location, once activated. On activation, a cookie banner with consent option will be shown.

  • Google Places API

    Retrieval of public ratings for the home page, once activated.

5. Data transfer to third countries

When using Stripe and Google, data may be transferred to the USA. Both providers have concluded Standard Contractual Clauses (SCC) and have additional technical and organizational safeguards in place pursuant to Art. 46 GDPR.

6. Retention periods

Orders and invoices
7 years (§ 132 Federal Fiscal Code Austria).
Reservations
12 months after the reserved date.
Customer data
Until a deletion request is received, or after 24 months of inactivity.
Newsletter subscribers
Until unsubscribing.
Server log files
30 days.

7. Your rights

You have the right at any time to access, rectify, delete, restrict the processing of, and data portability for your personal data, as well as to object to its processing. Please contact info@aguacatelatinfood.at to exercise these rights.

8. Complaint to the supervisory authority

You have the right to lodge a complaint with the Austrian Data Protection Authority: Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna · dsb@dsb.gv.at · www.dsb.gv.at.

9. Changes to this privacy policy

We reserve the right to adapt this privacy policy in response to changes in the legal situation or changes to our services and data processing. The current version is always available on this page.