Privacy

Information on the processing of personal data

This privacy policy informs you, in accordance with Art. 13 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), about the processing of your personal data in connection with your visit to our website, your enquiries, your orders, our catering service and purchases in our shop GUAT & GREIS in Latsch.

Data controller

The controller responsible for processing your personal data is:

GUAT & GREIS d. Martin Greis
Marktstraße 20a
39021 Latsch (BZ), South Tyrol, Italy
Phone: +39 388 1188192
Email: info@guat-greis.com
VAT no.: IT02505190211

What personal data is processed?

Depending on how you get in touch with us, the following personal data in particular may be processed:

contact details such as first and last name, email address and phone number
the content of messages you send us via the contact form, by email, by phone or via WhatsApp
details of orders and pre-orders, in particular the requested products, quantities and pick-up time
details of catering enquiries, in particular the type, date, location and size of the event and the number of guests
details of the payment method, payments and invoicing, in particular for catering orders
when entering the shop outside opening hours: the data of your debit card used to grant access and the time of entry
technical data when visiting the website, in particular IP address, date and time of access, pages visited and browser and device information
where applicable, information on food intolerances or special dietary requirements, if you provide it voluntarily and its processing is necessary to prepare your order or catering

Purposes and legal basis of processing

Your personal data is processed in particular for the following purposes:

to handle enquiries submitted via the contact form, by email, by phone or via WhatsApp
to receive, prepare and process orders and pre-orders and to notify you as soon as your order is ready for pick-up
to prepare quotes and to plan and carry out catering orders
to grant access to the shop outside opening hours and to process payments at the self-checkout
to ensure the security of the shop and prevent misuse
to process payments and invoices
to comply with legal obligations, in particular tax and commercial retention requirements
to provide the website and ensure its security and technical optimisation

The processing of your personal data is based in particular on:

Art. 6(1)(b) GDPR for the performance of a contract or to take steps prior to entering into a contract, e.g. for orders, purchases and catering enquiries
Art. 6(1)(c) GDPR for compliance with legal obligations
Art. 6(1)(a) GDPR where you have given your consent to the processing of your data for specific purposes, e.g. for the use of non-essential services on the website
Art. 6(1)(f) GDPR where processing is necessary for the legitimate interests of GUAT & GREIS or a third party, e.g. for the security of the shop and the website, provided that these interests are not overridden by the interests or fundamental rights and freedoms of the data subject

If you provide us with information on food intolerances or other special categories of personal data within the meaning of Art. 9 GDPR, this data is processed solely on the basis of your explicit consent and only to prepare your order or catering.

Contact form and email

If you contact us via the contact form or by email, we process the data you provide solely to handle your enquiry and any follow-up questions. The email address is marked as a required field, as we cannot reply to you without it. All other information is voluntary.

Orders via WhatsApp

Pre-orders and enquiries can also be made via WhatsApp. If you contact us via WhatsApp, we process your phone number, your profile name and the content of your messages in order to prepare your order and inform you as soon as it is ready for pick-up.

WhatsApp is a service provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a company of the Meta group. WhatsApp’s own privacy policy also applies when you use WhatsApp. A transfer of data to the USA cannot be ruled out; any such transfer takes place on the basis of the EU-US Data Privacy Framework or appropriate safeguards pursuant to Art. 46 GDPR. Using WhatsApp is voluntary. Alternatively, you can place your order at any time by phone, by email or directly at the counter.

Shop access and self-checkout

Outside counter service hours, the shop can be accessed with a debit card. The card is used to grant access; the card data required for this purpose and the time of entry are processed by the access system. Payment at the self-checkout is handled by a certified payment service provider. GUAT & GREIS neither views nor stores full card details.

This processing takes place to carry out your purchase (Art. 6(1)(b) GDPR) and on the basis of our legitimate interest in the security of the shop and the prevention of misuse (Art. 6(1)(f) GDPR).

Website, hosting and cookies

When you visit our website, technically necessary data such as your IP address, the date and time of access and browser and device information are processed by the hosting provider and stored in server log files. This is necessary to deliver the website and to ensure its security and stability (Art. 6(1)(f) GDPR).

Our website uses technically necessary cookies. Non-essential services are only activated if you give your consent via the cookie banner (Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via the “Privacy settings” link in the footer of the website.

Links to external websites

Our website contains links to external websites, in particular to the Stadlgut online shop. The respective operator is responsible for the processing of personal data on these websites. The privacy policies published there apply.

Recipients of personal data

Your personal data is generally only processed to the extent necessary and is not disclosed to third parties without an appropriate legal basis.

Data may be disclosed in particular to service providers and processors who support GUAT & GREIS in providing its services, for example in the areas of hosting, website maintenance, IT, email communication, the access system, the till system, payment processing or tax consulting.

In addition, personal data may be disclosed to authorities or other bodies where this is required by law.

Recipients may only process the data transferred to them in accordance with the applicable data protection regulations and for the intended purposes.

Storage period

Your personal data is only stored for as long as necessary for the respective purposes of processing or as required by statutory retention periods.

Enquiries and messages are deleted once they have been fully dealt with, unless a further business relationship arises. Data processed on the basis of legal or contractual obligations, such as invoicing data, is retained for the respective prescribed period. Data processed on the basis of your consent is stored until you withdraw your consent, unless there is another legal basis for further storage.

Rights of data subjects

Within the scope of the applicable legal provisions, you have the right to:

access your personal data pursuant to Art. 15 GDPR
rectification of inaccurate or incomplete personal data pursuant to Art. 16 GDPR
erasure of your personal data pursuant to Art. 17 GDPR, where the legal requirements are met
restriction of processing pursuant to Art. 18 GDPR
data portability pursuant to Art. 20 GDPR, where the legal requirements are met
object to the processing of your personal data pursuant to Art. 21 GDPR, where the legal requirements are met
withdraw consent at any time with effect for the future

To exercise your rights, you can contact the controller at any time using the contact details above. Requests to exercise these rights are generally answered within one month; for complex requests, this period may be extended within the limits set by law.

Consent

Where the processing of your personal data is based on your consent, giving consent is voluntary. You may withdraw your consent at any time with effect for the future.

The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Where personal data is required on the basis of a legal or contractual obligation, failure to provide it may mean that certain services, in particular handling an enquiry, an order or a catering request, cannot be provided or can only be provided to a limited extent.

Right to lodge a complaint with a supervisory authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the applicable data protection regulations.

The competent Italian supervisory authority is:

Garante per la protezione dei dati personali
Piazza Venezia 11
00187 Rome, Italy
www.garanteprivacy.it

Last updated: October 2026