Privacy Policy

This Privacy Policy explains how Guzman y Gomez ("we," "us," "our," or "the Company") collects, uses, discloses, stores, and protects your personal information when you visit our website at guzmanuugamez.com, use our mobile applications, place orders online or in-store, participate in our loyalty programmes, or otherwise interact with our services. We are committed to protecting your privacy and handling your personal information in an open, transparent, and responsible manner in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act.

Please read this Privacy Policy carefully. By accessing or using our website, placing an order, or engaging with any of our services, you acknowledge that you have read, understood, and agree to the practices described in this document. If you do not agree with this Privacy Policy, please discontinue your use of our services immediately.

This Privacy Policy applies to all personal information collected by Guzman y Gomez in Australia, whether collected online, in person at our restaurant locations, via telephone, or through any other means.

1. About Us

Guzman y Gomez is an Australian food service company operating a chain of Mexican-inspired quick-service restaurants across Australia and internationally. We are committed to delivering fresh, flavoursome food while respecting your privacy at every step of your customer journey.

2. What Personal Information We Collect

We collect personal information that is reasonably necessary for us to operate our business, provide our food services, and improve your customer experience. The types of personal information we collect depend on how you interact with us.

2.1 Information You Provide Directly

When you create an account, place an order, join our loyalty programme, contact us, or otherwise interact with our services, you may provide us with:

• Identity Information: Your full name, date of birth, and gender (where voluntarily provided).
• Contact Information: Email address, telephone number, home or delivery address, and postal code.
• Account Credentials: Username and password for your online account or loyalty programme membership.
• Order Information: Details of food items ordered, order history, dietary preferences, customisations, and special requests.
• Payment Information: Credit card or debit card details, PayPal information, or other payment method details. Note that payment card data is processed securely through our PCI-DSS compliant payment processors and we do not store full card numbers on our systems.
• Loyalty Programme Data: Points accumulated, rewards redeemed, membership tier, and participation history.
• Feedback and Communications: Information you provide when completing surveys, writing reviews, submitting feedback, or contacting our customer service team via email, phone, or social media.
• Promotional Entries: Information submitted in connection with competitions, giveaways, or promotional events we organise.

2.2 Information Collected Automatically

When you visit our website or use our mobile application, we automatically collect certain technical and usage data, including:

• Device Information: Device type, operating system and version, browser type and version, unique device identifiers, and screen resolution.
• Usage Data: Pages visited, time spent on pages, links clicked, referring URLs, search queries made within our website, and navigation paths.
• Location Data: Approximate geographic location derived from your IP address, and precise location data if you grant permission through our mobile application for features such as finding the nearest restaurant.
• Log Data: Internet Protocol (IP) address, access times, request details, error logs, and browser activity logs.
• Cookie and Tracking Data: Information collected through cookies, web beacons, pixel tags, and similar tracking technologies. Please refer to Section 8 of this Privacy Policy for more details on our use of cookies.

2.3 Information from Third Parties

We may receive personal information about you from third parties in the following circumstances:

• Social Media Platforms: If you choose to log in to our website or app using a social media account (such as Facebook or Google), we receive basic profile information such as your name, email address, and profile picture.
• Delivery Partners: Third-party delivery services such as Uber Eats, DoorDash, or Menulog may share certain order-related information with us to facilitate delivery and resolve issues.
• Analytics Providers: Analytics services may provide aggregated and sometimes pseudonymised information about how users interact with our platforms.
• Franchisee Partners: If you interact with a Guzman y Gomez franchise location, that franchisee may share relevant customer information with us in accordance with their own privacy obligations.
• Publicly Available Sources: We may collect information available through public registers, social media, or review platforms to manage our business reputation and respond to feedback.

2.4 Sensitive Information

We do not intentionally collect sensitive information as defined under the Privacy Act 1988 (Cth), which includes information about racial or ethnic origin, political opinions, religious beliefs, health information, biometric data, and criminal records. However, if you voluntarily share dietary requirements that indicate a health condition or religious belief (for example, allergen requirements), we treat this information with additional care and use it solely to provide appropriate food service. We will not use such information for any other purpose without your explicit consent.

3. How We Use Your Personal Information

We use the personal information we collect for the following purposes, all of which are reasonably necessary for our business operations and the provision of our services:

3.1 Service Provision and Order Fulfilment

• Processing and fulfilling your food orders, whether placed in-store, online, or via our mobile app.
• Managing your customer account and loyalty programme membership.
• Processing payments and issuing receipts or invoices.
• Coordinating delivery services with our third-party delivery partners.
• Handling returns, refunds, or complaints related to your orders.
• Providing customer support and responding to your enquiries, feedback, or complaints.

3.2 Marketing and Communications

• Sending you promotional emails, SMS messages, or push notifications about new menu items, special offers, discounts, and events — but only where you have consented to receiving such communications or where permitted under the Spam Act 2003 (Cth).
• Personalising marketing content and offers based on your order history and preferences.
• Conducting competitions, giveaways, and loyalty promotions.
• Displaying targeted advertisements on our own platforms and through digital advertising networks.

3.3 Analytics and Service Improvement

• Analysing usage patterns, customer behaviour, and order trends to improve our menu, website, app, and in-store experience.
• Conducting market research and customer satisfaction surveys.
• Developing new products, features, and services.
• Monitoring and troubleshooting technical issues with our digital platforms.
• Measuring the effectiveness of our marketing campaigns and promotional activities.

3.4 Legal and Compliance Purposes

• Complying with our legal obligations under applicable Australian laws, including the Privacy Act 1988 (Cth), the Australian Consumer Law (Schedule 2 of the Competition and Consumer Act 2010 (Cth)), and food safety regulations.
• Preventing, detecting, and investigating fraud, unauthorised access, and other unlawful activities.
• Responding to lawful requests from government authorities, regulators, or law enforcement agencies.
• Enforcing our Terms of Service and other agreements.
• Protecting the rights, property, and safety of Guzman y Gomez, our customers, employees, and the public.

3.5 Business Operations

• Managing our franchise network and ensuring consistent service standards across all Guzman y Gomez locations.
• Conducting internal audits and risk management activities.
• Training our staff and improving our operational procedures.
• Facilitating corporate transactions such as mergers, acquisitions, or asset sales, where applicable.

4. Sharing Your Personal Information with Third Parties

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may share your personal information in the following circumstances:

4.1 Service Providers and Business Partners

We engage trusted third-party service providers to assist us in operating our business and delivering our services. These providers are contractually required to handle your personal information only as directed by us and in compliance with applicable privacy laws. They include:

• Payment Processors: Companies that securely process credit card and other payment transactions.
• Delivery Partners: Third-party platforms and drivers who facilitate the delivery of your food orders.
• IT and Cloud Services: Providers of hosting, data storage, cybersecurity, and software-as-a-service solutions.
• Marketing and Advertising Agencies: Partners who assist with email marketing, digital advertising, and campaign management.
• Analytics Providers: Companies such as Google Analytics that help us understand how our platforms are used.
• Customer Support Platforms: Software providers that power our customer service and helpdesk functions.
• Loyalty Programme Operators: Technology partners who manage our rewards and loyalty system.
• Market Research Firms: Organisations that conduct surveys and analyse customer satisfaction on our behalf.

4.2 Franchise Partners

Guzman y Gomez operates a franchise model. Where you interact with a franchised restaurant location, we may share relevant customer information with that franchisee to facilitate your order, address a complaint, or maintain consistent service standards. All franchisees are bound by confidentiality and data protection obligations consistent with our Privacy Policy.

4.3 Legal and Regulatory Disclosures

We may disclose your personal information to government bodies, regulators, law enforcement agencies, courts, or other authorities where we are legally required to do so, or where we reasonably believe that disclosure is necessary to:

• Comply with a legal obligation, court order, or regulatory requirement;
• Protect and defend our legal rights or property;
• Prevent or investigate possible wrongdoing in connection with our services;
• Protect the personal safety of our customers, employees, or the public; or
• Protect against legal liability.

4.4 Business Transfers

If Guzman y Gomez undergoes a merger, acquisition, restructuring, or sale of all or part of its assets, your personal information may be transferred to the acquiring or successor entity as part of that transaction. We will notify you of any such change via a prominent notice on our website or by email, and we will ensure that the recipient entity is bound by privacy obligations at least as protective as those described in this Privacy Policy.

4.5 With Your Consent

We may share your personal information with other third parties in any other circumstances where you have provided your explicit consent to such sharing.

5. Data Security

We take the security of your personal information seriously and implement a range of technical, administrative, and physical safeguards to protect it from unauthorised access, disclosure, alteration, loss, and destruction.

5.1 Security Measures We Employ

• Encryption: All data transmitted between your browser or app and our servers is encrypted using industry-standard Transport Layer Security (TLS) protocols. Payment data is encrypted in accordance with PCI-DSS standards.
• Access Controls: Access to personal information is restricted to authorised employees and contractors who need it to perform their job functions. All such personnel are bound by confidentiality obligations.
• Firewalls and Intrusion Detection: Our network infrastructure is protected by firewalls, intrusion detection systems, and regular security monitoring.
• Secure Data Storage: Personal information is stored on secure servers located in Australia or in countries with equivalent privacy protections.
• Regular Audits: We conduct regular security assessments, vulnerability scans, and penetration tests to identify and address potential weaknesses in our systems.
• Staff Training: Our employees receive regular training on data protection, privacy obligations, and cybersecurity best practices.
• Incident Response: We maintain a data breach response plan and will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in the event of an eligible data breach, as required under the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth).

6. Your Privacy Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have a number of important rights in relation to your personal information. We are committed to honouring these rights promptly and without undue delay.

6.1 Right of Access

You have the right to request access to the personal information we hold about you. Upon receipt of a valid request, we will provide you with a copy of that information within a reasonable timeframe (generally 30 days), unless an exception under APP 12 applies (such as where access would pose a serious threat to health or safety, or unreasonably impact the privacy of another individual).

6.2 Right to Correction

If you believe that personal information we hold about you is inaccurate, incomplete, out of date, irrelevant, or misleading, you have the right to request that we correct it. We will take reasonable steps to correct the information or, if we decline to make the requested correction, we will provide you with our reasons and notify you of how you may complain about our decision.

6.3 Right to Deletion (Erasure)

In certain circumstances, you may request that we delete or de-identify personal information we hold about you — for example, where it is no longer necessary for the purpose for which it was collected, or where you withdraw your consent on which processing was based. We will comply with such requests where we are not legally required to retain the information or where no other legitimate ground for retention applies.

6.4 Right to Restrict Processing

You may request that we restrict the processing of your personal information in certain circumstances, such as while a dispute regarding the accuracy of your data is being resolved.

6.5 Right to Data Portability

Where technically feasible and where permitted under applicable law, you may request that we provide your personal information to you in a structured, commonly used, and machine-readable format, or that we transmit it directly to another organisation.

6.6 Right to Withdraw Consent

Where we process your personal information based on your consent (for example, for direct marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to the withdrawal.

6.7 Right to Opt Out of Direct Marketing

Under the Spam Act 2003 (Cth) and the Privacy Act 1988 (Cth), you have the right to opt out of receiving direct marketing communications from us at any time. You can do this by:

• Clicking the "Unsubscribe" link in any marketing email;
• Replying "STOP" to any marketing SMS;
• Adjusting your notification settings in our mobile app; or
• Contacting us directly at [email protected].

6.8 How to Exercise Your Rights

To exercise any of the rights described above, please contact our Privacy Officer using the contact details set out in Section 11 of this Privacy Policy. We may need to verify your identity before processing your request. We will respond to your request within 30 days of receipt. In complex cases, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it.

7. Data Retention

We retain your personal information for as long as is reasonably necessary to fulfil the purposes for which it was collected, as described in this Privacy Policy, and to comply with our legal, regulatory, tax, accounting, and reporting obligations. The specific retention periods depend on the type of information and the purpose for which it is held:

After the applicable retention period has expired, we will securely delete, destroy, or de-identify your personal information in accordance with our data destruction procedures and the requirements of APP 11.2.

8. Cookies and Tracking Technologies

Our website and mobile application use cookies and similar tracking technologies (such as web beacons, pixel tags, and local storage) to enhance your experience, analyse usage, and support our marketing activities.

8.1 What Are Cookies?

Cookies are small text files that are placed on your device by a website when you visit it. They are widely used to make websites work efficiently and to provide information to website operators. Cookies can be "session cookies" (which expire when you close your browser) or "persistent cookies" (which remain on your device for a specified period or until you delete them).

8.2 Types of Cookies We Use

• Strictly Necessary Cookies: These are essential for our website to function correctly and cannot be disabled. They enable core features such as account login, shopping cart functionality, and secure payment processing.
• Performance and Analytics Cookies: These cookies collect information about how visitors use our website, such as which pages are visited most frequently and whether error messages are received. We use this data to improve our website performance. These cookies do not collect personally identifiable information.
• Functionality Cookies: These cookies allow our website to remember your preferences (such as your saved delivery address or language settings) to provide a more personalised experience.
• Marketing and Targeting Cookies: These cookies are used to deliver advertisements that are relevant to you and your interests. They are also used to limit how often you see an advertisement and to measure the effectiveness of marketing campaigns.

8.3 Managing Cookies

You can manage your cookie preferences through our cookie consent tool, which is presented when you first visit our website. You can also manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For more detailed information about the specific cookies we use and how to manage them, please refer to our Cookie Policy.

9. International Data Transfers

Guzman y Gomez is an Australian company, and we primarily store and process your personal information within Australia. However, some of our third-party service providers, technology platforms, and business partners are located overseas, including in the United States, the European Union, Singapore, and other jurisdictions. As a result, your personal information may be transferred to, stored in, or processed in countries outside of Australia.

Where we transfer personal information overseas, we take steps to ensure that it receives a level of protection that is at least equivalent to that required under the Australian Privacy Principles, as required by APP 8. These steps may include:

• Ensuring that overseas recipients are located in countries with privacy laws that are substantially similar to Australia's;
• Entering into contractual arrangements with overseas recipients that require them to handle personal information in accordance with the APPs;
• Relying on specific privacy frameworks or data transfer mechanisms where applicable (such as Standard Contractual Clauses for transfers to the European Economic Area); or
• Obtaining your consent to the transfer in specific circumstances.

By using our services, you acknowledge that your personal information may be transferred internationally as described above.

10. Children's Privacy

Our website and online services are not directed at children under the age of 18. We do not knowingly collect personal information from individuals under 18 years of age without the consent of a parent or legal guardian. If we become aware that we have inadvertently collected personal information from a person under 18 without appropriate parental consent, we will take prompt steps to delete that information from our systems.

If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at [email protected] so that we can address the matter.

Minors who wish to use our services must do so under the supervision of a parent or legal guardian who accepts this Privacy Policy on their behalf. Individuals under 18 may visit our restaurants and place in-store orders, but we recommend that account registration and online ordering features are used only by persons aged 18 and over, or by a parent or guardian acting on behalf of a minor.

11. Contact Information and Privacy Enquiries

We welcome your questions, feedback, and requests regarding this Privacy Policy and our data handling practices. If you have any privacy-related concerns, please contact our Privacy Officer using the details below:

When contacting us about a privacy matter, please provide sufficient detail to allow us to identify you and understand your concern. We will acknowledge receipt of your enquiry within 5 business days and aim to provide a substantive response within 30 days.

12. How to Lodge a Complaint

If you believe that we have breached the Australian Privacy Principles or otherwise mishandled your personal information, we encourage you to contact us in the first instance so that we can attempt to resolve your concern directly.

12.1 Internal Complaint Process

1. Submit your complaint in writing to our Privacy Officer at [email protected], providing as much detail as possible about the nature of your complaint.
2. We will acknowledge receipt of your complaint within 5 business days.
3. We will investigate your complaint and provide a written response within 30 days of receipt (or such longer period as is reasonably necessary for complex matters, of which we will notify you).
4. If you are not satisfied with our response, we will advise you of other avenues available to you, including referral to the OAIC.

12.2 Complaint to the Office of the Australian Information Commissioner (OAIC)

If you are not satisfied with our response to your complaint, or if you feel that we have not adequately addressed your privacy concern, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC), which is the independent national regulator for privacy and freedom of information.

The OAIC may investigate your complaint and, where appropriate, make a determination or seek conciliation between you and Guzman y Gomez.

13. Third-Party Websites and Links

Our website and app may contain links to third-party websites, social media platforms, delivery partner portals, and other external services. This Privacy Policy applies only to Guzman y Gomez's own platforms and services. We are not responsible for the privacy practices of any third-party websites and encourage you to review the privacy policies of any external sites before providing them with your personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, our services, or applicable laws. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page;
• Post a prominent notice on our website or app notifying you of the change; and/or
• Send you a direct communication (such as an email) if the changes are significant and you have provided us with a contact email address.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our services after we post any modifications to this Privacy Policy will constitute your acknowledgement of the modifications and your consent to abide and be bound by the updated Privacy Policy.

15. Governing Law

This Privacy Policy is governed by the laws of Australia, including the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Spam Act 2003 (Cth), the Competition and Consumer Act 2010 (Cth) (including the Australian Consumer Law), and any other applicable federal or state legislation. Any disputes arising in connection with this Privacy Policy shall be subject to the jurisdiction of the courts of Australia.