Privacy notice

Controller

Taco Ranch GmbH, Duisburger Straße 24, 40477 Düsseldorf, Germany. Privacy contact: info@tacoranch.de, telephone +49 211 15830750.

Website and protected test access

Requests process in particular your IP address, requested address, time and technical browser information to deliver content and protect the service from misuse. The test website runs on a STRATO server in Germany. The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in a secure, functioning website.

Password-protected sessions secure access to the test website and administration. Login-attempt data helps prevent abuse. Operational error logs may contain technical information; form contents and passwords do not belong in these logs. Retention depends on necessary troubleshooting, protection against attacks and, where relevant, preservation of evidence of specific incidents.

Franchise enquiries and appointments

To handle a franchise enquiry, we process the contact, experience and planning information entered in the form: name, email address, telephone number, experience, motivation, desired location and equity range. These details help us contact you and assess possible cooperation. Please do not submit health data or other particularly sensitive information.

The legal basis is Article 6(1)(b) GDPR for pre-contractual steps at your request. If you act as a company contact, Article 6(1)(f) GDPR applies, with the legitimate interest of handling business enquiries. Marketing consent is not required.

There is no statutory obligation to submit a franchise enquiry. The marked information is needed to identify and answer your enquiry and assess your proposed project. The form cannot be processed without these details.

Access is restricted to the Taco Ranch staff responsible for enquiries. Appointment scheduling processes the appointment, its relationship to your enquiry and necessary confirmation data. This test environment uses a local test calendar and does not create external appointments.

Enquiries and correspondence are needed for the duration of the enquiry and follow-up. They are then deleted unless statutory retention duties or overriding reasons such as establishing or defending legal claims apply. Decisions on franchise cooperation are not made solely by automated processing.

Email and form confirmations

When you email us directly, we process your sender address, message and any attachments to handle your request. Depending on its content, Article 6(1)(b) or (f) GDPR applies. The business mailbox is hosted by STRATO.

Once email delivery is enabled, we send acknowledgements for new franchise enquiries, necessary internal notifications and related correspondence through the STRATO mailbox. This processes the recipient address, necessary message content and technical delivery data. Earlier sandbox cases remain in the access-protected local test mailbox and are never sent externally afterwards. Status information distinguishes storage, queued delivery, errors and acceptance by the mail server; acceptance does not establish delivery to an inbox. Messages are not used for advertising.

Internal AI assistance

Submitting a franchise enquiry does not automatically send information to AI. After their own review, authorised staff may send a separate summary limited to business experience and motivation to the OpenAI API. Names, contact details, identifiers and other personal or particularly sensitive information must be removed first. Recognisable contact details are also rejected by technical checks. Complete enquiries, contact details and meal-planner targets are not automatically sent to OpenAI.

The assistance supports preparation for possible franchise cooperation. Responsible staff assess the results themselves; no decision or rejection is made solely by AI. If a sufficiently anonymised summary cannot be prepared, this AI feature must not be used for the case. The legal bases stated above apply to processing the actual enquiry.

The provider is OpenAI. For business customers in the European Economic Area, its terms name OpenAI Ireland Ltd. as the contracting party; processing by other entities, including outside the European Economic Area, is possible. OpenAI describes safeguards including standard contractual clauses in its data processing addendum. According to its documentation, API content is not used for model training by default; security logs may contain content and generally be retained for up to 30 days. Disabling response storage therefore does not establish zero retention by the provider. Further information: https://openai.com/policies/data-processing-addendum/ and https://developers.openai.com/api/docs/guides/your-data.

Cookies, browser storage and nutrition calculator

This test website uses only technically necessary cookies for protected access, administration and protection against abusive requests. Details and durations are available under “Cookies & storage”. The exemption in section 25(2)(2) TDDDG applies only to these necessary functions; subsequent processing is based on Article 6(1)(f) GDPR.

Language is selected through the page address. The meal planner processes your selections, targets and history for the current page in browser memory. History is discarded on reload and is not stored in a persistent browser profile. Calculations run in your browser; entered targets are not sent to an external planning service.

Fonts and external links

Web fonts are loaded from this website’s server. Loading them does not require a request to Google Fonts. External maps, social-media pages and ordering services are provided as links where listed. Clicking such a link takes you to the provider’s website, where its privacy information applies.

This test environment does not use analytics or advertising trackers. The website functions described here do not require transmission to Google or another external analytics provider.

Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction and data portability under Articles 15–20 GDPR. Where processing is based on consent, you may withdraw it for the future without affecting the lawfulness of earlier processing.

For processing based on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. You may object to direct marketing at any time.

You may complain to a supervisory authority, particularly in your place of residence or work or where a suspected infringement occurred. The authority responsible for our registered location is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information: www.ldi.nrw.de. You can send requests to us at info@tacoranch.de.