Privacy Policy

The Data Controller is CIGIERRE – COMPAGNIA GENERALE RISTORAZIONE S.p.A., VAT number 01896000302 (hereinafter also referred to as 'Cigierre'), with its registered office at via Nazionale n. 35 – 33010 Tavagnacco (UD).

You can contact the Data Controller:

• by sending a certified email to: cigierre@legalmail.it;
• by calling the number 0432-804804;
• by sending a letter to the address: via Nazionale n. 35 – 33010 Tavagnacco (UD).

For administrative, organizational, and accounting purposes, as well as for marketing and profiling activities related to the Old Wild West Loyalty Program, including prize competitions related to the loyalty program, Cigierre and the Old Wild West Consortium, with its registered office at via Nazionale n. 35 – 33010 Tavagnacco (UD), VAT number (hereinafter also referred to as 'Consorzio OWW'), act as joint Controllers of the processing. It is possible to request to view the essential content of the Joint Controller Agreement, in compliance with the provisions of art. 26, co. 2, of the GDPR, by writing to Cigierre's DPO at the following email address: dpo@cigierre.com.

The Data Controller has appointed a DPO (Data Protection Officer), whose tasks are listed in Article 39 of the GDPR.

You can contact the DPO:

• by sending an email to: dpo@cigierre.com;
• by sending a letter, addressed to the DPO, to the address: via Nazionale n. 35 – 33010 Tavagnacco (UD).

• Purpose: creation of a personal area and related account that will allow you to keep track of your orders and manage your consents on the Site and App.
• Category of data processed
  • Identification and contact data: name, surname, email, date of birth, gender, city, postal code, mobile number;
  • Data related to your orders, purchases, and choices: information provided or otherwise acquired during the use of our services or following the purchase of our products regarding your purchases and consumption choices (e.g., preferred restaurant);
  • Social Log-in data: information related to your Social account as well as other data provided by you to the Social Network used to log in to the Site or App; this information may be communicated based on the privacy preferences you have set on that Social Network.
• Legal basis: execution of a contract (art. 6.1 b GDPR). The provision of data for this purpose is necessary, and in case of failure to provide the data, we will not be able to process your request.
• Retention period: your account and associated data will be retained until you request deletion and, in any case, no later than 2 years from the creation in case of an account created and never used or in case of prolonged inactivity for 2 years.

• Purpose: joining the Old Wild West loyalty program and issuing the CARD and managing participation in the program. The data is processed to manage all aspects related to the contractual relationship inherent to the loyalty program and related administrative-accounting obligations.
• Category of data processed
  • Identification and contact data: name, surname, email, date of birth, gender, city, postal code, mobile number;
  • Data related to your use of the CARD and purchases: order history (date and time, method), delivery address in case of delivery orders or point of sale for pickup in case of take-away orders, cart composition, name used for delivery;
  • Payment and transactional data: payment method (payment card data is not saved) and transaction data (date and time of the transaction, order history, amount, etc.);
  • Other data: information freely provided by you in filling out the various online forms on the Site or App and information related to your use or participation in offers and promotions (e.g., coupons).
• Legal basis: execution of a contract (art. 6.1 b GDPR). The provision of data for this purpose is necessary, and in case of failure to provide the data, we will not be able to process your request.
• Retention period: your data will be retained for the duration of your membership in the Old Wild West loyalty program and until you request deletion and, in any case, no later than 2 years from joining the program without any related activity or in case of inactivity of the CARD for 2 years.

• Purpose: purchase of products online with the possibility of delivery or pickup at the chosen point of sale.
• Category of data processed

• Identification and contact data: name, surname, email, date of birth, gender, city, postal code, mobile number;
• Delivery data: point of sale for pickup (take away) or delivery address (delivery);
• Payment and transactional data: payment method (payment card data is not saved) and transaction data (date and time of the transaction, amount, etc.);
• Other data: information freely provided by you in filling out the various online forms on the Site or App.

• Identification and contact data: name, surname, email, mobile number;
• Delivery data: point of sale for pickup (take away) or delivery address (delivery);
• Payment and transactional data: payment method (payment card data is not saved) and transaction data (date and time of the transaction, amount, etc.);
• Other data: information freely provided by you in filling out the various online forms on the Site or App.

• Legal basis: execution of a contract (art. 6.1 b GDPR). The provision of data for this purpose is necessary, and in case of failure to provide the data, we will not be able to process your request.
• Retention period:

• Purpose: sending commercial and promotional communications or for market research and statistical surveys by Cigierre S.p.A., for its brands ("Wiener Haus", "Shi’s", "Smashie", "Take Me Home" and "America Graffiti").
• Category of data processed
  • Identification and contact data: name, surname, email, date of birth, gender, city, postal code, mobile number;
• Legal basis: consent (art. 6.1 a GDPR). The provision of data for this purpose is free and optional.
• Retention period: unless revoked or opposed by you, after 24 months from the collection of consent, you will receive an email to confirm or revoke your consent.

• Purpose: sending personalized commercial communications based on your interests and purchase or browsing habits on the Site or App and developing products and services in line with customer preferences and statistical survey activities.
• Category of data processed
  • Identification and contact data: name, surname, email, date of birth, gender, city, postal code, mobile number;
  • Data related to your interests: information provided or otherwise acquired during the use of our services or purchase of our products regarding your habits and consumption choices (e.g., preferred restaurant);
  • Data related to the use of the Site or App and our social channels;
  • Other data: information related to your use or participation in offers and promotions (e.g., coupons).
• Legal basis: consent (art. 6.1 a GDPR). The provision of data for this purpose is free and optional.
• Retention period: 12 months from the collection of consent, unless revoked or opposed by you.

• Purpose: sending email communications regarding services or products similar to those already purchased by you.
• Category of data processed
  • Identification and contact data: name, surname, email, date of birth, gender, city, postal code, mobile number;
  • Data related to purchases: information acquired during the purchase of our products (e.g., preferred restaurant).
• Legal basis: legitimate interest of the Data Controller (art. 6.1.f GDPR and art. 130.4 Privacy Code). For information on the balancing test carried out in the evaluation of legitimate interest, contact us at the contact details provided in this information notice.
• Retention period: 24 months from the date of the first purchase or account registration on the Site, unless opposed by you.

7) FIND THE NEAREST OLD WILD WEST RESTAURANT TO YOU

• Purpose: identification of the nearest Old Wild West restaurant to you.
• Category of data processed: static position.
• Legal basis: consent (art. 6.1 a GDPR). The provision of data is free and optional, and in case of failure to provide the data, we will not be able to process your request.
• Retention period: data is processed for the time necessary to identify the nearest Old Wild West restaurant to you and is not retained.

8) TABLE RESERVATION SERVICE

• Purpose: provision of the online table reservation service or by phone contact.
• Category of data processed
  • Data related to table reservation: name, surname, email, phone number, date and time of reservation, number of people;
  • Other data: information freely provided by you in filling out the various online forms on the Site.
• Legal basis: execution of a contract (art. 6.1 b GDPR). The provision of data is necessary, and in case of failure to provide the data, we will not be able to process the requested service.
• Retention period: until the service is provided.

• Purpose: allowing participation in prize competitions organized by the Data Controller or Joint Controllers, as well as compliance with legal obligations related to the regulations on prize competitions;
• Category of data processed
  • Identification and contact data: name, surname, email, date of birth, gender, city, postal code, mobile number;
  • Data related to your use of the CARD and purchases: order history (date and time, method);
  • Payment and transactional data: payment method (payment card data is not saved) and transaction data (date and time of the transaction, order history, amount, promotional code, etc.);
• Legal basis: execution of a contract (art. 6.1 b GDPR) and compliance with legal obligations (art. 6.1 c GDPR) and specifically the regulations on prize competitions (D.P.R. 430/2001). The provision of data is necessary, and in case of failure to provide the data, we will not be able to guarantee your participation in the prize competition and, in case of winning or earning the right to the prize, we may not be able to deliver the prize.
• Retention period: data is processed for the time necessary to carry out the prize competition and until the closure of the administrative and legal operations related to the conclusion of the prize competition according to specific regulations. Subsequently, the data is retained for purposes related to compliance with specific legal obligations (e.g., administrative-accounting purposes), legally binding requests, regulations or provisions of the judicial authority, as well as to defend a right in court. The data processed may be retained for the time necessary to fulfill these obligations and, in any case, no later than the next 10 years, regarding the data necessary for administrative-accounting purposes, except in cases where retention for a longer period is required for any disputes, requests from the competent authority, or under applicable law.

• Purpose: analysis of logs necessary to monitor the actions performed by users of the Site or App and the administrative area to protect the security of the Site or App and the collected data, as well as to prevent malicious activities.
• Category of data processed:
  • Data related to the use of the Site or App: log data, device used, IP address, access date, pages visited, and activities performed in the individual sections of the Site or App.
• Legal basis: legitimate interest of the Data Controller or third parties (art. 6.1.f GDPR and art. 130.4 Privacy Code). For information on the balancing test carried out, contact us at the contact details provided in this information notice.
• Retention period: 6 months and until the time necessary for the purposes of the service or different prescription period established by law.

• ​​​​​​​Purpose: activities of research and selection of personnel by the Data Controller through the uploading of your application on the appropriate form on the "Work with us" page. If you submit your application through the appropriate form on the "Work with us" page, you will be redirected to the corresponding page on the site http://www.cigierre.com/lavora-con-noi.
• Category of data processed:
  • Data related to the CV: data contained in the Curriculum Vitae to submit a spontaneous application or respond to the offers present in the "Work with us" section.
• Legal basis: fulfillment of pre-contractual measures activated at your request (art. 6.1 b GDPR). The provision of data is necessary, and in case of failure to provide the data, we will not be able to process your request.
• Retention period: the Curriculum Vitae and the data contained therein will be retained from the moment of uploading and for up to 12 months to allow the Data Controller to contact the interested party for different open positions.

• Purpose: your data may be processed by the Data Controller to defend its rights or take legal action or even make claims against you or third parties or to comply with obligations arising from laws, regulations, community legislation, provisions/requests from authorities authorized by law and/or supervisory and control bodies.
• Category of data processed
  • Identification and contact data (name; surname; email; date of birth; gender; city; postal code; mobile number);
  • Data related to your interests (information provided or otherwise acquired during the use of our services or following the purchase of our products regarding your habits and consumption choices, e.g., preferred restaurant);
  • Data related to your use of the CARD and purchases: order history (date, time, method, and delivery address / point of sale for pickup in case of take-away orders, cart composition, name used for delivery, delivery address in case of delivery orders);
  • Payment and transactional data: payment method (payment card data is not saved) and transaction data (date and time of the transaction, amount, etc.);
  • Other data: information freely provided by you in filling out the various online forms on the Site or App;
  • Data related to the use of the Site or App and logs: log data, device used, IP address, access date; pages visited, activities performed in the individual sections of the Site or App.
• Legal basis: legitimate interest (art. 6.1.f GDPR and art. 130.4 Privacy Code) or compliance with a legal obligation (art. 6.1.c GDPR). For information on the balancing test carried out, contact us at the contact details provided in this information notice.
• Retention period: legal prescription period.

• Purpose: providing assistance to your requests and communicating general information related to our products, services, and points of sale through a virtual assistance chat-bot.
• Category of data processed:
  • Identification and contact data: name, surname, email, date of birth, gender, city, postal code, mobile number;
  • Data related to your use of the CARD and purchases: order history (date and time, method), delivery address in case of delivery orders or point of sale for pickup in case of take-away orders, cart composition, name used for delivery;
  • Payment and transactional data: payment method (payment card data is not saved) and transaction data (date and time of the transaction, amount, etc.);
  • Data related to table reservation: name, surname, email, phone number, date and time of reservation, number of people;
  • Other data: information freely provided in filling out the various online forms on the Site.
• Legal basis: legitimate interest of the Data Controller (art. 6.1.f GDPR). For information on the balancing test carried out in the evaluation of legitimate interest, contact us at the contact details provided in this information notice.
• Retention period: your data will be processed for the time necessary to respond to your assistance requests. Chat conversations are retained for 6 months and then deleted.

Your personal data may be accessed by duly authorized employees, as well as external providers, appointed, if necessary, as data processors, who provide support for the provision of services, as well as law enforcement agencies, government entities, regulatory bodies, courts, or other public authorities authorized by law to the extent strictly necessary to achieve the purposes of the provision:

• Loyalty program: franchise companies of the Data Controller for the operational management of the loyalty program and Customer Care service provider;
• Purchase of products online (e-commerce take away or delivery): franchise companies of the Data Controller, our delivery partners, and IT service providers;
• Participation in prize events: our partner organizers and managers of the prize events and entities possibly associated with the prize event;
• Assistance via chat-bot: our authorized personnel or IT service provider or Customer Care service;
• Table reservation: service provider and franchise company where the reservation service is provided (as an independent data controller);
• Data related to the Curriculum Vitae sent in response to the offers in the "Work with us" section: duly authorized personnel of the Data Controller;
• Sending commercial and promotional communications: marketing office of the Data Controller and our communication service providers.

In any case, it is possible to request a complete and updated list of the entities with whom we share your data by writing a PEC email to the email address: cigierre@legalmail.it or by sending an email to the DPO at the address dpo@cigierre.com or by contacting the Data Controller through the "Contacts" form. We inform you that your data will not be disclosed beyond what is stated above.

a. Right to access personal data and the following information:

• Confirmation of whether or not personal data processing is ongoing;
• The purposes of the processing;The categories of personal data;
• The recipients or categories of recipients to whom the personal data have been or will be disclosed;
• If the data are not collected from the data subject, all available information about their source;
• The existence of automated decision-making, including profiling;
• A copy of the personal data being processed.

b. Rectification, erasure, or restriction of processing (Articles 16, 17, and 18);

c. Right to object at any time to the processing of personal data, including profiling, particularly if:

• The processing is based on the legitimate interest of the Data Controller, subject to the explicit reasons for the objection;
• The personal data are processed for direct marketing purposes;
• The processing is carried out for the sending of commercial communications and advertising or direct sales material.

Right to data portability, i.e., the right to receive in a structured, commonly used, and machine-readable format the personal data concerning you provided to a Data Controller and possibly transmit them to another data controller, provided that the processing is based on consent or a contract and is carried out by automated means. Where technically feasible, you have the right to obtain the direct transmission of data from one data controller to another.

Right to withdraw consent at any time; the data, if not based on another legal ground (including compliance with a legal obligation or performance of a contract), must be erased by the Data Controller.

Right to lodge a complaint with the Data Protection Authority, following the procedures and instructions published on the official website of the Authority www.garanteprivacy.it.

You can send your request to exercise your rights by writing an email to the following email address: dpo@cigierre.com  or by contacting the number 0432-804804 or by filling out the form in the "Contacts" section.