Privacy Policy
Last updated: August 2026
Convenience translation. This English version is provided for information only. The legally binding version is the German Datenschutzerklärung.
Contents
- Controller and contact details
- Data protection officer
- General information
- Provision of the website and server log files
- Cookies and embedded content
- Contact via form, e-mail and telephone
- Talent pool newsletter
- Communication via WhatsApp Business
- Surveys via FormFlow
- Customer and prospect management
- Application procedure
- Talent pool: consent and anonymised candidate profiles
- Personnel questionnaire via Deftform
- Employee data, staff scheduling and time recording
- Photographs and employee profiles
- Assignment to client establishments
- Our profiles on Instagram and Facebook
- Recipients and processors
- Data transfers to third countries
- Retention period
- Your rights
- Right to object
- Right to lodge a complaint with the supervisory authority
- No automated decision-making
- Data security
- Changes to this privacy policy
1. Controller and contact details
The controller within the meaning of the General Data Protection Regulation is:
Gastro & Friends GmbH
Schneider-Ulrich-Weg 3
80999 München
Deutschland
Telephone: +49 89 48402004
E-mail: info@gastro-and-friends.de
Managing director authorised to represent the company: Andreas Freund
Register court: Amtsgericht München (Munich Local Court), HRB 306614
VAT identification number: DE269228553
2. Data protection officer
We are not legally required to appoint a data protection officer. For all questions concerning data protection and the exercise of your rights, you can reach us using the contact details set out in section 1.
3. General information
The protection of your personal data is important to us. We process personal data exclusively on the basis of the applicable statutory provisions, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
Personal data means any information by which a natural person can be identified or becomes identifiable. This policy applies to our website as well as to the processing of the data of our customers, their contact persons, our applicants and our employees.
4. Provision of the website and server log files
Each time you visit our website, information transmitted by your browser is automatically collected:
- IP address of the requesting device
- date and time of access
- name and URL of the file retrieved
- volume of data transferred
- notification of successful retrieval
- previously visited page (referrer URL)
- browser type, browser version and operating system used
Purpose: Ensuring a smooth connection setup, convenient use of the website, evaluation of system security and stability, and investigation of misuse.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free provision and the security of our website.
Retention period: Server log files are deleted as soon as they are no longer required for the purposes stated above.
Hosting: Our website is provided by HOSTINGER operations, UAB, Švitrigailos str. 34, LT-03230 Vilnius, Lithuania (company code 306308157). The website is hosted in a data centre within the European Union. A data processing agreement pursuant to Art. 28 GDPR (Data Processing Addendum) is in place with the provider. In order to provide the service, Hostinger partly uses sub-processors established in third countries; these transfers are safeguarded by standard contractual clauses of the European Commission (see section 19).
5. Cookies and embedded content
Our website is designed for data minimisation. We use no analytics, statistics or marketing cookies and do not embed any tracking services. For this reason, we do not require a consent banner.
Insofar as individual cookies are strictly necessary for the technical operation of the website, they are based on Section 25(2) no. 2 TDDDG and, for the subsequent processing, on Art. 6(1)(f) GDPR. These cookies serve exclusively to ensure the functionality of the website and are not used for evaluation purposes.
5.1 Self-hosted fonts
The fonts used on our website are loaded from our own server (self-hosted). No connection to third-party servers is established in this process, in particular not to Google Fonts. No personal data is transferred to third parties for this purpose.
5.2 Google Maps (external link)
For directions to our location, we do not use Google Maps as an embedded map; we merely link to Google Maps. Only when you actively click this link will you be redirected to the services of the Google group, where personal data (e.g. your IP address) may be processed. Google is then independently responsible for this processing; Google's privacy policy applies: https://policies.google.com/privacy. As long as you do not click the link, no data is transferred to Google.
6. Contact via form, e-mail and telephone
If you contact us via the contact form, by e-mail or by telephone, we process the data you provide: name, e-mail address, telephone number (optional), subject or reason for your enquiry (optional) and the content of your message.
Purpose: Processing your enquiry and contacting you.
Legal basis: Art. 6(1)(b) GDPR insofar as your enquiry relates to the conclusion or performance of a contract; otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in responding to enquiries.
Obligation to provide data: We require the information marked as mandatory fields (name, e-mail address and message) in order to process your enquiry. There is no statutory or contractual obligation to provide this information; however, without it we cannot respond to your enquiry.
Enquiry form in the talent pool: Via the enquiry form in the talent pool (/talent-pool/), we additionally process the profile numbers you have selected in order to assign and respond to your candidate enquiry. The legal basis and retention period correspond to the information set out above.
Note on e-mail communication: Unencrypted e-mails are sent via the internet and are not protected against access by third parties. Please do not send us particularly sensitive information by unencrypted e-mail.
Retention period: We delete your enquiry as soon as it has been conclusively dealt with and no statutory retention obligations prevent deletion, at the latest after six months. If the enquiry leads to a contractual relationship, the retention periods of six or ten years under commercial and tax law apply.
7. Talent pool newsletter
On our website you can subscribe to our talent pool newsletter. Through it, we inform you as soon as new pre-qualified candidate profiles are online in our talent pool.
Data processed: Your e-mail address and the confirmation data required for evidentiary purposes (confirmation token, time of registration and of confirmation).
Purpose: Sending the newsletter with notices of new candidate profiles.
Legal basis: Art. 6(1)(a) GDPR (consent).
Registration procedure (double opt-in): After you register, we send you an e-mail containing a confirmation link. Your registration only becomes active once you have clicked this link. This ensures that the registration actually originates from you.
Withdrawal: You may withdraw your consent at any time with effect for the future, for example via the unsubscribe link contained in every newsletter e-mail or by sending a message to the contact details set out in section 1. The lawfulness of the processing carried out up to the withdrawal remains unaffected.
Retention period: Until you withdraw your consent. After you unsubscribe, we retain the data required to demonstrate that consent was given, insofar as this is necessary to fulfil our accountability obligations.
8. Communication via WhatsApp Business
For the short-term coordination of assignments, we use WhatsApp Business. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, a company of the Meta group.
Data processed: Your mobile phone number, your profile name and profile picture where stored, the content of your messages, and connection data such as time and delivery status.
Purposes: Short-term organisational coordination of assignments, availability before and during an event, and answering queries.
Legal basis: Art. 6(1)(b) GDPR in the context of performing a contractual or employment relationship, otherwise Art. 6(1)(a) GDPR. The use of WhatsApp is always voluntary. You may at any time request to be contacted exclusively by telephone, e-mail or via our staff scheduling system, without suffering any disadvantage as a result.
Important notes:
- Message content is end-to-end encrypted. However, WhatsApp receives connection and usage data, in particular about who communicates with whom and when.
- The use of WhatsApp Business is additionally subject to WhatsApp's business-related terms of use and privacy terms. Meta may also use data from business communication for its own purposes to the extent described therein. We have no influence over this; in this respect, WhatsApp is independently responsible.
- WhatsApp belongs to the Meta group. Processing of data in third countries, in particular in the United States, cannot be ruled out; section 19 applies.
- We use WhatsApp Business exclusively on business devices or in business profiles that are separated from private contact data.
Please do not send us sickness notifications, health information, identity documents, bank details or other sensitive documents via WhatsApp. Please use e-mail, telephone or our staff scheduling system for these purposes.
Retention period: We delete message histories as soon as they are no longer required for the respective purpose, at the latest six months after completion of the assignment concerned, insofar as no retention obligations exist.
9. Surveys via FormFlow
We use the FormFlow service to conduct surveys. The data processed are name, e-mail address, telephone number and your responses.
Purpose: Evaluation to improve our services and, where applicable, subsequent contact.
Legal basis: Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.
The survey is provided via the provider's servers. A data processing agreement pursuant to Art. 28 GDPR is in place. The provider's privacy policy is available on its website.
Retention period: Until you withdraw your consent, at most 24 months after completion of the survey.
10. Customer and prospect management
For the initiation, performance and settlement of contracts, we process the data of our customers and their contact persons: name, position, contact details, and contract, assignment and billing data.
Legal basis: Art. 6(1)(b) GDPR. For contact persons of corporate customers, additionally Art. 6(1)(f) GDPR on the basis of our legitimate interest in managing the business relationship. For invoicing and record-keeping, Art. 6(1)(c) GDPR applies in conjunction with the provisions of commercial and tax law.
Retention period: Until expiry of the statutory retention periods of six or ten years pursuant to Section 257 German Commercial Code (HGB) and Section 147 German Fiscal Code (AO).
11. Application procedure
If you apply to us, we process the documents and information provided to us, in particular contact details, curriculum vitae, references, proof of qualifications and other application documents.
Purpose: Conducting the application procedure and deciding on the establishment of an employment relationship.
Legal basis: Section 26(1) BDSG and Art. 6(1)(b) GDPR. We process special categories of personal data that you voluntarily disclose on the basis of Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG or your consent.
Retention period: If no employment relationship is established, we delete your documents six months after conclusion of the procedure. This period takes into account the limitation periods for claims under the German General Equal Treatment Act (AGG). Longer storage takes place only with your consent to inclusion in our applicant pool or for as long as legal proceedings are pending.
12. Talent pool: consent and anonymised candidate profiles
On our website, we present selected candidate profiles in anonymised form ("setcards") in order to present candidates to potential clients and client establishments. Such a profile contains exclusively professional experience data (qualifications, skills, type of previous work, years of experience). In particular, the full name, address, contact details, specific previous employers and identifying dates are not published. No profile photograph is published.
Legal basis of publication: Art. 6(1)(a) GDPR (consent). We publish a profile only if the data subject has previously given us their express consent.
Consent landing page: We obtain consent via a separate landing page (/einwilligung/), the link to which we send individually to the person concerned. There we process the information required for the consent and for its evidence: name, e-mail address, telephone number (optional), the consent decisions made, a signature provided by you and, for evidentiary purposes, the time, the IP address and the exact wording of the consent. The consent is confirmed by way of a confirmation procedure (double opt-in); you subsequently receive a copy as a PDF.
CV upload: On the landing page, you upload your curriculum vitae. We use it exclusively internally to create your anonymised setcard from it; the CV itself is not published. The legal basis for this processing is the initiation or performance of the employment relationship (Section 26(1) BDSG, Art. 6(1)(b) GDPR). We store the uploaded documents and the consent records in an area separately protected against unauthorised access.
Contact: If you have additionally consented on the landing page, we will contact you about suitable assignment opportunities (by e-mail, telephone or WhatsApp). The legal basis is Art. 6(1)(a) GDPR.
Withdrawal: You may withdraw any consent at any time with effect for the future — via the withdrawal link in our confirmation e-mail or by sending a message to the contact details set out in section 1. After a withdrawal, we remove your profile from the website without undue delay. The lawfulness of the processing carried out up to the withdrawal remains unaffected.
Retention period: We store your profile and the underlying documents for as long as your consent remains in place and the cooperation requires it. After a withdrawal, we remove the profile and the documents; we retain the data required to demonstrate the consent in order to fulfil our accountability obligations.
13. Personnel questionnaire via Deftform
For the commencement of an employment relationship, we use a digital form provided by the Deftform service.
Data processed:
- Master data: name, address, date of birth, contact details, nationality
- Tax data: tax identification number, tax class, child allowance, religious affiliation
- Social security data: social security number, health insurance, employment status
- Bank details
- Information on existing employment, in particular main employment, marginal ("mini-job") and short-term employment, and student status
- further information required for payroll accounting and personnel administration
Special categories of personal data: Religious affiliation is a special category of personal data within the meaning of Art. 9(1) GDPR. We process it exclusively to fulfil our statutory obligation to withhold church tax. The legal basis is Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG. The same applies to information on a severe disability, insofar as this is required for payroll accounting, for reporting obligations or for the granting of additional leave.
Purposes: Initiation and performance of the employment relationship, payroll accounting, registration with health insurance funds, the pension insurance scheme, the employers' liability insurance association and the tax office, verification of the requirements for short-term employment, and fulfilment of statutory documentation, reporting and retention obligations.
Legal bases: Art. 6(1)(b) GDPR and Section 26(1) BDSG; Art. 6(1)(c) GDPR for compliance with legal obligations under the German Social Code Book IV (SGB IV), the German Income Tax Act (EStG), the German Minimum Wage Act (MiLoG) and the German Temporary Employment Act (AÜG); Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG; and Art. 6(1)(a) GDPR and Section 26(2) BDSG for voluntary disclosures.
The personnel questionnaire is provided via the servers of the provider Deftform. A data processing agreement pursuant to Art. 28 GDPR is in place. Further information: https://deftform.com/privacy-policy
Obligation to provide data: The information marked as mandatory fields is required in order to establish an employment relationship and to carry out payroll accounting properly. Without this information, an employment relationship cannot be established.
Retention period: For the duration of the employment relationship and thereafter in accordance with the statutory retention periods, in particular ten years for documents relevant to wage tax and up to 30 years for documents of relevance to the pension insurance scheme.
14. Employee data, staff scheduling and time recording
For the planning, dispatching and billing of staff assignments, we use the CrewBrain system. In it, we process master data, qualifications, availability, assignment times, assignment locations and billing data of our employees.
Purposes: Staff scheduling and dispatching, communication about upcoming assignments, recording and documentation of working hours, payroll accounting, and evidence of compliance with statutory requirements.
Legal basis: Section 26(1) BDSG and Art. 6(1)(b) GDPR for the performance of the employment relationship, and Art. 6(1)(c) GDPR for compliance with the record-keeping obligations under Section 17 German Minimum Wage Act (MiLoG) and Section 16(2) German Working Hours Act (ArbZG).
A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.
Recording of working hours: Working hours are recorded at the beginning and end of the assignment and confirmed by the client establishment. No further monitoring of behaviour or performance takes place.
Retention period: For the duration of the employment relationship and beyond that for the duration of the statutory retention and limitation periods. We retain working-time records for at least two years pursuant to Section 17(2) MiLoG.
15. Photographs and employee profiles
Insofar as we use photographs of our employees, for example for internal profiles in staff scheduling or for presentation to clients, this takes place exclusively on the basis of separate, voluntary consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 26(2) BDSG.
Consent may be withdrawn at any time without stating reasons and without any disadvantage to the employment relationship. After a withdrawal, we remove the photographs from our systems and records without undue delay.
16. Assignment to client establishments
In the context of temporary employment (Arbeitnehmerüberlassung), we transfer the name, contact details and the qualification information required for the assignment of our employees to the respective client establishment.
Legal basis: Art. 6(1)(b) GDPR in conjunction with Section 26(1) BDSG.
In this respect, the client establishment and we are each independent controllers. We contractually oblige our clients to use these data exclusively for carrying out the assignment, to protect them appropriately and to delete them after completion of the assignment, insofar as no statutory retention obligation exists.
Conversely, we receive from our clients the information that we require to fulfil the equal treatment principle under Section 8 German Temporary Employment Act (AÜG) and to comply with the maximum assignment duration under Section 1(1b) AÜG. This information relates to the working conditions at the client establishment and is processed exclusively for this purpose.
17. Our profiles on Instagram and Facebook
We maintain profiles on Instagram and Facebook. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.
When you visit or interact with our profiles, Meta processes your data on its own responsibility in accordance with its own privacy terms. We have no influence over the nature and scope of this processing.
Joint controllership: For the collection and processing of data in the context of so-called Page Insights, we are jointly responsible with Meta. Page Insights are aggregated statistics on how users interact with our profiles. The basis is the agreement on joint controllership pursuant to Art. 26 GDPR provided by Meta. In it, Meta has assumed the essential obligations under the GDPR for this processing, in particular informing data subjects and enabling the exercise of their rights.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in our public presence, the recruitment of employees and communication with interested parties.
You may exercise your rights both against us and directly against Meta. Since Meta has direct access to the data, we recommend contacting Meta directly.
If you contact us via the messaging function of these platforms, we process your message in order to respond to your enquiry on the basis of Art. 6(1)(b) or (f) GDPR. For confidential matters, please use e-mail or telephone.
The links to our profiles on this website are simple links. No data is transferred to the platforms before you click the link.
18. Recipients and processors
We disclose data only where a legal basis permits this, where it is necessary for the performance of a contract, or where you have consented. Recipients may include:
- IT service providers for hosting, maintenance and software provision
- providers of the systems we use for staff scheduling, forms and communication
- payroll service providers
- tax advisors and auditors
- banks and payment service providers
- health insurance funds, the pension insurance scheme, the employers' liability insurance association, tax authorities and customs in the context of statutory obligations and audits
- client establishments in the context of temporary employment
- lawyers, courts and debt collection service providers for the assertion or defence of claims
We have concluded data processing agreements pursuant to Art. 28 GDPR with all service providers that process personal data on our behalf.
19. Data transfers to third countries
Personal data is transferred to countries outside the European Union and the European Economic Area only insofar as this is necessary for the performance of a contract, is required by law, or you have consented.
When using services of the Meta group, in particular WhatsApp, Instagram and Facebook, processing in the United States cannot be ruled out.
Our hosting provider Hostinger (HOSTINGER operations, UAB) also uses sub-processors established in the United States and other third countries (including Cloudflare, Proofpoint and MailChannels). Insofar as personal data is transferred to a third country in this context, this takes place on the basis of the standard contractual clauses of the European Commission pursuant to Art. 46(2)(c) GDPR.
Insofar as a transfer takes place, we base it on an adequacy decision of the European Commission pursuant to Art. 45 GDPR, in particular for providers certified under the EU-US Data Privacy Framework, or on standard contractual clauses of the European Commission pursuant to Art. 46(2)(c) GDPR together with supplementary safeguards. You may request a copy of the safeguards via the contact details set out in section 1.
20. Retention period
We store personal data only for as long as is necessary for the respective purposes or as statutory retention periods require. The specific periods are stated for the respective processing operations. Once the purpose no longer applies and the periods have expired, the data is deleted or anonymised.
21. Your rights
You have the right to:
- access to the data stored about you (Art. 15 GDPR)
- rectification of inaccurate or incomplete data (Art. 16 GDPR)
- erasure of your data, insofar as no statutory retention obligations prevent this (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- withdrawal of consent given with effect for the future (Art. 7(3) GDPR)
- objection to certain processing operations (Art. 21 GDPR, see section 22)
- lodge a complaint with a supervisory authority (Art. 77 GDPR, see section 23)
To exercise your rights, please contact us using the contact details set out in section 1. Exercising your rights is free of charge for you.
22. Right to object
Information about your right to object under Art. 21 GDPR
You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR.
We will then no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where your personal data is processed for direct marketing purposes, you have the right to object at any time to such processing. After an objection, we will no longer use your data for direct marketing purposes.
The objection is not subject to any formal requirements and may be addressed to the contact details set out in section 1.
23. Right to lodge a complaint with the supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The supervisory authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority)
Promenade 18
91522 Ansbach
Telephone: +49 981 180093-0
E-mail: poststelle@lda.bayern.de
Website: https://www.lda.bayern.de
You may also contact the supervisory authority of your habitual residence or place of work.
24. No automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Decisions on hiring and assignment allocation are made exclusively by humans.
25. Data security
Our website uses SSL or TLS encryption. You can recognise this by the character string ""https://" in the address bar of your browser and by the padlock symbol. In addition, we take appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access. Our measures are regularly reviewed and adapted to the state of the art.
26. Changes to this privacy policy
We reserve the right to amend this privacy policy so that it complies with current legal requirements or to implement changes to our services. The version current at the time will apply to your next visit.