1. Controller and contact details
Worklivery GmbH, Huemerstraße 23, 4020 Linz, Austria, is the controller for its own processing activities described in this notice.
If you have questions about data protection or wish to exercise your rights, you can contact us at office@worklivery.at or by telephone on +43 650 301 4121.
This notice covers our website, the Worklivery web app and our mobile apps. In particular, it explains how we process data relating to enquiries, user accounts, orders, payments and support.
If your employer uses Worklivery to manage employees and meal allowances, it determines the associated business purposes and permissions. Where we process these data on its behalf, its privacy information also applies. You can contact us in these cases as well; we will forward your request to the responsible party or assist with handling it.
2. Visiting our website
Technical connection data are processed when you access our website. These include, in particular, your IP address, the page requested, the time of access, and browser and device information. These data enable us to deliver the website, identify faults and protect against misuse.
Our website is provided using Framer B.V., Netherlands. Framer processes the data required for hosting and forms. The legal basis is our legitimate interest in a functioning and secure website under Article 6(1)(f) GDPR.
We also use Framer's integrated statistics to analyse aggregate information such as page views, visitor sources and device types. Framer describes this feature as statistics without persistent cookie identifiers. Our interest is to assess the use and clarity of our website; the legal basis is Article 6(1)(f) GDPR. These statistics are separate from the advertising measurement described below.
3. Cookies and advertising measurement
Technically necessary storage and access on your device serve, in particular, to provide requested functions and save your privacy choices. We use non-essential advertising technologies with your consent. The legal basis for the associated processing of personal data is Article 6(1)(a) GDPR.
We use the Meta Pixel from Meta Platforms Ireland Limited, Ireland, to measure our advertising. Pages visited, access times, technical browser and device information, IP addresses and identifiers may be transmitted to Meta. Meta may associate this information with an existing Facebook or Instagram account and process it to evaluate and personalise advertising.
Meta provides for joint controllership with the website operator for the collection and transmission of the relevant event data. Meta's subsequent processing is governed by its privacy terms. Further information is available in Meta's Privacy Policy and the joint controller arrangement.
You can access your choices and withdraw consent for the future through the cookie settings in the website footer. Withdrawal does not affect the lawfulness of processing carried out before it. You can use our website without consenting to advertising measurement.
Google Analytics and Google Ads
With your separate consent to the Statistics category, we use Google Analytics 4 by Google Ireland Limited, Ireland, to analyse website usage. With your consent to the Advertising category, we also load the Google Ads tag for advertising measurement. Page views, timestamps, browser and device information, cookie identifiers and technical connection data may be sent to Google. Google processes IP addresses for technical communication and approximate location; according to Google, Google Analytics does not store individual IP addresses of users in the European Economic Area.
Google tags load only after the corresponding consent. This integration does not send form field values or URL query parameters to Google Analytics. Google Signals and Google ad personalisation are disabled in this integration. The legal basis is your consent under Article 6(1)(a) GDPR. You can choose statistics and advertising separately and withdraw consent at any time through Cookie Settings in the footer. Withdrawal stops the relevant measurement and removes the corresponding Google cookies on our domain.
Google and its service providers may process data in the USA; the international transfer arrangements described in Section 9 apply. Further information is available in Google’s Privacy Policy and How Google uses data from sites and apps.
4. Contact, demos and business enquiries
When you contact us or request a demo or quotation, we process the contact and company details you provide and the content of your enquiry. Depending on the form, these include, in particular, your name, email address, telephone number, company name and number of employees. Required information is indicated in the relevant form.
We use this information to handle your enquiry and arrange the next steps you have requested. Forms are provided through Framer. We use Google Workspace for business email communication. The legal basis is Article 6(1)(b) GDPR where you are personally taking steps to enter into or perform a contract. For a company's business contacts and other enquiries, the basis is our legitimate interest in handling communications under Article 6(1)(f) GDPR.
If you voluntarily wish to book a sales call or demo with us, you can use the linked booking pages of Cal.com or Calendly. When you open these booking pages, the respective service processes technical connection information; when you make a booking, it also processes the contact and appointment details you provide there. We receive the information needed to prepare for and conduct the appointment. Alternatively, you can contact us directly by email. Further information is available in the privacy notices of Cal.com and Calendly. The legal bases are those described above for pre-contractual or business enquiries.
5. User accounts and use of the platform
For your user account, we process, in particular, your first and last name, email address, company affiliation, user identifier and permissions. We receive this information from you or from your company when it invites you to use the service or manages your account. We also process the technical data required for authentication and access protection.
This processing enables sign-in, association with your company and use of the enabled features. Where you have your own agreement to use Worklivery, the legal basis is Article 6(1)(b) GDPR. For technical security and prevention of misuse, we rely on Article 6(1)(f) GDPR. The allocation of roles explained in Section 1 applies to processing on behalf of your company.
Without the information required for accounts and order processing, we cannot provide the corresponding functions. Optional information is not required for this purpose.
6. Orders, credit and payments
For orders, we process the selected meals and options, restaurant, order time, price and fulfilment status, together with the information required to identify and deliver the order. For credit, meal allowances and payments, we process amounts, transactions and payment or invoice references.
The restaurant involved and, where applicable, the delivery partner receive the order and delivery details required to prepare, identify and hand over the order. These may include your name, the company address and contact details needed for delivery. Authorised administrators at your company receive the information required for the agreed administration of orders, allowances and billing.
Payments are handled through Stripe. Stripe processes payment, contact and transaction data for this purpose. Worklivery processes the payment references and status information needed for allocation and billing. Stripe also processes data as an independent controller for certain purposes of its own, such as statutory checks and fraud prevention. Further information is available in Stripe's Privacy Policy.
Necessary order and payment processing is carried out on the basis of Article 6(1)(b) GDPR or on behalf of the responsible company. We process legally required accounting and tax records under Article 6(1)(c) GDPR.
7. Support and notifications
We use Crisp IM SAS, France, for in-app support. Contact details needed to handle your request and the content of your messages are processed. Please provide only information that is necessary for your request. We provide contract-related support on the basis of Article 6(1)(b) GDPR; we handle other enquiries on the basis of our legitimate interest in customer support under Article 6(1)(f) GDPR.
We use Amazon Web Services Simple Email Service (AWS SES) for technical emails, for example those relating to sign-in or activities in the platform. Recipient addresses, message content and technical delivery information are processed. These messages serve to provide the requested service.
Push notifications are delivered through Google's Firebase Cloud Messaging and, on Apple devices, the Apple Push Notification Service. Technical identifiers for delivering app notifications and the necessary message content are processed for this purpose. Delivery follows the permission you grant in your device settings; you can disable push notifications there. Order-related messages serve to perform the contract under Article 6(1)(b) GDPR. Device permission alone does not constitute consent to any and all advertising.
We use a service to centrally adjust app settings. Installation identifiers and technical information are processed in particular. Our legitimate interest under Article 6(1)(f) GDPR is to provide and adjust app features reliably.
When you download an app from an app store, the respective store operator processes data under its own privacy terms.
8. Technical operations and error analysis
winkk GmbH operates our core platform. The application servers, database, storage for files and backups are hosted at OVH in Frankfurt am Main. Sentry runs on netcup infrastructure in Vienna for technical error analysis. The web app is delivered through Cloudflare. We use Microsoft Azure Blob Storage to provide publicly accessible restaurant and company logos.
Operations involve processing the account, order and content data needed for the respective functions. Delivery, access protection and error analysis generate technical connection data and error reports; these may contain user identifiers or other information about the affected activity. Accessing publicly available logos also generates technical connection data.
Processing serves to provide our services, resolve errors and protect the platform. Where we act as controller, the legal bases are Article 6(1)(b) GDPR for contractual services and Article 6(1)(f) GDPR for secure and reliable operations.
9. Recipients and processing outside the EEA
In addition to the recipients expressly named, contracted technical service providers receive the data required for their respective services. For processing on our behalf, we specify the permitted purposes and protection obligations by contract. Information required by law may also be disclosed to authorities and to appointed tax and legal advisers.
International providers such as Framer, Cloudflare, Microsoft, Google, Apple, Amazon Web Services, Stripe, Meta, Cal.com and Calendly may also process data outside the European Economic Area, particularly in the USA. A European server location alone does not rule out such processing, for example by subprocessors or support teams.
Necessary transfers to third countries require a basis under Chapter V GDPR. These include applicable adequacy decisions or the European Commission's Standard Contractual Clauses with any necessary supplementary safeguards. The EU-US Data Privacy Framework covers only transfers to recipients that are appropriately certified and covered by the decision. You can request information about the safeguards applicable to your processing, and a copy of the relevant contractual safeguards, at office@worklivery.at.
10. Retention periods
We distinguish the following purposes and deletion criteria:
Account data: for the duration of use and afterwards only to the extent that individual details are needed to conclude outstanding matters or meet legal obligations. Closing an account does not remove those obligations.
Accounting and tax records: generally seven years from the end of the relevant calendar year, where Austrian retention requirements apply, particularly Section 132 BAO and Section 212 UGB. Ongoing proceedings may require longer retention. This period does not apply indiscriminately to all profile fields or messages.
Contact and demo enquiries: until the enquiry and related follow-up questions have been resolved. Any resulting contractual documents are retained according to their own purpose.
Support communications: We delete support conversations that have not been updated for six months, unless further retention is necessary to establish, exercise or defend specific legal claims.
Technical logs and error reports: for as long as they are needed to detect and resolve errors, investigate security events or document a specific activity. Records needed separately are retained for that purpose; technical operations do not provide a basis for unlimited retention.
Consent records: to the extent necessary to demonstrate the choice given, its withdrawal and the lawfulness of processing based on it.
Backup copies are overwritten as part of the defined backup cycle. They serve recovery purposes and are not used as an active data set for new purposes. For data we process on behalf of your company, we take account of its instructions and the agreed deletion periods.
11. Your rights
Subject to the applicable legal conditions, you have the right of access, rectification, erasure, restriction of processing and data portability.
You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to processing for direct marketing at any time; this includes related profiling.
You may withdraw consent at any time with effect for the future. You can use the relevant setting or contact us at office@worklivery.at. No special form is required. Where necessary, we verify your identity to prevent disclosure to unauthorised persons.
You may lodge a complaint with a data protection supervisory authority, particularly in your place of residence or work, or where the alleged infringement occurred. In Austria, this is the Austrian Data Protection Authority, email: dsb@dsb.gv.at.
12. Protecting your data and changes to this notice
We implement technical and organisational measures appropriate to the risk. These include encrypted connections and limiting access to authorised persons.
We do not use decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. This is distinct from the advertising measurement described in Section 3.
We update this notice when our processing or the applicable requirements change. The publication date is shown alongside this notice.