Legal

Privacy

This website sets no cookies, loads no scripts from third parties and runs no analytics. What we do collect, we list here.

Last updated: 21 October 2026

Controller

retail butlers GmbH, Fuchsweg 3/1, 5400 Hallein, Austria
FN 487656 t (Landesgericht Salzburg), VAT ID ATU73148159
Managing director: Alexey Weber
Email: office@retail-butlers.at

We are not legally required to appoint a data protection officer. For any data protection matter, write to the address above.

This website

The web server writes an access log with IP address, time, requested page, status code, referrer and browser identifier. It is used to deliver the site, keep it secure and defend against attacks. The legal basis is our legitimate interest in operating the site securely (Article 6(1)(f) GDPR). The log is deleted automatically after 14 days at the latest; after a security incident it is kept until the incident has been resolved. Fonts are served from this domain.

Where you came from

When you arrive through an advert, the link carries campaign parameters such as utm_source and utm_campaign. Your browser keeps them in local storage on this domain for 30 days, and they are sent to our own server together with a request for an account or a demo, so that we can see which advert works. They stay on this origin, they identify a campaign rather than a person, and clearing your browser data removes them.

Requests for an account or a demo

When you send the form on Start free or Request a demo, our server forwards your details by email to the person who sets up your account or runs the demo: the name and type of your place, city and country, your name, email address and phone number, your preferred time and your message. We use them to set up the account and to contact you, and apart from our email provider we pass them on to no one. Our server additionally records that a request arrived, with the plan and the campaign parameters, without your name or contact details.

The legal basis is pre-contractual steps taken at your request (Article 6(1)(b) GDPR) and your consent given with the checkbox in the form (Article 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future by writing to office@retail-butlers.at; processing carried out before the withdrawal remains lawful.

We keep the details until your request has been dealt with and delete them no later than six months after the correspondence has ended. If the request leads to a contract, the statutory retention periods apply (in particular § 132 BAO and § 212 UGB, as a rule seven years).

AI assistants at an ordering kiosk

Guests can operate a kiosk that runs OrderStation with their own AI assistant, for example Claude or ChatGPT. The kiosk shows a QR code, an address and an eight-digit code. A guest who gives these to their assistant connects it through our server (https://order-station.com/mcp) to exactly that kiosk, for one order.

For this we process the session's connection data (an identifier and the time), the venue's menu, and the content and state of the cart on the kiosk. If the guest asks their assistant to check the menu for an intolerance or a diet, the assistant passes the allergen codes or the diet to the kiosk session, which uses them to check the dishes; they are not stored with the order. We do not receive the conversation between the guest and their assistant, and no name, email address, location or card details. Payment is made with a card at the kiosk's terminal. Our web server logs the IP address and time of each request as described under "This website".

The assistant and its provider receive what our server sends to the assistant: the menu, the cart and the state of the kiosk. The guest chooses the provider, and that provider's privacy terms apply to what it receives. An order placed this way goes to the venue that runs the kiosk and is handled there like any other order.

The session exists only in our server's memory. It ends when the order is complete or the guest disconnects. A code nobody uses expires after five minutes, and a connection without activity is removed after one hour at the latest. The legal basis is the guest's request to place an order (Article 6(1)(b) GDPR) and, for an intolerance the guest names, the explicit consent given by asking for the check (Article 9(2)(a) GDPR). How to use it: Order with your AI assistant.

Your restaurant's data

Your restaurant's data, menus, orders and devices, is stored in a database that belongs to your account alone. Where it contains personal data, for example of your staff or your guests, we process it on your behalf, and we conclude a data processing agreement with you pursuant to Article 28 GDPR.

Recipients

We disclose personal data to third parties only with your consent, to meet legal obligations towards authorities, or to carefully selected processors with whom a contract pursuant to Article 28 GDPR is in place. We do not sell or rent data.

Requests from the forms reach us by email through Gmail. Google Ireland Limited processes them on our behalf. Data may be transferred to Google LLC in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework, and the transfer is additionally covered by the EU standard contractual clauses. Apart from that, your data is not transferred to countries outside the EU or EEA.

There is no automated decision-making, including profiling, within the meaning of Article 22 GDPR.

Security

We take technical and organisational measures pursuant to Article 32 GDPR to protect your data against manipulation, loss, destruction and unauthorised access. Data between your browser and our server is always encrypted with TLS (HTTPS).

Your rights

With regard to your personal data you have the right to:

• access (Article 15 GDPR)
• rectification (Article 16 GDPR)
• erasure (Article 17 GDPR), unless a statutory retention obligation prevents it
• restriction of processing (Article 18 GDPR)
• data portability (Article 20 GDPR)
• object to processing based on legitimate interest (Article 21 GDPR)
• withdraw a consent with effect for the future (Article 7(3) GDPR)

A short message to office@retail-butlers.at is enough. We may ask for suitable proof of identity. Deleting an account removes its database.

Complaints

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria, phone +43 1 52 152-0, dsb@dsb.gv.at, www.dsb.gv.at.

Changes

We update this page when the law, our service or our processing changes. The version shown here at the time of your visit applies.