^Legal

This privacy policy provides information about processing of your personal data on our website www.oetker.com.my

It also covers the following social media profiles:

Facebook Page Dr. Oetker Nona --> https://www.facebook.com/DrOetkerNona
Facebook Page Dr. Oetker Ristorante Pizza Malaysia --> https://www.facebook.com/droetkerpizzamalaysia

1. Controller

The following company is the controller for all data processing activities described below:

Dr. Oetker Nona Malaysia Sdn. Bhd.

2nd floor, 24, Lorong Perda Selatan 2,

Bandar Perda, 14000 Bukit Mertajam,

Penang, Malaysia.
Telefon: 04-502 5632
E-Mail: service@oetker.my

2. Data Protection Officer

Please do not hesitate to contact our Data Protection Officer in case of questions about processing of your personal data:

Dr. Oetker Nona Malaysia Sdn. Bhd.

2nd Floor, 24 Lorong Perda Selatan 2,

Bandar Perda, 14000 Bukit Mertajam,

Pulau Pinang, Malaysia.
E-Mail: service@oetker.my

3. Details about specific processing activities

• Event & Tours

You may sign up for events or tours through our website. We use the data provided by you through registration forms to fulfill our contract, for example, to reserve a tour for you.

Legal basis for this processing activity is the fact that data processing is necessary for performance of a contract or entering into such a contract (Art. 6 para. 1 b) GDPR). Information that is entered through mandatory fields in registration forms is necessary for participation in an event or tour (i.e. necessary to form a contract). If you do not provide this information you cannot participate in an event or tour.

• Customer retention / Advertising similar goods and services

We also use your contact data for advertising purposes in cases in which we do not need your consent to do so (for example, for advertising through mail or direct marketing for our own similar goods and services based on an existing customer relationship).

Legal basis for this processing activity is our legitimate interest (Art. 6 para. 1 f) GDPR). Our legitimate interest lies in customer care and in providing information about our products.

Please refer to section “Right to object (Art. 21 GDPR)” in particular. You may object to these processing activities at any time and free of charge, for example by contacting us via the contact details provided in the section “Controller”.

• Promotions: Raffles / Loyalty programmes / other promotions

If you take part in a promotion, we collect personal data that is required to carry out the promotion. These are marked as mandatory fields in the participation form. The legal basis for the processing of this data is Art. 6 para. 1 b) GDPR. If you do not provide this data, you will not be able to take part in the promotion.

In addition, we may collect further data that you can provide voluntarily. This processing is carried out on the legal basis of our legitimate interest (Art. 6 para. 1 f) GDPR). For example, we ask for your salutation so that we can address you as requested. Answering questions about the product purchase and the promotion itself is important to us because we derive insights and decisions about product development and maintenance from this.

We generally store participants' data for up to 6 months after the end of the promotion. There are also retention periods under tax and commercial law for the winners' data, which means that we have to store this data for longer.

As part of some promotions, we link participation in the promotion with the obligation to consent to further marketing measures (e.g. newsletter subscription) and - with your consent - may also use the data collected as part of the promotion to personalize marketing measures. In this case, your separately granted consent is the legal basis for the processing of this data (Art. 6 para. 1 a) GDPR).

We use service providers as processors (e.g. for the dispatch of goods or the processing of cashback) to carry out the promotion.

• Contacting us / feedback

You may contact us through forms or via email. We will process your data in order to reply to you. Therein also lies our legitimate interest for data processing. Legal basis for this processing activity is our legitimate interest (Art. 6 para. 1 f) GDPR).

• Contact us via Webchat

You can contact us in real time via web chat. We process your data to respond to your request. The legal basis for this is our legitimate interest (Art. 6 para. 1 f) GDPR). Our legitimate interest lies in responding appropriately to inquiries from end users or other interested parties.

· Newsletter

You may sign up for our email newsletter. We will process your data in order to send you email and to evaluate which emails you open. Legal basis for this processing activity is your consent (Art. 6 para. 1 a) GDPR). If you have consented to this, we will also personalize our newsletters using data that we have received from you in another context. For example, we can send you regional offers by e-mail if you have provided us with your address as part of a competition.

You may withdraw your consent for future processing at any time, for example, by clicking the “unsubscribe” link in one of our newsletters.

If you have consented to your email address being shared with marketing partners when ordering a newsletter, the regulations described under "(Re-)Marketing - Data exchange with third parties via email addresses or telephone numbers" also apply.

When accessing our website, we will process data in server log files. This data derives from your terminal equipment and may include personal data. In particular, we process the following data:

- The operating system of your terminal equipment

- The browser used by you (when accessing the website)

- The name of your provider

- Your IP address

- Data and time of access

- Accesses pages and search terms (if applicable)

- The website that referred you to our website (referrer; when accessing the website)

This processing activity is necessary to ensure the operation of our website to optimise the content and deliverability of our website and to provide the necessary information to public bodies in case of a cyber attack. Therein also lies our legitimate interest for data processing. Legal basis for this processing activity is our legitimate interest (Art. 6 para. 1 f) GDPR).

We regularly delete this data after 14 days, in case of misuse after administrative or legal proceedings are finished.

Our website uses cookies and similar technologies that store information on your terminal equipment or accesses such information for the following purposes:

Providing our website / app
Analytics and personalisation - Tracking
(Re-)Marketing / data sharing with third parties

In the context of this data processing, we collaborate with one or more partners with whom we have agreed on joint controllership. You can find more details in the section Cooperation/ Joint Controllership.

Providing our website

We use cookies and similar technologies to ensure certain features of our website. This is strictly necessary to provide our website / app. By doing this, we can, for example,

Save your preferred language version of our website / app or similar settings for your next visit.
Distribute requests to our website / app across multiple web servers (load balancing).
Provide a uniform context (session) to multiple requests to our website / app, in order to facilitate login-secured parts of our website or checkout / payment processes.
Save your consent regarding tracking tools and active / deactivate tracking tools according to your choice.

Our legitimate interest for these processing activities lies in the uninterrupted usability of our website and in ensuring that user interactions are actually linked to an authenticated user.

Legal basis for this processing activity is our legitimate interest (Art. 6 para. 1 f) GDPR).

We use the following products to enable the functionality of the website.

Analytics and personalisation – Tracking

We use cookies and similar technologies to evaluate user behaviour on our website and in our app and to adapt them according to this.

Provided you have given your consent, we process information on your terminal equipment and the browser you are using (in the case of the website) every time you interact with our website. For example, we can find out with which language settings you use our website, whether you use a smartphone or a desktop computer or from which country you access our website.

In addition, we process information about how you interact with our website e.g. from where you are referred to our website, how long you use our website and the path you take through individual sub-pages. For example, we can record whether you found us via a search engine (and if so, under which search term) or an advertisement, how long you spent browsing the content of a particular page and how many pages you visited in total.

We use this information to create analyses of user behaviour on our website to optimise the website accordingly. In some cases, we create several different versions of our website, which we present to individual users or user groups, and use cookies or similar technologies to evaluate which version is used by you in which way.

Legal basis for this processing activity is your consent (Art. 6 para. 1 a) GDPR. You may withdraw or change your consent for future processing at any time by changing your tracking settings. Additionally, you may change your browser settings regarding cookies and similar technologies.

We use the following products for analytics and personalisation:

Google Analytics (Website)

Google Analytics is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google processes your data on our behalf (data processor). Our configuration of Google Analytics does not allow Google to use data that is gathered through Google Analytics to improve Google products and services.

Please find more information about the cookies that are used by Google Analytics and their
respective storage periods here.

Google Firebase Analytics (App)

Google Firebase Analytics is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google processes your data on our behalf (data processor). Our configuration of Google Firebase Analytics does not allow Google to use data that is gathered through Google Firebase Analytics to improve Google products and services.

(Re-) Marketing / data sharing with parties

We use cookies and similar technologies to evaluate the reach of our advertising campaigns and how users who have become aware of our website through our advertising campaigns use our services. We also use cookies and similar technologies to record which users use our website / app in order to form groups (so-called audiences) and to address these audiences on other online platforms with personalised advertising.

We also transfer this information to third parties who may also process it for their own purposes.

If you have consented to this, we will record whether you have reached us via one of our advertising campaigns and how you then interact with our website. For example, we may record whether you have installed our app after you have seen one of our ads on the internet. We can also record which share of users who have seen an ad actually use content from our website. This enables us to better plan and control our advertising budget.

In addition, we group the users of our website / app in so-called audiences. Audiences are user groups that are put together by us according to certain criteria (e.g. all users who have accessed a category of recipes). If the users of an audience are also users of our marketing partners, we can individually address these users with advertisements (re-marketing) through our marketing partner’s platform. Information that our marketing partner has about his users in one of our audiences can also be used by him to suggest similar user groups to us for advertising.

To this end, we inform our marketing partners that you have visited our website or used our app and whether you have visited pages defined by us or have carried out other actions (e.g. registered an account). Our marketing partners may also use this information for their own purposes, for example to further personalise your profile on their own platform.

Our marketing partners are separate controllers for the data processing that they carry out for their own purposes. The marketing partner also provides you with data protection information.

We use the following products for (re-)marketing and share data with the following third parties.

Facebook Pixel (website)

Facebook Pixel is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Ireland (“Facebook”). More information about Facebook Pixel can be found here. Please also refer to the Facebook Data Policy.

Google Ads / Doubleclick (website)

Google Ads / Doubleclick is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). More information about cookies set by Google can be found here. Please also refer to the Google Privacy Policy.

YouTube Cookies are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“YouTube”). More information about cookies set by YouTube can be found here. Please also refer to the Google Privacy Policy.

Google Floodlight (website)

Google Floodlight is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). More information about cookies set by Google can be found here. Please also refer to the Google Privacy Policy.

The Trade Desk Pixel (website)

The Trade Desk Pixel is provided by The UK Trade Desk Ltd.10th Floor, 1 Bartholomew Close, London EC1A 7BL, Great Britain (“The Trade Desk”). Please also refer to The Trade Desk Privacy Policy (among other things for information about cookies storage periods) and the possibility to opt-out from data processing by The Trade Desk.

For the United Kingdom, the European Commission has issued an adequacy decision pursuant to Art. 45 GDPR. The United Kingdom thus offers an adequate level of protection for the processing of personal data.

TikTok Pixel (website)

TikTok Pixel is provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (“TikTok ”). More information about cookies set by TikTok can be found here. Please also refer to the TikTok Privacy Policy.

Microsoft Clarity (website)

Microsoft Clarity is a service of Microsoft Corporation One Microsoft Way. Redmond, Washington 98052-6399, USA ("Microsoft"). Please also note the Microsoft data protection declaration.

We transfer your personal data to the USA on the basis of your consent within the meaning of Art. 49 para. 1 a)

Facebook App Ads (App)

Facebook App Ads is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Ireland (“Facebook”). More information about Facebook App Ads can be found here. Please also refer to the Facebook Data Policy.

Cooperation/Joint Controllership

Oetker Digital

All data processing described in the section “Tracking and Cookies” is carried out jointly with our sister company Oetker Digital GmbH (Lutterstr. 14, 33617 Bielefeld, Germany). We and Oetker Digital are jointly responsible for the data processing.

We and Oetker Digital have entered into an agreement between joint controllers. In essence we agreed on the following: We are providing our website and apps (online-services). Oetker Digital uses cookies and similar technologies to evaluate user behaviour on our website and in our apps. We use this information to create analyses of user behaviour on our website and in our app and to optimise the website / app accordingly. If you declare your consent to data processing as described in the section “Tracking and Cookies”, you also declare this to Oetker Digital.

(Re)Marketing– Data sharing with third parties via email addresses / phone numbers

If you have provided us with your email address / phone number (for example, by participating in a raffle or by subscribing to our newsletter) and also consented to this, we will also use your email address / phone number to form groups (so-called audiences) and to address these audiences on other online platforms with personalised advertising.

To do this, we first create a “hashed” version of your email address / phone number. This means that we create a digital representation of your email address / telephone number. This representation (the “hash”) of your email address / phone number cannot be reconverted into the original form of your email address / phone number. For example, we convert the email address hash@oetker.com into the hash fddd90f6267d4868a33d07f3d95d7271c7385555156739628eafbed789b862b.

Your email address / phone numbers will be pseudonymised by this conversion procedure.

We share the hash of your email address / phone number with our marketing partners. If you are registered on one of marketing partners’ platforms with the same email address / phone number our respective marketing partner can identify you as a user of their platform (in order to to this, the marketing partner will compare the hash that we shared with them with hashes of the email address / phone numbers of their users that were created in the same way). In this case, you will be grouped in a marketing audience. Audiences are user groups that are created based on criteria chosen by us. This allows us to address you with personalised advertising on our marketing partner’s platform (re-marketing). Our marketing partner may also use additional information about their users who are part of one of our audiences to suggest similar audiences to us. Our marketing partners may also use this information for their own purposes, for example to further personalise your profile on their own platform.

If you are not registered on one of our marketing partners’ platforms or used a different email address / phone number the respective marketing partner will not be able to identify you.

In both cases, after a successful match and if our hash does not match the hashes of the marketing partner, the respective marketing partner will delete the hash that was submitted by us.

Legal basis for this processing activity is your consent (Art. 6 para. 1 a) GDPR. You may withdraw your consent at any time.

Our marketing partners are separate controllers for the data processing that they carry out for their own purposes. The marketing partner also provides you with data protection information.

We use the following products for (re-)marketing - data sharing with third parties via email addresses / phone numbers and share data with the following third parties.

Facebook Customer List Custom Audience

Facebook Customer List Custom Audience is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Ireland (“Facebook”). Please also refer to the Facebook Data Policy.

Facebook is based in the USA with other companies in the same group of companies (in particular Meta Platforms Inc., 1 Hacker Way Menlo Park, CA 94025, USA) and uses them as processors, so that we cannot rule out a transfer of your personal data to the USA.

Google Display & Video 360 Audience list targeting

Google Display & Video 360 Audience list targeting is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Please also refer to the Google Privacy Policy.

X List Custom Audiences

X List Custom Audiences is provided by Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland (“X”). Please also refer to the X Privacy Policy.

Pinterest Audience Targeting via Customer lists

Pinterest Audience Targeting via Customer lists is provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (“Pinterest”). Please also refer to the Pinterest Privacy Policy.

Snapchat Customer List Audiences

Snapchat Customer List Audiences is provided by Snap Group Limited, 77 Shaftesbury Avenue, London, W1D 5DU, United Kingdom (“Snapchat”). Please also refer to the Snapchat Privacy Policy.

LinkedIn lists for company and contract targeting for LinkedIn Ads

LinkedIn lists for company and contact targeting for LinkedIn Ads is provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). Please also refer to the LinkedIn Privacy Policy .

We maintain publicly accessible profiles on social networks and platforms to communicate with interested parties, customers, and users and to provide information about our products and services. The platforms we use include Facebook, Instagram, Pinterest, TikTok, X (formerly Twitter), YouTube, and Snapchat.

Please note that your personal data may be processed by the respective platform operators.
This includes, among other things, your IP address, the pages and content you visit, as well as any information you share via the platforms or provide to us through them.

Data processing is generally carried out independently by the respective platform operators and may take place outside the European Union. We have no influence on the data processing by platform operators and refer to their respective privacy policies:

Facebook & Instagram: https://www.facebook.com/privacy/explanation
Pinterest: https://policy.pinterest.com/de/privacy-policy
TikTok: https://www.tiktok.com/legal/privacy-policy
X (formerly Twitter): https://twitter.com/de/privacy
YouTube: https://policies.google.com/privacy#europeanrequirements
Snapchat: https://www.snap.com/en-US/privacy/privacy-policy

Joint Responsibility with Meta (Facebook & Instagram)

We operate a Facebook page and an Instagram profile. Facebook and Instagram are services provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta"). When using our Facebook page or Instagram profile, personal data may be processed by Meta, for which both Meta and we are jointly responsible. This joint responsibility is regulated in Facebook's "Page Insights Controller Addendum."

All key information regarding data processing on Facebook and Instagram can be found in the Facebook Data Policy and the Instagram Privacy Policy. These policies also provide details about the nature and scope of the personal data processing, as well as your rights regarding access, confirmation, rectification, deletion, restriction, data portability, and the right to lodge complaints.

The legal basis for data processing on our Facebook and Instagram profiles is the legitimate interest of both us and Meta, as well as its customers, in advertising, recommendations, insights, and measurement (Art. 6 (1) lit. f GDPR). You may object to data processing by Meta (see Facebook Data Policy and Instagram Privacy Policy).

We have no control over data processing by Meta. We do not receive any data from Meta that would allow us to identify users or analyze their behavior. Furthermore, we do not use any tools that would enable such identification or analysis.

Processing of Your Data by Us

We process the data you provide to us through these platforms (e.g., messages, comments, likes) solely for the purpose of communication with you or to handle your inquiries. The legal basis for this is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in maintaining customer relationships, handling inquiries, and providing information about our products and services.

4. Withdrawal of consent (Art. 7 para. 3 GDPR)

If processing is based on your consent (Art. 6 para. 1 a) GDPR) you may withdraw your consent for future processing at any time. You may reach us through the contact data that is provided in the”Controller” section or use options for withdrawal of consent that are described in the context of a specific processing activity.

5. Right to object (Art. 21 GDPR)

If processing is based on our legitimate interest (Art. 6 para 1 f) GDPR) you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data that concerns you. This also extends to profiling.

Where we process personal data for marketing purposes, you have the right to object at any time to processing of personal data that concerns you for such marketing. This also extends to profiling that is related to such direct marketing.