Website Privacy Policy

The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

You will find detailed information in the following sections of this Privacy Policy. The date of the last update is shown at the top of the page and in the section “Status and changes to this Privacy Policy”.

This Privacy Policy applies to our website citychickennhas.de. Our order portal at citychickennhas.de/bestellen, our “Nhas City Chicken” app and your customer account are covered by the Privacy Policy for your customer account, the app and online ordering. We also list the cookies and storage entries of the order portal in the overview in section 5, so that you can find all entries on our domain in one place. Other applications and systems of our company, such as the supplier portal, are covered by separate privacy information that is available in the respective application.

The controller responsible for data processing on this website is Nhas Food 1993 GmbH, represented by its managing director Nesrin Nhas, Südwestkorso 14, 12161 Berlin, Germany, e-mail media@citychicken-nhas.de.

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data (e.g. names, e-mail addresses or similar). Where we are responsible jointly with others, we say so in the relevant section (sections 6, 7 and 11).

We have appointed a data protection officer. You can reach Richard Heyne at c/o Nhas Food 1993 GmbH, Südwestkorso 14, 12161 Berlin, Germany, or by e-mail at r.heyne@citychicken-nhas.de.

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel receives requests in the data centre of its worldwide network that is closest to you and decrypts them there; for visitors from Germany, this is usually a data centre in the EU. Vercel may carry out preliminary steps when a page is requested, such as redirecting you to your language version, in that data centre; we run server-side processing – for example of form requests – in the Frankfurt am Main region (EU). When you visit the website, Vercel, as our processor, records technically necessary server log files that your browser transmits automatically – in particular the IP address, the date and time of access, the page requested, the referrer URL and information about your browser and operating system. The log files are only stored for as long as is necessary for the secure and stable operation of the website and are deleted after 30 days at the latest.

In these server logs, we also record when your browser reports that it has blocked content because of our security policy (Content Security Policy), with details of the page concerned and the blocked source.

The legal basis is our legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR). We have a data processing agreement with Vercel (Art. 28 GDPR). As Vercel is a US company, processing of data in the USA (e.g. for support and administration) cannot be ruled out; such a transfer to a third country is safeguarded by Vercel’s certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, in addition, by the EU standard contractual clauses (Art. 46 GDPR).

We also run our order portal on Vercel; the details are set out in the Privacy Policy for your customer account, the app and online ordering.

Our website uses a cookie banner with three categories: Necessary (technically required, always active), Statistics (audience measurement with Google Analytics 4, section 10) and Marketing (measuring and optimising our advertising with the Meta Pixel and Google Ads conversion tracking, sections 11 and 12). Cookies are small text files that are stored on your device; entries in your browser’s local storage work in a similar way. You will find all cookies and entries on our domain in section 5.

We set and read cookies and similar entries without consent if they are strictly necessary for us to provide a service you have expressly requested – for example to store your cookie choice, your language choice or your sign-in to the order portal (§ 25 Abs. 2 Nr. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). Insofar as we process personal data in doing so, we rely on Art. 6(1)(b) GDPR where this is necessary for the use of your customer account or for your order, and otherwise on our legitimate interest in a functioning and secure website (Art. 6(1)(f) GDPR). We only use the services in the Statistics and Marketing categories on the basis of your consent (§ 25 Abs. 1 TDDDG, Art. 6(1)(a) GDPR).

Before you give your consent, we do not load any scripts from Google or other statistics and marketing providers; in addition, Google Consent Mode v2 initially sets all categories requiring consent to “denied”. We store your decision in the cookie nhas_consent (lifetime one year). You can withdraw or change it at any time with effect for the future via the “Cookie settings” link in the footer; this does not affect the lawfulness of the processing carried out before the withdrawal. If you withdraw your consent, we also delete the cookies of the category concerned that are stored under our domain (section 5) and reload the page once; you can delete cookies that Google or Meta have set under their own domains in your browser settings.

If you are under 16, please choose only the necessary cookies.

On the pages of our order portal at citychickennhas.de/bestellen and on the pages with our terms and conditions (citychickennhas.de/agb), with the Privacy Policy for your customer account, the app and online ordering (citychickennhas.de/datenschutz/kundenkonto) and with the accessibility information (citychickennhas.de/barrierefreiheit), in all language versions, we load neither Google Tag Manager nor Google Analytics, Google Ads or the Meta Pixel, even if you have given your consent. We deliver the PDF files linked from the pages with our legal texts through our interface at nhascitychicken.app; section 13.1 of the Privacy Policy for your customer account, the app and online ordering explains what is processed in the process.

The following overview lists all cookies and entries in your browser’s local storage that occur on citychickennhas.de, including our order portal at citychickennhas.de/bestellen, with their purpose, provider, lifetime, category and legal basis. The entries of the order portal are only created if you use the order portal, and Stripe’s cookies only on its checkout page. We only set statistics and marketing cookies after you have given your consent; we do not load statistics or marketing services on the pages listed in section 4.

Once you have consented to the “Marketing” category, Google and Meta may also set or read cookies under their own domains, for example if you are signed in there; the privacy notices of these providers apply to this. Klarna sets its own cookies on its own page if you pay with Klarna in the order portal; Klarna’s privacy policy applies to this.

You can change your choice for statistics and marketing via the “Cookie settings” link in the footer (section 4). You can also set your browser to block cookies in general or in individual cases and delete stored entries at any time; without the necessary entries, some functions, such as signing in to the order portal, no longer work as usual.

At citychickennhas.de/bestellen, we run an order portal in which you can book time slots for our restaurant in Cologne, pre-order food and pay in advance. It uses the same customer accounts as our “Nhas City Chicken” app. All processing in the order portal and in your customer account is covered by the Privacy Policy for your customer account, the app and online ordering. Your contracting party for a booking is the operating company of the restaurant, in Cologne MOG Gastro GmbH; we are jointly responsible with it for your bookings.

If you are signed in to the order portal, the top of this website shows an account icon with your profile picture or your initials. When you open it, it takes you to your orders, your profile and signing out. For this, the website checks whether the cookie bp_present, which only contains the value “1”, is set in your browser and only then requests your initials and your profile picture from our server; your browser sends the order portal’s sign-in cookie with this request; scripts on this website cannot read that cookie. Our server keeps this information in its working memory for about one minute. We only show it to you and do not pass it on to Google or Meta. If you go from the order portal to another page of this website, your browser only transmits our domain as the origin, not the address of the page in the order portal. If you sign out via the account icon, we also delete your basket in this browser. The legal basis is § 25 Abs. 2 Nr. 2 TDDDG for reading the cookies and Art. 6(1)(b) GDPR for showing your details as part of your customer account.

On our website, we offer several forms: the general contact form (for matters such as press, social media, feedback or business enquiries), the separate route “Problem with an order”, the franchise application form and the form for landlords of commercial premises. If you use one of these forms or contact us by e-mail, we process the data you provide (e.g. name, e-mail address, telephone number if applicable, your message and the additional details requested depending on the matter – for example the preferred city and equity capital for franchise enquiries, the address and details of the premises for landlord enquiries, or the order or invoice number, branch, date and time of the order, ordering channel, type of problem, desired solution and – if stated – amount and payment method for enquiries about an order) in order to handle and answer your enquiry.

If your enquiry concerns a booking made via our app or our order portal, we handle it jointly with the operating company of the restaurant booked, in Cologne with MOG Gastro GmbH; the information in the Privacy Policy for your customer account, the app and online ordering also applies to this.

After you have submitted the form, you will receive an automatic confirmation of receipt by e-mail at the address you provided; it contains a copy of your details. For franchise and landlord enquiries, you will also receive an automatically sent e-mail with information about the next steps shortly afterwards. It is generated from the mailbox in which your enquiry was received; this mailbox is operated by IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) as our processor (Art. 28 GDPR). Your data is not stored beyond this for the purpose of this e-mail.

Our mailboxes and the sending of our e-mails are operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, as our processor (Art. 28 GDPR); for the mailboxes under citychicken-nhas.de, it uses Microsoft 365 of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a sub-processor. The transmission is encrypted in transit. Processing by Microsoft Corporation in the USA is possible; it is safeguarded by Microsoft’s certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, in addition, by the EU standard contractual clauses (Art. 46 GDPR).

To protect against misuse, we also briefly process your IP address when you submit a form in order to detect automated requests and to limit the number of requests per sender (rate limiting, honeypot field). The legal basis for this is our legitimate interest in preventing spam and misuse (Art. 6(1)(f) GDPR); your IP address is not stored permanently for this purpose.

If a form rejects an e-mail address you entered as invalid, we record the entry in the server logs at Vercel (section 3). This allows us to check whether our validation wrongly rejects valid addresses; the entries are deleted together with the logs. The legal basis is our legitimate interest in forms that work reliably (Art. 6(1)(f) GDPR).

The legal basis for processing your enquiry is Art. 6(1)(b) GDPR if your enquiry is aimed at entering into or performing a contract (e.g. a franchise partnership or an offer of premises), and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

We store this data until your enquiry has been dealt with in full, unless statutory retention obligations (e.g. under commercial or tax law) prevent this. The data is then deleted.

For our job advertisements and the application process, we use the join.com service of JOIN Solutions AG. If you apply via a job link, you will be forwarded to the join.com platform; the application data you enter there is processed by join.com on our behalf and made available to us.

You can also send us unsolicited applications by e-mail to jobs@citychicken-nhas.de. We process these applications in our mailbox (section 7) under the same rules as applications via join.com.

The legal basis for processing application data is Art. 6(1)(b) GDPR, because the processing is necessary for steps taken at your request prior to entering into an employment relationship. If you are not hired, we delete your application data no later than six months after the end of the application process, unless you have consented to longer storage. The privacy notices of join.com also apply.

On this website, we link to videos of our channel on the YouTube platform (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The preview images shown on our website are loaded from our own servers; YouTube content is not embedded directly in the website. When you simply visit our website, no data is therefore transmitted to YouTube.

Only when you click on a video link do you leave our website, and YouTube processes your data (e.g. IP address, possibly linking it to your Google account) under its own responsibility; data may be transferred to the USA in the process. Google is certified under the EU-U.S. Data Privacy Framework. The links are based on your own action and our legitimate interest in presenting our content (Art. 6(1)(f) GDPR).

For audience measurement (“Statistics” category), we use Google Analytics 4, which we integrate via Google Tag Manager (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Tag Manager and Google Analytics are only loaded after you have consented to a category requiring consent (“Statistics” or “Marketing”). Before you give your consent, no script at all is loaded from Google servers, so your IP address is not transmitted to Google either.

We use Google Consent Mode v2: before you give your consent, all categories requiring consent are set to “denied” by default, so that no analytics or marketing cookies are set and no personal data is transmitted to Google. After you have given your consent, a connection to Google servers may be established, and data may be transferred to the USA; Google is certified under the EU-U.S. Data Privacy Framework. The event data collected in Google Analytics is automatically deleted after 14 months.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25 Abs. 1 TDDDG), which you can withdraw at any time with effect for the future via the “Cookie settings” link in the footer.

To measure and optimise our adverts (“Marketing” category), we use the Meta Pixel (provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). The Meta Pixel is integrated via Google Tag Manager and only loaded after you have consented to the “Marketing” category. Before you give your consent, no script is loaded from Meta servers and your IP address is not transmitted to Meta.

After you have given your consent, the Meta Pixel sets cookies (in particular _fbp, possibly _fbc) and transmits event data such as pages visited and actions taken (e.g. clicking on a job application link) to Meta. Meta may link this data to your Meta account and use it for its own advertising purposes. We are jointly responsible with Meta for collecting and transmitting this data (Art. 26 GDPR); this is governed by the Meta Controller Addendum (se abre en una pestaña nueva). Data may be transferred to the USA in the process; Meta is certified under the EU-U.S. Data Privacy Framework.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25 Abs. 1 TDDDG), which you can withdraw at any time with effect for the future via the “Cookie settings” link in the footer.

To measure the success of our Google adverts (“Marketing” category), we use Google Ads conversion tracking (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The associated Google tag is integrated via Google Tag Manager and only loaded after you have consented to the “Marketing” category. Before you give your consent, none of your data is transmitted to Google Ads.

After you have given your consent, Google Ads may set cookies (in particular _gcl_au) and evaluate whether you have carried out certain actions on the website after clicking on one of our adverts (e.g. opening the jobs page or clicking on an order link). Data may be transferred to the USA in the process; Google is certified under the EU-U.S. Data Privacy Framework.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25 Abs. 1 TDDDG), which you can withdraw at any time with effect for the future via the “Cookie settings” link in the footer.

On our website, we link to our profiles on social networks, namely on Instagram and Facebook (both Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland), TikTok and YouTube. These are simple links – we do not embed any content from these networks directly in our website; the videos and images shown on the website are loaded from our own servers.

Only when you click on such a link do you leave our website; from that point on, the respective provider processes your data (e.g. IP address, possibly linking it to your account there) under its own responsibility, and data may be transferred to the USA. The privacy notices of the respective provider apply. The links are based on our legitimate interest in presenting our offer (Art. 6(1)(f) GDPR).

Using the “Order now” button, you choose a branch. For our restaurant in Cologne, you go to our own order portal (section 6). For our other branches, we forward you to an external ordering system of a third-party provider (citychickennahas1993.online-karte.com (se abre en una pestaña nueva)). We also link to our recruitment partner join.com and, in our news articles, to press reports and other websites, such as the voting page of the Uber Eats Awards. On our location pages, you will also find links to route planning with Google Maps (Google Ireland Limited); no map view is embedded in our website.

When you open an external page, your browser transmits technical data to the provider there, such as your IP address and information about your browser and, depending on the link, also our domain as the origin. The respective provider is responsible for the processing of data on the external pages; its privacy policy applies. The forwarding is in each case based on your own action (clicking on the link) and on our legitimate interest in offering ways to order, have food delivered and find your way to us and in providing further information (Art. 6(1)(f) GDPR).

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the browser’s address bar begins with “https://”.

In addition, we take technical and organisational measures in line with the state of the art (Art. 32 GDPR) to protect your data – including up-to-date security headers in the browser, not using external fonts, loading external scripts only after your consent (with the exception of Stripe’s payment module on the checkout page of the order portal), mechanisms against misuse of forms and the principle of not including names, contact details or order numbers in analytics and advertising events. We continuously review and improve these measures.

You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data (Art. 15 GDPR). You also have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).

If you have given your consent to data processing, you can withdraw it at any time for the future (Art. 7(3) GDPR). This does not affect the lawfulness of the processing carried out before the withdrawal.

Irrespective of this, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, phone +49 30 13889-0, e-mail mailbox@datenschutz-berlin.de, www.datenschutz-berlin.de (se abre en una pestaña nueva).

You can contact us at any time about this and any other questions on data protection.

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If your personal data is processed for direct marketing purposes, you have the right to object at any time to such processing; this also applies to profiling to the extent that it is related to such direct marketing.

An informal message to media@citychicken-nhas.de or to our data protection officer (r.heyne@citychicken-nhas.de) is sufficient for your objection.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on this website.

You are not required by law or contract to provide your personal data. However, some form fields are marked as mandatory because we cannot handle your enquiry without them – for example the e-mail address in the contact form or, for an enquiry about an order, the branch and the date and time of the order, without which the matter cannot be traced in the store. If you do not provide this information, the form cannot be submitted; instead, you can write to us informally by e-mail at any time. You can use the website itself without providing any personal data. Your customer account and your bookings in the order portal are covered by the information in the Privacy Policy for your customer account, the app and online ordering.

This Privacy Policy is up to date as of the date shown at the top of the page. We adapt it as soon as the legal situation or our data processing changes – for example when we introduce new services or functions. The current version published on this page applies to each of your visits.

You can request earlier versions of this Privacy Policy by e-mail to media@citychicken-nhas.de.