Privacy policy
We process personal data solely in accordance with the GDPR and the Austrian Data Protection Act (DSG). This policy describes which data we use and why.
Controller
The controller is the company named in the imprint. Contact for privacy requests: kontakt@imbi.at.
Data we process
Account and profile data (e-mail, name, password hash, passkeys), food-truck profiles including public contact details, inquiries to trucks, event requests (name, e-mail, event details), bookings and invitations from market managers, payment data via Mollie (we store no card data), technical log data (IP address, timestamps) and session cookies.
Purposes and legal bases
Contract performance (Art. 6(1)(b) GDPR) for account, profile and paid plans; legitimate interest (point f) for security, abuse prevention and statistics; consent (point a) for passing event requests on to matching food trucks; legal obligations (point c) for bookkeeping.
E-mails
We send transactional e-mails (registration, password, payments), booking-related messages on behalf of market managers and event requests to matching food trucks. We send promotional e-mail only with consent. Every non-transactional e-mail contains an unsubscribe link.
Recipients and processors
Hosting in Austria; payments by Mollie B.V. (EU); e-mail delivery via the configured SMTP provider; audience measurement via analytics.diedigitale.at. Processing agreements under Art. 28 GDPR exist with all processors.
Third parties in the browser
Maps use tiles from OpenStreetMap and address search uses Nominatim (OpenStreetMap Foundation). Your IP address is transmitted to these services; address search only when you trigger it actively.
Cookies
We only set technically necessary cookies (session, CSRF protection, language). No tracking cookies are set.
Retention
Account data until the account is deleted; unconfirmed event requests are deleted after 7 days, completed ones anonymised; accounting records for the statutory period (7 years, § 132 BAO); log data briefly.
Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection, and to withdraw consent. You can download your data (JSON) and delete your account yourself under “Account → Data & privacy”. Complaints may be lodged with the Austrian Data Protection Authority (www.dsb.gv.at).