Orange Octopus GmbH
Effective Date: 18.03.2026
This Privacy Policy describes how Orange Octopus GmbH, Am Gassl 1b, 82205 Gilching, Germany, processes personal data when customers visit the website www.pizzaorangeoctopus.com, create an account, place orders or interact with our services. We comply with all applicable data protection laws, including the General Data Protection Regulation (GDPR) and the Bundesdatenschutzgesetz (BDSG). This Policy applies to all website visitors, customers, account holders, newsletter subscribers and recipients of promotional messages such as SMS reminders and vouchers.
The responsible entity for all data processed through this website is Orange Octopus GmbH. When a customer places an order, the data required to prepare and deliver the food is transferred to the store that fulfils the order. These store operators, many of whom are independent franchise or operator partners, act as joint controllers for order-related data and use such data strictly for fulfilment and service purposes.
We process information that customers provide voluntarily, such as name, address, telephone number, email address, order details, customer notes, account credentials, and marketing preferences. We also process certain technical information automatically when the website is used. This includes the customer’s IP address, browser and device information, session identifiers, and other technical data required for security and functionality. In addition, we process analytics and tracking data provided by our integrated systems, including Google tools and Deliverect, which may record interactions with the website, the ordering process and checkout functions. Payment data is processed exclusively through our payment partners and is not stored by Orange Octopus GmbH.
Personal data is processed to enable customers to place orders, receive confirmations, communicate with stores, and obtain deliveries. Data is also used to manage customer accounts, provide order history, store preferred addresses, and respond to enquiries. With the customer’s consent, we process data for newsletters, promotional messages, vouchers, SMS reminders and other marketing communication. Technical and analytics data is processed to operate, maintain and optimise the website, ensure system security, prevent misuse, detect fraud and improve overall performance.
We process personal data when it is necessary for performing a contract with the customer, including order handling, delivery and account management. We also process data where we have a legitimate interest in operating a stable, secure and functional website, preventing misuse and optimising user experience. For marketing communications, analytics technologies and cookies that are not essential for website operation, we rely on the customer’s explicit consent. In certain cases, data may also be processed to comply with legal obligations, such as accounting or tax requirements.
To fulfil an order, customer data is transmitted to the store selected during checkout. This includes contact details and order information required to prepare and deliver the food. Independently operated stores are instructed to use this data only for fulfilling the order and for handling complaints or enquiries directly related to that order. We also use external service providers to support technical operations, including hosting, analytics, email distribution, SMS messaging, payment processing and online order management. These partners act under strict contractual agreements and comply with GDPR requirements. Personal data may also be disclosed to authorities where legally required. We do not sell customer data under any circumstances.Cookies may be stored on a user’s device for different periods. Some cookies are session-based and expire when the browser is closed. Others are persistent and remain stored until they reach their programmed expiry date or until the user deletes them manually. Analytics and marketing cookies may remain active for longer periods, depending on the settings of the technology provider. Users may delete all cookies at any time via their browser settings, although doing so may limit the functionality of the website.
The website uses cookies and similar technologies. Essential cookies are required for core website functions such as ordering, checkout, address storage, session management and security. Analytics and marketing cookies are used only with the customer’s consent and help us understand how the website is used and how well our promotions perform. Google Analytics, Google Tag Manager and other tools may process anonymised or pseudonymised information, which we use to improve our service. Details regarding these technologies are provided separately in our Cookie Policy.
Online payments are processed through Deliverect and their integrated payment partners. Orange Octopus GmbH does not store full card numbers or payment credentials. Payment providers may handle billing information, transaction verification and fraud prevention measures under their respective privacy policies and GDPR frameworks. Where an order is rejected by a store, the responsibility for issuing a refund lies with the store that received the payment.
Customers may choose to receive marketing communications such as newsletters, SMS reminders, promotional messages and voucher notifications. These communications are sent only after the customer has provided valid consent, and customers may withdraw their consent at any time through the unsubscribe link or by contacting us. Withdrawing consent does not affect the lawfulness of data processed before the withdrawal.
Personal data is stored only for as long as necessary for the purposes for which it was collected. Order-related data is retained in accordance with tax and legal obligations. Customer account data is retained for as long as the account remains active. Marketing and newsletter data is retained until the customer withdraws consent. Technical and security logs are stored for a limited time as required to ensure system integrity. Customers may request account deletion at any time, after which the account and its associated personal data will be removed unless legal requirements mandate continued retention.
Under GDPR, customers have the right to request access to their personal data, correct inaccurate information, request deletion where legally permissible, restrict processing, object to processing based on legitimate interest, and receive their data in a portable format. Where we rely on consent, customers may withdraw their consent at any time. Requests regarding data protection should be sent to info@pizzaorangeoctopus.com. We respond to all requests in accordance with legal timelines.
We implement appropriate technical and organisational measures to protect personal data. These measures include encrypted data transmission, secure hosting environments, controlled access rights, monitoring of system activity and adherence to industry-standard security practices. While no system can guarantee absolute security, we continually update and review our measures to maintain a high level of protection.
When placing an order, the customer’s personal data is shared with the store responsible for preparing and delivering the order. These stores may be independently operated businesses under the Orange Octopus franchise or operator model. Each operator is responsible for handling the order, delivery and any subsequent customer enquiries or complaints. Orange Octopus GmbH remains responsible for the processing of data collected directly through the website but does not control the day-to-day operations of independently operated stores.
Some service providers, including Google, may process data outside the European Union. Wherever such transfers occur, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses, adequacy decisions or equivalent data protection measures, to maintain GDPR compliance.
Our website and services are not directed at individuals under the age of 16. We do not knowingly collect data from minors without the necessary legal consent. If we become aware that a minor has provided personal data, we will take appropriate steps to delete such data.
We may update this Privacy Policy from time to time to reflect legal changes or improvements to our service. The latest version is always available on our website. Continued use of the website after changes implies acceptance of the updated Policy.
All questions or concerns relating to this Privacy Policy or the processing of personal data may be directed to:
Orange Octopus GmbH
Am Gassl 1b
82205 Gilching
Germany
Email: info@pizzaorangeoctopus.com