Privacy Statement for Consumers

This privacy statement applies to the processing of personal data of consumers who place an order on one of Winmall customers’ platforms. The data controller for processing these personal data is Mustang service srls (hereinafter referred to as “Winmall”).

Winmall is responsible for the processing of your personal data and takes your privacy seriously. Winmall therefore adheres to the requirements of the General Data Protection Regulation (GDPR) when processing personal data.

What personal data we process and why

Winmall processes your personal data because you use our services.

We use the following personal data for the following purposes. .

1. Ordering process

We process the personal data you provide to us when you place your order. These personal data are needed to execute your order, confirm your order, and to assess your order, payment, and a possible refund. The legal basis for this processing of personal data is that it is needed for the performance of a contract as defined in the GDPR. We process the following personal data in the ordering process:

Marketing messages

We also process your personal data to be able to send you (personalised) marketing messages and notifications. Such messages include the latest news, discounts, and updates about new restaurants (by email or push notification), and loyalty schemes, regardless of the format we use to share these kinds of messages (including email or push messages). The legal basis for this processing of personal data, as defined in the GDPR, is that you have consented to it when you placed an order. Whenever you want to change your preferences with respect to receiving such messages and notifications, you can unsubscribe using the link in the message in question.

We process the following personal data for marketing purposes:


And finally, we also process personal data that you submit to us indirectly. Winmall uses cookies for functional, analytical, and marketing purposes. The functional cookies are necessary for the use of the website. Cookies collect the following personal data:

Please refer to our Cookie Statement for further details about cookies.


Our website is neither intended for persons aged under 16, and nor do we intend to collect personal data of website visitors who are aged under 16. However, we are unable to verify visitors’ age. We therefore advise parents to monitor their children s online activities, so as to prevent their personal data being collected without parental consent. If you feel that we have collected personal data of a minor without consent, please send an email to

We will then proceed to erase these data.

How long we store personal data for

Winmall will not store your personal data for longer than is strictly necessary for the purposes for which your personal data were collected. We will only store your personal data for longer if we are required by law to do so. Winmall erases most of your personal data 2 years after you placed your order. We use this 2-year term for administrative purposes and to be able to deal with possible questions and complaints about your order, either from you or from restaurants. We store personal data that we use for reporting, analytical, and misuse prevention purposes for up to 20 years after you placed your order. We are unable to remove your personal data from backups. But when performing a restore from a backup, we will erase the personal data right away.

Sharing with restaurants

Winmall shares your personal data (name, address details and [telephone number,] order) with the restaurant, so that the restaurant can deliver your order. As you are a direct customer of the restaurant, the restaurant will have its own responsibility and obligations with respect to the processing of your personal data.

Sharing with others (not being restaurants)

Winmall will not sell your personal data to third parties, and we will only disclose them to third parties if necessary for the performance of our contract with you, for analytical and marketing purposes, or to comply with legal obligations.

Your personal data may be shared with the following parties:

Whenever we instruct third-party companies to process your personal data on our behalf, we will enter into a data processing agreement to guarantee the same level of protection and confidentiality of your personal data. Winmall will then continue to have ultimate responsibility for such processing operations.

Third-party websites

Our website may include links to third-party websites. When accessing such third-party websites, bear in mind that each of these websites has its own privacy statement. Although Winmall takes great care in selecting websites to link to, we cannot assume responsibility for the way in which they handle your personal data.

Personal data access, rectification, and erasure

You have the right to access all personal data we collect about you, as well as to request that we rectify or erase your personal data. If you feel that we are processing your personal data without a valid legal basis or that we are processing personal data that are not relevant for our selection process, please send an email to Winmall will respond to your request as soon as possible, and in any case no later than four weeks after receiving your request.

Tips, questions, and complaints

If you have any other questions or complaints about the processing of your personal data, we will be happy to talk to you. And we would also like to hear from you if you have tips or suggestions on how to improve our privacy policy.


Winmall takes personal data protection very seriously and we therefore take appropriate measures to protect your personal data against misuse, loss, unauthorised access, unwanted disclosure, and unauthorised alteration. If you feel that your personal data are not adequately protected or there are indications of misuse, please contact us on:

Data Protection Authority

Besides the option of lodging a complaint with us, you have the right to lodge a complaint with the relevant supervisory authority for the protection of personal data. To do so, contact the supervisory authority directly.

Contact details

Mustang Service srls:

Via Paolo Lomazzo, 1

20154 Milano (MI)