Privacy Policy

Controller

Company: KARGA CONSULTANCY LIMITED
Address: 71-75 Shelton Street, Covent Garden, WC2H 9JQ London, United Kingdom
Email: info@gastrologic.co
Company number: 15311819
Registrar: Companies House (England and Wales)

Basic principle

This website mainly collects personal data where you provide it to us yourself: in the forms. There are no user accounts and no registration. We only analyse how you use the website with Microsoft Clarity and Google Analytics if you allow the “Statistics” category in the cookie notice. We only measure the success of our ads with Google Ads and LinkedIn if you allow the “Marketing” category.

The sections below describe each processing operation separately: which fields are collected, on what legal basis this happens and how long the details are kept.

Applicable data protection law

The controller is the company named above, which is established in the United Kingdom. The UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, therefore apply.

Because this website is directed at businesses and individuals in the European Union and offers them our services, the EU General Data Protection Regulation (EU GDPR) also applies under Art. 3(2) EU GDPR.

The article references in this policy refer to the EU GDPR. The UK GDPR covers the same points under the same article numbers.

Where we have appointed a representative in the EU under Art. 27 EU GDPR, their contact details are given above under “Controller”.

Forms on this website

Three forms, plus the technical details stored with every submission.

PoC request (demo form): We collect: company name, first name and surname, email address, telephone number, position in the company, country, city, industry segment, number of employees, number of warehouses, software currently in use, the modules you are interested in, your preferred start date and your message. The legal basis is Art. 6(1)(b) EU GDPR for taking steps at your request prior to entering into a contract, and Art. 6(1)(a) EU GDPR for the consent you give by ticking the checkbox in the form. The details on segment, number of employees and warehouses, software in use and modules help us prepare for the conversation; you can also send the request without them, the conversation will simply take longer. Requests that do not lead to a contractual relationship are anonymised 24 months after the last contact: name, email address and telephone number are removed, and the statistical details are kept without any personal reference.
Contact form and callback request: We collect: name, email address, telephone number, company, your message and, for a callback request, also the time at which you would like us to call. The legal basis is Art. 6(1)(b) EU GDPR for handling and answering your enquiry, and Art. 6(1)(a) EU GDPR for the consent you have given. These enquiries are also anonymised 24 months after the last contact, unless they lead to a contractual relationship.
Newsletter: For the newsletter we store only your email address. Sign-up uses a double opt-in procedure: after you register, you receive an email with a confirmation link. Until you have clicked that link, we send no further messages to that address. The legal basis is Art. 6(1)(a) EU GDPR. Every newsletter contains an unsubscribe link that lets you unsubscribe with a single click; your address is then deleted from the mailing list.
Protection against automated submissions: To protect the forms against automated abuse, we evaluate how long it took to fill them in and check an additional field that is invisible to people and is only filled in by programs. This evaluation is automated, serves solely to distinguish between humans and machines, is not submitted for human review and has no legal effect on you. The legal basis is Art. 6(1)(f) EU GDPR, our legitimate interest in forms that work properly.
IP address and browser details: Your IP address is not stored in plain text when you submit a form. We store only a cryptographic checksum (hash) of the address, which cannot be converted back into the original address and therefore cannot be attributed to any person. It is used to detect repeated automated submissions. The browser identifier (user agent) is stored in shortened form. The legal basis is Art. 6(1)(f) EU GDPR.
Record of your consent: Together with your consent, we store a checksum (hash) of the consent text in exactly the version that was displayed to you when you submitted the form, along with the time of submission. This allows us to demonstrate later what you agreed to, even if the text on the website has since changed. The legal basis is Art. 6(1)(c) EU GDPR in conjunction with the obligation to demonstrate consent under Art. 7(1) EU GDPR.
Origin of the enquiry: With a form submission we store the page on which your visit began, the website you came from (its address only, for example a search engine or an AI assistant) and, where present, the campaign details in the link (UTM parameters). This shows us which channels lead to enquiries. These details are stored only together with your enquiry and are anonymised with it. The legal basis is Art. 6(1)(f) EU GDPR.

Audience measurement

We use Plausible Analytics for audience measurement. Plausible does not set cookies, does not assign a cross-device identifier and does not collect personal data. It measures aggregated figures such as pages viewed, referring source, country of origin and device type.

The data is processed on servers within the European Union. It is not possible to identify individual visitors, and no visitor profile is created.

For this reason we do not ask for consent to audience measurement: no information is stored on or read from your device, and no personal data is processed.

Microsoft Clarity (statistics, only with consent)

If you allow the “Statistics” category in the cookie notice or choose “Accept all”, we use Microsoft Clarity to understand how the website is used and where it needs to improve. Clarity records mouse movements, clicks, scrolling and the pages viewed, creates heatmaps and recordings of individual visits, and processes details of your device and browser, your approximate location and your IP address. Entries in form fields are not captured; the forms on this website are fully masked for Clarity.

The legal basis is your consent under Art. 6(1)(a) EU GDPR; storing and reading cookies is additionally governed by the national rules implementing the ePrivacy Directive and, in the United Kingdom, by PECR. Without consent to the “Statistics” category Clarity is not loaded. You can withdraw your consent at any time via “Cookie settings” at the bottom of every page; this does not affect the lawfulness of processing carried out before the withdrawal.

For users in the EU the provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Under the Clarity terms of use Microsoft processes the data as an independent controller and may also use it for its own purposes, such as improving its services and for advertising. We have declined sharing with Microsoft Advertising. The data is stored in the Microsoft cloud (Azure) and may be transferred to Microsoft Corporation in the USA; Microsoft is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition.

Recordings are kept for 30 days, selected recordings and heatmaps for up to nine months. More information is available in Microsoft's privacy statement at privacy.microsoft.com.

Google Tag Manager

We embed the services described below, Google Analytics, Google Ads and the LinkedIn Insight Tag, via Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager manages these services; it is only loaded once you allow at least one of the categories “Statistics” or “Marketing” in the cookie notice, and it then only loads the services you have consented to. Tag Manager itself does not set cookies; when it loads, your IP address is transmitted to Google.

The legal basis is your consent under Art. 6(1)(a) EU GDPR; storing and reading information on your device is additionally governed by the national rules implementing the ePrivacy Directive and, in the United Kingdom, by PECR. The data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition.

You can withdraw your consent or limit it to one category at any time via “Cookie settings” at the bottom of every page; this does not affect the lawfulness of processing carried out before the withdrawal. This applies to all of the following services.

Google Analytics 4 (statistics, only with consent)

If you allow the “Statistics” category, we use Google Analytics 4 to understand how visitors find and use the website. It records, among other things, the pages viewed, time spent, clicks and other interactions, the referring source, details of device and browser, and the approximate location. For visits from the EU your IP address is shortened and not stored in Google Analytics; it is only used to determine the approximate location. Form entries are not transmitted.

Google Analytics sets the cookies _ga and _ga_<ID>, which distinguish visitors and sessions, for up to two years. We keep event data in Google Analytics for 14 months; after that it is deleted automatically.

The legal basis is your consent under Art. 6(1)(a) EU GDPR, and for cookies additionally the national ePrivacy rules and PECR. Google processes the data on our behalf as a processor under Google's data processing terms. The provider is Google Ireland Limited (address above); the data may be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition. More at policies.google.com/privacy.

Google Ads conversion tracking (marketing, only with consent)

If you allow the “Marketing” category, we use Google Ads conversion tracking. If you reached this website through one of our ads on Google, it records whether an enquiry was submitted afterwards. This shows us which ads lead to enquiries. We only receive aggregated figures, no details that identify you personally.

Cookies such as _gcl_au (90 days) and other Google advertising cookies are set for this, including on Google domains. The legal basis is your consent under Art. 6(1)(a) EU GDPR, and for cookies additionally the national ePrivacy rules and PECR. Under its terms for Google Ads, Google is a controller in its own right for this processing and may also use the data for its own purposes. The provider is Google Ireland Limited; a transfer to Google LLC in the USA is possible (EU-US Data Privacy Framework, with standard contractual clauses in addition).

LinkedIn Insight Tag (marketing, only with consent)

If you allow the “Marketing” category, we load the LinkedIn Insight Tag. It shows us whether our ads on LinkedIn lead to visits and enquiries, provides aggregated information about the website's visitors, such as industry or company size, and can make it possible to show ads on LinkedIn to visitors of this website. It processes the URL visited, the referring page, details of device and browser, the time and your IP address. We do not see individual people, only aggregated reports.

The cookies li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory and li_fat_id are set for this, some of them on LinkedIn domains, for up to one year. The legal basis is your consent under Art. 6(1)(a) EU GDPR, and for cookies additionally the national ePrivacy rules and PECR.

The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Under LinkedIn's terms, we and LinkedIn are joint controllers for the collection via the Insight Tag (Art. 26 EU GDPR). LinkedIn answers requests about your rights regarding its own processing, but you can also contact us. The data may be transferred to LinkedIn Corporation in the USA; LinkedIn is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition. More at linkedin.com/legal/privacy-policy.

Cookies

This website sets only strictly necessary cookies: a session cookie that keeps your entries together during a visit, and a security cookie that protects forms against being submitted from other sites (CSRF protection).

Cookies from Microsoft Clarity and Google Analytics (“Statistics” category) and from Google Ads and LinkedIn (“Marketing” category) are only set with your consent (see the sections above). Details of purpose, duration and deletion are given on the Cookies page.

Hosting and email

This website is hosted by Hostinger. The server used is located within the European Union. The provider processes the server log data generated when the website is accessed as our processor; a contract under Art. 28 EU GDPR is in place for this purpose.

Email correspondence arising from your enquiries runs through the same provider's mail server. When you write to us, we process your message and your sender details in order to reply.

Transfers between the EU and the United Kingdom

The data from the forms is stored on servers within the European Union. The controller, however, is a company in the United Kingdom. Where personal data is transferred from the European Union to the United Kingdom in this context, this takes place on the basis of the European Commission's adequacy decision for the United Kingdom. The Commission renewed this decision in December 2025; it is valid until 27 December 2031.

Under UK law, transfers from the United Kingdom to the European Union and the European Economic Area are covered by the United Kingdom's adequacy regulations for the European Economic Area.

Apart from the Microsoft, Google and LinkedIn services described above, which are only loaded with your consent and whose possible transfer to the USA is explained in the relevant section, personal data is not transferred to any country outside the European Union and the United Kingdom.

Your rights

You have the following rights in relation to your personal data. A short message to the address above is enough; no form is required.

Access: confirmation of whether we process data about you and, if so, which data (Art. 15 EU GDPR).
Rectification of inaccurate data and completion of incomplete data (Art. 16 EU GDPR).
Erasure of your data, unless a statutory retention obligation prevents this (Art. 17 EU GDPR).
Restriction of processing while the accuracy of the data or the lawfulness of the processing is disputed (Art. 18 EU GDPR).
Data portability: receiving the data you have provided in a commonly used, machine-readable format (Art. 20 EU GDPR).
Objection to processing based on our legitimate interest (Art. 21 EU GDPR).
Withdrawal of consent you have given, with effect for the future; this does not affect the lawfulness of processing carried out before the withdrawal (Art. 7(3) EU GDPR).

Complaints

If you believe that we are not processing your data lawfully, you can lodge a complaint (Art. 77 EU GDPR). You decide whom to contact.

With us: You can first address a data protection complaint to us, informally, at the address above. We will acknowledge receipt within 30 days, look into the matter and reply without undue delay. This is what the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, provides. Complaining to us first is not a requirement: you can also contact a supervisory authority directly at any time.
Supervisory authority in the United Kingdom: The authority responsible for us is the Information Commissioner's Office (ICO), ico.org.uk.
Supervisory authorities in the European Union: If you live or work in the European Union, you can also contact the supervisory authority in your country. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb.gv.at. In Germany it is the data protection supervisory authority of the relevant federal state. In Slovenia it is the Information Commissioner (Informacijski pooblaščenec), ip-rs.si.

Changes to this policy

If the website or the processes behind it change, we will update this policy. The version published here is the one that applies.