Privacy policy

The controller within the meaning of Art. 4 (7) GDPR is:

We have not appointed a data protection officer, and we are not required to: fewer than 20 people in our company are permanently engaged in the automated processing of personal data (§ 38 (1) BDSG). For any data protection question, reach us using the contact details above.

This website uses no tracking, no analytics tools and no advertising cookies. There are no web fonts from external servers, no embedded map, no videos and no social media plug-ins. This site therefore needs no cookie banner: consent under § 25(1) TDDDG is required only for access to your device that is not strictly necessary.

One technically necessary exception: as soon as you put an item in the basket, your browser remembers its contents in what is called sessionStorage. That is strictly necessary for the ordering function you asked for, and so exempt from consent under § 25(2) no. 2 TDDDG. It stays in your browser, is not transmitted to us unless you submit the order, and disappears when you close the tab.

Text, photos and the menu's search function are served exclusively from our own server. Search terms and filters on the menu page take effect only in the open window; they are neither stored nor transmitted to us.

One single exception: the booking form on the "Book a table" page. It comes from resmio and is loaded only after you click "Load booking form" — see section 5. Until you do, visiting this website establishes no connection to any third party.

The references to our ordering shop, WhatsApp, Google Maps, Instagram and Facebook are ordinary links. They transmit nothing unless you follow them.

When this page is requested, our hosting provider automatically stores data in what are known as server log files, transmitted by your browser:

• the address requested, and the date and time of the request
• the volume of data transferred and confirmation of a successful request
• browser type and version, operating system used
• the previously visited page (referrer), where transmitted
• IP address

Purpose and legal basis. This data is technically necessary to deliver the page, to ensure its stability and security, and to investigate misuse. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the secure and trouble-free operation of this site. This data is not combined with other data sources, and we draw no conclusions about individuals from it.

Retention. Log files are deleted after 30 days at the latest, unless they are exceptionally needed for longer to investigate a specific security incident.

This site is hosted with the following provider:

The provider processes the data named in section 3 exclusively on our behalf and on our instructions. A data processing agreement under Art. 28 GDPR is in place with them. The servers hosting this site are located in the European Union.

For table reservations we use the service resmio:

Only on click. On the "Book a table" page you first see only a notice with a button. The booking form itself is loaded only when you use that button. At that point your browser connects to resmio's servers (static.resmio.com and app.resmio.com) and, as is technically necessary, transmits your IP address and the usual connection data. Until that click, no data is transmitted to resmio.

Legal basis. The form is loaded on your explicit action and serves to prepare the reservation contract; the legal basis is Art. 6 (1) (b) GDPR and, for the access to your device, your consent under § 25 (1) TDDDG, which you give with that click. You can always book by phone instead on +49 (0) 241 91793702, in which case nothing is transmitted to resmio.

What is processed. If you fill in and submit the form, resmio processes the reservation details you provide — typically name, email address, phone number, party size, date and time, and any note — in order to confirm the reservation and pass it to us. resmio acts on our behalf in doing so; a data processing agreement under Art. 28 GDPR is in place for that processing. resmio's own processing is additionally governed by their privacy policy.

We delete reservation data as soon as it is no longer needed to run the restaurant and no statutory retention periods apply.

You can order food and drink directly on this website for collection. We do not deliver.

What we collect. To place an order we process your name, your telephone number, the items ordered with quantities and prices, your chosen collection time and — if you provide them — your email address for the confirmation and a note.

Purpose and legal basis. We process this data to accept, prepare and hold your order for collection, that is, to perform the contract with you under Art. 6(1)(b) GDPR. Without it we cannot fulfil the order. We need the telephone number so we can reach you if there is a question about your order.

Payment. You choose between two routes when ordering:

• Cash on collection — no payment data is collected at all.
• Paying online by card — you are forwarded to a payment page operated by SumUp. Your card details are entered there and there only; they never reach our website. From SumUp we receive only whether the payment succeeded, plus a transaction reference.

We have a data processing agreement with SumUp under Art. 28 GDPR. SumUp is established in Ireland, so no transfer to a third country outside the EU arises.

Retention. We keep order data for as long as it is needed to fulfil the order and answer questions about it. Where it forms part of an accounting record it is subject to the statutory commercial and tax retention periods and is deleted only once those expire. Orders that do not complete — abandoned or unpaid — are deleted after 90 days.

If you contact us by email or telephone, we process the information you give us in order to answer your enquiry. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries), or Art. 6 (1) (b) GDPR where your enquiry concerns a contract, such as a reservation. We delete this data once the enquiry has been dealt with conclusively and no statutory retention periods apply. There is no contact form on this website.

Contact via WhatsApp

We offer WhatsApp as an additional way to reach us. The link on this page is an ordinary reference: unless you click it, no connection to WhatsApp is established and no data is transmitted.

If you message us on WhatsApp, we process your phone number, your WhatsApp name and the content of your message in order to answer your enquiry. The legal basis is Art. 6 (1) (f) GDPR, or Art. 6 (1) (b) GDPR where a reservation or order is involved.

The service is operated by:

The service belongs to the Meta group; personal data may in that context also be transferred to and processed in the USA. We have no influence over the nature and extent of WhatsApp's processing. You can find more in WhatsApp's privacy policy.

If you would rather avoid that, you can reach us just as well by phone, by email or in person at the restaurant. Please do not send us health data or other sensitive information over WhatsApp; for allergy questions, please speak to us directly.

We delete messages once the enquiry has been dealt with and no statutory retention periods apply.

Beyond the processors named in sections 4, 5 and 6, we do not pass on personal data arising from the operation of this site. We do not sell data.

Merely visiting this website results in no transfer to a third country outside the EU or EEA. Neither does placing an order: our hosting provider, resmio and SumUp are all established in the EU or EEA. A transfer to a third country can only arise if you choose the WhatsApp route yourself (section 7) or follow a link to a social network.

You have the following rights against us in respect of your personal data:

• access to the data processed (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)

An informal message to the address or email address given above is enough to exercise them.

Right to object

Where we process data on the basis of Art. 6 (1) (f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

Right to lodge a complaint

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

This site is delivered over an encrypted connection (TLS/HTTPS). You can recognise this by the padlock symbol in your browser's address bar. It means the data you send us cannot be read by third parties.

We will amend this privacy policy as soon as the underlying processing changes — for instance if we introduce a contact form, an analytics function or an embedded map in future. The version published on this page, bearing the date given above, is the one that applies.