Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

echtasien (Demo) GmbH, Alsterdorfer Straße 85, 22299 Hamburg, represented by Max Mustermann. Email: info@tasteclick.de, phone: +49 40 226 339 780.

Data protection contact: datenschutz@tasteclick.de.

2. Subject of this policy

This policy explains what personal data we process when you visit our website and use our services (table reservations, contact and job enquiries, newsletter, vouchers and online orders), for what purposes and on what legal bases, who receives the data, how long we store it and what rights you have.

3. Access data / server log files

When you visit our website, your browser automatically transmits data that is temporarily stored in server log files: the IP address of the requesting device (shortened or hashed where possible), date and time of the request, the requested resource, the referrer URL, and information about the browser and operating system. This data is required to deliver the website, to guarantee stability and security and to prevent misuse.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in the secure and stable provision of the website).

4. Table reservation

When you reserve a table, we process the data you enter (name, email address, phone number, number of guests, date and time, location and any message). We use it to process, confirm and manage your reservation and to send you a confirmation and, where applicable, a self-service link to change or cancel it.

Legal basis: Article 6(1)(b) GDPR (performance of pre-contractual measures and the reservation) and, for the associated confirmation emails, Article 6(1)(f) GDPR.

5. Contact and job enquiries

If you send us an enquiry via a contact or careers form, we process the data you provide (e.g. name, email address, phone number and the content of your message) in order to answer and process your request. Job application data is processed solely for the purpose of the application procedure.

Legal basis: Article 6(1)(b) GDPR (pre-contractual measures) and Article 6(1)(f) GDPR (legitimate interest in answering enquiries); for applications, § 26 of the German Federal Data Protection Act (BDSG).

6. Newsletter (double opt-in)

You can subscribe to our newsletter with your email address. We use the double opt-in procedure: after registering, you receive a confirmation email and your subscription only becomes active once you click the confirmation link. We store the email address, the confirmation and the time of registration and confirmation in order to prove your consent. You can unsubscribe at any time using the link in every newsletter or by contacting us; this revokes your consent with effect for the future.

Legal basis: Article 6(1)(a) GDPR (consent).

7. Vouchers and online orders

If you purchase a voucher or place an online order, we process the data required to conclude and perform the contract (e.g. name, email address, phone number, order/voucher details and, where applicable, a delivery address) and to send you confirmations and receipts. Payment is handled by a payment service provider; we do not receive or store your full payment card or account details.

Legal basis: Article 6(1)(b) GDPR (performance of the contract) and Article 6(1)(c) GDPR (compliance with legal, in particular commercial and tax, retention obligations).

8. Map embedding

On our location pages we embed a map. The map is only loaded after you have actively consented (two-click / consent overlay); before that, no connection to the map provider is established and no data is transferred. When you activate the map, the provider may process your IP address.

Legal basis: Article 6(1)(a) GDPR (consent).

9. Cookies and consent

We only use cookies and comparable technologies that are technically necessary to operate the website, unless you have given your consent to further use. You can withdraw consent given at any time with effect for the future. Technically necessary storage is based on Article 6(1)(f) GDPR; any non-essential technologies are based on Article 6(1)(a) GDPR.

10. Recipients and processors

To operate the website and services we use carefully selected service providers who process data on our behalf under a data processing agreement pursuant to Article 28 GDPR: our hosting and platform provider (Tasteclick, including the hosting infrastructure Vercel and the database service Supabase), an email delivery provider (Amazon Web Services / Amazon SES) and, for paid transactions, a payment service provider (Mollie). We only pass on data to public authorities where we are legally obliged to do so.

11. Transfer to third countries

Where a processor also processes data outside the European Economic Area, this is done on the basis of the EU standard contractual clauses or another valid transfer mechanism pursuant to Chapter V GDPR to ensure an adequate level of data protection.

12. Storage period

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention periods (in particular under commercial and tax law, e.g. § 257 HGB and § 147 AO). Afterwards the data is deleted or anonymised. Reservation and enquiry data is deleted once the respective matter has been fully processed and no retention obligations apply.

13. Your rights

You have the right to access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and to object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR). Where processing is based on your consent, you may withdraw it at any time with effect for the future. To exercise your rights, please contact us using the details above.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg.

15. Currency of this policy

This privacy policy is current. We will amend it if changes to our services or the legal situation make this necessary.