Legal Notice

Privacy

The restaurant list, the detail pages and the open dataset can be used without an account and without providing personal data. Anyone who creates an account, suggests a restaurant or joins a waiting list deliberately provides data — which data and where it goes is set out in the sections below. The controller responsible for this processing is the operator named above.

Website operation (Hostinger)

This website, the background service for sending email and the database run on a server operated by Hostinger International Ltd. (Larnaca, Cyprus). The server is located in Germany. Hostinger therefore processes, as our processor, all data arising on this site — including the web server’s access logs. The legal basis is our legitimate interest in the secure operation of the website under Art. 6(1)(f) GDPR. A data processing agreement is in place.

Error tracking (Sentry)

To detect and fix technical errors, we use Sentry (Functional Software, Inc.). If an error occurs on our website, technical details such as the time, the page requested and the error message are transmitted to servers in the European Union (Frankfurt am Main). IP addresses and user data are not transmitted. The legal basis is our legitimate interest in the stable and secure operation of the website pursuant to Art. 6(1)(f) GDPR.

Usage measurement (Umami, self-hosted)

To understand which pages are read and where visitors abandon the restaurant search or a form, we measure usage with Umami. We run Umami ourselves on a dedicated server at Hostinger International Ltd.; the server is located in Germany. Nothing is sent to the maker of Umami or to third parties. We record: the page visited without search parameters, the domain of the page you came from, the country, region and city, browser and device type, screen size and language, as well as events such as “filter applied” or “contact option used” — for contact options only the kind, never a number or address. To group the page views of one visit, Umami derives a session identifier from characteristics of the visit; it changes monthly. Your IP address is used for this but not stored. No cookies are set, and nothing is linked to an account or to form contents. The administration area and your profile are not measured. We keep the measurement data without a time limit so that reach can be compared over the years. If your browser sends “Do Not Track” or “Global Privacy Control”, nothing is measured; the same applies without JavaScript. The legal basis is our legitimate interest in a platform that actually reaches its visitors pursuant to Art. 6(1)(f) GDPR. You can object to the measurement at any time:

Email delivery (Brevo)

To send email — confirmations, notifications, waiting lists — we use Brevo (Brevo SA, 7 rue de Madrid, 75008 Paris, France). The recipient’s email address and name are transmitted along with the content of the message. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures), or (a) for waiting-list sign-ups. A data processing agreement is in place.

Newsletter and campaigns (Brevo)

Anyone who explicitly consents when joining a waiting list or registering is stored as a contact at Brevo (Brevo SA, France) — permanently and for marketing purposes, that is, beyond merely sending an individual message. Transmitted are: email address, contact person’s name, organisation or restaurant name, language, the role in our sales process and the processing status. Free-text messages, phone numbers and locations are explicitly not transmitted. The legal basis is Art. 6(1)(a) GDPR (consent). Consent is voluntary, not a condition for signing up, and can be withdrawn at any time — via the unsubscribe link in every campaign or by deleting the account. After a withdrawal the contact is removed from Brevo.

Nearby stops (Verkéiersverbond)

On restaurant detail pages we show public transport stops. For this we query the Verkéiersverbond interface — only the restaurant’s coordinates are transmitted. No visitor data: neither IP address nor identifier. We cache the response for 24 hours.

Transfers to third countries

Every service we engage directly is based in the European Union. Some of them, however, use sub-processors outside the EU — in the United States in particular. This concerns technical services: delivery and resilience, analytics and user support. These transfers are covered by the EU-US Data Privacy Framework or by the European Commission’s standard contractual clauses. The full lists are published by each provider in their data processing agreements.

Your rights

You have the right at any time to:

• access the data stored about you (Art. 15 GDPR)
• erasure of your account and the associated data (Art. 17 GDPR)
• portability — a machine-readable copy of your data (Art. 20 GDPR)
• withdraw your consent, for example to a waiting list sign-up (Art. 7(3) GDPR)
• lodge a complaint with the Commission nationale pour la protection des données (CNPD), Luxembourg

Access, export and erasure you do yourself in your profile — immediately and without a request: go to my profile.

Retention

Account data is kept while the account exists; after deletion it disappears immediately. Waiting list sign-ups remain until withdrawn or until the programme starts. Restaurant information stays permanently — it is factual data and is separated from the person after an account deletion. Usage measurement data is kept without a time limit; it contains no IP address and no link to an account.