Privacy policy
This privacy policy applies to all personal data we process and explains what we use it for and what rights you have. (Courtesy translation: only the German version is legally binding.)
1. Purposes of data processing
The purposes for which we process personal data can be listed as follows:
- Processing orders and delivering goods or services
- Communicating with our customers and users, e.g. to answer questions or receive feedback
- Carrying out marketing activities such as sending newsletters or personalising advertising
- Analysing the use of our website in order to improve it and adapt it better to the needs of our users
- Ensuring the security and integrity of our systems and data
- Fulfilling legal obligations, e.g. in connection with taxes or the handling of complaints
We process personal data only for the purposes mentioned above and only to the extent necessary for the respective purpose. For this reason, we process your data exclusively on the basis of the relevant statutory provisions of the GDPR, the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act (TKG).
2. Controller within the meaning of data protection law
- Name
- Elena-Carmen Mihalcea
- Address
- Amerlingstraße 15, 1060 Vienna
If you have any questions or concerns about data protection on our website, you can reach us using the contact details below. We will handle your enquiries as quickly as possible.
3. Legal bases
The legal bases on which our data processing is based can be explained as follows:
- Consent
- In some cases we process personal data on the basis of your express consent. This applies in particular to sending newsletters or processing data in connection with certain marketing activities.
- Performance of a contract
- If you order goods or services from us, we process your personal data to perform the contract. This includes order processing, payment processing and the delivery of goods or services.
- Legitimate interests
- We also process personal data on the basis of our legitimate interests, for example to analyse the use of our website in order to improve it, to personalise advertising or to ensure the security and integrity of our systems and data.
- Legal obligations
- We may also process personal data in order to comply with our legal obligations, e.g. in connection with taxes or the handling of complaints.
We process personal data only on the basis of a valid legal basis and only to the extent necessary for the respective purpose.
4. Recipients of the data
We pass on personal data to third parties only if this is necessary to fulfil our obligations or to provide services. Examples of recipients of personal data may be:
- Payment service providers
- If you order goods or services from us, it may be necessary for us to pass on your payment details to our payment service provider in order to process the payment.
- Shipping service providers
- If we deliver goods to you, we may pass on your address details to a shipping service provider to enable delivery.
- IT service providers
- We work with IT service providers to operate and maintain our website and our systems. These service providers may have access to personal data in order to carry out their tasks.
- Analytics tools
- We use analytics tools to analyse and improve the use of our website. In some cases these tools may collect personal data. We ensure that the analytics tools follow our instructions and do not use personal data for their own purposes.
We pass on personal data to third parties only if this is required by law or if we have your express consent. We ensure that all recipients of personal data take the necessary security measures to protect this data.
5. Duration of data storage
We store personal data only for as long as is necessary for the respective purposes or as required by law. As a rule, we store personal data for the following periods:
- Contract processing
- For the duration of the contractual relationship and for the handling of returns or warranty claims.
- Consent
- For the duration of the consent or until you withdraw it.
- Statutory retention periods
- For the duration of the statutory retention periods, e.g. in connection with tax or accounting obligations.
- Legitimate interests
- For a reasonable period in order to pursue our legitimate interests, e.g. to ensure the security and integrity of our systems and data or to defend against possible legal claims.
We delete personal data when it is no longer needed for the purposes mentioned above or when you ask us to do so, unless we are legally obliged to keep storing this data.
6. Your rights as a data subject
As a user of our website, you have certain rights under the General Data Protection Regulation (GDPR):
You have the right to request information from us about which personal data we process about you and for what purpose.
If the personal data we store is incorrect or incomplete, you have the right to request that this data be corrected or completed.
You can request the erasure of your data if it is no longer necessary for the purposes for which it was collected, if you have withdrawn your consent or if the processing is unlawful.
You can request the restriction of processing if you dispute the accuracy of the data, if the processing is unlawful or if you have objected to the processing.
You can object to the processing on grounds relating to your particular situation. We will then no longer process your data unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
You can request that your data be transferred to another controller if the processing is based on your consent or on a contract and is carried out by automated means.
To exercise your rights, you can contact us at any time. We will deal with your request promptly and reply within one month. In certain cases this period may be extended.
7. Technical and organisational measures
We take various technical and organisational measures on our website to ensure the security of your personal data. These include in particular:
- The use of secure connections (HTTPS) to transfer data between your browser and our server
- The use of firewalls and other protective mechanisms to prevent unauthorised access to our servers
- Regular review and updating of our IT systems and our security measures
- Restricting access to your data to those employees and service providers who need it to fulfil our contractual and legal obligations
- Training our employees in data protection and data security
In addition, we make sure that we process only the personal data that is necessary for the respective purpose and that we store it only for as long as is necessary for that purpose.
8.–16. Services & cookies used
8. Fonts (hosted locally)
This website uses the fonts Fraunces, Jost and Parisienne. The font files are stored locally on our web server. When you visit the website, no connection to Google or any other font provider is established for this purpose, so no data is transferred to third parties.
9. Google Analytics
Google Analytics is a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). Google Analytics uses cookies that are stored on your computer and allow an analysis of your use of our website. The information generated by the cookie about your use of our website (including your IP address) is usually transferred to a Google server in the USA and stored there.
We use Google Analytics to analyse the use of our website and to improve it regularly. The statistics obtained allow us to improve our offer and make it more interesting for you as a user.
If IP anonymisation is activated on our website, your IP address will first be shortened by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there.
The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. The user data is deleted after 14 months.
You can prevent cookies from being stored by adjusting the settings of your browser software accordingly. Please note, however, that in this case you may not be able to use all functions of our website to their full extent. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by downloading and installing the browser plug-in available at the following link: tools.google.com/dlpage/gaoptout.
For more information on how Google uses data and on your settings and objection options, please see Google’s privacy policy (policies.google.com/privacy).
10. Facebook page
We would like to inform you that we operate a Facebook page for which the American company Meta Platforms Inc. is responsible as the service provider. For the European region, however, Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) is responsible.
Please note that Facebook also processes your data in the USA, among other places. The European Court of Justice has ruled that there is currently no adequate level of protection for data transfers to the USA, which may entail various risks for the lawfulness and security of data processing.
As the basis for data processing by recipients based in third countries (in particular the USA) or for transferring data there, Facebook uses so-called standard contractual clauses (Art. 46(2) and (3) GDPR). These clauses are based on an implementing decision of the EU Commission and are intended to ensure that your data meets European data protection standards even when it is transferred to and stored in third countries (such as the USA). Facebook undertakes to comply with the European level of data protection when processing your relevant data.
For more information about the data processed through the use of Facebook, please see the privacy policy at facebook.com/about/privacy. You can find the Facebook data processing terms, which correspond to the standard contractual clauses, at facebook.com/legal/terms/dataprocessing.
11. Instagram page
We would like to inform you that we also use Instagram as a social media platform on our website. Instagram is operated by Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland).
Instagram also processes your data in the USA, among other places. Please note that, according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA, which may entail various risks for the lawfulness and security of data processing.
As the basis for data processing by recipients based in third countries (in particular the USA) or for transferring data there, Instagram uses so-called standard contractual clauses (Art. 46(2) and (3) GDPR). Instagram undertakes to comply with the European level of data protection when processing your relevant data.
For more information about the data processed through the use of Instagram, please see the privacy policy at help.instagram.com/519522125107875. This privacy policy also describes your rights and options regarding the processing of your personal data by Instagram.
12. WhatsApp
In this section we explain how we collect, use, disclose, transfer and store personal data when you use WhatsApp on our website.
Data we collect
We may collect personal data from you when you use WhatsApp on our website. This data may include your name, your contact details, your IP address and other relevant information.
Purpose of use
We use the data you provide to enable you to use WhatsApp on our website and to respond to your enquiries. Your data is processed in accordance with the applicable data protection laws and for the purposes stated in this privacy policy.
Disclosure of data
We do not pass on your personal data to third parties without your express consent unless this is required by law or necessary to protect our rights and interests.
Data storage
We store your personal data only for as long as is necessary to fulfil the stated purposes or as required by law. We take appropriate technical and organisational measures to protect your data against loss, misuse or unauthorised access.
External links
Our website may contain links to external websites to which this privacy policy does not apply. We have no influence on the data protection practices of these websites and are not responsible for their content or their handling of personal data.
Your rights
You have the right to obtain information about the data we store about you and, where applicable, to have it corrected, erased or its processing restricted. You can also object to the processing of your data and exercise your right to data portability. Please contact us to exercise these rights.
Updates
We reserve the right to update this privacy policy at any time. The updated version will be published on our website.
13. Use of cookies
We use cookies on our website in order to offer you the best possible user experience. Cookies are small text files that are stored on your device when you visit our website. We may use both necessary and non-necessary cookies.
Necessary cookies are essential for our website to function properly, for example to save your settings. These cookies are set automatically and therefore do not require your consent.
Non-necessary cookies are set only with your consent. They are used, for example, to analyse and improve our website, to show you personalised content or to make it easier for you to use social media platforms. You can adjust the use of non-necessary cookies at any time via the settings in your browser or via our cookie settings on the website. We also use third-party services such as Google Analytics, which also use cookies to collect information.
You can withdraw your consent or change the use of cookies at any time. Please note that blocking cookies may impair the functioning of our website.
14. Google Maps
This page uses the map service Google Maps. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. To use the functions of Google Maps, it is necessary to store your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this page has no influence on this data transfer. On our contact page, the map is only loaded when you click on “Load map”.
Google Maps is used in the interest of an appealing presentation of our online offers and to make the places we mention on the website easy to find. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. For more information on the handling of user data, please see Google’s privacy policy: policies.google.com/privacy.
15. Online reservation
When you book a table on our website, we process the details from the form: day, time, number of guests, name, e-mail address, phone number and your message. We use them to accept and confirm the reservation and to reach you if there are questions. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or contract).
Reservations are stored on our own web server (see item 16). You receive a confirmation by e-mail and, if enabled, a reminder the day before; these e-mails are in German. We send them through our own mail server. To limit abusive repeated requests we briefly store a hash of your IP address. How long we keep the data is described in item 5.
16. Hosting and server
The website runs on a server of IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. It is delivered through the Cloudflare network (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which makes the pages faster and protects them against attacks. Technically necessary data such as your IP address, date and time, the requested address and browser details are processed (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework.
The website does not use a content management system. In your browser’s local storage we only keep your choice in the cookie notice and whether you have already closed a notice window; this information does not leave your device.
15. Right to object and to withdraw consent
You have the right to object at any time to the processing of your personal data insofar as it is based on legitimate interests or carried out in the public interest. In this case we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
If the processing of your personal data is based on your consent, you have the right to withdraw this consent at any time. The lawfulness of the processing of your data up to the time of withdrawal remains unaffected.
To exercise your right to object or to withdraw consent, you can send us a corresponding message. We will deal with your request without delay and send you a confirmation of receipt of your declaration.
16. Right to lodge a complaint with the supervisory authority
You have the right to lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data violates data protection law. In Austria, this is the Data Protection Authority: www.dsb.gv.at.
However, we recommend that you contact us directly first so that we can clarify your concern and find solutions as quickly as possible.
Questions about data protection?
Write to us, we will reply as quickly as possible.