Privacy Policy

1. Controller

Café Gusto Erfurt
Owner: Hazal Yilmaz
Kürschnergasse 14
99084 Erfurt
Germany
Phone: [Mobile number to follow]
Email: cafegusto26@gmail.com

No data protection officer has been appointed, as there is no legal obligation to do so. [Please check]

2. Summary

We only process personal data to the extent necessary to operate this website and to handle your requests.

• We do not use any analytics, tracking or marketing tools (e.g. no Google Analytics, no Google Tag Manager, no Meta Pixel).
• We do not use cookies for analytics or advertising. Only your choice in the cookie notice is stored – locally in your browser.
• Fonts are loaded from our own server; there is no connection to Google Fonts.
• Google Maps is only loaded after you have explicitly agreed.
• There is no automated decision-making or profiling.

3. Hosting and server log files (Vercel)

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you access the website, technically necessary data automatically transmitted by your browser is processed:

• IP address
• date and time of the request
• page or file requested and amount of data transferred
• referrer URL (previously visited page)
• browser and operating system used

This processing serves to deliver the website, ensure its stability and security and prevent misuse. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in providing the website securely and reliably. Vercel also delivers optimised images and technically receives the form submissions.

We have concluded a data processing agreement with Vercel pursuant to Art. 28 GDPR. Data may be transferred to the USA. Vercel is certified under the EU-US Data Privacy Framework; transfers are based on the European Commission's adequacy decision (Art. 45 GDPR) and additionally on standard contractual clauses. Vercel only stores log data for a limited period and then deletes it.

More information: Vercel privacy policy

4. Content delivery network / DNS (Cloudflare)

[Only include if Cloudflare is used as a DNS, proxy or CDN service for this domain – otherwise remove this section.]

To secure the website and deliver it faster, we use Cloudflare, provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Connection data such as your IP address, time and requested content is processed. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a secure and fast website). We have concluded a data processing agreement with Cloudflare; Cloudflare is certified under the EU-US Data Privacy Framework.

More information: Cloudflare privacy policy

5. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar. Data you send to us cannot be read by third parties.

6. Cookie notice and local storage

This website does not set any cookies. To respect your decision in the cookie notice, we store your choice (consent to external media yes/no) and the time of your choice in your browser's local storage. This information is not transmitted to us.

This storage is strictly necessary to provide the service you requested (Section 25 (2) no. 2 TDDDG). The legal basis is Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR (proof of consent). You can change your choice at any time via “Cookie settings” in the footer or delete the entry in your browser settings.

7. Google Maps (only with your consent)

To show our location, a map from Google Maps can be embedded. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded once you allow “External media” in the cookie notice or click “Show map”. Before that, only a preview image from our own server is displayed.

Once the map is loaded, data such as your IP address, browser information and possibly location data is transmitted to Google; Google may set cookies. Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). You can withdraw your consent at any time with effect for the future via “Cookie settings”.

The links “Get directions” and “Open in Google Maps” only lead to Google after you click them; no data is transmitted beforehand.

More information: Google privacy policy

8. Reservation and contact forms

If you send us a request via the reservation or contact form, we process the data you provide:

• name, email address and phone number
• for contact requests: subject, message and optionally company name
• for reservations: preferred date, time and number of guests
• for voucher requests: desired voucher value

We use this data solely to process your request and for follow-up questions. The legal basis is Art. 6 (1) (b) GDPR where your request relates to a reservation, an order or a contract; otherwise your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future.

To protect against spam and automated requests, we check technical characteristics of the request (e.g. a field invisible to humans and the time taken to fill in the form) and limit the number of requests per IP address. For this purpose, the IP address is only processed briefly in the server's working memory and is not stored permanently. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in preventing misuse).

9. Email delivery of requests (Resend)

Requests submitted via the forms are forwarded to us by email. For the technical delivery we use Resend, provided by Resend, Inc., USA. [Please check: only include this section while email delivery via Resend is used.]

Resend processes the content of the request solely on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place. The data is stored in the USA. Resend is certified under the EU-US Data Privacy Framework; standard contractual clauses of the European Commission apply additionally. The legal basis corresponds to that of the respective request (see section 8).

More information: Resend privacy policy

The emails are received in our mailbox at Google (Gmail), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. [Please check: data processing agreement with Google – not available for a private Gmail account; consider Google Workspace]

10. Contact by email or phone

If you contact us by email or phone, we process your details (e.g. name, contact details, content of the request) to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR if your request relates to a contract or reservation, otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding to enquiries).

11. Links to social networks

Our website links to our profiles on Instagram and TikTok. These are simple links – no social media plugins are embedded and no data is transmitted to these networks when you visit our website. Only when you follow a link do the privacy policies of the respective provider apply.

12. Storage period

We only store personal data for as long as necessary for the respective purpose. We delete requests once they have been fully processed, unless statutory retention obligations apply (e.g. six or ten years for commercial and business correspondence and tax-relevant documents under Section 257 HGB and Section 147 AO).

13. Your rights

You have the following rights regarding your personal data:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to withdraw consent with effect for the future (Art. 7 (3) GDPR)

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation.

To exercise your rights, an informal message to the contact details above is sufficient.

14. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI)
Häßlerstraße 8, 99096 Erfurt, Germany
Postal address: Postfach 900455, 99107 Erfurt

www.tlfdi.de

15. Changes to this privacy policy

We update this privacy policy whenever the website or the services used change. The version published here applies.