Here you can read which personal data we process when you use our website and when you send a table request, for which purposes, and what rights you have.
1. Controller and contact
The controller responsible for the processing of your data is:
[OPEN: full legal name of the operator, legal form and address, as in the legal notice]
Email: [OPEN: contact address]
Telephone: [OPEN: if available]
2. Provision of the website and hosting
When our website is accessed, technically necessary connection data is processed. This includes in particular the IP address, the time of the request, the page or file requested, and the device, browser and, where applicable, referrer information transmitted by your browser. This serves to deliver the content, to fix errors and to protect against abusive access. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and reliable operation of the website.
The website and its reservation functions are configured to run on Vercel. Provider: Vercel Inc., USA.
[OPEN: confirm the actual hosting provider and contracting party, the regions used, the log data, the specific deletion periods and any further CDN or security services. Add the data processing agreement applicable to the plan actually booked, together with the transfer mechanism including where a copy of the safeguards can be obtained.]
Provider information: Vercel privacy notice and Vercel data processing agreement.
3. Table requests
When you request a table through the form, we process your name, your telephone number, the requested date and time, the number of guests and the language of the request. Any voluntary notes are transmitted as well. This information serves to handle your request, to reply to you and to plan the seating. The legal basis for the necessary handling is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract).
The mandatory fields are required in order to handle an online request. You are not legally obliged to provide this information; without it, however, the request cannot be handled through the form. The notes field is voluntary.
The request is forwarded from our website to a Telegram chat set up for the JUNE team. In doing so, the information listed above, including any notes, is transmitted to Telegram and to the authorised members of that chat. The guest making the request does not need a Telegram account of their own. Service information: Telegram privacy notice.
[OPEN: confirm the Telegram contracting party, its role under data protection law, who has access, the countries of processing, a valid transfer mechanism, and the deletion procedure for messages and copies. The legal basis for the request alone does not settle this disclosure.]
If the additional reservation storage is switched on, requests including the time of submission are also stored in a Redis database used for the internal reservation overview. The code supports Upstash or a compatible Vercel KV connection for this.
[OPEN: whether the storage is active; the actual provider, region, recipients, processing agreement, third-country safeguards and backups. Delete this section if the storage is not used.]
Storage period: [OPEN: define and implement justified retention and deletion periods for reservations, Telegram messages, database entries and copies. Where individual details remain necessary for specific statutory retention obligations or legal claims, confirm the legal basis under Art. 6(1)(c) or (f) GDPR, the purpose limitation, the access restriction and the subsequent deletion.]
4. Protection against abusive requests
To protect the reservation form, the IP address and the times of requests are processed temporarily in the server's working memory. In addition, a form field invisible to ordinary visitors is used to detect automated submissions. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to limit automated bulk requests and to keep the service available.
[OPEN: confirm the storage period and the clean-up of the IP entries as well as the hosting logs. The 60-second checking window in the code is not a guaranteed deletion period.]
5. Getting in touch
If you contact us by email or by telephone, we process the contact and content data you provide in order to deal with your enquiry. For contract-related enquiries this is based on Art. 6(1)(b) GDPR; for other enquiries on Art. 6(1)(f) GDPR and our interest in answering enquiries appropriately.
[OPEN: confirm the contact routes actually offered, the email and communication providers used, the recipients and the deletion periods; remove any routes that are not offered.]
6. Google Maps
On the home page you can activate a map from Google Maps. The map itself is only embedded once you press “Load map”. Google then receives in particular your IP address as well as browser and connection information. If you are signed in to a Google account, Google may associate the request with that account. For users in the European Economic Area the service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing by Google LLC in the USA is also possible.
The optional embedding is based on your consent under Art. 6(1)(a) GDPR; where information is stored on or read from your device, § 25(1) TDDDG applies in addition. Without activating the map you can still use the website and see the address shown.
The activation is stored in your browser's session storage. Within the same browsing session the map loads automatically on a return visit. Using “Remove map & withdraw consent” below the map you can remove it and reset your choice for future visits. Withdrawing consent does not delete data already transmitted to Google. Information: Google privacy policy.
[OPEN: confirm the consent notice and the third-country basis as well as where a copy of the safeguards can be obtained. A withdrawal takes effect for the future and does not delete data already transmitted to Google.]
7. Typefaces
The typefaces on this website are delivered by our own web hosting provider. No connection to Google Fonts is made in order to load them.
8. Instagram, TikTok and external links
Our website contains links to our profiles on Instagram and TikTok as well as to an external route planner. The social media links currently embed no posts, videos or tracking scripts from those platforms. Only when you follow such a link do you open the platform in question, where its own privacy notices apply.
If you send us a message on a platform, we process the information transmitted in order to deal with your enquiry, on the basis of Art. 6(1)(b) GDPR for contract-related enquiries or Art. 6(1)(f) GDPR for other communication. The platform additionally processes data under its own terms.
[OPEN: confirm the messaging channels actually used, the responsible platform companies, the recipients, the transfer mechanisms and the deletion periods. If an Instagram feed is switched on, add a section matched to the chosen provider and the actual integration. Assess any joint controllership for profile insights separately.]
9. Cookies, session storage and administrative access
For the map activation, your choice is kept in session storage until the end of the browsing session. In the administrative area, which is not intended for guests, sign-in data is additionally kept in session storage together with a short-lived security cookie for the login. That cookie expires after ten minutes at the latest and is removed once the check succeeds. Where this is necessary for the expressly requested protected administrative access, the storage is based on § 25(2) no. 2 TDDDG; the associated processing serves secure access under Art. 6(1)(f) GDPR.
10. Processing outside the EEA
With the service providers named above, processing may take place outside the European Union or the European Economic Area. In addition to the legal basis for the processing, the requirements of Art. 44 et seq. GDPR must be observed for this.
[OPEN: for each active service, state the actual recipients and countries and the specific applicable basis, for example an adequacy decision covering that recipient, or agreed standard contractual clauses including any necessary additional measures. State how a copy of the safeguards can be obtained. Do not claim blanket DPF or SCC coverage, or EU-only processing.]
11. Your rights
Subject to the statutory conditions, you have the right of access to your personal data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). Please contact the controller named above to exercise them.
Objection: Where we process data on the basis of Art. 6(1)(e) or (f) GDPR, you may object under Art. 21 GDPR on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons.
Withdrawal of consent: You may withdraw consent you have given at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.
Complaint: You may lodge a complaint with a data protection supervisory authority, in particular in the country of your habitual residence, your place of work or the place of the alleged infringement. For private businesses in Bavaria, the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, is generally responsible: complaint to the BayLDA.
12. Automated decisions
The reservation function that was reviewed can filter the available time slots against the table capacity. This is a technical availability check. A decision based solely on automated processing which produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR is not provided for in the website code that was reviewed.
[OPEN: confirm that no further systems are used which make such decisions or carry out corresponding profiling.]