Privacy Policy
Version b132619377b5
Controller
The controller responsible for processing data on this website and in our services is:
THAMARAI Restaurant Heilbronn
Horkheimer Straße 29
74081 Heilbronn
Germany
Email: kontakt@thamarai.de
What this policy covers
This policy describes which personal data we process when you visit this website or use our services, for what purpose, on which legal basis of the General Data Protection Regulation (GDPR), and for how long. We do not sell personal data and do not use it for third-party advertising.
Visiting this website
Server logs
With every request our server processes technically necessary details: IP address, time, the address requested, the amount of data transferred, and the browser and operating system. We need them to deliver the website and to fend off attacks (legitimate interest, Art. 6(1)(f) GDPR).
Contacting us
If you write to us, we process your details to answer your request (Art. 6(1)(b) GDPR where it concerns a contract, otherwise point (f)).
Cookies
Our cookie policy describes which cookies we set and how you decide about them.
Using our service
Reservations
For a reservation we process your name, email address, phone number, date, time, party size and your requests, such as allergies (Art. 6(1)(b) GDPR). We keep reservations for three years so we can look after you well on your next visit.
Online orders
For an order we process your contact details, the delivery address and the dishes ordered (Art. 6(1)(b) GDPR). Details relevant to invoices are kept for ten years under § 147 AO (Art. 6(1)(c) GDPR).
Newsletter
If you subscribe to our newsletter, we store your email address and, if you give it, your name until you unsubscribe (consent, Art. 6(1)(a) GDPR). We send the newsletter with Ghost, which we run ourselves on servers in Frankfurt am Main. Every issue carries an unsubscribe link.
Service providers working for us
Hosting
The website and the application run on servers of Amazon Web Services EMEA SARL (Luxembourg) in the Frankfurt am Main data centre (eu-central-1). The databases, uploaded files and backups are stored there too. A data processing agreement under Art. 28 GDPR is in place with AWS.
Sending email
Emails THAMARAI sends (confirmations, notifications, invoices) are delivered by Amazon Simple Email Service (SES) of Amazon Web Services EMEA SARL (Luxembourg) from the Frankfurt am Main data centre. For this SES processes the recipient address, the content and the delivery status (Art. 6(1)(b) GDPR). A data processing agreement is in place.
Payments
Payments are processed by Stripe Payments Europe, Limited (Dublin, Ireland). You enter card and account details directly with Stripe; we never receive them in full, only the payment method, its last digits and the payment status (Art. 6(1)(b) GDPR). Stripe may transfer data to Stripe, Inc. in the USA, relying on the EU-US Data Privacy Framework and standard contractual clauses. Stripe is itself responsible for fraud prevention, see stripe.com/privacy.
order3000
Reservations, orders and our loyalty programme run on order3000 of soosap GmbH (Winterthur, Switzerland), which processes them on our behalf. The EU Commission has found that Switzerland ensures an adequate level of data protection.
Email
Our email runs on Proton Mail of Proton AG (Geneva, Switzerland), end-to-end encrypted where the recipient supports it.
Analytics
To understand how our website is used, we use OpenPanel. We run it ourselves, on our servers in Frankfurt am Main; no data goes to OpenPanel AB or any other third party. It records the pages viewed, the referring page, the browser, the device type and the approximate location (country, region, city) derived from the IP address; the IP address itself is not stored. The legal basis is your consent where we ask for it (Art. 6(1)(a) GDPR), and otherwise our legitimate interest in improving the website (Art. 6(1)(f) GDPR). The data is deleted after 26 months at the latest.
How long we keep data
We keep personal data only as long as its purpose requires. Server logs are deleted after 30 days at the latest. Data we must keep under commercial or tax law is restricted until those periods end (usually six to ten years) and then deleted.
Security
Every connection to this website is encrypted with TLS. Stored data and backups are encrypted; only the people who need access for their work have it.
Your rights
You have the right to
- access the data we hold about you (Art. 15 GDPR),
- have inaccurate data corrected (Art. 16 GDPR),
- erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on legitimate interests (Art. 21 GDPR),
- withdraw consent with effect for the future (Art. 7(3) GDPR).
An informal message to kontakt@thamarai.de is enough.
Complaints
You may complain to a data protection supervisory authority, in particular in the country where you live or work. The authority responsible for us is: the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Stuttgart.
Changes to this policy
When our processing changes, we update this policy. The version published here applies.