Privacy Policy

Hosting and server logs

This website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you visit the site, the hosting provider automatically processes technical data such as your IP address, browser type, the pages requested and the time of the request, in order to deliver the site securely and reliably.

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in a secure, functioning website). Vercel processes this data on my behalf under its data processing addendum, which forms part of its terms of service (Art. 28 GDPR); processing may involve transfer to servers outside the EU under appropriate safeguards (EU Standard Contractual Clauses).

Reservation and contact forms

When you send a reservation request or a contact message, I process the details you enter: your first and last name, email address, optionally your phone number, and — for reservations — party size, preferred date and time and any message; for contact messages, the chosen subject and your message. The time at which you gave your consent is recorded together with your request.

This data is used solely to handle your request and to reply to you. Legal basis: Art. 6 (1)(b) GDPR (steps prior to a contract / answering your enquiry). Both forms are processed by two service providers acting on my behalf (Art. 28 GDPR). Each provider’s data processing addendum, including the EU Standard Contractual Clauses, forms part of its terms of service:

Database — reservation requests are stored with Supabase Pte. Ltd. (65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513). The database itself is hosted in a data centre in the EU and is only accessible to me.

Email delivery — your request is delivered to my mailbox through Mailgun (Sinch Email / Mailgun Technologies, Inc., 112 E. Pecan Street #1135, San Antonio, TX 78205, USA), using its EU region (servers in the EU). If you use the contact form, Mailgun also sends you a short confirmation email at the address you entered. Where a transfer to the USA occurs, it is covered by the EU Standard Contractual Clauses contained in the addendum.

The data is kept only as long as needed to handle your request and to meet any legal retention obligations, then deleted.

Web analytics

I use Vercel Web Analytics to understand, in aggregate, how the site is used. It is privacy-friendly: it does not set cookies, does not build visitor profiles, and does not track you across other websites. No data that identifies you personally is collected.

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in understanding and improving the site).

Cookies and local storage

The site does not use advertising or tracking cookies. It only stores your cookie-notice choice in your browser so the notice is not shown again. This storage is essential and requires no consent.

Map

The homepage embeds a map from Google Maps (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). The map loads together with the page, so your IP address and browser details are transmitted to Google as soon as you open the homepage, and Google may set cookies in your browser. This is used only to show where the café is. Google may transfer data to its parent company Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework.

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in showing visitors how to find the café). If you prefer not to load the map, you can use the “Get Directions” button instead, which opens Google Maps only when you click it. Please see Google’s privacy policy for details of their processing.

Fonts

The fonts used on this site are served from the website’s own hosting. No connection to Google Fonts or any other font provider is made when you visit the site.

External links and social media

The site links to external services such as Instagram and Google. Once you follow such a link, the respective provider’s privacy policy applies; I have no control over their processing.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time.

To exercise any of these rights, contact me at info@cafeprana.de.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for Berlin is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

Data security

The site is served exclusively over encrypted HTTPS connections. I take reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access.

Changes to this policy

I may update this privacy policy when the website or legal requirements change. The current version always applies and is dated above.