Privacy policy

This is a translation provided for your convenience. Only the German version is legally binding.Read the German version

1. Controller

2. Visiting the website and hosting

This website is hosted by Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit it, Cloudflare processes technically necessary data, in particular your IP address, the date and time, the page requested, your browser and your operating system, in order to deliver the site and protect it against attacks. The legal basis is our legitimate interest in providing the site securely and quickly (Art. 6(1)(f) GDPR). The log data are stored only for as long as necessary for these purposes. The Cloudflare hosting account is operated on our behalf by Dr. Jonas Heimicke Webdesign. We remain the controller within the meaning of the GDPR; Dr. Jonas Heimicke Webdesign processes the data as a processor pursuant to Art. 28 GDPR on the basis of a data processing agreement that forms part of our maintenance contract. Cloudflare is engaged as a further processor (sub-processor). Cloudflare is certified under the EU-US Data Privacy Framework; the EU standard contractual clauses apply in addition.

3. Display of available seats and beds

The number of available breakfast seats and beds is loaded from a service at Cloudflare (Cloudflare Workers, see above) when you open the page. Your IP address is transmitted for technical reasons, but no personal data is stored or evaluated. The legal basis is Art. 6(1)(f) GDPR.

4. Reserving breakfast

If you request a seat using the “Reserve breakfast” form, we process the details you enter there: the day you would like, the number of people, your name, your phone number, your optional message and – if you are staying with us – the name of your Airbnb booking. We need these details in order to handle the reservation and confirm your seat. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract).

The reservations are held in a storage service at Cloudflare (Cloudflare Workers KV, provider see section 2). Cloudflare is engaged as a sub-processor; access is available to us through a password-protected area and – for technical reasons, as a processor and for maintenance only – to Dr. Jonas Heimicke Webdesign as the operator of the hosting account (see section 2). There are no other recipients.

Storage period: reservation data is deleted automatically 30 days after the entry is made; sooner, as soon as it is no longer needed to handle the reservation.

To protect against automated bulk requests we limit the number of reservations per internet connection. For this purpose the service stores a check value (hash) derived from your IP address for ten minutes; the IP address itself is not stored for this. The legal basis is our legitimate interest in abuse-free operation (Art. 6(1)(f) GDPR).

5. Ordering (preview without payment)

The ordering function is currently a preview: nothing is ordered bindingly and nothing is paid for. What you put in the basket, and the details you enter on the order page (pick-up time, name, phone number), stay exclusively in your browser (session storage) and are not transmitted to us or to any third party. They are deleted as soon as you close the browser tab. These are not cookies; the storage is strictly necessary for the function you called up and therefore does not require consent under § 25(2)(2) TDDDG. As soon as real online ordering with payment is added, we will supplement this policy.

6. No cookies, no tracking

This website sets no cookies and uses no analytics or advertising services. Fonts are loaded from our own server, not from Google or other providers. Apart from the basket described in section 5, only the non-public area “/panel” stores information on the business’s own device (password and sound setting in local storage), and it does so for a function that the business itself calls up. If you switch on the music using the button at the top, the audio file is loaded from our own server; so that it keeps playing when you move to another page, your browser remembers in session storage whether the music is playing and at which position. This is deleted when you close the tab, is not sent to us, and is required for the function you switched on (Section 25(2) No. 2 TDDDG).

7. Links to other providers

We link to OpenStreetMap (route planning), Airbnb (booking the accommodation) and our social media profiles. These are plain links: data is only transmitted once you click a link. The privacy policy of the respective provider then applies.

8. Contact by e-mail or phone

If you contact us, we process your details in order to answer your enquiry (Art. 6(1)(b) or (f) GDPR). We delete them as soon as they are no longer needed for that and no statutory retention obligations apply.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Please contact us at the address given above.

You also have the right to lodge a complaint with a data protection supervisory authority, for example with the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, Germany.

Version: September 2026