Privacy policy

This information explains how we process personal data when you visit our website or contact us. Last updated: 2 November 2026.

1. Controller

Wassee Hafizi, Ristorante Pfaffenbrunnen
Otto-Hahn-Str. 8, 63456 Hanau, Germany
Telephone: 06181 6753238
Email: info@ristorante-pfaffenbrunnen.de

2. Hosting and technical access data

Our website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Technical access data is processed to deliver and secure the website. This includes the IP address, date and time, the requested file or page, the amount of data transferred, status messages, browser and operating system information and, where applicable, the previously visited page.

This processing supports reliable and secure website operation and the prevention and investigation of attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is providing and securing this website. According to STRATO, IP addresses are stored for no more than seven days to detect and prevent attacks; IP addresses in access logs made available to hosting customers are anonymised. Information needed to investigate a specific security incident may be retained until the incident has been resolved.

Further information: STRATO privacy information and STRATO information on data processing.

3. Contact and online reservations

You can contact us by email or telephone or, once the service is enabled, through our reservation form. The form requires your name, telephone number, email address, date, time and number of guests. Additional requests are optional. Please do not enter health information or other sensitive personal data in the free-text field.

We obtain your consent under Article 6(1)(a) GDPR to store and process online reservation requests. We record the consent text version and time. Without consent, an online request cannot be submitted; telephone and email remain available as alternatives. You can withdraw your consent at any time with effect for the future using our contact details. A request is initially unconfirmed. Our team must approve it before a confirmation email is sent.

Contact details and additional requests are encrypted on our webspace and accessible only to authorised website administrators. Records in the active reservation database are deleted 30 days after the reservation date. Legally required documents, necessary evidence, email correspondence and historical backups may have different retention and deletion periods. Backups are used solely for recovery and security.

Direct enquiries and contractual arrangements by email or telephone are processed under Article 6(1)(b) GDPR; other communication is processed under Article 6(1)(f) GDPR based on our legitimate interest in answering enquiries. Email is processed through the restaurant’s STRATO mailbox. Data is deleted once its purpose and any applicable retention requirements have ended.

4. Telegram notifications and approval

With the consent given in the form, we send the name, phone number, reservation number, requested date and time, number of guests, event and optional additional requests to our Telegram bot for internal processing. Your email address is not sent to the bot. Only approved team members can confirm or decline requests through the bot; the website then sends the guest an email.

Telegram is provided by Telegram Messenger Inc. Bot messages are cloud messages and are not end-to-end encrypted. Telegram is based outside the European Economic Area; processing may involve transfers to third countries. Telegram’s privacy policy applies to its processing. When the deletion period expires, the website attempts to redact its own reservation notifications in Telegram. This cannot fully retrieve copies or forwarded messages or reverse Telegram’s processing. For a request without Telegram transmission, please contact us by telephone or email.

5. Cookies, Google reCAPTCHA and external services

Our own cookie dialog stores your choice in the pf_consent cookie for up to 180 days. It contains the version, your choice about Google reCAPTCHA and the time. This storage is necessary to respect your choice (section 25(2) TDDDG; Article 6(1)(f) GDPR). WordPress may also use technically necessary login and preference cookies for signed-in administrators.

The reservation form uses Google reCAPTCHA v3, provided by Google Ireland Limited, once enabled. It loads only after your express consent in the cookie dialog. Google processes technical connection data, such as your IP address, browser information and interactions, to detect automated input; cookies or similar storage technologies may be used. Processing by related companies and transfers to third countries, particularly the United States, are possible. The legal bases for this optional service are your consent under section 25(1) TDDDG and Article 6(1)(a) GDPR.

The website also verifies the result on the server with Google. You can change or withdraw consent at any time through “Cookie settings” at the bottom of the page. Withdrawal reloads the page but does not reverse data already transmitted. Without consent to Google, you can request a reservation by email or telephone. Further information: Google privacy policy and Google terms.

No advertising or analytics services are enabled through the cookie dialog. Fonts, images and the menu are loaded locally. Facebook, Google Maps and other external services are provided as ordinary links; the respective provider’s privacy information applies when you open them.

6. Your rights

Subject to the applicable legal conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Where processing is based on consent, you can withdraw it at any time with effect for the future. The lawfulness of earlier processing is unaffected.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you can object under Article 21 GDPR on grounds relating to your particular situation. Please use the contact details above to exercise your rights.

You can also complain to a data protection supervisory authority. In Hesse, this is the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

7. Security and updates

The website is provided over an encrypted HTTPS connection. This information is updated when the website’s functions or data processing change.

Contact forms and internal reservation view

The celebration enquiry form emails your name, phone number, preferred date, group size and requests to the restaurant; Telegram receives only a notification. The general contact form emails your name, phone number, email address, subject and message to the restaurant; Telegram receives a notification including name and phone number, with consent. The design contact form emails your details directly to Sebastian Wedel without a Telegram notice. Enquiry contents are not stored in a separate website contact database. Mail correspondence is held by its recipient for processing the enquiry. The protected staff view shows confirmed reservations and manually maintained attendance. A missing attendance mark after 45 minutes is an internal prompt to check; it does not prove absence. Matching uses name and phone number only within the existing 30-day retention period and never automatically rejects a booking. Contact notification details are redacted in Telegram after 30 days where technically possible.