Privacy

We take the protection of your personal data seriously. This policy explains who is responsible, what we collect, for which purpose, and on which legal basis under the EU GDPR.

1. Controller

2. Hosting & CDN (Netlify, Supabase)

The site is hosted by Netlify, Inc. (USA). Database, auth and file storage are operated by Supabase Inc. (USA, EU data centre). Access logs (IP, timestamp, user agent, referrer, requested resource) are processed on Art. 6 (1) (f) GDPR (legitimate interest in secure operation). Raw-log retention: up to 30 days.

3. Reservations

For online reservations we process your name, email, phone, party size, time and special requests to confirm, remind and manage your booking (Art. 6 (1) (b) GDPR). Retention: 12 months after the visit date; personal fields are anonymised afterwards.

4. Shop & payments (PayPal)

For shop orders we process line items, billing and shipping address, email and a PayPal transaction reference. Payments are handled by PayPal (Europe) S.à r.l. et Cie, S.C.A. — card data is transmitted directly to PayPal and never stored on our systems. Legal basis: Art. 6 (1) (b) GDPR. Invoice data is retained for the statutory 10 years.

5. Shipping (merch) & vouchers

Shipping addresses are forwarded to our logistics partner for merch orders. For gift vouchers we email the voucher code to the recipient address you provide; that address is deleted 90 days later if no redemption occurs.

6. Email (SMTP)

Outgoing mail (confirmations, notifications) is sent through our SMTP provider. Recipient address, content and status code are retained for 30 days for troubleshooting.

7. Chatbot "Sin-Bot" (Anthropic Claude)

The optional AI host "Sin-Bot" forwards your questions to Anthropic PBC (USA). The chatbot only loads if you consent to the "Functional" cookie category. Messages are kept in our database for 30 days (Art. 6 (1) (a) GDPR) and then deleted. Per Anthropic's terms, the content is not used for model training.

8. Cookies & Consent Mode v2

We only use technically necessary cookies by default (Art. 6 (1) (f) GDPR, §25 (2) no. 2 German TTDSG); any analytics or functional cookies are set only after your consent. Your choice is stored locally in your browser and can be withdrawn at any time via "Cookie settings" in the footer.

9. Analytics (GA4 via GTM) — consent-gated

With consent to the "Analytics" category we use Google Analytics 4 via Google Tag Manager (Google Ireland Ltd.) with IP anonymisation. Purpose: reach measurement and site improvement. Retention: 14 months. Consent Mode v2 defaults to "denied".

10. Third-country transfers

Transfers to the USA (Netlify, Anthropic, Google) rely on the EU-US Data Privacy Framework adequacy decision or EU Standard Contractual Clauses with additional safeguards.

11. Your rights

• Right of access (Art. 15 GDPR)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing based on legitimate interests (Art. 21)
• Complaint to a supervisory authority — Hamburg jurisdiction: Hamburg Data Protection Commissioner

12. Privacy contact

Please write to business.sin@outlook.de with subject "Privacy". We reply within statutory deadlines.