Privacy policy

The business named above is responsible (controller) for processing your data on this website, in our online ordering and in the services described here. For any data protection question, reach us at these contact details.

We process personal data only as far as we need it for the purpose in question. For each purpose, the sections below say which data we process, on which legal basis, who receives it and how long we keep it. You will find an overview of all retention periods and of all recipients outside the EU at the end.

For an order, reservation or application we need the fields marked as required; without them we cannot conclude the contract or handle the request. Everything else is voluntary. We make no decisions based solely on automated processing within the meaning of Art. 22 GDPR.

This website is delivered via Firebase Hosting by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. With every request the provider processes technically necessary data: IP address, date and time, the address requested, amount of data transferred, referrer and browser identifier (user agent). The purpose is to deliver the site securely and reliably; the legal basis is Art. 6(1)(f) GDPR. Google may also transfer data to Google LLC in the USA (see “Recipients outside the EU”).

Server log retention: 30 days.

Orders, customer accounts, reservations, enquiries and all other data you send us through the website are stored and processed at Supabase Inc. (USA) as our processor (Art. 28 GDPR). Supabase provides the database, sign-in, file storage and server functions; technical logs with IP addresses arise there too. Server location of our instance: Frankfurt am Main, Germany (AWS region eu-central-1). Transfers to the USA are covered by the EU Standard Contractual Clauses in Supabase’s data processing agreement.

To make the site work, we keep some information in your browser (cookies, local storage, session storage): your language, your cookie choice, your cart and your delivery or pickup details, the identifier of a current order with its access key, the identifier of a chat, any allergen filters you set and – only with your consent to “Preferences” – your colour scheme. This information stays in your browser; it is only sent when you use the feature in question.

Strictly necessary storage happens without consent (Section 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR). Anything beyond that, in particular Google Analytics, happens only with your consent via the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time with effect for the future:

If you allow “Analytics” in the cookie banner, we use Google Analytics 4 by Google Ireland Limited (address above). Google Analytics sets cookies (_ga, _ga_*) holding a randomly generated identifier for your browser (client ID) and reports page views and events to Google: the pages you open (without query parameters or access keys), time, referrer, language setting, screen size, device and browser type, and the approximate location Google derives from your IP address. The data is pseudonymous, not anonymous: the client ID lets your visits be linked to each other.

The purpose is to understand how our pages are used and to improve them. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The recipient is Google; data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. The cookies expire after up to 2 years; Google keeps the event data for 2 months.

Withdrawal: Open the cookie settings (button above under “Cookies and browser storage”, or in the footer) and switch “Analytics” off. From then on nothing more is sent to Google and the Analytics cookies are deleted. More on Google’s processing: policies.google.com/privacy.

Separately from Google Analytics, we count page views in our own cookie-free statistics. For each view we store the page, the device type, a country derived from the time zone, the language, the referring page and a check value (hash) of your IP address and browser identifier that changes daily and is formed with a secret key. The check value only serves to avoid counting a day’s visits twice; it is deleted after 2 days. After that only aggregated figures without any personal reference remain. The legal basis is our legitimate interest in simple audience measurement (Art. 6(1)(f) GDPR). The data is stored at Supabase.

When you open one of our QR codes or short links, we store the time, browser identifier, referring page and a daily-changing check value of your IP address – never the IP address itself – and delete these entries after 90 days.

When you order from us, we process the details from the order form: name, phone number, email address (required for online payment), for delivery the address, for pickup at your car the plate, colour and model, your notes, the dishes ordered, options chosen, tip and requested time. The purpose is to perform the contract: to prepare, deliver or hand over, to bill, and to keep you informed of progress (Art. 6(1)(b) GDPR). A secret link lets you follow your order live.

Payment: Online payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter card details directly with Stripe; we never receive them. Stripe also processes device and connection data to prevent fraud and may transfer data to Stripe, Inc. in the USA (Data Privacy Framework). Where Stripe checks payments under its own responsibility (for example fraud prevention), Stripe’s privacy policy applies.

Till receipt: Every order is signed as a till transaction with a technical security device (TSE). For this we send the transaction data (amounts, items, times, no contact details) to our TSE provider fiskaly (based in the EU). The legal basis is our legal obligation (Section 146a German Fiscal Code (AO), Art. 6(1)(c) GDPR).

Retention: We anonymise the name, phone, email, address, notes and vehicle details of a guest order 12 months after the order – unless you have a customer account or a confirmed stamp card. We keep amounts, items, receipts and invoices for up to 10 years because of tax and commercial law (Section 147 AO, Section 257 HGB, Section 14b UStG).

If you order through a platform such as Wolt or Lieferando, the platform itself is responsible for your data in the order process. The order (dishes, time and – as far as the platform passes them on – name, phone and delivery address) reaches us through the interface service Mergeport (based in the EU). We use it only to prepare and hand over the order (Art. 6(1)(b) GDPR). We remove contact details from the stored raw data 30 days after receipt; amounts and items are kept as for any order.

After an order you can choose to be updated on its progress by push message. If you allow this in your browser, we store the push address and keys your browser creates for it together with the order. Messages run through the push service of your browser’s maker (e.g. Google, Apple, Mozilla or Microsoft), which may be located outside the EU. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); you withdraw it by switching the notifications off in your browser. We delete the push address as soon as the push service declares it invalid; in any case we delete it after 12 months without use.

If you create a customer account, we store your email address, name, phone number, saved addresses and your orders so that you can order faster and find earlier orders (Art. 6(1)(b) GDPR). Sign-in runs through Supabase. If you sign in with Google or Facebook, the provider (Google Ireland Limited or Meta Platforms Ireland Limited) gives us your name, email address and an identifier; what the provider itself processes is governed by its own privacy policy. The account exists until you delete it or ask us to delete it; after that we keep order and receipt data only within the statutory periods.

Only if you tick the stamp card box when ordering do we create a stamp card under your email address and send you an email to confirm it. We store the email address, the stamps collected with a reference to each order, the confirmation time and any vouchers issued. The purpose is to run the stamp programme under our terms of participation (Art. 6(1)(b) GDPR). The stamp card exists until you ask us to delete it; a card that has received no stamp for 24 months is deleted automatically.

For the newsletter we need your email address. After you sign up we send you an email with a confirmation link (double opt-in); only then do you receive mail. We store your email address, language, chosen topics, the times of sign-up and confirmation, and your browser identifier and a check value (hash) of your IP address so that we can prove your consent. Sending runs through Amazon SES (Amazon Web Services, Frankfurt, see below).

Targeting (segments): So that not every message goes to everyone, we also select recipients by language, chosen topics, and by whether and how often orders were placed under your email address (period, number, type of order), how many stamps your stamp card holds, and whether you belong to one of our business customers.

Open and click tracking: Our newsletters contain an invisible tracking pixel and links that are redirected through Amazon SES. This tells us, per recipient, whether and when a message was opened and which link was clicked. That way we see which content works.

The legal basis for the newsletter, targeting and tracking is your consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG, Section 25(1) TDDDG). You can withdraw it at any time through the unsubscribe link in every email. After you unsubscribe we send nothing more and delete your address after 30 days. So that you do not get mail again by mistake, for instance through a fresh import, we keep only a check value of your address on a block list. It is formed with a secret key (HMAC) and cannot be traced back to the address without that key; the legal basis is our legitimate interest in respecting your no (Art. 6(1)(f) GDPR). The same applies if you ask us to erase your data. Only a new sign-up with the confirmation link lifts the block. We keep the proof of your consent (the times of sign-up and confirmation) for 3 years after you unsubscribe, so that we can demonstrate the consent (Art. 6(1)(c) and (f) GDPR).

For a reservation we process your name, phone number, email address, date, time, party size and your note, to reserve the table and to reach you with any questions (Art. 6(1)(b) GDPR). We send the confirmation by email through Amazon SES. 12 months after the visit we anonymise the name, contact details and notes.

For a catering enquiry we process your name, email address, phone number, occasion, date, number of guests, food and dietary wishes and your message, to make you a quote and carry out the order (Art. 6(1)(b) GDPR). To prevent abuse we store a check value (hash) of the IP address. Retention: quotes and orders within the statutory retention periods; enquiries that lead to no order are deleted after 6 months.

If you write to us through the contact form or by email, we process your name, email address and message in order to reply (Art. 6(1)(b) GDPR, for general enquiries (f)). The message reaches us through Amazon SES; to prevent abuse we store only a check value (hash) of the email address.

You can give feedback without a name or email address. If you give them, we use them to reply to your feedback (Art. 6(1)(f) GDPR). We delete feedback after 12 months.

In the website chat we process your name, your email address (if given), your messages, language and browser identifier, to answer your questions (Art. 6(1)(b) GDPR, for general questions (f)).

Voice messages are voluntary. We tell you about them before the first recording; by starting the recording you consent to our storing and listening to the recording – that is, your voice (Art. 6(1)(a) GDPR). You can withdraw your consent at any time; just tell us in the chat or by email.

We delete the chat history and voice messages 90 days after the last message. The data is stored at Supabase.

If you apply to us, we process the details from the form (name, email, phone, message, preferred area and hours) and the documents you upload, to decide on your application (Section 26 BDSG, Art. 6(1)(b) and Art. 88 GDPR). To prevent abuse we store your browser identifier and a check value (hash) of the IP address. Only the people who decide on hiring have access. We delete the application and documents 6 months after our decision (offer or rejection) or, if we did not decide, 6 months after it arrived, so that we can defend ourselves against any claims under the German General Equal Treatment Act (AGG). If you are hired, we transfer the necessary data to your personnel file.

We need no consent for the application. Only if you tick the optional “talent pool” box in the form do we, with your consent (Art. 6(1)(a) GDPR), also consider your application for other or later positions. You can withdraw that consent at any time with effect for the future; a short message is enough. With this consent we keep your application for up to 2 years after it arrived; without it, the 6-month period applies.

Business customers: For a business account we process the company details and the name, email and phone number of the contact persons, to perform and bill the contract (Art. 6(1)(b) GDPR).

Employees: So that a business customer’s employees can order on the company’s account or with a subsidy, we receive from their employer or from them directly their name, email address, where applicable phone number, staff number and department. We use these details to assign orders, to print the staff number on kitchen tickets and till receipts, and to provide the employer with orders and statements (Art. 6(1)(b) and (f) GDPR). The business customer and we are each independent controllers. Full details are in the privacy notice for employees of business customers.

On the website we show reviews that guests have published on Google: name or display name, stars, text and date. We fetch them through Google’s interface and store them in order to present our restaurant with real voices (Art. 6(1)(f) GDPR). If you would like your review not to appear here any more, write to us; you manage the review on Google itself in your Google account.

We send order confirmations, reservation and stamp card emails, newsletters and replies to forms through Amazon Simple Email Service (Amazon SES) of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, as our processor (Art. 28 GDPR). AWS processes the email address, content and delivery information, including whether a newsletter was opened and which link was clicked. Server location: Frankfurt am Main, Germany (AWS region eu-central-1). Transfers to Amazon Web Services, Inc. in the USA cannot be ruled out; they are covered by the EU-U.S. Data Privacy Framework, under which Amazon Web Services, Inc. is certified, and by the EU Standard Contractual Clauses in the AWS data processing addendum. Fonts in our emails load from our own server, not from Google.

We serve all fonts on this website and in our emails from our own server. No connection is made to Google Fonts or any other font provider.

We do not embed a map; we link to Google Maps. Only when you click such a link do you leave our site, and Google then processes your data under its own responsibility: policies.google.com/privacy.

If you delete something earlier or ask us to, we delete it sooner, unless a statutory retention duty prevents it.

Some of our service providers are based in the USA or may transfer data there. This happens only on one of the following bases: the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (DPF) for certified companies, or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

fiskaly (TSE) processes data in the EU.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7(3)); processing up to the withdrawal remains lawful.

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation. You can object to advertising by email at any time without giving reasons.

Just write to info@alsafi-heidelberg.de. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.