Privacy policy

The controller for data processing on this site is:

• No tracking, no analytics, no advertising. The site sets no cookies and stores nothing in your browser.
• Fonts and images come from our own server, not from Google Fonts or other services.
• The TheFork calendar and the Google map load only when you click on them.
• Job applications go by email straight to the owners and are deleted after 6 months at the latest. The site itself stores nothing.
• Everything is transferred encrypted (HTTPS).

The site runs on Vercel (Vercel Inc., USA), on servers in Frankfurt am Main. Every visit creates technical data: IP address, date and time, the page requested, the referring page, browser and operating system. Vercel needs it to deliver the site, find errors and fend off attacks (Art. 6(1)(f) GDPR; our legitimate interest is running the site safely and reliably). The logs are deleted after 1 day.

We have a data processing agreement with Vercel (Art. 28 GDPR). Where data reaches the USA, the transfer relies on the European Commission’s adequacy decision for the EU-US Data Privacy Framework and, in addition, on standard contractual clauses.

If you email or call us, we use your details only to answer your request (Art. 6(1)(b) GDPR for bookings and visits, otherwise Art. 6(1)(f)). Our mailbox is hosted by IONOS SE, Montabaur, Germany, under a data processing agreement. We delete emails once the request is settled, unless the law requires us to keep them.

Online bookings go through TheFork (La Fourchette SAS, Paris, France). The calendar on this site loads only when you click “Show booking calendar”. Only then does your browser connect to TheFork, which receives your IP address and technical details about your browser and may set cookies. To protect against bots, TheFork also loads a service by DataDome (Paris, France) that analyses technical details of your browser. The legal basis is the consent you give with that click (Art. 6(1)(a) GDPR, section 25(1) of the German TDDDG). It applies to that page view only; on your next visit the calendar again waits for a click.

“Book on TheFork” is a plain link to TheFork’s website. When you book, we see your booking (name, number of guests, time, contact details) in the booking system so we can prepare your table (Art. 6(1)(b) GDPR). Everything else about the booking is covered by TheFork’s privacy policy.

In the directions section you can load a map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). It loads only when you click “Show map”. Google then receives your IP address and details about your browser, may set cookies, and data may be transferred to Google LLC in the USA. The legal basis is the consent you give with that click (Art. 6(1)(a) GDPR, section 25(1) TDDDG); the transfer to the USA relies on the EU-US Data Privacy Framework.

“Get directions” is a plain link to Google Maps. More in Google’s privacy policy.

The links to our reviews on Google, to Instagram and to TikTok are plain links. The service only receives data from you once you follow one, and its own privacy policy applies there.

The Google rating and the reviews shown with it are fetched by our server from Google Maps once a day. No data about visitors is sent. Reviewers’ profile pictures are also delivered by our server, so your browser does not contact Google. We show the name, profile picture, review text and date as the reviewers published them on Google (legal basis: Art. 6(1)(f) GDPR, our interest in showing genuine guest opinions). We do not store any of it permanently; it stays in our server’s cache until the next update, for one day at most. Removed or changed reviews disappear from our site with the next daily update.

The reviews on our home page come from Google Maps, sorted by Google’s relevance. We show up to three with text and at least 4 stars, quoted verbatim. If Google delivers none, we show reviews from Google selected by us. Neither we nor Google check whether a review comes from a guest, but Google looks for fake reviews and removes them (Google’s content policy).

If you apply through the form on the jobs page, we receive your name, email address, position and employment type, plus your phone number, message and attachment if you provide them, and the language of the form. We use them only to decide on your application (Art. 6(1)(b) GDPR, steps prior to an employment relationship). Giving them is voluntary, but without name, email and position we cannot process the application.

The website stores nothing. On its way, your application passes only through our server at Vercel in Frankfurt (see “Hosting”) and is sent from there, encrypted in transit, as an email straight to a mailbox that only the owners read, hosted by IONOS (see “Email and phone”).

We delete the application and attachment once the process is complete, after 6 months at the latest. If we hire you, we take the necessary details into your personnel file.

To prevent abuse, the server counts submissions per IP address for 15 minutes, in memory only (Art. 6(1)(f) GDPR). There is no automated decision-making.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent (calendar, map) at any time with effect for the future (Art. 7(3)). An email to info@kyoto-bbq.de is enough.

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can complain to a data protection authority. Ours is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.