Legal

Privacy policy

This page explains which personal data we process when you use our website or contact us, why we do so, and what rights you have.

Controller

The controller responsible for data processing on this website is:

Cataldo Fabrizio Costa

Südstraße 26
42103 Wuppertal

Phone: 0202 300589
Email: info@taormina.de

Technical operation with tischlein

We run this website, our menu and our online forms with tischlein, a service of OpsAgent UG (haftungsbeschränkt), Clausewitzstr. 21, 42389 Wuppertal, Deutschland (tischlein.pro). tischlein processes personal data solely on our behalf and on our instructions as a processor (Art. 28 GDPR).

Servers and data are hosted by Amazon Web Services EMEA SARL (38 Avenue John F. Kennedy, L-1855 Luxembourg) in data centres in Frankfurt am Main (Germany). tischlein manages the servers with Laravel Forge (Laravel Holdings Inc., USA). Images and files of this website are delivered via the content delivery network Amazon CloudFront at media.tischlein.pro; your IP address is processed to load the files from a server near you.

Server log files

Whenever you access the website, your browser automatically transmits technical data that is stored in server log files: IP address, date and time, page or file requested, referrer URL (if transmitted), browser type and operating system, amount of data transferred and HTTP status code.

We need this data to deliver the website securely and reliably and to detect attacks or errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and error-free operation of the website. Log files are deleted after 60 days at the latest, unless they are needed longer in an individual case to investigate a security incident. We do not combine this data with other data or use it to create profiles.

Cookies and third-party content

Our website sets no tracking or marketing cookies and uses no third-party analytics tools and no advertising networks, so no cookie banner is needed. Fonts, scripts and styles come from our own server, images via the content delivery network named above. Visiting the website makes no connection to Google Fonts, map services or social media plugins.

Reach measurement without cookies

To understand which content is in demand, we count page views directly on our server — without cookies, without storing anything on your device and without third parties. We only keep daily totals: the page visited, language, device type (smartphone, tablet, computer), the domain of the previously visited website and the use of menu filters and forms. To estimate the number of visitors per day, we create a one-way hash from the IP address and browser identifier together with a random value that changes daily. The IP address and browser identifier are not stored; the hash is deleted after two days at the latest and the random value after three days at the latest. After that, no link to a person can be established.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is designing our offer according to demand. As nothing is stored on or read from your device, no consent under Section 25 TDDDG is required.

We link to our profiles on social networks (e.g. Instagram, Facebook). These are plain links, not plugins or embedded content. No data is transferred to these networks when you visit our website. Only when you click a link does the network's page open, and its privacy policy then applies.

Online orders and vouchers via external providers

For online orders (e.g. for pickup), vouchers or reservations we use the service gastronovi (gastronovi GmbH). When you click such a link, the provider's page opens in a window on our website (embedded as a so-called iframe), or in a new tab without JavaScript. Only your click establishes a connection to the provider; merely visiting our website loads no content from the provider and transfers no data to it. From that click on, the provider processes your IP address and the details you enter there (e.g. order, name, contact and payment details) to handle your order or voucher purchase, and may set its own cookies for this. The provider's privacy policy applies. The legal basis is Art. 6(1)(b) GDPR (performance of your order or pre-contractual measures).

Contact by email or phone

If you contact us by email or phone, we process your details (e.g. name, email address, phone number, your message) to handle your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or steps prior to entering into one (e.g. a table reservation), otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete the data once your request has been dealt with, unless statutory retention obligations apply.

Request forms

You can send us the following requests via our website:

Party and event request: name, contact details, preferred date, number of guests, occasion, budget and your message.
Contact form: name, email address, optionally phone number and subject, and your message.

Required fields are marked in the form. We also store the language in which you filled in the form, the page the request came from and the time of the request.

Purpose and legal basis: We use the data to handle your request, reply to you and, if you wish, arrange a table, a celebration or catering with you. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract and performance of a contract).

Allergies or intolerances: If you voluntarily tell us about allergies, intolerances or similar health information, we use it solely to take it into account during your visit or when preparing food. The legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you give by providing the information voluntarily and which you can withdraw at any time.

Spam protection: We use no captcha and no third-party services. Instead, an invisible check field, a timing check and a limit on requests per IP address protect the forms against misuse. For this purpose the IP address is held only briefly (at most 24 hours) in a cache. The legal basis is Art. 6(1)(f) GDPR.

Retention: Requests from guests who have not become regular guests are automatically anonymised 12 months after the date of the request. Afterwards only non-personal information (e.g. date, number of guests, type of request) is kept for our statistics. Statutory retention obligations (e.g. for invoices for a celebration or catering) remain unaffected.

Emails we send you

In connection with your requests and orders via our website, we only send transactional emails: an acknowledgement of receipt and status updates (e.g. confirmation, decline, cancellation). Beyond that we send newsletters only with your consent (see "Newsletter"). The legal basis is Art. 6(1)(b) GDPR.

tischlein sends these emails via the email service Amazon Web Services EMEA SARL (Amazon Simple Email Service) (38 Avenue John F. Kennedy, L-1855 Luxembourg; sub-processor). When you send a request, we receive a notification email containing your details; when we reply, the reply goes directly to your email address.

You can subscribe to our newsletter (signup form on our website, notices of new events, or otherwise with your consent). A signup on the website only takes effect once you click the link in our confirmation email (double opt-in). We inform you about news, events and offers on the topics you chose.

Which data: your email address, optionally your first name, the chosen language and topics, the time and wording of your consent and confirmation, a daily changing, non-reversible hash of your IP address at signup (proof of consent) and, per newsletter, whether it was delivered, bounced or reported as spam. We do not analyse opens or clicks.

Legal basis: your consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG); for the proof of consent and the suppression list our legitimate interest (Art. 6(1)(f) GDPR) not to write to you again after you unsubscribed or your address bounced.

Storage period and withdrawal: we keep your data until you unsubscribe. Every newsletter contains an unsubscribe link and a link to your preferences; you can also withdraw your consent at any time with a short message to info@taormina.de. After unsubscribing we only keep your email address on a suppression list so you receive no further newsletters. The lawfulness of processing up to that point remains unaffected.

Sending: we send newsletters via tischlein using the email service Amazon Simple Email Service (Amazon Web Services EMEA SARL, Luxembourg; data centre Frankfurt) as sub-processor.

Job applications

If you apply for a job with us, we process the details from the application form (name, contact details, position, message, earliest start date if given) and the documents you upload (e.g. CV). The documents are not stored publicly; only the people in our business responsible for the selection have access.

Legal basis: Art. 6(1)(b) GDPR (steps prior to an employment relationship) in conjunction with Section 26 of the German Federal Data Protection Act (BDSG). If you voluntarily share special categories of data (e.g. health information), we only process them to the extent necessary for the decision (Art. 9(2)(b) GDPR).

Retention: If you are hired, your documents become part of your personnel file. Otherwise we delete them 6 months after the application process has ended, so that we can defend ourselves against any claims (e.g. under the German General Equal Treatment Act, AGG). If you would like to be added to our talent pool, we will ask for your consent separately.

AI assistant in our operations app (tischlein Chat)

Our team uses an AI assistant in the operations app of tischlein, for example to answer requests or to maintain the menu. The assistant processes the texts, photos and PDFs our team enters in the chat, as well as the inputs and results of the tools it uses to retrieve or change our business's data. These may contain guest data, e.g. names and phone numbers from requests. With every message the assistant also receives the name and role of the team member, the name of our business and its locations, and the local time. Uploaded files are stored privately and only for our business.

Conversations, uploaded files (photos, PDFs) and the log of tool calls are stored without an automatic deletion period. The AI service is provided by Anthropic Ireland, Limited (Dublin, Ireland) as sub-processor; under its contract terms Anthropic does not use the content to train its models. The legal basis is Art. 6(1)(b) GDPR or, where your request is concerned, the same legal basis as for the request itself.

AI image editing

Photos our team has enhanced with AI (light, colour, sharpness – the content stays the same) are sent to OpenAI (OpenAI Ireland Ltd., Dublin) without metadata, together with a short description of the desired image style. Processing may also take place in the USA, on the basis of the EU-US Data Privacy Framework; no use for training, logs are deleted after 30 days. The original is kept. If a photo shows recognisable people, we only publish it with their consent. The legal basis is Art. 6(1)(f) GDPR (our interest in presenting our business attractively).

Recipients of your data

Your data is only seen by the people in our business who need it for the task at hand. We also use the following service providers, with whom data processing agreements (Art. 28 GDPR) are in place or who act as independent controllers:

tischlein (OpsAgent UG (haftungsbeschränkt), Clausewitzstr. 21, 42389 Wuppertal, Deutschland) – operation of the website, the forms and the database (processor)
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg – hosting of the platform, database and websites (Amazon EC2), storage of files and backups (Amazon S3); sending e-mails (Amazon Simple Email Service); delivery of images through Amazon CloudFront, also from locations outside the EU; data centres in Frankfurt am Main (region eu-central-1) (sub-processor)
Laravel Holdings Inc., USA – server management (Laravel Forge): setup, updates and software deployment; USA (remote access to the servers in Frankfurt) (sub-processor)
Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland – AI assistant in the tischlein Chat of the operations app: messages, files and the data the chat retrieves for a task; Ireland; processing also possible in the USA (sub-processor)
OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland – image editing: enhancing and editing photos and creating images with AI (photos without metadata); voice input in the chat (speech to text); Ireland; processing also in the USA (sub-processor)

Some of these service providers belong to companies based in the USA; processing there cannot be ruled out. Transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR).

Beyond that, we only pass on your data if we are legally obliged to (e.g. to authorities) or you have consented. We do not sell data.

Your rights

You have the following rights regarding your personal data at any time:

Access to the data stored about you (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability, i.e. receiving your data in a common format (Art. 20 GDPR)
Withdrawal of consent with effect for the future (Art. 7(3) GDPR) Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

A short message to info@taormina.de is enough.

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
https://www.ldi.nrw.de

Obligation to provide data, no automated decisions

You are not obliged to provide us with personal data. However, without the details marked as required we cannot process a request. No automated decision-making, including profiling (Art. 22 GDPR), takes place.

Last updated: October 12, 2026

This is a translation for convenience. In case of doubt, the German version applies.