Privacy policy

Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Kerscher und Eisenbach Website & AI Solutions GbR
Ratoldstr. 70
80995 München
Germany

info@kunde-ai-solutions.de

Overview

This privacy policy explains how we process personal data when you use Goodtable. Goodtable is a directory of independent restaurants. Restaurant owners can create a profile there that serves as their homepage.

Processing is governed by the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Visiting the website and server log files

When you open our website, our hosting provider processes technically necessary data, in particular your IP address, the date and time of access, the page requested, the amount of data transferred, the HTTP status code, and browser and operating system information (server log files). This processing is required to deliver the website and keep it secure.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). We do not use this data to identify individual visitors.

Hosting and service providers

To operate the platform we use the following service providers as processors under Art. 28 GDPR: Vercel Inc., USA (hosting and delivery of the website) and Supabase Inc., USA (authentication, database, and file storage).

These providers may also process data on servers outside the EU or access it from there. Where this is the case, we rely on appropriate safeguards under Art. 44 et seq. GDPR, in particular EU Standard Contractual Clauses or an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework.

Owner account

To create a restaurant profile you must create an account. For this we process your email address, your display name, and your password, which is stored only in hashed form. We also process technical sign-in data, such as session information.

The legal basis is Art. 6(1)(b) GDPR (providing the account and the platform functions).

Restaurant profiles and published content

As a restaurant owner you can enter information about your restaurant, for example name, cuisine, description, address, phone number, WhatsApp number, contact email address, website, social media links, opening hours, photos, menus, and optional imprint details. This content is stored and, once you publish your profile, displayed publicly on the internet. Published profiles may be indexed by search engines. Drafts are not publicly visible.

The legal basis is Art. 6(1)(b) GDPR. You can edit your profile at any time or set it back to draft, or delete it permanently. Please do not publish personal data of third parties unless you have their consent or another legal basis; you are responsible for this yourself.

Determining the map position (HERE Geocoding)

When you save a restaurant profile, our server sends the address you entered (street, postal code, city, and country) to the HERE geocoding service to determine its coordinates. We store the coordinates together with the profile. The request is made from our server; your IP address is not transmitted to HERE in the process.

The legal basis is Art. 6(1)(b) GDPR (displaying your profile with a map position). The provider is HERE Europe B.V., the Netherlands.

Map display (HERE Maps)

On profile pages with a stored map position we show a map from HERE. When the map loads, your browser connects to HERE servers and loads scripts, map tiles, and style files there. As a technical necessity, HERE receives your IP address, information about your browser and device, and the page you are viewing.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in clearly showing the restaurant location). You may object to this processing on grounds relating to your particular situation. If you do not want the map to load, you can block third-party scripts in your browser; the rest of the page remains usable.

Cookies and local storage

We do not use cookies or similar technologies for analytics or advertising. We only use storage that is technically necessary.

Language selection: a cookie named goodtable_locale stores the language you chose so the website is shown in that language.

Sign-in: when you sign in as a restaurant owner, your browser stores session data in local storage so that you stay signed in.

Under Section 25(2) No. 2 TDDDG this storage is permitted without consent because it is strictly necessary to provide a service you expressly requested. The related processing of personal data is based on Art. 6(1)(b) or (f) GDPR.

Contacting us

If you contact us by email or phone, we process the data you provide, for example your name, email address, and the content of your message, to handle your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contractual relationship, otherwise Art. 6(1)(f) GDPR (legitimate interest in handling enquiries).

External links

Our pages contain links to external websites and services, for example to restaurants' websites and social media profiles and to WhatsApp. Data is only transmitted to the respective provider once you click such a link. The provider is responsible for the processing that takes place there; please refer to its privacy information.

Storage period

Server log files are stored only for a short period. We keep profile data until you delete your restaurant profile, which also removes its photos and menus. We keep account data as long as your account exists; you can ask us to delete your account using the contact details above. We delete enquiries once they have been dealt with and no statutory retention obligations apply.

Data security

We protect your data with technical and organisational measures under Art. 32 GDPR. These include encrypted transmission via HTTPS (TLS), hashed passwords, and access-restricted databases.

Your rights

Under the GDPR you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): on grounds relating to your particular situation, you can object at any time to the processing of your personal data insofar as it is based on Art. 6(1)(f) GDPR. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise, or defence of legal claims.

Right to lodge a complaint (Art. 77 GDPR): you can complain to a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement.

To exercise your rights, you can reach us using the contact details above.

Obligation to provide data and automated decisions

You can use the public directory without providing personal data. For an account and a profile we need your email address and the details marked as required in the form; without them we cannot provide the profile. There is no automated decision-making, including profiling, under Art. 22 GDPR.

Changes to this privacy policy

We update this privacy policy when our services or the legal requirements change. The version published on this page applies.