Privacy notice

We collect only the contact and booking details needed to handle your reservation. Access is limited to authorized staff. Reservation details are anonymized after the configured retention period unless legal obligations require longer storage.

Controller

Data processed

When you make a reservation: name, email address, phone number, party size, reservation time, optional notes, status history and technical abuse-prevention data.

On every visit our server also processes the usual connection data: IP address, timestamp, requested address and browser details. This is technically required to deliver the page.

We use no analytics or tracking services and build no visitor profiles.

Legal bases

Reservation details are processed to perform the reservation under Art. 6(1)(b) GDPR. Connection data and abuse prevention rest on our legitimate interest in a secure, working service under Art. 6(1)(f) GDPR. The map is shown solely on the basis of your consent under Art. 6(1)(a) GDPR.

Purpose and retention

Details are used only to handle the reservation, send necessary notices and protect the service. The configured default retention period is 365 days, after which personal details are anonymized.

Recipients

We do not pass your details on for advertising. We use the following processors to run the site:

• Hetzner Online GmbH, Germany — hosting for the site and the database. The servers are located in Germany.
• Resend, Inc., USA, delivering through Amazon Web Services in the EU Ireland region — sending reservation confirmations. The EU standard contractual clauses cover the transfer to the USA.

Map

The map on the home page is embedded from Google Maps (Google Ireland Limited, Ireland, and Google LLC, USA). It does not load on its own: only when you select “Load the map” are your IP address and browser details sent to Google, including to servers in the USA. Your choice is stored locally in your browser and can be withdrawn at any time with “Hide the map again” below the map. Withdrawal takes effect going forward. Without consent the “Get directions” link still works and only takes you to Google once you follow it.

Cookies and local storage

This site sets no analytics, tracking or advertising cookies, and embeds no service that recognises you across websites. That is why there is no cookie banner: the only things stored are the ones the site needs to work.

• cosi_locale (cookie, one year): remembers whether you read the site in German or English.
• cosi.map-consent (local storage): remembers that you agreed to load the map. It is deleted as soon as you withdraw with “Hide the map again”.
• The administration area additionally uses a session cookie for signing in. It affects staff only, not guests.

Under § 25(2) TDDDG these are strictly necessary for the service you requested, so they need no consent. You can delete them at any time in your browser settings.

Your rights

For access, correction or deletion requests, contact info@cosi-cafe.com.

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw any consent at any time with effect for the future. You may also complain to a supervisory authority; ours is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany.

info@cosi-cafe.com