Privacy policy

Last updated: 5 November 2026

1. Controller and contact

The controller for this website is Notting Hill Gastro GmbH, represented by Kübra Karakus, Theresienhöhe 12, 80339 Munich, Germany. Contact us at info@nottinghillcafe.de or +49 89 55 26 07 48. Company registration details are available in our legal notice.

2. Website and IONOS hosting

IONOS provides our website hosting and email services. The provider is IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Visiting the site requires processing connection data such as your IP address, time, requested page, access status and browser information. This enables delivery, troubleshooting and security. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is operating a secure, functioning website.

IONOS explains its hosting logs and retention periods. Actual logging depends on the hosting plan. For the webhosting access statistics described by IONOS, the provider states a retention period of eight weeks and anonymisation of IP addresses. See IONOS webhosting data processing information and IONOS privacy information.

3. Necessary browser storage

No analytics or advertising tracking code is currently embedded in these pages. Fonts, product images, videos and the displayed map image are served locally. We use necessary storage for these functions:

• Your browser tab's session storage holds the cart and its options, order type, table or name, an optional note, the selected language, and references and status information for a payment attempt. These support editing, reloading and payment reconciliation.
• Local browser storage may hold an acknowledged privacy preference. It is used for 180 days and discarded on the next page visit after expiry. Statistics and marketing remain disabled.
• Submitting a contact or application form starts a session cookie with a random identifier to limit repeated submissions. A 60-second repeat-submission restriction is recorded in that session.

Order information in session storage generally remains for the browser tab's session. Browser session-restore features may restore it. You can remove it through your browser's website-data settings; “Empty cart” clears the cart and its note. Resetting the privacy notice does not erase pending payment references. Do not remove a reference while the status of its payment remains unclear.

Access to strictly necessary storage relies on section 25(2)(2) TDDDG. Processing for the requested order functionality relies on Article 6(1)(b) GDPR; technical preferences and secure form operation rely on Article 6(1)(f) GDPR. No consent for future optional services is recorded. You can reopen the privacy information using “Cookie settings” in the footer.

4. Contact requests

When you contact us through the form or email, we process your contact details and message to respond. The form sends the information to our team by email through IONOS and sends you an acknowledgement. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries and Article 6(1)(f) GDPR for other correspondence. Fields marked as required must be completed to submit the form. A contact request does not confirm a table reservation.

Completed contact requests are deleted three months after final handling, unless legal retention obligations or the need to address specific legal claims require particular records to be kept longer.

5. Job applications

We process your entered name, contact details, preferred role and any PDF CV to consider your application. These are emailed through IONOS to the people responsible for recruitment. Your acknowledgement email does not contain a copy of your CV. The legal basis is section 26(1) BDSG together with Article 6(1)(b) GDPR for deciding whether to establish an employment relationship.

Unsuccessful applications are deleted three months after rejection or completion of the recruitment process. Longer retention requires a separate arrangement, a legal obligation or a need to address specific legal claims. If hired, necessary information is transferred into personnel administration under its retention rules. Please provide only information necessary for your application.

6. Order details and SumUp

The order feature processes order type, table or name, products and ingredients, quantities, prices and an optional note of up to 200 characters. A name is required for takeaway; table 1–32 or a name is sufficient for eating here. These details identify and handle your selection under Article 6(1)(b) GDPR.

Online payments use SumUp. Starting a payment sends its amount, currency and reference, together with the order type, name and any entered note in the payment description. The website also keeps a private order copy containing products and payment status for reconciliation. Names are not included in website or return URLs. Card details are entered on SumUp's payment page and are not collected by this website.

SumUp also processes payment data as a controller in its own right. The applicable SumUp entity, recipients, international transfers and retention periods are described in SumUp's privacy information. Order and payment records are retained as required for fulfilment, resolving payment questions and applicable statutory retention obligations.

The server checks payment status directly with SumUp; returning to the website does not itself confirm payment. SumUp may also notify the server about status changes. Orders are not automatically sent to the till or kitchen. Please show our team your confirmed order. Private order copies on our web server and the payment provider's records are separate.

To prevent abusive payment requests, we use request counters with hashed IP identifiers. The counter is replaced with the first request in a new minute window. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure payment processing.

7. External links and newsletters

OpenTable reservations, Google Maps directions and Instagram are external links. Following a link takes you to that provider's service, where its privacy information applies. No Google Maps frames, Facebook plugins or Instagram feeds are loaded automatically. This website currently has no newsletter subscription.

8. Recipients, security and deletion

Information is available to our responsible team and the providers used for hosting, email and payment processing as needed for the relevant purpose. The public website is intended to use encrypted HTTPS connections. Processing required by law relies on Article 6(1)(c) GDPR. Data is deleted once no longer needed, subject to legal obligations and necessary legal claims. The stated three-month periods for completed enquiries and unsuccessful applications also apply to their storage in our email inbox.

9. Your rights

Subject to the applicable conditions, you may request access, rectification, erasure, restriction and data portability under Articles 15–20 GDPR. Consent can be withdrawn for the future. You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation under Article 21 GDPR. Contact info@nottinghillcafe.de to exercise these rights.

You may complain to a data protection authority. The Bavarian State Office for Data Protection Supervision (BayLDA) supervises private-sector organisations in Bavaria. The described website features do not involve automated decisions with legal or similarly significant effects.