Notting Hill Café & Fine Food

Notting Hill Café & Fine Food

Privacy policy

Cookie settings on this website

Your choice in the cookie dialog is stored in your browser’s local storage under “nh-cookie-choice” for up to 180 days. The stored information includes the time, the settings version and the selected categories. You can view and reset your choice at any time via “Cookie settings” in the footer. This information is stored in your browser; the dialog does not transmit your choice to an external provider.

When you submit our contact or application forms, a PHP session may be used to limit repeated requests. Your cookie choice does not disable this processing, which is required for the forms to function.

This privacy policy explains the nature, scope and purpose of the processing of personal data (hereinafter “data”) within our online offering and its associated websites, functions and content, as well as external online presences such as our social media profiles (collectively the “online offering”). For terms such as “processing” and “controller”, please refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).

CONTROLLER

Notting Hill Café Theresienhöhe 12 80339 Munich Email address: info@nottinghillcafe.de Managing director / owner: Kübra Karakus

TYPES OF DATA PROCESSED:

CATEGORIES OF DATA SUBJECTS

Visitors and users of the online offering (hereinafter collectively referred to as “users”).

PURPOSE OF PROCESSING

TERMINOLOGY

“Personal data” means any information relating to an identified or identifiable natural person (the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier (e.g. a cookie), or to one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.

“Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically every form of handling data.

“Pseudonymisation” means processing personal data in such a way that it can no longer be attributed to a specific data subject without additional information, provided that this additional information is kept separately and subject to technical and organisational measures ensuring that the personal data cannot be attributed to an identified or identifiable natural person.

“Profiling” means any form of automated processing of personal data consisting of using personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

APPLICABLE LEGAL BASIS

In accordance with Article 13 GDPR, we inform you of the legal bases for our data processing. Where no legal basis is specified in this privacy policy, the following applies: the legal basis for obtaining consent is Article 6(1)(a) and Article 7 GDPR; the legal basis for processing to provide our services, perform contractual measures and respond to enquiries is Article 6(1)(b) GDPR; the legal basis for processing to fulfil our legal obligations is Article 6(1)(c) GDPR; and the legal basis for processing to safeguard our legitimate interests is Article 6(1)(f) GDPR. Where processing personal data is necessary to protect the vital interests of the data subject or another natural person, Article 6(1)(d) GDPR serves as the legal basis.

SECURITY MEASURES

In accordance with Article 32 GDPR, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the varying likelihood and severity of risks to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to data, access to and input of data, disclosure, availability and segregation. We have also established procedures to ensure the exercise of data subject rights, deletion of data and responses to data risks. Furthermore, we take the protection of personal data into account when developing or selecting hardware, software and procedures, in accordance with the principles of data protection by design and by default (Article 25 GDPR).

COOPERATION WITH PROCESSORS AND THIRD PARTIES

If, in the course of processing, we disclose data to other persons or companies (processors or third parties), transfer it to them or otherwise grant access, this takes place only on the basis of legal permission (e.g. where transferring data to third parties such as payment service providers is necessary to perform a contract under Article 6(1)(b) GDPR), your consent, a legal obligation or our legitimate interests (e.g. when using agents or web hosting providers).

Where we commission third parties to process data under a data processing agreement, this is based on Article 28 GDPR.

TRANSFERS TO THIRD COUNTRIES

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs when using third-party services or disclosing or transferring data to third parties, this takes place only where necessary to fulfil our contractual or pre-contractual obligations, on the basis of your consent, a legal obligation or our legitimate interests. Subject to statutory or contractual permissions, we process data, or have it processed, in a third country only where the special requirements of Articles 44 et seq. GDPR are met. This means, for example, that processing is based on specific safeguards, such as an officially recognised finding of a level of data protection equivalent to that of the EU (e.g. through the “Privacy Shield” for the USA), or compliance with officially recognised specific contractual obligations (“standard contractual clauses”).

RIGHTS OF DATA SUBJECTS

You have the right to obtain confirmation as to whether data concerning you is being processed, access to that data, further information and a copy of the data in accordance with Article 15 GDPR.

Under Article 16 GDPR, you have the right to request completion of data concerning you or correction of inaccurate data concerning you.

Under Article 17 GDPR, you have the right to request that data concerning you be deleted without undue delay or, alternatively, to request restriction of processing under Article 18 GDPR.

Under Article 20 GDPR, you have the right to receive the data concerning you that you have provided to us and to request its transmission to other controllers.

Under Article 77 GDPR, you also have the right to lodge a complaint with the competent supervisory authority.

RIGHT TO WITHDRAW CONSENT

Under Article 7(3) GDPR, you have the right to withdraw consent with effect for the future.

RIGHT TO OBJECT

You may object at any time to future processing of data concerning you in accordance with Article 21 GDPR. In particular, you may object to processing for direct marketing purposes.

COOKIES AND THE RIGHT TO OBJECT TO DIRECT MARKETING

“Cookies” are small files stored on users’ computers. Various types of information can be stored in cookies. A cookie primarily serves to store information about a user (or the device on which it is stored) during or after a visit to an online offering. Temporary cookies, also called “session cookies” or “transient cookies”, are deleted after a user leaves an online offering and closes their browser. Such a cookie may store the contents of an online shopping basket or a login status, for example. “Permanent” or “persistent” cookies remain stored after the browser is closed. For example, a login status may be retained when users return after several days. Such cookies may also store users’ interests for audience measurement or marketing. “Third-party cookies” are offered by providers other than the controller operating the online offering; cookies offered only by that controller are called “first-party cookies”.

We may use temporary and permanent cookies and explain their use in this privacy policy.

If users do not want cookies stored on their computers, they should disable the corresponding option in their browser settings. Stored cookies can be deleted in the browser settings. Disabling cookies may restrict the functionality of this online offering.

A general objection to the use of cookies for online marketing purposes can be made for many services, particularly tracking services, via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/ . Cookies can also be prevented from being stored by disabling them in the browser settings. Please note that this may prevent some functions of this online offering from being used.

DELETION OF DATA

The data we process is deleted or its processing restricted in accordance with Articles 17 and 18 GDPR. Unless expressly stated otherwise in this privacy policy, the data we store is deleted as soon as it is no longer needed for its intended purpose and no statutory retention obligations prevent deletion. If data is not deleted because it is required for other legally permissible purposes, its processing is restricted. This means the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.

Under German statutory requirements, records are retained in particular for 10 years pursuant to sections 147(1) AO and 257(1), nos. 1 and 4, and (4) HGB (books, records, management reports, accounting documents, commercial books, documents relevant to taxation, etc.), and for 6 years pursuant to section 257(1), nos. 2 and 3, and (4) HGB (commercial correspondence).

Under Austrian statutory requirements, records are retained in particular for 7 years pursuant to section 132(1) BAO (accounting records, receipts/invoices, accounts, supporting documents, business papers, statements of income and expenditure, etc.), for 22 years in connection with real estate, and for 10 years for documents relating to electronically supplied services, telecommunications, radio and television services provided to non-business customers in EU member states for which the Mini One Stop Shop (MOSS) is used.

CONTACTING US

When you contact us (e.g. via a contact form, email, telephone or social media), your details are processed to handle and respond to the enquiry under Article 6(1)(b) GDPR (within contractual or pre-contractual relationships) or Article 6(1)(f) GDPR (other enquiries). Users’ details may be stored in a customer relationship management system (“CRM system”) or a comparable enquiry management system.

We delete enquiries when they are no longer required. We review whether they are still required every two years. Statutory archiving obligations also apply.

GOOGLE ANALYTICS

On the basis of our legitimate interests (i.e. our interest in the analysis, optimisation and economical operation of our online offering within the meaning of Article 6(1)(f) GDPR), we use Google Analytics, a web analytics service provided by Google LLC (“Google”). Google uses cookies. Information generated by the cookie about users’ use of the online offering is generally transferred to a Google server in the USA and stored there.

Google is certified under the Privacy Shield agreement and thereby provides a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

Google uses this information on our behalf to evaluate users’ use of our online offering, compile reports on activities within it and provide us with further services relating to use of the online offering and the internet. Pseudonymous user profiles may be created from the processed data.

We use Google Analytics only with IP anonymisation enabled. This means that Google shortens users’ IP addresses within EU member states or other states party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.

The IP address transmitted by the user’s browser is not combined with other Google data. Users can prevent cookies from being stored by adjusting their browser settings. They can also prevent Google from collecting the data generated by the cookie about their use of the online offering, and from processing that data, by downloading and installing the browser plugin available at: http://tools.google.com/dlpage/gaoptout?hl=de.

Further information about Google’s use of data, settings and options to object is available in Google’s privacy policy (https://policies.google.com/technologies/ads) and in Google’s advertising display settings (https://adssettings.google.com/authenticated).

Users’ personal data is deleted or anonymised after 14 months.

GOOGLE UNIVERSAL ANALYTICS

We use Google Analytics in the form of “Universal-Analytics”. “Universal Analytics” is a Google Analytics method in which users are analysed using a pseudonymous user ID, creating a pseudonymous user profile containing information from the use of different devices (“cross-device tracking”).

ONLINE PRESENCES ON SOCIAL MEDIA

We maintain online presences on social networks and platforms to communicate with customers, prospective customers and users active there and to inform them about our services.

Please note that users’ data may be processed outside the European Union. This may pose risks to users, for example by making it more difficult to enforce their rights. US providers certified under Privacy Shield undertake to comply with EU data protection standards.

Users’ data is also generally processed for market research and advertising purposes. For example, user profiles may be created from usage behaviour and the interests inferred from it. These profiles may in turn be used to display advertisements within and outside the platforms that are presumed to match users’ interests. For these purposes, cookies storing usage behaviour and interests are generally placed on users’ computers. User profiles may also contain data irrespective of the devices used, particularly if users are members of the relevant platforms and are logged in.

Users’ personal data is processed on the basis of our legitimate interests in effectively informing and communicating with users under Article 6(1)(f) GDPR. If the respective providers ask users for consent to data processing (e.g. by ticking a checkbox or confirming a button), the legal basis is Article 6(1)(a) and Article 7 GDPR.

For a detailed description of the respective processing activities and opt-out options, please refer to the providers’ information linked below.

Requests for information and the exercise of user rights are also most effectively addressed directly to the providers. Only the providers have access to users’ data and can take appropriate action and provide information directly. If you still need help, you may contact us.

GOOGLE MAPS

We embed maps from the “Google Maps” service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The data processed may include users’ IP addresses and location data, although location data is not collected without their consent (usually granted through their mobile device settings). The data may be processed in the USA. Privacy policy: https://www.google.com/policies/privacy/, opt-out: https://adssettings.google.com/authenticated.

USE OF FACEBOOK SOCIAL PLUGINS

On the basis of our legitimate interests (i.e. our interest in the analysis, optimisation and economical operation of our online offering within the meaning of Article 6(1)(f) GDPR), we use social plugins (“plugins”) from the social network facebook.com, operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). These may include content such as images, videos or text and buttons that allow users to share content from this online offering within Facebook. A list and previews of Facebook social plugins can be found at: https://developers.facebook.com/docs/plugins/.

Facebook is certified under the Privacy Shield agreement and thereby provides a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).

When a user accesses a function of this online offering containing such a plugin, their device establishes a direct connection to Facebook’s servers. Facebook transmits the plugin content directly to the user’s device, which embeds it in the online offering. User profiles may be created from the processed data. We therefore have no influence over the scope of the data Facebook collects through this plugin and inform users according to our current knowledge.

Embedding the plugins informs Facebook that a user has accessed the relevant page of the online offering. If the user is logged into Facebook, Facebook can associate the visit with their Facebook account. If users interact with the plugins, for example by pressing the Like button or posting a comment, the relevant information is transmitted directly from their device to Facebook and stored there. Even if a user is not a Facebook member, Facebook may still obtain and store their IP address. According to Facebook, only an anonymised IP address is stored in Germany.

The purpose and scope of data collection, Facebook’s further processing and use of the data, and users’ rights and settings to protect their privacy are explained in Facebook’s privacy information: https://www.facebook.com/about/privacy/.

If a user is a Facebook member and does not want Facebook to collect data about them through this online offering and link it with their membership data stored on Facebook, they must log out of Facebook and delete their cookies before using our online offering. Further settings and objections to the use of data for advertising purposes are available in Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/. These settings apply across platforms, i.e. to all devices such as desktop computers and mobile devices.

INSTAGRAM

Our online offering may embed functions and content from Instagram, provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. These may include images, videos, text and buttons that allow users to share content from this online offering within Instagram. If users are members of Instagram, Instagram may associate access to this content and these functions with their user profiles. Instagram privacy policy: http://instagram.com/about/legal/privacy/.