Privacy policy

This policy explains which personal data we process when you use EAWE (https://eawe.net), for what purposes, on which legal basis under the General Data Protection Regulation (GDPR), and which rights you have.

Controller

The controller responsible for data processing on this website is:

Hosting

This website runs on a hosting platform whose operator processes data on our behalf under a data processing agreement (Art. 28 GDPR). The servers are located in the European Union. The processing is based on our legitimate interest in a secure and reliable website (Art. 6 (1) (f) GDPR).

Server log files

When you open a page, your browser automatically sends information that the server records in log files: IP address, date and time of the request, the address requested, the referring page, the HTTP status, the amount of data transferred and your browser's user agent. We need these data to deliver the website, to keep it secure and to find errors (Art. 6 (1) (f) GDPR). Log files are kept only for a short period and then deleted, unless an incident needs further investigation.

Cookies and local storage

We only store what this site needs to work in your browser (§ 25 (2) TDDDG, Art. 6 (1) (b) and (f) GDPR):

your chosen language (cookie app_locale, one year) and display mode (light or dark),
after you sign in, the sign-in tokens (in the browser's local or session storage; with "remember me" for up to 30 days),
the contents of your shopping cart (an anonymous cart number).

You can delete these data at any time in your browser's settings. Optional storage that is not needed to run the site is only used with your consent and described below.

Contact by email

When you contact us, we process the data you send us (for example your name, email address and message) to answer your request (Art. 6 (1) (b) GDPR if it relates to a contract, otherwise Art. 6 (1) (f) GDPR). We delete the data once your request has been dealt with, unless statutory retention obligations apply.

Contact form

If you use the contact form, we receive your name, email address and message by email. We use them only to answer you; the legal basis is the same as for a contact by email.

Emails we send

We send emails that belong to the use of this site (for example confirmations, password resets or messages about your orders). To make sure they arrive, we keep a send log: the content of a mail is deleted after 30 days, the log entry (recipient, subject, status) after 180 days (Art. 6 (1) (b) and (f) GDPR).

User accounts

If you have an account, we store your user name, email address, password (only as a secure hash) and the profile data you enter yourself, as well as the time of your last sign-in. We use them to provide the account (Art. 6 (1) (b) GDPR) and keep them until the account is deleted. In your profile you can view and correct your data and request a copy or the deletion of your data.

Bot protection (Cloudflare Turnstile)

To protect sign-in, registration, password reset, contact, newsletter, order and reservation forms against automated misuse we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile checks technical data of your browser and your IP address to tell humans from bots. Cloudflare is certified under the EU-US Data Privacy Framework. Legal basis is our legitimate interest in protecting the site from misuse (Art. 6 (1) (f) GDPR). More information: https://www.cloudflare.com/privacypolicy/

If you sign up for our newsletter or ask to be notified about something, we store your email address, your language, the lists you chose and the time of the sign-up and confirmation. You only receive emails after you have confirmed your address with the link in our email (double opt-in); the link is valid for seven days, unconfirmed sign-ups are deleted afterwards. If your address is already confirmed, a further list is added at once and we send you a short notice with a link to undo it. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can leave single lists or all of them at any time with the link in every email, without signing in; you can also delete your address there. We delete a list entry 30 days after you left it, and the entry of a one-time notification 30 days after it was sent.

Visitor statistics

We count visits with our own statistics tool that runs on our server; no data is passed on to third parties. To recognise repeat visits, a random visitor number is stored in the cookie ia_vid (about 13 months). We record the pages you view, the referring page, campaign parameters, actions such as clicks on buttons, your browser and operating system family, device type, screen size and language, and the approximate location (country, region, city). Your IP address is used only for a moment to determine the approximate location and is never stored. If you are signed in, the visit is linked to your account. Signals such as "Do Not Track" can be respected.

The statistics are only recorded if you agree in the notice shown on your first visit (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw your consent at any time with effect for the future with "Privacy settings" at the bottom of every page.

Reservations and restaurant orders

For table reservations we process your name, email address, phone number, the number of guests, the date and your note; for orders also the delivery address if you choose delivery. We use the data to handle the reservation or order and to contact you about it (Art. 6 (1) (b) GDPR).

Forum

To take part in the forum you need an account. Your posts, polls you vote in, your signature and the user name shown with your posts are visible to other users; private messages are visible only to their participants. Reports and moderation measures are stored to keep the forum safe. Legal basis is the provision of the forum (Art. 6 (1) (b) GDPR) and our legitimate interest in moderation (Art. 6 (1) (f) GDPR).

Your rights

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Changes to this policy

We update this policy when our website or the legal requirements change. The current version is always available on this page.