Privacy notice

Personal data is any information that can identify you. We process only the data required to deliver the website technically or to handle your enquiry.

This website uses no analytics, tracking or marketing cookies and does not automatically embed external maps, fonts or social-media widgets.

Technical support and hosting for this website, including its editorial system, are provided by concave.systems – Daniel Romaniuk, Brucknerstr. 5, 29633 Munster, Germany. The website runs on a virtual private server (VPS) at Hetzner in Nuremberg, Germany. The server infrastructure is supplied by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

When you visit the site, your IP address, the time and destination of the request, and necessary connection and browser information are processed to deliver content and identify faults or misuse. Operational and error logs support security and availability; they are not used for advertising or profiling. We retain them only as long as necessary for these purposes. Specific security incidents may require longer retention for investigation and preservation of evidence.

To restore the service after technical failures, we create encrypted backups of the CMS database and uploaded media on a Hetzner Storage Box. These backups may include authorised editorial account data and personal information in published content. Website form messages are not stored in the CMS database and are therefore not included in these website backups. The regular backup retention period is 90 days. Any longer retention required to investigate a specific security incident or meet statutory obligations is limited to that purpose.

Hosting, technical security measures and backups are based on our legitimate interest in a secure and reliable website under Article 6(1)(f) GDPR. Further information about the infrastructure provider is available in Hetzner’s privacy notice.

For contact, table, booking and event enquiries, we process the contact and request data you provide so that we can assess and answer your enquiry. Article 6(1)(b) GDPR applies to pre-contractual or contractual enquiries; otherwise, processing is based on our legitimate interest in efficient communication under Article 6(1)(f) GDPR.

The form transfers your details to our server over encrypted HTTPS. The server sends them through our business STRATO mailbox to the staff responsible for the relevant request. The system uses only our own email address as sender and your address only as Reply-To. No automatic confirmation email is sent.

Form data is not stored in the website database. After delivery, it remains in the operational mailbox. Messages that are not relevant to a contract or statutory retention obligation are deleted no later than six months after final processing. Longer legally required periods apply where an enquiry leads to a contract or retention obligations exist.

Providing your information is voluntary. Required fields contain the details needed to identify and handle the enquiry. Without them, we cannot process the form; you can alternatively contact us by phone or email. No automated decision-making within the meaning of Article 22 GDPR takes place.

For applications, we process contact details, the requested working area and your message to decide whether to establish an employment relationship. The legal basis is Section 26(1) of the German Federal Data Protection Act (BDSG). Please do not submit information that is unnecessary for the application.

Any further application documents can be arranged directly with our team if required. If no employment follows, application data is generally deleted no later than six months after the procedure ends unless legal reasons or a separate agreement require otherwise.

To protect forms from automated or excessive requests, we use an invisible empty field, a time-limited form authorisation and request limits. A server-only key converts the client IP address into a check value. Form-limit counters exist only in working memory and contain no plain-text IP address. Their time windows are 15 minutes and 24 hours; expired entries are cleaned up during subsequent checks and are not counted in a new window. Restarting the service discards these counters.

Additional technical request limits protect media delivery and editorial previews. No external CAPTCHA services are used. Processing is based on our legitimate interest in website security and availability under Article 6(1)(f) GDPR.

Enquiries are accessed by the staff responsible for reception, the restaurant, events or recruitment. We use concave.systems – Daniel Romaniuk for technical support and hosting, with server and backup infrastructure supplied by Hetzner. Data processing agreements cover this processing between us and concave.systems and between concave.systems and Hetzner. The website operates on the server in Germany described above.

STRATO provides our business email service and processes the data needed to transmit and make messages available. Form data is not shared for analytics or advertising. External services that you choose to open are described in section 9.

The public website sets no analytics, marketing or language-selection cookies and stores no corresponding identifiers in the browser. The language follows from the requested URL. External content requiring consent is not loaded automatically.

Sign-in and content preview are separate functions for authorised editors. Technically necessary session and preview cookies may be used for authentication and for displaying unpublished content. Where this stores or accesses information on a device, it is based on Section 25(2)(2) TDDDG for the explicitly requested function. Related personal data processing supports secure editorial operation under Article 6(1)(f) GDPR.

Booking links lead to Viato's external booking service. Direction links open Google Maps, and profile links lead to Instagram or Facebook. The respective external website is contacted only after you click. Its privacy terms then apply, and technical access data may be transferred to that provider.

Images, the heathland video, icons and the Montserrat font are delivered by this website itself. Loading a page therefore creates no additional connection to Google Fonts, Font Awesome or a video platform.

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with future effect; this does not affect the lawfulness of processing before withdrawal.

Right to object: Under Article 21 GDPR, you may object to processing based on Article 6(1)(f) GDPR for reasons relating to your particular situation. For questions or to exercise your rights, contact info@deutscheshausmunster.de.

Under Article 77 GDPR, you may complain to a data protection supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. The authority responsible for our location is the State Commissioner for Data Protection in Lower Saxony: Postfach 221, 30002 Hannover, Germany; poststelle@lfd.niedersachsen.de. Contact and complaint information is available at lfd.niedersachsen.de.

We update this privacy notice when our data processing, service providers or legal requirements change. The version published on this website is the current version.