Privacy policy

Privacy at a glance

This is a translation for convenience; the German Datenschutzerklärung is authoritative. It gives an overview of what happens to your personal data when you visit this website. Personal data is any data that can identify you personally.

• This website sets no cookies and uses no advertising or tracking services. That is why there is no cookie banner.
• We count page views anonymously, without cookies and without storing IP addresses.
• Fonts are loaded from our own server, not from Google.
• There is no contact form. If you email us, we only use your details to reply to your message.

Data controller

The controller responsible for data processing on this website is:

Lacanto Fast Casual Gastronomie GmbH
Vöttinger Str. 40
85354 Freising, Germany
Managing directors: Vasileios Kyritsis, Dimitrios Evagelou
Email: info@lacanto.de

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

Hosting and delivery of the website

This website is hosted by:

Cloudflare, Inc.
101 Townsend St.
San Francisco, CA 94107
USA

When you open the website, Cloudflare processes technically necessary data so that the pages can be delivered and protected against attacks. This includes in particular your IP address, the date and time of the request, the address requested, the previous page (referrer) and details of your browser and operating system. The data is not combined with other data sources.

We have not enabled any permanent storage of access logs at Cloudflare. For the few functions that run on the server (the page statistics and the error page), Cloudflare keeps technical logs of the requests for at most seven days so that we can detect errors; they are then deleted automatically. How long Cloudflare keeps connection data beyond this for delivery and protection against attacks is described in Cloudflare's privacy policy (link below).

The legal basis is Art. 6(1)(f) GDPR. We have a legitimate interest in providing our website securely, quickly and reliably.

We have a data processing agreement with Cloudflare (Cloudflare Data Processing Addendum). Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are additionally covered by the European Commission's Standard Contractual Clauses. More information: cloudflare.com/privacypolicy.

Cookieless statistics

To understand how often our pages are visited, we count page views anonymously. Only the following is stored: the page visited (without URL parameters), the country the request comes from (derived by Cloudflare from the IP address; the IP address itself is not stored) and the name of the website that referred you (for example "www.google.com", without the full address).

To do this, a small script sends the address of the page and the previous page (which your browser tells the website anyway) to our server when a page is opened; of the previous page, only the website's name is kept. No cookies are set, nothing is stored on your device and no user profiles are created. The stored data does not allow you to be identified. It is stored at Cloudflare (Workers Analytics Engine) and deleted automatically after three months.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to evaluate the use of our website in a simple, data-minimising way.

Cookies and local storage

This website does not use cookies. To protect against attacks, Cloudflare may in individual cases set technically necessary security cookies; these are not used for analytics or advertising.

If you choose the light or dark colour scheme with the button in the header, your choice is stored only in your browser (local storage), so that the website looks the same on your next visit. This information is not sent to us. Storing it is strictly necessary to provide the setting you explicitly asked for (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

If you close a notice that pops up (for example about a closing day), your browser likewise stores only when you closed it (local storage), so that it doesn't appear again for one day. This information is not sent to us either and is strictly necessary for the function you asked for (§ 25(2) no. 2 TDDDG).

Fonts

The fonts used on this website are loaded from our own server. No connection is made to servers of Google or other providers.

Contact by email

If you contact us by email, we process your details (for example your name, email address and the content of your message) to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We keep the data until the purpose no longer applies, you ask us to delete it, or statutory retention periods end.

Our mailbox is operated by the following provider, with whom we have a data processing agreement:

CretaForce E.E.
Leof. Lavriou
190 02 Peania
Griechenland / Greece

Guest reviews

On the home page we show selected reviews that guests have published on our Google Business Profile: the text word for word (on the English page, Google’s translation), the star rating, the month and the first name with the initial of the last name. We do not take full names, profile pictures or photos. The information comes from the reviewers’ public Google profiles (Art. 14 GDPR). The legal basis is our legitimate interest in showing visitors the experiences of other guests (Art. 6(1)(f) GDPR). We renew the selection regularly and remove older reviews when we do. If you would rather not see your review here, an email to info@lacanto.de is enough, and we will remove it promptly.

Links to other websites

We do not embed any content from other providers (no maps, videos or social media posts); we only set links, for example to our Instagram profile, to our location and our reviews on Google Maps and, for events, to registration or ticket pages (such as Eventbrite). No data is therefore transferred to these services when you visit our website. Only when you click such a link do you go to the provider's site, and its privacy policy applies, for example that of Meta Platforms Ireland Limited (Instagram privacy policy) and Google Ireland Limited (Google privacy policy).

Obligation to provide data, automated decisions

You are not obliged by law or contract to provide us with personal data. Without the technically necessary connection data (see "Hosting"), however, the website cannot be displayed, and without your email address we cannot reply to you. There is no automated decision-making, including profiling (Art. 22 GDPR).

Your rights

Within the limits of the law, you have the right at any time to

• free information about your stored personal data, its origin, recipients and the purpose of processing (Art. 15 GDPR),
• correction of inaccurate data (Art. 16 GDPR),
• deletion (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR)

Where processing is based on Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

For questions about data protection and to exercise your rights, write to us at info@lacanto.de.

SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar and the lock icon. Please note that data transmission over the internet, for example by email, can have security gaps.