Privacy policy

Courtesy translation. The German Datenschutzerklärung is the authoritative version.

As of November 2026. Here you can read which personal data we process on this website and in the restaurant, why, and for how long.

1. Controller

SpiceCoast UG (haftungsbeschränkt)
Krayer Straße 302, 45307 Essen, Germany
Represented by Managing Director Sherin Sinha
Email: [email protected] · Phone: +49 201 43775709 · Mobile: +49 151 62963770

2. Hosting and server logs (Cloudflare)

This website is hosted by Cloudflare (Pages/CDN); the database and server functions also run at Cloudflare (Cloudflare, Inc., USA). When you open our pages, Cloudflare processes technically necessary connection data, in particular your IP address, date and time, the page requested and browser details, to deliver the pages and keep them secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and stable website). A data processing agreement exists with Cloudflare; transfers to the USA rely on the EU standard contractual clauses or the adequacy decision for certified companies. We do not store IP addresses ourselves.

3. Table reservation request on the website

When you request a table through the form we process your name, phone number, optionally your email address, party size, date, time, an optional note and the time of the request. Purpose: handling and confirming your reservation; legal basis Art. 6(1)(b) GDPR. The data is kept in our database at Cloudflare and is only visible to authorised staff. Notifications to our staff contain no guest data.

From reservations we keep a guest list (name, phone number, email address, times of your visits, internal notes such as wishes or allergies). This lets us recognise regular guests and take your wishes into account (Art. 6(1)(b) and (f) GDPR). We keep this data until you ask us to delete it. Just write or call us and we will delete your data completely (see section 12).

4. Reservations by phone

If you call us, our staff record your reservation with the same details as above (name, phone number, party size, date, time, notes) in our internal reservation system. Purpose, legal basis, storage and deletion are as in section 3.

5. Contact form, email and phone

Through the contact form we process your name, your phone number or email address and your message in order to reply (Art. 6(1)(b) or (f) GDPR). The message is stored in our database and linked to your contact details in the guest list; our staff receive a notification without its content. No email is sent automatically. If you contact us by email or phone we likewise use your details only to handle your request. Storage until deletion at your request, section 12.

6. Spam protection (Cloudflare Turnstile)

The forms (reservation, voucher, contact) use Cloudflare Turnstile to block automated requests. Your browser loads a script from Cloudflare and technical browser and connection data are sent to Cloudflare. Legal basis: Art. 6(1)(f) GDPR (protection against abuse).

7. Voucher requests

For a voucher request we process your name, phone number and email address, the recipient's name, the amount, an optional message and the payment reference (Art. 6(1)(b) GDPR). Payment is made by bank transfer or PayPal outside this website; we store no payment card data. We keep voucher data as long as needed to process the voucher and beyond that for the statutory retention periods (Art. 6(1)(c) GDPR). Your contact details are also added to the guest list (section 3).

8. WhatsApp

Our website contains links that open a WhatsApp chat with us (provider: WhatsApp Ireland Ltd., Meta). Merely visiting a page transmits no data to WhatsApp; only when you click the link and send a message do WhatsApp's privacy terms apply. We then see your phone number and message and use them to reply. A WhatsApp message is not a confirmed reservation.

9. Newsletter (Brevo)

If you subscribe to the newsletter we process your email address on the basis of your consent (Art. 6(1)(a) GDPR) to inform you about news and offers of the restaurant. The sign-up form and sending run through our service provider Brevo (data processor, with a data processing agreement); submitting the form transmits your entry to Brevo. Sign-up uses double opt-in. You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or by writing to [email protected].

The guest list records whether you agreed to receive marketing by email (a voluntary, unticked checkbox on the reservation, voucher or contact form). We store the time and the version of the wording as proof. Without your consent you receive no marketing.

People who were already on our earlier newsletter list and had agreed there were carried over with that status; their consent is documented. They too can withdraw at any time.

We may also send messages about your reservation or voucher by email (for example a confirmation or a payment reminder with bank and PayPal details), if you gave us an email address. Technically the email is sent through Brevo (processor); the legal basis is performance of your reservation or order (Art. 6(1)(b) GDPR). This is not advertising.

10. Staff area and push notifications

In the protected staff area a technically necessary session cookie ("sc_session") is set so that signed-in staff stay signed in; it is not set for visitors of the public website. We store staff names or email addresses, roles and login sessions. Staff may voluntarily enable push notifications, in which case we store the address of their device's notification service. Notifications contain no guest data.

11. Anonymous statistics, cookies and local storage

We anonymously count how often pages are viewed, with page, language, device type (phone, tablet, computer), country, city (place name only) and referrer category (e.g. search engine, direct visit). No IP addresses, names, cookies or device identifiers are stored, only daily totals. We also use the cookie-free analytics service "Cloudflare Web Analytics" (Cloudflare, Inc.), which stores no personal data and sets no cookies. Visitors who have enabled "Do Not Track" or "Global Privacy Control" are not counted (Art. 6(1)(f) GDPR).

We use no tracking or marketing cookies and load no fonts, maps or videos from third parties. For faster display your browser keeps menu and photo data (without personal reference) in local storage and remembers for the session whether a notice window was closed. This is technically necessary or serves display only.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time. Contact [email protected] or +49 201 43775709; on request we delete your data completely unless statutory retention duties apply.

You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (ldi.nrw.de).

13. External links

Our pages contain links to external services (e.g. online ordering at online-karte.com, Lieferando, Uber Eats, map services, Facebook, Instagram, TikTok, YouTube). Merely visiting our page transmits no data to them; only when you click a link do the privacy terms of that provider apply.

14. Security, automated decisions

This website is protected by an encrypted connection (SSL/TLS, shown by "https://"). No automated decision-making or profiling takes place. We do not sell your data.