Privacy Policy

1. Controller

The controller responsible for the processing of personal data in connection with the website and the LePèlerin iOS App is:

2. General information on data processing

We process personal data only insofar as this is necessary for the operation of our website and app, the provision of the respective functions, communication with you, or taking steps prior to entering into or performing a contract.

Depending on the processing activity, the legal basis is in particular Art. 6(1)(b) GDPR where processing is necessary for the performance of a contract or for taking steps prior to entering into a contract, or Art. 6(1)(f) GDPR.

Where we rely on Art. 6(1)(f) GDPR, our legitimate interests include in particular the secure, reliable and user-friendly operation of our digital services, the prevention of misuse and technical disruptions, and efficient communication with users and customers.

We do not carry out solely automated decision-making producing legal or similarly significant effects within the meaning of Art. 22 GDPR.

3. Provision and hosting of the website

Our website is provided using services of Cloudflare, Inc., USA.

When the website is accessed, technically necessary connection and log data is processed. This may include, in particular, the IP address, date and time of access, the page or URL accessed, HTTP method and status code, browser and device information, any referrer transmitted, and technical network and security data.

This processing serves the secure and reliable provision of the website, the detection and prevention of abusive or harmful access, error analysis, and the technical stability and performance monitoring of the website.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and efficient provision of our website.

As part of these services, Cloudflare also provides us with technical, partly aggregated statistics concerning website traffic handled through the Cloudflare network, for example information relating to requests, data transfer, countries of origin, cache usage, and technical error and security events. We use this information exclusively for the technical operation, security and optimisation of our website and not for personalised advertising, profiling or cross-site tracking.

The retention period for technical data processed by Cloudflare depends on the respective function used and the applicable retention periods provided for that function. We do not additionally store this data in our own web server log archives.

Cloudflare may also process personal data outside the European Economic Area, in particular in the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework. In addition, or for other international data transfers, Cloudflare states that it uses the European Commission’s Standard Contractual Clauses and supplementary safeguards.

4. Cookies and access to end-user devices

We currently do not use cookies or comparable storage technologies for analytics, advertising or tracking purposes.

In particular, we currently do not use browser-based analytics services to create personal usage profiles or to track users across different websites.

Where technically necessary information is temporarily stored on or accessed from an end-user device, this takes place only insofar as it is strictly necessary to provide a function expressly requested by the user. The legal basis for such access is § 25(2) no. 2 TDDDG.

Where the Coffee Recommender is used on the website, the selections made are processed exclusively locally in the browser. The selections are not transmitted to us or third parties and are not stored permanently.

5. LePèlerin iOS App

5.1 General information

The LePèlerin iOS App does not require a user account or login.

The app does not use analytics, advertising or tracking services for the creation of personal usage profiles and does not itself access the user’s location data.

5.2 Provision of current content via GitHub

To provide and update public content such as the menu, offers, coffee information and opening hours, the LePèlerin iOS App retrieves content using services of GitHub, Inc., USA.

In connection with such requests, technically necessary connection data, in particular the IP address and time of the request, may be processed by GitHub.

The processing serves the reliable provision and updating of app content.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the reliable and efficient provision of up-to-date app content.

GitHub may process personal data in the United States and other countries. GitHub is certified under the EU-U.S. Data Privacy Framework and states that it also uses the European Commission’s Standard Contractual Clauses for international data transfers.

5.3 Local caching

Public app content may be temporarily cached locally on the device to ensure reliable availability.

No personal user profiles or personal usage histories are created in this process.

6. External links and maps

The website and app may contain links to external services, for example map, app, email or other third-party services.

A connection to the respective external provider is generally established only when you actively open the corresponding link.

From that point onwards, the respective provider may process technical connection data such as your IP address, device information and time of access, as well as any existing account or cookie information. The respective provider’s privacy policy applies to further processing by that provider.

The LePèlerin iOS App itself does not access the user’s location data.

7. Contact

7.1 Contact by email

If you contact us by email, we process the data you provide. This may include, in particular, your name, email address, the content of your message and any attachments you send.

For our email communication, we use iCloud Mail, a service provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.

The processing takes place for the purpose of handling your enquiry.

Where your enquiry relates to entering into or performing a contract, the legal basis is Art. 6(1)(b) GDPR. In all other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the appropriate and efficient handling of incoming enquiries.

Apple may also process personal data outside the European Economic Area in connection with its services. Apple states that it uses the European Commission’s Standard Contractual Clauses for international transfers of personal data from the EEA.

Further information regarding international data transfers and the safeguards used by Apple is available in Apple’s privacy information.

We store communication data only for as long as necessary to process your enquiry, perform a contract, comply with statutory retention obligations, or establish, exercise or defend legal claims.

Providing personal data when contacting us is generally voluntary. Without the information necessary to deal with a particular matter, however, we may be unable to process an enquiry or may only be able to process it in part.

7.2 Contact by telephone

If you contact us by telephone, we process the information you voluntarily provide in order to deal with your enquiry.

Telephone calls are not recorded.

Where the communication relates to a contract or steps prior to entering into a contract, the legal basis is Art. 6(1)(b) GDPR. In all other cases, processing is based on Art. 6(1)(f) GDPR on the basis of our legitimate interest in efficient communication with customers and interested parties.

8. Your rights

Where the relevant legal requirements are met, you have in particular the following rights:

• right of access to your personal data under Art. 15 GDPR;
• right to rectification of inaccurate data or completion of incomplete data under Art. 16 GDPR;
• right to erasure under Art. 17 GDPR;
• right to restriction of processing under Art. 18 GDPR;
• right to data portability under Art. 20 GDPR, where the applicable requirements are met;
• right to lodge a complaint with a data protection supervisory authority under Art. 77 GDPR.

To exercise your rights, it is sufficient to contact us at:

info@lepelerin.de

9. Right to object under Art. 21 GDPR

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right under Art. 21 GDPR to object to such processing at any time on grounds relating to your particular situation.

We will then no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

10. Competent data protection supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority particularly responsible for us is:

The Hessian Commissioner for Data Protection and Freedom of Information (HBDI) Wilhelmstraße 7 65185 Wiesbaden Germany

11. Changes to this Privacy Policy

We will update this Privacy Policy if our website, app, the services used or the associated data processing activities change.