Privacy Policy
Last updated: 21 October 2026 · This notice describes the Cabarelo website prepared for STRATO and its current functions.
1. Controller and Contact
The controller responsible for the processing described below is:
Cabarelo · Café · Bar · Restaurant · Lounge
Proprietor: Dipl.-Ing. Alper Samanci
Willy-Brandt-Allee 1
27753 Delmenhorst, Germany
Telephone: 04221 – 85 00 466
Email: info@cabarelo.de
Privacy enquiries and requests to exercise your rights are handled personally by proprietor Dipl.-Ing. Alper Samanci. You can reach him at info@cabarelo.de or using the contact details above.
2. Hosting and Server Logs
The website prepared for operation at STRATO is provided through webspace operated by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. Our business email accounts are also hosted by STRATO. This description does not cover the hosting of the separate ChatGPT Sites preview.
When you access the website, technically necessary data is processed, in particular your IP address, time of access, requested page or file, volume of data transferred, status message, and browser and operating system information. The previously visited page may also be recorded if transmitted. This enables us to deliver the website and detect technical faults and attacks.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to provide our website securely and reliably. STRATO processes the data arising from hosting and email operations as part of the services commissioned.
We have a data processing agreement with STRATO pursuant to Article 28 GDPR. In particular, it governs processing according to our instructions, confidentiality, technical and organisational safeguards, and the use of further processors.
Under the STRATO data processing agreement available to us, website visitor log data is stored for no more than seven days. For other hosting log data, the agreement specifies a maximum period of twelve months; website content data is deleted within two months after the contract ends. These different periods do not mean that complete website visitor logs are stored for twelve months.
For email services, the agreement specifies a maximum retention period of six months from creation for log files, and no more than 30 days after the end of the contract term for email services. These technical contractual periods do not replace our purpose-based deletion of individual messages and cake photos during the ongoing contract. Sections 4 to 6 and 9 explain the deletion criteria for our own activities.
This is separate from the access logs and aggregated statistics made available by STRATO in the customer account, which the provider describes as anonymised. STRATO makes these access logs available for the past six weeks. Aggregated hosting statistics available over a longer period do not mean that complete visitor IP addresses are routinely stored for that same period.
Further information: STRATO: Data Processing and Log Data and STRATO: Access Logs and Statistics.
3. Images, Fonts and Browser Storage
Images, system fonts and the food and drinks menus provided do not require external font or image services. Images and PDF files are loaded from the website host. Our own website code contains no analytics or advertising trackers and no social media feeds.
Our own website code does not set cookies or use Local Storage or Session Storage. The light/dark theme selection is passed on through a parameter in the page address. Forms initially process your input on your device. Our website code does not store this data permanently. This is distinct from your browser's own functions, such as autofill or restoring open pages.
The additional information below applies to Google Maps and the linked external portals. These services may use their own storage technologies once opened.
4. Contact, Catering and Event Enquiries
If you contact us by telephone or email, we process your contact details and the information you provide to handle your request. This may include the date, number of guests, delivery address and individual requirements.
The catering and celebrations form only generates enquiry text in your browser from the information you enter. “Open in email app” passes the text to your email application. It reaches our inbox only when you send the message yourself in that application. The website does not automatically send this enquiry to a form server. Copying the enquiry text uses your device's clipboard in response to your action.
We handle contract-related enquiries on the basis of Article 6(1)(b) GDPR. Other enquiries are handled on the basis of Article 6(1)(f) GDPR; our legitimate interest is to respond to your request. Data is used to handle and fulfil your enquiry. Section 9 also applies to retention and deletion.
5. Cake Enquiries and Personal Photo Designs
For cake enquiries, we use torten@cabarelo.de. Choosing “Send cake enquiry” transfers the entered details and an optional JPG or PNG image over HTTPS to our STRATO webspace. The image is checked and re-encoded there to remove embedded metadata such as location data. The enquiry and image are then passed to torten@cabarelo.de by email. The temporary upload file is removed after processing or, at the latest, at the end of the request; no public image storage is created. The image preview before submission stays on your device. Alternatively, you can still prepare an email draft; you must attach the photo yourself in your email application and send the message there.
To protect against misuse and duplicate submissions, timestamps, one-time token verification values and a keyed verification value derived from the IP address are processed on STRATO webspace outside the public website directory. These protective records contain no names, email addresses, enquiry messages or images. Records are considered for checks for one hour and pruned on subsequent requests; without further requests, expired records can remain stored until the next cleanup. This processing serves our legitimate interest in a secure and available enquiry form and is based on Article 6(1)(f) GDPR. It uses no cookies or persistent browser storage.
We use the details you provide about your name, contact information, collection, number of people, cake preferences and inscription, together with any photo designs you send, to discuss and make your cake. The legal basis for handling your order is Article 6(1)(b) GDPR. Images you send of other people must also respect their personal and data protection rights. Please send only images that you are entitled to have used for this purpose, and no unnecessary sensitive information.
Within Cabarelo, only proprietor Dipl.-Ing. Alper Samanci has access to submitted cake photos. These photos are deleted after production. This is separate from technical processing by STRATO as our email provider, including the handling of any backup copies. Order and invoice documents are handled separately where statutory retention obligations apply; this does not imply routine retention of the photo files.
Placing an order does not give us permission to publish your submitted personal photo for advertising or as an example on the website. Any such use would require a separate agreement.
6. Job Applications
If you apply for a job with us, we process your contact details, application documents and information from the application process to decide whether to establish an employment relationship. The legal basis is Section 26(1) BDSG. Any additional voluntary processing based on your consent is governed by Section 26(2) BDSG.
Please send only information necessary for your application. Within Cabarelo, only proprietor Dipl.-Ing. Alper Samanci can view incoming applications. This is separate from technical processing through our email provider STRATO.
Application documents are used for the application process and deleted following rejection. If you are hired, the information required for the employment relationship may be transferred to personnel administration.
7. Reservations, Orders, Fan Card and Gift Vouchers
The reservation and ordering links currently included lead to consumer.vectron.cloud. The Fan Card and gift voucher sales open through secure.bonvito.net. These portals are not embedded in this website. You access the respective external service only by clicking its link.
When using these services, your name, contact details, reservation or order details, account information and, depending on the transaction, payment data may be processed. Where we receive and use your data to handle a reservation, order or gift voucher purchase, this is for entering into and performing a contract under Article 6(1)(b) GDPR. Article 6(1)(c) GDPR applies to legally required retention.
The published bonVito privacy information names Vectron Systems AG, Willy-Brandt-Weg 41, 48155 Münster, as the controller for the portal processing described there. Contact: datenschutz@vectron.de. The information displayed in each portal about controllers, recipients, retention periods and any other service providers is also relevant to processing in that portal. This does not establish the contractual role in every individual Cabarelo transaction without further review.
Privacy Information for the bonVito Consumer Portal. The Cabarelo contracts and reservation and ordering notices still need to be cross-checked before this working draft is approved.
8. Google Maps and Links to Social Networks
The contact page loads Google Maps only after you click “Load Google Maps”. Until then, the map function does not connect to Google. Loading the map means that you choose to enable the embedded map. The legal basis for the data transfer initiated by us is your consent under Article 6(1)(a) GDPR. Where this involves storing information on or accessing information from your device in a way requiring consent, Section 25(1) TDDDG also applies.
When the map loads, Google necessarily receives, in particular, your IP address and information about your browser, device and request. Google may process further data under its own policies and associate a visit with your Google account if you are signed in. Processing outside the EU or EEA, for example in the USA, is also possible. The recipients, safeguards for international transfers and storage rules applicable to Google services are described in the Google Privacy Policy .
You can use “Close map” to stop the embedded map from making further map requests. This does not reverse data transfers that have already taken place; the lawfulness of processing before withdrawal remains unaffected. Our website code does not permanently store your choice. Alternatively, you can read our address without a map or call us.
“Plan your route”, Instagram and Facebook are external links. Clicking them opens the respective operator's service. The operator receives technically necessary connection data and processes it under its privacy policy. Our website code does not load social media content without your click. The privacy information provided on those platforms also applies when you use our profiles there.
9. Recipients and Retention
Recipients depend on the respective purposes: Cabarelo to handle your enquiry or order, STRATO to provide the website and email services technically, and the external services you choose to open. Data may also be transferred to competent public authorities where required by law, or processed where necessary to establish, exercise or defend legal claims.
We store personal data only as long as necessary for the respective purpose or as required by statutory retention obligations. Data from completed enquiries must be deleted where there is no further reason for retention. Contract and invoice documents are subject to commercial and tax law requirements depending on the type of document. Where data is retained solely to meet these obligations, its use is restricted to those purposes. Specific information about log data, cake photos and applications is provided in the respective sections.
10. Your Data Protection Rights
Subject to the statutory conditions, you have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with effect for the future (Article 7(3)).
Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation under Article 21(1) GDPR. You may object to processing for direct marketing at any time without giving reasons.
To exercise your rights, you can contact info@cabarelo.de or write to the address above. Under Article 77 GDPR, you may also lodge a complaint with a data protection supervisory authority, in particular in the place where you live or work or where a suspected infringement occurred. The authority responsible for our registered location is the State Commissioner for Data Protection of Lower Saxony .
11. Voluntary Provision of Data and Automated Decisions
You do not have to provide contact, application or booking data to read this website. Technical connection data is required to access it. For an enquiry or service, we need the information necessary for that purpose; without it, we may be unable to handle your request. Using Google Maps is voluntary.
Our own website code does not carry out automated decision-making producing legal or similarly significant effects under Article 22 GDPR, or profiling. Please refer to the policies of external portals for their independent processing.