Privacy
We take the protection of your personal data seriously. This website is built to minimise data: without your consent no cookies are set and no services are loaded that could recognise you. The measurement and marketing tools described below are added only once you agree. Independently of this, a cookie-free measurement counts page views; it stores nothing on your device and does not recognise you — see below for details.
Controller
Lalibela Restaurant Ohlauer Str. 27 10999 Berlin, Germany Email: info@lalibela.de
Hosting and server log files
This website is hosted as a static site with Cloudflare. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When you access it, technically necessary access data are processed (IP address, date and time, file requested, browser type, operating system, referrer). This processing serves to ensure trouble-free operation and system security on the basis of Art. 6(1)(f) GDPR (legitimate interest).
Cloudflare operates a global server network, so data may also be transferred to countries outside the EU. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; the European Commission’s standard contractual clauses apply in addition. A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare.
We do not keep server log files ourselves: this website is a static site on Cloudflare Pages, we operate no server of our own and have no access to access logs. Retrieving or retaining raw access data is not technically provided for in our plan — Cloudflare offers the corresponding services (Logpull, Logpush) to Enterprise customers only, and even there the data reaches back just three to seven days. Processing and deletion of the technical connection data therefore rests entirely with Cloudflare as our processor; its privacy notice and the data processing agreement apply.
Consent, cookies and withdrawal
Without your consent this website sets no cookies and loads no third-party services. On your first visit a notice appears in which you decide separately for “Statistics” and “Marketing”. Nothing is preselected; the services listed below are loaded only after you click “Accept all” or “Save selection”. If you decline, not a single request is sent to Google or Meta.
Your decision is stored solely in your browser (web storage), together with the time and the version of this policy — this documents the consent and is strictly necessary under § 25 (2) TTDSG. The legal basis for the subsequent processing is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TTDSG.
You may withdraw your consent at any time with effect for the future, via the “Cookie settings” link at the bottom of every page. This does not affect the lawfulness of processing carried out beforehand.
Google Analytics 4 (category “Statistics”)
Only with your consent do we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The data collected includes a truncated IP address, pages viewed, time on page, approximate location, device type and the referring page. We use this solely to understand which content is in demand.
Google also processes the data in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the European Commission’s standard contractual clauses apply in addition. A residual risk of access by US authorities cannot be ruled out — we point this out expressly.
Google Ads and Meta Pixel (category “Marketing”)
Only with your consent do we embed the measurement tools of our advertising accounts: Google Ads (Google Ireland Limited, address as above) and the Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). They record whether your visit followed an advertisement on Google, Instagram or Facebook, and whether it led to a reservation. You may be recognised via your account there or via identifiers set on your device.
For the Meta Pixel we are jointly responsible with Meta for the collection and transmission (Art. 26 GDPR); Meta provides the essential content of this arrangement as the “Controller Addendum”. Meta alone is responsible for the subsequent processing in its own systems. Here too data is transferred to the USA, safeguarded as described in the previous section.
These services set cookies and comparable identifiers. None of this happens without your consent.
Audience measurement without cookies (Cloudflare Web Analytics)
Regardless of your cookie choice, we measure how often our pages are opened using Cloudflare Web Analytics. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA — the same company that already delivers this website.
The service works without cookies: it stores nothing on your device and reads nothing from it. Only aggregated information is recorded — page viewed, referring page, approximate device type and country. There is no recognition across websites, and attributing anything to you personally is not possible for us.
Because your device is not accessed, no consent under § 25 TTDSG is required. The legal basis is our legitimate interest in a data-minimal analysis of which content is in demand (Art. 6 (1) (f) GDPR).
Fonts
All fonts are served from our own server (self-hosted). There is no connection to Google Fonts or other font services, and no data is transferred to third parties.
Maps and external links
We do not embed map services directly in the page. The “Get directions” and “Open in Google Maps” buttons are ordinary links: only when you click them is a connection to Google established, and Google’s privacy policy then applies. The same is true for links to our social media profiles.
Online reservations
When you book a table through the reservation window, the details you enter are transmitted to our reservation system and stored there: name, email address and/or phone number, the requested date and time, the number of guests and an optional note to us. We need these details in order to reserve the table and to reach you in case of questions or changes.
The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). Without these details we cannot accept a reservation. We delete reservation data as soon as they are no longer required for that purpose and no statutory retention obligations apply.
The reservation system runs on our own infrastructure at Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA); the statements on data processing and transfers to third countries in the “Hosting and server log files” section apply accordingly. Your reservation data are not used for advertising and are not sold or passed on to further third parties.
To protect against automated false bookings, the form contains a hidden field that only programs fill in (a honeypot). Your behaviour is not analysed.
In addition, the final step of the reservation uses Cloudflare Turnstile to tell bots from real guests. This establishes a connection to Cloudflare and transmits your IP address and technical details of your browser. Turnstile sets no cookies and does not track you across websites. The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in protecting the reservation system from abuse. The check script is only loaded once you reach the contact step; anyone who merely looks at the available times establishes no connection to Cloudflare.
If you send us an enquiry by email, we process your details (name, contact data, request) solely in order to handle your enquiry – the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR. We delete the data as soon as it is no longer required and no statutory retention obligations apply.
Your rights
- Access to the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing (Art. 21 GDPR)
- Complaint to a supervisory authority (Art. 77 GDPR) – in Berlin the Berlin Commissioner for Data Protection and Freedom of Information