Privacy policy

Protecting your personal data matters to us. In accordance with Article 13 of the General Data Protection Regulation (GDPR), this notice explains which personal data we process when you visit this website or book online, for what purposes and on what legal basis.

1. At a glance

• This website uses no cookies, no analytics, no tracking and no advertising networks.
• No third-party content is loaded: fonts, images, the map and all code are hosted on our own server in the European Union.
• We only process personal data when you contact us or book a table – and only for as long as necessary.

2. Controller

Vini… da Sabatini
Owner: Franco Grande
Grüneburgweg 81, 60323 Frankfurt am Main, Germany
Phone: +49 69 72 66 65
Email: info@vinisabatini.com

We have not appointed a data protection officer, as there is no legal obligation to do so. For any data protection questions, please contact us using the details above.

3. Hosting and technical operation

The website and booking system are operated on our behalf by an IT service provider and hosted on servers of Contabo GmbH, Aschauer Straße 32a, 81549 Munich, in data centres in the European Union. Data processing agreements pursuant to Art. 28 GDPR are in place with our service providers; they process data only on our instructions. No data is transferred to countries outside the European Union.

4. Visiting the website (server log files)

Each time the website is accessed, our server automatically processes information transmitted by your browser: IP address, date and time, the page or file requested, amount of data transferred, status code, the previously visited page (referrer), and browser and operating system (user agent).

Purpose: delivering the website, ensuring stability and security and fending off attacks. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, functioning website). Retention: log files are deleted automatically after 14 days unless they are needed to investigate a specific security incident.

5. No cookies, nothing stored on your device

This website sets no cookies and does not store or read any other information on your device (e.g. in local storage). Consent under § 25 of the German TDDDG is therefore not required, and no cookie banner is shown.

6. Online booking

When you request a table via our website, we process:

• required details: first name, last name, phone number, requested date, time and number of guests;
• optional details: email address, number of children, occasion, seating preference, your message and – only with your explicit consent – information on allergies and intolerances;
• technical details: IP address and browser identifier at the time of the request, the selected language and an automatically assigned request number.

Purpose and legal basis: we use this data to check, confirm and carry out your booking and to contact you with any questions (Art. 6(1)(b) GDPR – pre-contractual measures and performance of a contract). Without the required details we cannot process an online booking, but you can always reach us by phone. Questions and confirmations are handled by phone or – if you have provided an email address – by email.

Allergies and intolerances are health data within the meaning of Art. 9 GDPR. We only process them if you give your explicit consent in the form (Art. 9(2)(a) GDPR), and solely so that our kitchen can prepare for your visit. You may withdraw your consent at any time with effect for the future, e.g. by email or phone. We delete this information no later than 30 days after your visit.

Protection against abuse: to prevent automated mass requests (spam), your browser solves a small computational task before sending; no third-party service is used and no cookie is set. We also limit the number of requests per IP address and phone number, and store the IP address of the request for 30 days for this purpose (Art. 6(1)(f) GDPR; legitimate interest: protecting our booking system from abuse).

Recipients: your details are visible only to the responsible members of our restaurant team and – as a data processor – to our technical service provider. They are not disclosed to any other third parties.

Retention: booking data is anonymised twelve months after the booked date; only non-personal information (e.g. date and number of guests) is kept for statistics. Statutory retention obligations remain unaffected.

7. Recognising regular guests

So that we can welcome you personally on your next visit and remember your preferences (e.g. a favourite table), we link bookings made with the same phone number into a guest profile (name, contact details, number of visits, notes from our team). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is attentive, personal hospitality. The profile is anonymised 24 months after your last visit. You may object to this processing at any time (see section 11) – we will then delete the profile immediately.

8. Contact by email or phone

If you contact us by email or phone, we process your details to deal with your enquiry (Art. 6(1)(b) GDPR for bookings and events, otherwise Art. 6(1)(f) GDPR). Our mailbox is provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. We delete your enquiry once it has been dealt with, unless statutory retention obligations apply.

9. Maps and external links

The map on our website is an image stored on our server (map data © OpenStreetMap contributors); displaying it transmits no data to third parties. Only when you click “Google Maps” or “Apple Maps” does the provider's website open in a new window, and its privacy policy applies. The same applies to links to press articles and to La Corte dei Sabatini.

10. Data security

All data is transmitted encrypted via HTTPS (TLS). We apply technical and organisational measures pursuant to Art. 32 GDPR, including separated and hardened systems, minimal access rights, password-protected staff access with protection against unauthorised login attempts and two-factor authentication, access logging and regular backups on servers in the EU.

11. Your rights

Under the GDPR you have the right to:

• access the data stored about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• withdraw any consent given, with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. A short message to info@vinisabatini.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 31 63, 65021 Wiesbaden, Germany, datenschutz.hessen.de.

12. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Our team decides on every booking request personally.

13. Changes

We update this privacy notice when our website, our processes or the law change. The version published here applies.